Spyware / Malware / Virus Removal

Sloow box

5 min read

Looking for the outcome? Ask AI

froom Topic Starter

Post #1July 29, 2006, 9:18 PM UTC last edited July 29, 2006, 9:24 PM UTC

This box is running way too slow. Wouldn't be surprised if Norton Internet Security 2004 is causing the problem. But I don't know. I've been using Adaware and the system was just scanned by Norton AntiVirus.

Any help would be greatly appreciated.

froom

Logfile of HijackThis v1.99.1
Scan saved at 4:40:51 PM, on 7/29/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINNT\system32\CTsvcCDA.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\PGPserv.exe
C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\My Name\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS13
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reformer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.0.1:87
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.1;192.168.0.0;66.82.156.52
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\My Name\Application Data\Mozilla\Profiles\default\l1kukili.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC2\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClock\TCLOCKEX.EXE
O4 - HKCU\..\Run: [PPScheduler] C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: QuickShelf 2000.lnk = C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: PGPtray.exe.lnk = C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/28c1f8c1721bbc…ip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS1\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS2\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O20 - AppInit_DLLs: OCMAPIHK.DLL
O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing)
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINNT\system32\PGPserv.exe
O23 - Service: RAID Storage Manager Agent (RAIDStorAgent) - Dell - C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

ken545

Post #2August 18, 2006, 3:04 PM UTC

froom,

Welcome to Tom Coyote, sorry for the delay in responding, to say we are overwhelmed with logs would be an understatement.

Did you or your ISP set this proxy servers???

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.0.1:87
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.1;192.168.0.0;66.82.156.52

Your HJT log is about 2 weeks old and things may have changed, lets move it to its own folder and post a new log please.

DO THIS FIRST
Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to My Computer > YOUR C:\ DRIVE > Program Files and create a new folder and name it Hijackthis .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\Program Files\Hijackthis\Hijackthis.exe

froom

Post #3August 19, 2006, 5:28 PM UTC

Thank you for trying to help. Sorry it took me so long to reply.
There a few things I feel I should bring to your attention:
1. hijackthis.exe was already in the C: directory as you suggested.
2. I have a LAN and I don't believe I was the one who set those proxy addresses
2a. I've been trying to setup a VPN with a static IP on the remote box and a dynamic IP on this box but have not figured it out as yet.
3. I've been experiencing bad slowdowns while using MS Outlook. When I open an email it takes several seconds to open and appear on screen. This has been going on for sometime. Could Norton Internet Security have something to do with this? I've got Norton on other computers and do not have this sluggishness.
4. MS Word has started to act up. Since yesterday I can only open it in safe mode. I've been moving the folder locations for my templates but I cannot see how this could have caused the program to open in safe mode only.

I cannot believe the immensity of the work you guys are trying to accomplish here. It's an awesome endeavor. My hat is off to you, whether we get my problems solved or not.

Here is today's logfile:

Logfile of HijackThis v1.99.1
Scan saved at 12:56:19 PM, on 8/19/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINNT\system32\CTsvcCDA.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\PGPserv.exe
C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec

Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\Explorer.EXE
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Any Password Pro\apwp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\Mark Beresky\Start

Menu\Programs\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL

= http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://g.msn.com/0SEENUS/SAOS10
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.reformer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyServer = http=192.168.0.1:87
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = 192.168.0.1;192.168.0.0;66.82.156.52
N3 - Netscape 7: user_pref("browser.search.defaultengine",

"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Cs

earchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Mark

Beresky\Application Data\Mozilla\Profiles\default\l1kukili.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}

- C:\Program Files\Common Files\Symantec

Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -

C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -

{8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Web assistant -

{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program

Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton

Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet

Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common

Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding

-boot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common

Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program

Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE

TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC2\WinVNC.exe"

-servicehelper
O4 - HKLM\..\Run: [IndexSearch] "C:\Program

Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType

Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClock\TCLOCKEX.EXE
O4 - HKCU\..\Run: [PPScheduler] C:\Program

Files\ScanSoft\PaperPort\PPScheduler.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI

Multimedia\MAIN\ATISched.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: QuickShelf 2000.lnk = C:\Program Files\Microsoft

Reference\Bookshelf 2000\qshelf2k.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program

Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: PGPtray.exe.lnk = C:\Program Files\PGP

Corporation\PGP Desktop\PGPtray.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program

Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server -

C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Highlight - C:\Program Files\Avant

Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program

Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program

Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program

Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Search - C:\Program Files\Avant

Browser\Search.htm
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office

Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows

Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl

Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D

ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8}

(ActiveDataInfo Class) -

http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec

SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec

Script Runner Class) -

http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

http://software-dl.real.com/28c1f8c1721bbc…ip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec

RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}

(ActiveDataInfo Class) -

http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} -

http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D

3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 -

HKLM\System\CS1\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D

3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 -

HKLM\System\CS2\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D

3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O20 - AppInit_DLLs: OCMAPIHK.DLL
O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing)
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program

Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation -

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec

Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation

- C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology

Ltd - C:\WINNT\system32\CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -

VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation -

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) -

Symantec Corporation - C:\Program Files\Norton Internet Security\Norton

AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation -

C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA

Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation -

C:\WINNT\system32\PGPserv.exe
O23 - Service: RAID Storage Manager Agent (RAIDStorAgent) - Dell -

C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program

Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation

- C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\Security

Center\SymWSC.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner -

C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

ken545

Post #4August 19, 2006, 6:49 PM UTC

froom,

I cant read your log this way, do this and post a new log please. If your log shows no signs of a virus or malware, I can direct you to some excellent windows tech support sites including our own that deal with the things you want to accomplish.

Open HJT Scan and Save a Log File, it will open in Notepad, go to Format and make sure WordWrap is checked, then to Edit> Select All…..Edit > Copy and Paste the new log into
this thread.

froom

Post #5August 19, 2006, 11:48 PM UTC last edited August 19, 2006, 11:53 PM UTC

Hope this reads better. froom Logfile of HijackThis v1.99.1
Scan saved at 7:17:15 PM, on 8/19/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINNT\system32\CTsvcCDA.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\PGPserv.exe
C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\Explorer.EXE
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Any Password Pro\apwp.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\IrfanView\i_view32.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\WINNT\system32\notepad.exe
C:\Documents and Settings\my name\Start Menu\Programs\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reformer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.0.1:87
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.1;192.168.0.0;66.82.156.52
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\my name\Application Data\Mozilla\Profiles\default\l1kukili.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC2\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClock\TCLOCKEX.EXE
O4 - HKCU\..\Run: [PPScheduler] C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: QuickShelf 2000.lnk = C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: PGPtray.exe.lnk = C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/28c1f8c1721bbc…ip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS1\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS2\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O20 - AppInit_DLLs: OCMAPIHK.DLL
O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing)
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINNT\system32\PGPserv.exe
O23 - Service: RAID Storage Manager Agent (RAIDStorAgent) - Dell - C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

ken545

Post #6August 20, 2006, 4:05 AM UTC

froom,

Download and install the 30 day trial of Ewido Anti-Spyware from HERE and save that file to your desktop.

* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.

Open HJT Scan Only, close all open windows and your browser, check these and click on Fix Checked

Read this , its your call to remove it. Anything you remove with HJT can always be restored if needed by opening HJT > View the List of Backups and restore what you want.

CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/28c1f8c1721bbc…ip/RdxIE601.cab

O20 - Winlogon Notify: ATINotify - logonnfy.dll (file missing)

Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
*** make sure to remember where you saved that file, this is important
* Close Ewido

Do a windows search and delete this file if found —> logonnfy.dll It could be in C:\, C:\windows or C:\windows\system32

Reboot normally and lets run a system cleaner.

If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
Tutorial for CCleaner

Let me see a new HJT log, the Ewido report and let me know if you found that file.

froom

Post #7August 21, 2006, 1:07 AM UTC

Ken,
Ewido would not open in safe mode. An error box came up saying, "Something bad happened in the application. Error diagonstic file saved to 'C:\Program Files\ewido anti-spyware 4.0\ewido.err".
In the ewido directory, in logfile.txt, it said "synchronize database and filecache. application start was blocked because of several instances". But, Ewido did run without safe mode. I followed your directions and ran the cleaner. Also, after saving the registry, I ran the "Issues" component and deleted everything it found. That, you did not ask me to do.
In CCleaner's "Add Remove Program" list I found some entries which might be a problem: Norton AntiSpam
Norton AntiSpam
Norton AntiVirus
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security (Symantec Corporation)
CC_ccProxyMSI
CC_ccStart
ccCommon
DAO At the end of the CCleaner's "Uninstall_list.txt" file (generated by the "uninstall" feature under the "Tools" button, there was this reference:
C:\Program Files\Common Files\Symantec Shared\SymSetup\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}.exe /X MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125} I don't know (as yet) what these entries refer to (registry?) but it must have something to do with my Norton sluggishness. Can I delete (with CCleaner) all of the "Norton Internet Security" references except one? Also, the extra "Norton AntiSpam" reference? And if I do delete them, how do I tell which is kosher to delete and which is necessary for Norton to function correctly? BTW, all these extra instances do not show up on the "Add Delete Programs" in the Windows interface. The only ones Windows references is the one named "Norton Internet Security (Symantec Corporation)". I suppose that's the one to keep, huh? Those other apps, except DAO, are Norton's doing, if I'm not mistaken. A search of all drives failed to find "logonnfy.dll". Thanks for all the work you are putting into this.
mark ———————————————————
ewido anti-spyware - Scan Report
——————————————————— + Created at: 4:45:26 PM 8/20/2006 + Scan result: :mozilla.6:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
:mozilla.10:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.11:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.12:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.13:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.14:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.15:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.16:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.17:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.18:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.19:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.5:C:\Documents and Settings\my name\Application Data\Mozilla\Profiles\default\l1kukili.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.7:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.8:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.9:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\my name\Local Settings\Temp\Cookies\my name@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@2o7[4].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@2o7[4].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@2o7[4].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Adorigin : Cleaned with backup (quarantined).
:mozilla.52:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Centrport : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[3].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[4].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[5].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\my name\Cookies\my .txt"]name@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[3].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[4].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@com[5].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\my name\Cookies\my .txt"]name@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@com[3].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@com[4].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@com[5].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\my name\Cookies\my .txt"]name@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
:mozilla.84:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Hypertracker : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[2].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[3].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@ads.link4ads[1] (1).txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@ads.link4ads[1].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[2].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[3].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@ads.link4ads[1] (1).txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@ads.link4ads[1].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[2].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@ads.link4ads[3].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my name@ads.link4ads[1] (1).txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my name@ads.link4ads[1].txt -> TrackingCookie.Link4ads : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@linkbuddies[1] (1).txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@linkbuddies[1].txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@linkbuddies[1] (1).txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@linkbuddies[1].txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my name@linkbuddies[1] (1).txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my name@linkbuddies[1].txt -> TrackingCookie.Linkbuddies : Cleaned with backup (quarantined).
:mozilla.166:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.167:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.168:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.169:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.251:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
:mozilla.252:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\my name\Cookies\my .txt"][removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\my name\Cookies\my [removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\my name\Cookies\my .txt"][removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.253:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.254:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
:mozilla.142:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@oxcash[2].txt -> TrackingCookie.Oxcash : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@oxcash[2].txt -> TrackingCookie.Oxcash : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@oxcash[2].txt -> TrackingCookie.Oxcash : Cleaned with backup (quarantined).
:mozilla.29:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.30:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.31:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.32:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[3].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@preferences[1] (1).txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@preferences[1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[3].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@preferences[1] (1).txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my name@preferences[1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\[removed][1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\[removed][2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[2].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\furnaceroom@preferences[3].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my name@preferences[1] (1).txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my .txt"]name@preferences[1].txt -> TrackingCookie.Preferences : Cleaned with backup (quarantined).
:mozilla.144:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.6:C:\Documents and Settings\my name\Application Data\Mozilla\Profiles\default\l1kukili.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.75:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.170:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.171:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.172:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.173:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.49:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@specificpop[1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\administrator@specificpop[1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@specificpop[1].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\administrator@specificpop[2].txt -> TrackingCookie.Specificpop : Cleaned with backup (quarantined).
:mozilla.175:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.176:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\my name\Local Settings\Temp\Cookies\my .txt"]name@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.187:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed]-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\Administrator\Cookies\[removed]-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Cookies\[removed]-stat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my [removed][1] (1).txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"][removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my [removed][1] (1).txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
G:\Current Files\Retrospect Backup\Backup copy of Main archiv ©\Retrospect Backup\Backup copy of Main archiv ©\Documents and Settings\FURNACEROOM\Cookies\my .txt"][removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my [removed][1] (1).txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\FURNACEROOM\Cookies\my .txt"][removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined).
:mozilla.246:C:\Documents and Settings\my name\Application Data\Mozilla\Firefox\Profiles\ar49csnp.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).
G:\DidNotReinstall\Documents and Settings\Administrator\Desktop\Modem Utilities\snooper.exe -> Trojan.CuteSpy : Cleaned with backup (quarantined).
G:\DidNotReinstall\Program Files\Sound Snooper\uninst.exe -> Trojan.CuteSpy : Cleaned with backup (quarantined).
::Report end
Logfile of HijackThis v1.99.1
Scan saved at 8:19:41 PM, on 8/20/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINNT\system32\CTsvcCDA.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\PGPserv.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\my name\Start Menu\Programs\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reformer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.0.1:87
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0.1;192.168.0.0;66.82.156.52
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\my name\Application Data\Mozilla\Profiles\default\l1kukili.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClock\TCLOCKEX.EXE
O4 - HKCU\..\Run: [PPScheduler] C:\Program Files\ScanSoft\PaperPort\PPScheduler.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [ATI Scheduler] C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: QuickShelf 2000.lnk = C:\Program Files\Microsoft Reference\Bookshelf 2000\qshelf2k.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exe
O4 - Global Startup: PGPtray.exe.lnk = C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page… - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Open PDF in Word - res://C:\Program Files\ScanSoft\OmniPagePro14.0\PdfCnv\IEShellExt.dll /100
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\pgplsp.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS1\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O17 - HKLM\System\CS2\Services\Tcpip\..\{628A4434-8093-4435-8CBC-BC49D3DED9ED}: NameServer = 151.203.0.85,151.203.0.84
O20 - AppInit_DLLs: OCMAPIHK.DLL
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINNT\system32\PGPserv.exe
O23 - Service: RAID Storage Manager Agent (RAIDStorAgent) - Dell - C:\Program Files\Dell\RAID Storage Manager\StorServ.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

ken545

Post #8August 21, 2006, 2:00 AM UTC last edited August 21, 2006, 2:03 AM UTC

froom,

We got rid of the bad entries , and mostly what Ewido found were cookies

There is nothing in there you want to keep so I would empty out the Quanatine folder in Ewido. Ewido is also a trial version, it does use some system resources via the background guard. This program will still function after 30 days, you can check for updates, run scans and remove what it finds, you will just lose the background guard feature which you should have disabled anyway. So your call to uninstall this program.

Those proxy setting are associated with.

Hughes Network Systems
11717 Exploration Lane
DirecWAY Network Management Center
attn: Network Security Manager
Germantown, MD
US

Let me tell ya, the security suites that include all the firewalls , AV and the list goes on are very big resource hogs. We mainly recommend just a stand alone AV and a Firewall. I have used just Nortons AV and ZoneAlarms free firewall for years without any problems.

If you look at your HJT log, in the 04s and 023 entries, I have never saw so many programs running from one company. The 04s start when windows starts and the 023 are running processess that run in the background after windows loads.

These are just recommendations, look them over and you can decide which ones you may want to stop from loading when windows starts.
You can always open HJT> View the List of Backups and restore which ever ones you want.

Open HJT Scan Only and remove the ones you want , this is totally your call.

ScanSoft OmniPage auto updater. Can be disabled using the main program's options.
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

Associated with "Nero Burning Rom" CD writing software. Checks for driver issues
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe

O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClock\TCLOCKEX.EXE

Ahead Nero BackItUp backup program. Only required for if you have scheduled back-ups
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"

Your Java is out of date and leaving your system vulnerable.
Go to your Add-Remove Programs in the Control Panel and uninstall any previous (jre) installations.
Reboot your system.
Then go to the Sun Java website and download and install the update.
Java Runtime Environment (JRE) 5.0 Update 8 <–This is what you need to download and install.
Then after install you can verify your installation here Sun Java Verify

My self, I think you have to much going on with Norton. You can post over at CastleCops, one of our sister sites, they have a Norton forum.
http://www.castlecops.com/f80-Norton_Anti_Virus.html

Speedup Windows
http://www.techbuilder.org/recipes/59201471

http://www.techruler.com/tips.html#1
http://www.kellys-korner-xp.com/xp_abc.htm

How did I get infected in the first place.
http://www.castlecops.com/postlite7736-.html
http://www.bleepingcomputer.com/forums/topic2520.html

Here are some free programs and tips for keeping your system up to date, and to help keep all the riff raff out of your system.

Be sure to follow the instructions for System Restore because everything we removed is backed up in that program and if you ever use it to revert your system to an earlier date, you can reinfect your self all over again.

Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < When it asks you to backup the Registry..Say Yes
Tutorial for CCleaner

Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.
* Clean out your TEMP FILES
* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings
and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.

NOW RE-BOOT NORMALLY

* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

Now Empty your Recycle Bin

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

* Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.

AVG Free Edition
AntVir Personal Edition

* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and
give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains
in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed,
although you will still be able to connect to the sites.

* Firefox Browser
It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use
them both. When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you use this
for awhile, you will want to make it your default.

* Thunderbird Mail There companion mail program was highly favored in PCWorld Magazine,
this has a good spam filter and is more secure than Outlook Express.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't
access the internet without it.

* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/Click on PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Go to START/ CONTROL PANEL> PERFORMANCE AND MAINTENANCE> REARRANGE ITEMS ON YOUR HARD DISK TO MAKE PROGRAMS RUN FASTER
This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.

Thanks for stopping by Tom Coyote , I'm glad I was able to help you. You log looks ok so I cant help you any further.

froom

Post #9August 22, 2006, 11:09 PM UTC

Ken, THanks for all your help. There seems to be a definate improvement in speed. Your help has been awesome. Thanks so much,froom

ken545

Post #10August 22, 2006, 11:19 PM UTC

froom,

Your very welcome. Take care

ken545

Post #11August 25, 2006, 6:31 PM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Sloow box

✨ Ask AI

Ask AI