What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

is this adware? slyware?

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello – my son's PC suddenly started throwing po-ups saying hois PC was nifected and I should download a vrus/adware scanner. The page is sysprotection.net and it only does it on Internet Explore not Firefox. Can anyone help. We're run Lavasoft Adaware, Spybot and Ewido. IN fact just while typing this I got a flashing yellow triangle in the right hand bottom corner (next to the time). Clicking this takes me to a website malwarewipe.org Appreciate any advoice. Many thanks
Post #2
additionally I just realised that his home page has been changed to sysprotectionpage.net when using Internet Explore. Firefox is ok.
Post #3
Spiny Norman, :D

Sorry for the delay, more logs than we have people to work them.

Use the links in my signature to download and install Hijackthis 1.99.1, then run the program to Scan and Save a Log File. That log will open in Notepad, when it opens, go to Edit > Select All……Edit > Copy and paste the entire log into this thread by using the Add-Reply and not the New Thread Button.


Ken :D
Post #4
Thanks. No problem about the wait, here's the logfile and I'll look forward to hearing from you.

Logfile of HijackThis v1.99.1
Scan saved at 7:54:51 PM, on 7/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\system32\issearch.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/apps/mpfplus/en-us/re…ystempopup=true
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {72CFCF21-59A4-4C95-AEDE-1FDD01E3C5F3} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {7EF2E02D-2C5A-4857-B8F4-57C8C016FBD5} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {873eb32d-ae1a-4183-89bd-45a77f761be4} - C:\WINDOWS\system32\ixt0.dll
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00309} - C:\WINDOWS\g45119375.dll
O2 - BHO: (no name) - {EE8AAE8E-3031-69C9-3F51-1FB328B908B4} - C:\WINDOWS\system32\xcrkq.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O20 - Winlogon Notify: winpdc32 - C:\WINDOWS\SYSTEM32\winpdc32.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\Documents and Settings\Stefan\Application Data\Microsoft\SystemCertificates.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Post #5
Norman, :D

You have a couple of different infections going on, lets attack this one first.

Download SmitfraudFix (by S!Ri) to your Desktop from Here

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.


Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log.
IMPORTANT: Do NOT run any other options until you are asked to do so!
Post #6
ok here's the report, thanks SmitFraudFix v2.74 Scan done at 13:34:33.59, Sat 07/22/2006 Run from C:\Documents and Settings\Stefan\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\issearch.exe FOUND ! C:\WINDOWS\system32\ixt?.dll FOUND ! C:\WINDOWS\system32\ixt??.dll FOUND ! C:\WINDOWS\system32\ot.ico FOUND ! C:\WINDOWS\system32\pmnqguh.dll FOUND ! C:\WINDOWS\system32\components\flx?.dll FOUND ! C:\WINDOWS\system32\components\flx??.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Stefan\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Stefan\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\SpyQuake2.com\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="http://www.texassports.com/doc_lib/05_ba_stubbs_1024x768.jpg" "SubscribedURL"="http://www.texassports.com/doc_lib/05_ba_stubbs_1024x768.jpg" "FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}" »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Post #7
Hello Norman,

This should take care of this one, run the fix and then post a new HJT log along with the report from this fix.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
Post #8
Here's the Smifraud log

SmitFraudFix v2.74

Scan done at 14:28:45.68, Sat 07/22/2006
Run from C:\Documents and Settings\Stefan\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\Documents and Settings\Stefan\Application Data\Microsoft\SystemCertificates.dll -> Missing File


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\issearch.exe Deleted
C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\pmnqguh.dll Deleted
C:\WINDOWS\system32\components\flx?.dll Deleted
C:\Program Files\SpyQuake2.com\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End


and here's the HJT logfile, thanks again

Logfile of HijackThis v1.99.1
Scan saved at 2:37:07 PM, on 7/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/apps/mpfplus/en-us/re…ystempopup=true
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {72CFCF21-59A4-4C95-AEDE-1FDD01E3C5F3} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {7EF2E02D-2C5A-4857-B8F4-57C8C016FBD5} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00309} - C:\WINDOWS\g45119375.dll
O2 - BHO: (no name) - {EE8AAE8E-3031-69C9-3F51-1FB328B908B4} - C:\WINDOWS\system32\xcrkq.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O20 - Winlogon Notify: winpdc32 - C:\WINDOWS\SYSTEM32\winpdc32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Post #9
Hello Norman,

Your doing well :thumbup: You had a smitfraud infection and its gone, still a little more to do.

You may want to print this out, we will be offline for part of the fix


* Click on MY COMPUTER
* Then on your C: Drive
* Then to TOOLS/ FOLDER OPTIONS/ VIEW
* Choose the radio button to SHOW HIDDEN FILES AND FOLDERS
* Take the checkmark out of HIDE EXTENSIONS FOR KNOWN FILE TYPES
* Then APPLY/ OK


You have Ewido installed, open the program and make sure its set like this.

* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.


Open HJT Scan Only, close your browser and all open windows, check these and click on Fix Checked

O2 - BHO: (no name) - {72CFCF21-59A4-4C95-AEDE-1FDD01E3C5F3} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {7EF2E02D-2C5A-4857-B8F4-57C8C016FBD5} - C:\WINDOWS\system32\lcwqgxxf.dll
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00309} - C:\WINDOWS\g45119375.dll
O2 - BHO: (no name) - {EE8AAE8E-3031-69C9-3F51-1FB328B908B4} - C:\WINDOWS\system32\xcrkq.dll (file missing)

O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123

O20 - Winlogon Notify: winpdc32 - C:\WINDOWS\SYSTEM32\winpdc32.dll




Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
*** make sure to remember where you saved that file, this is important
* Close Ewido


Still in Safemode, right click on Start > then click on Explore and navigate to the following files and delete them.

C:\WINDOWS\g45119375.dll

C:\WINDOWS\system32\lcwqgxxf.dll
C:\WINDOWS\SYSTEM32\winpdc32.dll
C:\WINDOWS\system32\xcrkq.dll



Reboot normally and lets run a system cleaner

Installing this program will by default install the Yahoo Toolbar. You can remove the Yahoo Toolbar if you wish via the Add-Remove Programs in the Control Panel.
Download and Install CCleaner
* Click on Run Cleaner
Tutorial for CCleaner


I need to see the Ewido report and a new Hijackthis log and let me know how your system is running now.

Ken
Post #10
Hello again

I did all you instructed except I couldn't find any of the below files you said I should delete:

C:\WINDOWS\g45119375.dll

C:\WINDOWS\system32\lcwqgxxf.dll
C:\WINDOWS\SYSTEM32\winpdc32.dll
C:\WINDOWS\system32\xcrkq.dll

Here's the Ewido log:

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 7:55:05 PM 7/22/2006

+ Scan result:



C:\VundoFix Backups\rqrsppq.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Program Files\Hijackthis\backups\backup-20060722-154224-460.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g10059218.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g10639750.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g10872000.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g10965468.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g11090406.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g12085609.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g1235875.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g1296375.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g13785250.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g1400125.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g14253109.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g14990171.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g15466703.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g15723656.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g16231125.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g16930468.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g16996046.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g1734390.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g17459437.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g18146609.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g18695656.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g19896734.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g19951468.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g23013703.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g23708703.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g2449765.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g2459296.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g25221671.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g2599843.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g2932000.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g34069046.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g3644406.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g3654093.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g3662625.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g3701484.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g3804890.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g4137171.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g44848718.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g4835187.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g4848984.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g4964703.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g6055218.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g6403609.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g7386453.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g7649906.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g7757562.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g7777468.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g8221937.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g8587875.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g8854390.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g8982218.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g9426156.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g9660781.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\WINDOWS\g9791531.dll -> Downloader.Delf.aeo : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\042O7NRA\L2[1].exe -> Downloader.Small.cvw : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win2D3.tmp.exe -> Downloader.Small.cvw : Cleaned with backup (quarantined).
:mozilla.536:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
:mozilla.335:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.336:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.572:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.573:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.574:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.575:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.576:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
:mozilla.481:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.482:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.483:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.484:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.486:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.876:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.600:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.601:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
:mozilla.135:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.136:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.137:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.138:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.139:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.29:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.26:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
:mozilla.23:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.24:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.25:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.27:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\[removed][2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.142:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.143:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.144:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.145:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.146:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.147:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.148:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.149:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.513:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.613:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined).
:mozilla.67:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
:mozilla.196:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.197:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.198:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.199:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.121:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.122:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.123:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.124:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).
:mozilla.74:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.75:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.76:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.77:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.78:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.79:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.82:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.84:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.86:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
:mozilla.898:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.119:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.120:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.125:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.255:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.256:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.257:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.258:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.509:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.510:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.535:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.69:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
:mozilla.538:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.539:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.540:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.541:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.441:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup (quarantined).
:mozilla.442:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup (quarantined).
:mozilla.469:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.470:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.644:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.645:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.646:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.647:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.648:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.649:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.650:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.651:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\[removed][1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.480:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.485:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.487:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.429:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.430:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.431:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.432:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.433:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.548:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.549:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.550:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.551:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.552:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.287:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.290:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.291:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.292:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.293:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.457:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
:mozilla.182:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.184:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.185:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.186:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.187:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.188:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.189:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.190:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.70:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.71:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.72:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.73:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.80:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.81:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.83:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.85:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.87:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.88:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.89:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\stefan@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.219:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.220:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.221:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.224:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.225:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.226:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.227:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
:mozilla.330:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.331:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.332:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.333:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
:mozilla.334:C:\Documents and Settings\Stefan\Application Data\Mozilla\Firefox\Profiles\ne7qboqf.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\042O7NRA\bgates[2].exe -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\GD6TEX6B\bgates[1].exe -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\RDTUA8LA\bgates[1].exe -> Trojan.Dialer.pz : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\GD6TEX6B\srvjkw[1].exe -> Trojan.Dialer.u : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win517.tmp.exe -> Trojan.Dialer.u : Cleaned with backup (quarantined).
C:\WINDOWS\SYSTEM32\winpdc32.dll -> Trojan.Mezzia : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\042O7NRA\srvxvu[1].exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\GD6TEX6B\srvyoi[1].exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Documents and Settings\Stefan\Local Settings\Temporary Internet Files\Content.IE5\OTABSXQV\srvuls[1].exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win257.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win25E.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win322.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win41D.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win5B7.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).


::Report end

And here's the latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:20:50 PM, on 7/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/apps/mpfplus/en-us/re…ystempopup=true
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O20 - Winlogon Notify: winpdc32 - winpdc32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Post #11
Good Morning Norman :D



Open Ewido and go into the Quarantine folder and delete it all, nothing in there you want to keep on your system.


Open HJT Scan Only and remove this entry

O20 - Winlogon Notify: winpdc32 - winpdc32.dll (file missing)



Download Pocket Killbox to your desktop, unzip it to a folder that you can find

* Highlight the file with the complete path in the quote and press Ctrl C on your keyboard.

C:\WINDOWS\SYSTEM32\winpdc32.dll


* Open Pocket Killbox
* Go to File > Paste from clipboard
* Set it to Delete on Reboot
* Tick the box that says End Explorer shell while killing file
* If its not greyed out..Click the radio button that say Unregister .dll before deleting.
* Make sure Single File is selected
* Click on the Red circle with the white X
* It will ask you to confirm the deletion…Say yes
* It will ask you to reboot, say yes



Post a New HJT Log.
Post #12
Hi Ken

When I tried to use Killbox it said it was going to reboot but then I got this message:

"PendingFile RenameOperations Registry data has been removed by external process" When I clicked ok it didn't reboot. So I rebooted manuallly but I'm not sure if this took care of the problem.

Anyway here's the HJT log and I'll look forward to your next post. Thanks yet again.

Logfile of HijackThis v1.99.1
Scan saved at 9:17:56 AM, on 7/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/apps/mpfplus/en-us/re…ystempopup=true
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Post #13
Norman,

It looks like you had Mcafee installed at one time and its gone , so you can remove both these entries with HJT. Keep in mind that you should only have one Anti Virus program running, two or more are counter productive and will cause you problems.

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/apps/mpfplus/en-us/re…ystempopup=true

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)


The rest of your log looks good :thumbup: Any issues ??

Ken :D
Post #14
Ken - thanks. I do only have one anti-vrus program. I use Trend Micro. I guess McAfee must have been left over from the trial version installed when new. Anyway, I removed the two last items. The computer runs very well I'm grateful. Many thanks. Is there anywhere you'd recommend I read up to avoid getting infected again?

Thanks and here's my last logfile. Cheers

Logfile of HijackThis v1.99.1
Scan saved at 2:23:18 PM, on 7/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WZCBDL Service\WZCBDLS.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Program Files\WZCBDL Service\WZCBDLS.exe
Post #15
Here you go Norman ,

Glad all is well :thumbup:



Here are some free programs and tips for keeping your system up to date, and to help keep all the riff raff out of your system.

Be sure to follow the instructions for System Restore because everything we removed is backed up in that program and if you ever use it to revert your system to an earlier date, you can reinfect your self all over again.


Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < When it asks you to backup the Registry..Say Yes
Tutorial for CCleaner


Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.
* Clean out your TEMP FILES
* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings
and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.


NOW RE-BOOT NORMALLY


* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

Now Empty your Recycle Bin

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

* Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.

AVG Free Edition
AntVir Personal Edition


* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and
give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains
in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed,
although you will still be able to connect to the sites.

* Firefox Browser
It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use
them both. When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you use this
for awhile, you will want to make it your default.

* Thunderbird Mail There companion mail program was highly favored in PCWorld Magazine,
this has a good spam filter and is more secure than Outlook Express.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't
access the internet without it.

* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/Click on PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Go to START/ CONTROL PANEL> PERFORMANCE AND MAINTENANCE> REARRANGE ITEMS ON YOUR HARD DISK TO MAKE PROGRAMS RUN FASTER
This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.


Thanks for stopping by Tom Coyote , I'm glad I was able to help you. I will keep this thread open for about a week in case you have any other questions.

Ken :D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI