Command Service

Hello everybody, I'd like to say thanks in advance to anybody who reads this.

Being the idiot I am, I clicked a link from an AIM user and got myself infected. I know the 'drill' as it were (which is more-or-less the same as your instructions in the Self Help thread) and I think I have removed everything bad (good job I ripped out the cat5e before something really bad happened)…

Ad-Aware shows clean, and (to the best of my knowledge) so does HiJack This. But Spybot isn't satisfied and still says 'Command Service' is active. I've read the threads about it in your forum and they haven't helped because they've been buried amongst other pieces of malware.

I believe my system is clean because I haven't had any popups (Command Service serves popups according to my searches) but the questionable key is still in the registry and undeleteable. I've tried:

- Allowing Spybot to treat it on reboot
- Scanning in Safe Mode
- Removing the keys by hand with regedit
- Using HJT to remove 'cmdService'

All of those end up saying the service is active and unremovable. I checked with the command 'sc query cmdservice' and it says 'The specified service does not exist as an installed service.' So I'm baffled..!

Could you please check my log and make sure I haven't missed anything? Perhaps find out more about if this Command Service is really active or just fragments of a dead piece of malware? Any help is appreciated, and sorry for rambling a bit.

Logfile of HijackThis v1.99.1
Scan saved at 21:53:44, on 04/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\HeyJoe\HeyJoe.EXE
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\YKill\YKill.exe
C:\Program Files\TClockL\tclock.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Miranda IM 0.5\miranda32.exe
C:\Program Files\Grisoft\AVG Free\avgwb.dat
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Andrew\Desktop\Programs\Programs\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.live-astro.com/horoscopes_astrology/horoscopes.php?sign=can&type=daily
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [Hey, Joe!] C:\Program Files\HeyJoe\HeyJoe.EXE
O4 - HKCU\..\Run: [PowerMenu] "C:\Program Files\PowerMenu\PowerMenu.exe" -hideself on -disable priority -disable transparency
O4 - HKCU\..\Run: [YKill] "C:\Program Files\YKill\YKill.exe" \m
O4 - HKCU\..\Run: [TClock] C:\Program Files\TClockL\tclock.exe
O4 - Startup: Outlook 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

P.S. HeyJoe, TClock, PowerMenu and YKill are OK, I downloaded those tools from the creators' websites.

Thanks again,
Andrew.