What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Problems with ad.firstadsolution

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have problems with pop ups from ad.firstadsolution. Could anyone help me? My hijackthis log is here:

Logfile of HijackThis v1.99.1
Scan saved at 11:09:26, on 14. 5. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
D:\Oliver\ProShow Gold\ScsiAccess.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\ACER\PSM.EXE
C:\Program Files\Acer\eManager\admtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
D:\PROGRA~1\ICQ\ICQNet.exe
D:\Oliver\deamon\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\AlarmS4.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Acer\eManager\admServ.exe
D:\Program files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Program Files\Acer\eManager\admtray.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Oliver\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Oliver\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [defender] C:\\defender19a.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: AlarmS4.lnk = C:\WINDOWS\system32\AlarmS4.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: SharedDlls - C:\WINDOWS\system32\j8p00i7me8.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Hardware Monitoring Program (ADMService) - OSA Technologies Inc - C:\Program Files\Acer\eManager\admServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Oliver\ProShow Gold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #2
Please download Look2Me-Destroyer.exe to your desktop.
  • Close all windows before continuing.
  • Double-click Look2Me-Destroyer.exe to run it.
  • Put a check next to Run this program as a task .
  • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  • When Look2Me-Destroyer re-opens, click the Scan for L2M button , your desktop icons will disappear, this is normal.
  • Once it's done scanning, click the Remove L2M button .
  • You will receive a Done Scanning message, click OK .
  • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK .
  • Your computer will then shutdown.
  • Turn your computer back on.
  • Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339'. please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32. Directory
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

NEXT

Please download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #3
I have scanned the computer with Look2Me. Here are the contents:

Look2Me-Destroyer V1.0.12

Scanning for infected files…..
Scan started at 14. 5. 2006 22:22:24

Infected! C:\WINDOWS\system32\mvr4l99q1.dll
Infected! C:\WINDOWS\system32\fentsub.dll
Infected! C:\WINDOWS\system32\qrery.dll
Infected! C:\WINDOWS\system32\iifxpph.dll
Infected! C:\WINDOWS\system32\cYtsrvps.dll
Infected! C:\WINDOWS\system32\kqdcz2.dll
Infected! C:\WINDOWS\system32\mvr4l99q1.dll
Infected! C:\WINDOWS\system32\ir62l5jo1.dll
Infected! C:\WINDOWS\system32\kmdmac.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011577.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011586.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011589.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011614.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011633.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011646.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011648.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011654.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011664.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011682.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011691.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011694.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011704.dll
Infected! C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011714.dll

Attempting to delete infected files…

Attempting to delete: C:\WINDOWS\system32\mvr4l99q1.dll
C:\WINDOWS\system32\mvr4l99q1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\fentsub.dll
C:\WINDOWS\system32\fentsub.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\qrery.dll
C:\WINDOWS\system32\qrery.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\iifxpph.dll
C:\WINDOWS\system32\iifxpph.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\cYtsrvps.dll
C:\WINDOWS\system32\cYtsrvps.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kqdcz2.dll
C:\WINDOWS\system32\kqdcz2.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\mvr4l99q1.dll
C:\WINDOWS\system32\mvr4l99q1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\ir62l5jo1.dll
C:\WINDOWS\system32\ir62l5jo1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kmdmac.dll
C:\WINDOWS\system32\kmdmac.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011577.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011577.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011586.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011586.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011589.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011589.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011614.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011614.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011633.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011633.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011646.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011646.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011648.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011648.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011654.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011654.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011664.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011664.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011682.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011682.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011691.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011691.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011694.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011694.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011704.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011704.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011714.dll
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011714.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Hints

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D95FA66D-A89E-4922-97FD-777B6994CB3E}"
HKCR\Clsid\{D95FA66D-A89E-4922-97FD-777B6994CB3E}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{B3816AE2-091A-4A1F-87E8-2B123E11CC38}"
HKCR\Clsid\{B3816AE2-091A-4A1F-87E8-2B123E11CC38}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


… and a hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 22:29:50, on 14. 5. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
D:\Oliver\ProShow Gold\ScsiAccess.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\ACER\PSM.EXE
C:\Program Files\Acer\eManager\admtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
D:\PROGRA~1\ICQ\ICQNet.exe
D:\Oliver\deamon\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\AlarmS4.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Acer\eManager\admServ.exe
D:\Program files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Program Files\Acer\eManager\admtray.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Oliver\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Oliver\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [defender] C:\\defender19a.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: AlarmS4.lnk = C:\WINDOWS\system32\AlarmS4.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Hardware Monitoring Program (ADMService) - OSA Technologies Inc - C:\Program Files\Acer\eManager\admServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Oliver\ProShow Gold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #4
Now I scanned it with Ewido. The reports:

———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 23:42:13, 14. 5. 2006
+ Report-Checksum: D1951899

+ Scan result:

C:\WINDOWS\Temp\bw2.com -> Adware.Zestyfind : Cleaned with backup
C:\WINDOWS\QlVHWUkgTWlrdWzhmg\asappsrv.dll -> Adware.CommAd : Cleaned with backup
C:\WINDOWS\QlVHWUkgTWlrdWzhmg\command.exe -> Adware.CommAd : Cleaned with backup
C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup
C:\WINDOWS\iconu.exe -> Adware.Zestyfind : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temp\Rar$EX00.750\install.exe -> Downloader.Adload.bd : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\I0S60DJ9\defender19a[1].exe -> Hijacker.VB.nh : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\I0S60DJ9\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\P0J8E3VC\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\P0J8E3VC\drsmartload46a[1].exe -> Downloader.Adload.bi : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\P0J8E3VC\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\A42ILP6C\keyboard19[1].exe -> Downloader.VB.ys : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\A42ILP6C\AppWrap[1].exe -> Adware.Zestyfind : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\WAI2C4NL\Installer[1].exe -> Adware.Look2Me : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\WAI2C4NL\newname19[1].exe -> Downloader.VB.aci : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Temporary Internet Files\Content.IE5\WAI2C4NL\drsmartload45a[1].exe -> Downloader.Adload.bj : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\Cache\FAF02F0Ad01 -> Not-A-Virus.Exploit.HTML.UrlSpoof.a : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\Cache\8500ACB8d01/install.exe -> Downloader.Adload.bd : Cleaned with backup
C:\Documents and Settings\BUGYI Mikuláš\Cookies\bugyi mikuláš@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.11:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.12:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.13:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.14:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.15:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.45:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.48:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.49:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
:mozilla.58:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.59:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.60:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.67:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.68:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.69:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.71:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.85:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
:mozilla.86:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Adocean : Cleaned with backup
:mozilla.100:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Hotlog : Cleaned with backup
:mozilla.108:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.148:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.149:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.163:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.166:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.167:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.172:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.173:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.194:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.196:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.225:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.235:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.236:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.237:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.238:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.239:C:\Documents and Settings\BUGYI Mikuláš\Data aplikací\Mozilla\Firefox\Profiles\73wyhleq.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011567.Dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011598.DLL -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011605.exe -> Downloader.VB.ys : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011606.exe -> Downloader.Adload.bi : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011607.exe -> Downloader.Adload.ap : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011608.exe -> Downloader.Adload.bj : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011609.exe -> Downloader.VB.aci : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011610.exe -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011626.exe -> Downloader.VB.ys : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011628.exe -> Downloader.Small.buy : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011629.exe -> Downloader.Adload.bi : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011630.exe -> Downloader.Adload.bj : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011631.exe -> Downloader.Adload.ap : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011643.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011663.exe -> Hijacker.VB.nh : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011717.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011718.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011719.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011720.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011721.dll -> Adware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{D78C36D2-A0B6-4C64-A340-F2A1DC4AB725}\RP16\A0011722.dll -> Adware.Look2Me : Cleaned with backup


::Report End


hijackthislog:

Logfile of HijackThis v1.99.1
Scan saved at 23:47:00, on 14. 5. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Oliver\ProShow Gold\ScsiAccess.exe
C:\ACER\PSM.EXE
C:\Program Files\Acer\eManager\admtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
D:\Oliver\deamon\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\AlarmS4.exe
D:\Program files\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Acer\eManager\admServ.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Program Files\Acer\eManager\admtray.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Oliver\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Oliver\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [defender] C:\\defender19a.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: AlarmS4.lnk = C:\WINDOWS\system32\AlarmS4.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Hardware Monitoring Program (ADMService) - OSA Technologies Inc - C:\Program Files\Acer\eManager\admServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Oliver\ProShow Gold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #5
Scan with hijackthis and put a chek beside these lines and choose FIX R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank O4 - HKLM\..\Run: [defender] C:\\defender19a.exe Then reboot and a new log please. How is it running after the reboot?
Post #6
A new log (after fixing and rebooting):

Logfile of HijackThis v1.99.1
Scan saved at 17:37:36, on 15. 5. 2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\ACER\PSM.EXE
D:\Oliver\ProShow Gold\ScsiAccess.exe
C:\Program Files\Acer\eManager\admtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
D:\Oliver\deamon\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Acer\eManager\admServ.exe
D:\Program files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [Zástupce stránky vlastností sběrnice High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MPS] C:\ACER\PSM.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Program Files\Acer\eManager\admtray.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Oliver\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Oliver\deamon\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: AlarmS4.lnk = C:\WINDOWS\system32\AlarmS4.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Hardware Monitoring Program (ADMService) - OSA Technologies Inc - C:\Program Files\Acer\eManager\admServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ScsiAccess - Unknown owner - D:\Oliver\ProShow Gold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


Now, it seems it works correctly. There are no pop-ups any more. Thanks a lot.
Post #7
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI