What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP! computer infected with Spyware and Malware

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Help guys.

I need your help bad. I ran an .exe file by accident and since then My PC has been really screwed up. I've run Norton AntiVirus and Ad-aware several times and they've found many trojans, worms and spyware but it hasn't gotten rid of them all. Every time I open Internet explorer I get rerouted to www.sysprotectionpage.net instead of my home page www.google.com. I get many pop ups. Here is the output of Hijackthis. Let me know what to do. Many thanks to everyone.

Logfile of HijackThis v1.99.1
Scan saved at 7:05:02 AM, on 7/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\issearch.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ismon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R3 - URLSearchHook: (no name) - {9DBD634D-D78D-FC5E-AD3A-FBEA1B9A7299} - C:\WINDOWS\system32\yqmzwsw.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Eecl] "C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe" -vt yax
O4 - HKCU\..\Run: [Icanhb] C:\PROGRA~1\COMMON~1\RACLE~1\UERINI~1.EXE
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140536186536
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{68192F55-5131-4B22-A32F-BCE5AD07A1AE}: NameServer = 68.2.16.30,68.1.208.30
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #2
Welcome to the forum :wavey:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only

Don't run it yet.

Please download, install, and update the NEW free version of Ewido trojan scanner:
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • From the main ewido screen, click on update in the left menu, then click the Start update button.
  • After the update finishes (the status bar at the bottom will display "Update successful")
  • Close Ewido.
  • Boot in "safe" mode
  • Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All. Click the Empty Selected button. Close the program.
  • Run Ewido. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
  • If ewido finds anything, it will pop up a notification. Select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
  • When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.
Boot in normal mode.

Please post the results from ewido and a new hijackthis log.
Post #3
Micah_6:8,

Thanks for your help. I've followed your instructions and my system appears to be stable now :lol: . I'm not getting all the spybot popups anymore. The only problem still is that the when I go to internet explorer my home site gets redirected to www.sysprotectionpage.net instead of my home page www.google.com. Even if I change my home page I still get redirected. Here are the results of the Ewido and HighJack scan.

Lordlce

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 9:21:54 AM 7/22/2006

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{93ac7c30-3878-4eaa-9420-7977285df5b1} -> Adware.Generic : No action taken.
C:\Documents and Settings\jorge\Local Settings\Temp\temp.fr6954 -> Adware.PurityScan : No action taken.
C:\WINDOWS\system32\mljgg.dll -> Adware.Virtumonde : No action taken.
C:\WINDOWS\system32\ishost.exe -> Downloader.Zlob.zx : No action taken.
C:\WINDOWS\system32\ismon.exe -> Downloader.Zlob.zx : No action taken.
C:\Documents and Settings\jorge\Local Settings\Temporary Internet Files\Content.IE5\O7HRA239\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : No action taken.
C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : No action taken.
C:\WINDOWS\system32\components\flx5.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : No action taken.
C:\WINDOWS\system32\hhyembfc.exe -> Trojan.Agent.ny : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : No action taken.


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 9:29:41 AM, on 7/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\issearch.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Common Files\?racle\UERINI~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\HJT\HijackThis.exe

R3 - URLSearchHook: (no name) - {9DBD634D-D78D-FC5E-AD3A-FBEA1B9A7299} - C:\WINDOWS\system32\yqmzwsw.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {AD59632A-D9EB-F962-CD4B-FCBAAE111DC8} - C:\WINDOWS\system32\pdvpuv.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Eecl] "C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe" -vt yax
O4 - HKCU\..\Run: [Icanhb] C:\PROGRA~1\COMMON~1\RACLE~1\UERINI~1.EXE
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140536186536
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{68192F55-5131-4B22-A32F-BCE5AD07A1AE}: NameServer = 68.2.16.30,68.1.208.30
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #4
Boot in "safe mode" and run Ewido again. All the items say "no action taken". Have it remove all the bad things it finds. :) :thumbup:
Post #5
Well I followed your intructions and reran both programs. The 2nd time Ewido found more low end spyware bots but not the High severity ones it found during my first run. If I never deleted them then I don't know why it didn't find them again. So I ran the scan again a few times more but never found the high ones again. I'm still getting popups and my home page is still being rerouted. Here are the resuts of my scans.

lordlce


———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 7:51:48 AM 7/23/2006

+ Scan result:



C:\WINDOWS\system32\__delete_on_reboot__r_u_n_d_l_l_._d_l_l_ -> Adware.PurityScan : Cleaned.
[256] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[304] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[316] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[472] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[540] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[604] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
C:\WINDOWS\system32\mljgg.dll -> Adware.Virtumonde : Cleaned.
C:\Documents and Settings\jorge\Local Settings\Temporary Internet Files\Content.IE5\O7HRA239\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned.
C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned.
C:\WINDOWS\system32\components\flx5.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : Cleaned.


::Report end

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 11:45:24 AM 2/24/2003

+ Scan result:



C:\Program Files\Common Files\Оracle\UERINI~1.EXE -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\pdvpuv.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
[1192] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[256] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[304] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[316] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[472] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[540] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[604] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
[896] C:\WINDOWS\system32\rundll.dll -> Adware.PurityScan : Error during cleaning.
C:\WINDOWS\system32\mljgg.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\jorge\Local Settings\Temporary Internet Files\Content.IE5\O7HRA239\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignored.
C:\WINDOWS\system32\components\flx5.dll -> Not-A-Virus.Hoax.Win32.Renos.dw : Ignored.
E:\Documents and Settings\Jorge\Cookies\jorge@217.73.66[2].txt -> TrackingCookie.217.73.66.16 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@microsoftwga.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@pinnaclesystems.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@yamaha.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Adjuggler : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Adrevolver : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@bfast[1].txt -> TrackingCookie.Bfast : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@com[1].txt -> TrackingCookie.Com : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Euroclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@overture[2].txt -> TrackingCookie.Overture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@paycounter[1].txt -> TrackingCookie.Paycounter : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Realtracker : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@revenue[2].txt -> TrackingCookie.Revenue : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@targetnet[2].txt -> TrackingCookie.Targetnet : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Valuead : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Valueclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@valueclick[3].txt -> TrackingCookie.Valueclick : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@webstat[1].txt -> TrackingCookie.Web-stat : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned.
E:\Documents and Settings\Jorge\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned.
E:\Documents and Settings\Jorge\Cookies\jorge@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 8:01:24 AM, on 7/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\issearch.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {9DBD634D-D78D-FC5E-AD3A-FBEA1B9A7299} - C:\WINDOWS\system32\yqmzwsw.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {AD59632A-D9EB-F962-CD4B-FCBAAE111DC8} - C:\WINDOWS\system32\pdvpuv.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Eecl] "C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe" -vt yax
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140536186536
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{68192F55-5131-4B22-A32F-BCE5AD07A1AE}: NameServer = 68.2.16.30,68.1.208.30
O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #6
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R3 - URLSearchHook: (no name) - {9DBD634D-D78D-FC5E-AD3A-FBEA1B9A7299} - C:\WINDOWS\system32\yqmzwsw.dll (file missing)

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: (no name) - {AD59632A-D9EB-F962-CD4B-FCBAAE111DC8} - C:\WINDOWS\system32\pdvpuv.dll (file missing)

O4 - HKCU\..\Run: [Eecl] "C:\PROGRA~1\COMMON~1\ASKS~1\winword.exe" -vt yax

O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123

O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll

O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\program files\common files\asks~1\winword.exe <— file

c:\windows\system32\issearch.exe <— file

c:\windows\system32\rundll.dll <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread. :)
Post #7
Micah_6:8,

I followed the first part of your instructions and ran into ran into an error. But it appeared to work ok.

An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: C:\WINDOWS\system32\rundll.dll)
Error #5 - Invalid procedure call or argument

Please email me at [removed], reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows NT 5.01.2600
MSIE version: 6.0.2900.2180
HijackThis version: 1.99.1

This message has been copied to your clipboard.
Click OK to continue the rest of the scan.


Norton AV and Zone Labs is still detecting viruses(bgates[1].exe and win225.tmp.exe) after following your directions.

Here are the results of Hijackthis results. my home page is still being rerouted to www.sysprotectionpage.net , any idea on how to fix this issue? I think this may be causing me to be re-infected.


Logfile of HijackThis v1.99.1
Scan saved at 5:14:49 PM, on 7/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140536186536
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{68192F55-5131-4B22-A32F-BCE5AD07A1AE}: NameServer = 68.2.16.30,68.1.208.30
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8
Only for Windows XP and Windows 2000

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________
Next:

Download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
    ______________________________

    Open the SmitfraudFix folder and double-click smitfraudfix.cmd
    Select option #1 - Search by typing 1 and press Enter

    [external image: Posted Image]

    This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:

    c:\rapport.txt

    Open that file with Notepad, and "copy/paste" the ENTIRE CONTENTS of it into this thread.
Post #9
Here is the results of the script you had me run SmitFraudFix v2.75 Scan done at 9:33:39.17, Mon 07/24/2006 Run from C:\siri\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\isnotify.exe FOUND ! C:\WINDOWS\system32\ixt?.dll FOUND ! C:\WINDOWS\system32\ixt??.dll FOUND ! C:\WINDOWS\system32\ot.ico FOUND ! C:\WINDOWS\system32\ts.ico FOUND ! C:\WINDOWS\system32\components\flx?.dll FOUND ! C:\WINDOWS\system32\components\flx??.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jorge\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jorge\FAVORI~1 C:\DOCUME~1\jorge\FAVORI~1\Antivirus Test Online.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\SpyQuake2.com\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}" »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Post #10
Clean

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

[external image: Posted Image]


The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido, and run a full scan.
  • Click on Scanner
  • Click on Settings
    • Under How to scan all boxes should be checked
    • Under Unwanted Software all boxes should be checked
    • Under What to scan select Scan every file
    • Click on Ok
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
  • Click Save Report button
  • Save the report to your Desktop
Close Ewido and Reboot in Normal Mode.
______________________________

Please post:
  • c:\rapport.txt
  • Ewido log
  • A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off.
Post #11
Here are the results of the scans. Internet explorer is fixed now. After rebooting into normal mode Norton did pickup a virus that it quarantined (srvuud[1].exe) Also Zone labs keeps picking up these win1C8.tmp.exe type files trying to communicate out and blocking them.

Logfile of HijackThis v1.99.1
Scan saved at 6:58:53 AM, on 7/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {9DBD634D-D78D-FC5E-AD3A-FBEA1B9A7299} - C:\WINDOWS\system32\yqmzwsw.dll (file missing)
O2 - BHO: (no name) - {AD59632A-D9EB-F962-CD4B-FCBAAE111DC8} - C:\WINDOWS\system32\pdvpuv.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E5D68434-7E38-43C3-BD62-1B2AB9823BE1} - C:\WINDOWS\system32\mljgg.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1140536186536
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{68192F55-5131-4B22-A32F-BCE5AD07A1AE}: NameServer = 68.2.16.30,68.1.208.30
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winmqx32 - C:\WINDOWS\SYSTEM32\winmqx32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

SmitFraudFix v2.75

Scan done at 19:06:33.85, Mon 07/24/2006
Run from C:\siri\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"cinnamomum"="{93ac7c30-3878-4eaa-9420-7977285df5b1}"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\isnotify.exe Deleted
C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\WINDOWS\system32\components\flx?.dll Deleted
C:\DOCUME~1\jorge\FAVORI~1\Antivirus Test Online.url Deleted
C:\Program Files\SpyQuake2.com\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 6:42:59 AM 7/25/2006

+ Scan result:



C:\WINDOWS\system32\__delete_on_reboot__r_u_n_d_l_l_._d_l_l_ -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mljgg.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\DP.sys -> Trojan.Agent.ny : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win1C8.tmp.exe -> Trojan.Dialer.u : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win225.tmp.exe -> Trojan.Dialer.u : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win1CA.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\win227.tmp.exe -> Trojan.Pakes : Cleaned with backup (quarantined).


::Report end
Post #12
Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop. <— VERY IMPORTANT!!!

Go to Start –> Run and copy/paste in the following:

"%userprofile%\desktop\combofix.exe" /v mljgg

Then hit or click OK

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.
:)
Post #13
Due to lack of feedback:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI