What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

New to HijackThis- here is my log plz help

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Bell\Security Manager\fws.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Bell\Security Manager\Rps.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ZipGenius 6\zipgenius.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\ZGTemp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
F3 - REG:win.ini: load=??? ?
F3 - REG:win.ini: run=??? ?
F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe
O1 - Hosts: 205.238.40.2 www.winmx.com
O1 - Hosts: 205.238.40.2 err.winmx.com
O1 - Hosts: 82.195.155.5 test3201.winmx.com test3203.winmx.com test3205.winmx.com test3207.winmx.com
O1 - Hosts: 212.227.64.149 test3202.winmx.com test3204.winmx.com test3206.winmx.com test3208.winmx.com
O1 - Hosts: 67.18.233.36 c3310.z1301.winmx.com c3310.z1302.winmx.com c3312.z1305.winmx.com c3312.z1306.winmx.com c3313.z1303.winmx.com c3313.z1304.winmx.com c3314.z1301.winmx.com c3314.z1302.winmx.com c3316.z1305.winmx.com c3316.z1306.winmx.com c3317.z1303.winmx.com c3317.z1304.winmx.com c3318.z1301.winmx.com c3318.z1302.winmx.com c3318.z1305.winmx.com c3318.z1306.winmx.com c3319.z1303.winmx.com c3319.z1304.winmx.com
O1 - Hosts: 82.195.155.5 c3310.z1305.winmx.com c3310.z1306.winmx.com c3311.z1303.winmx.com c3311.z1304.winmx.com c3312.z1301.winmx.com c3312.z1302.winmx.com c3314.z1305.winmx.com c3314.z1306.winmx.com c3315.z1303.winmx.com c3315.z1304.winmx.com c3316.z1301.winmx.com c3316.z1302.winmx.com
O1 - Hosts: 209.67.209.50 c3310.z1303.winmx.com c3310.z1304.winmx.com c3311.z1301.winmx.com c3311.z1302.winmx.com c3313.z1305.winmx.com c3313.z1306.winmx.com c3314.z1303.winmx.com c3314.z1304.winmx.com c3315.z1301.winmx.com c3315.z1302.winmx.com c3317.z1305.winmx.com c3317.z1306.winmx.com c3318.z1303.winmx.com c3318.z1304.winmx.com c3319.z1301.winmx.com c3319.z1302.winmx.com c3319.z1305.winmx.com c3319.z1306.winmx.com
O1 - Hosts: 212.227.64.159 c3311.z1305.winmx.com c3311.z1306.winmx.com c3312.z1303.winmx.com c3312.z1304.winmx.com c3313.z1301.winmx.com c3313.z1302.winmx.com c3315.z1305.winmx.com c3315.z1306.winmx.com c3316.z1303.winmx.com c3316.z1304.winmx.com c3317.z1301.winmx.com c3317.z1302.winmx.com
O1 - Hosts: 67.18.233.36 c3520.z1301.winmx.com c3520.z1302.winmx.com c3522.z1305.winmx.com c3522.z1306.winmx.com c3523.z1303.winmx.com c3523.z1304.winmx.com c3524.z1301.winmx.com c3524.z1302.winmx.com c3526.z1305.winmx.com c3526.z1306.winmx.com c3527.z1303.winmx.com c3527.z1304.winmx.com c3528.z1301.winmx.com c3528.z1302.winmx.com c3528.z1305.winmx.com c3528.z1306.winmx.com c3529.z1303.winmx.com c3529.z1304.winmx.com
O1 - Hosts: 82.195.155.5 c3520.z1305.winmx.com c3520.z1306.winmx.com c3521.z1303.winmx.com c3521.z1304.winmx.com c3522.z1301.winmx.com c3522.z1302.winmx.com c3524.z1305.winmx.com c3524.z1306.winmx.com c3525.z1303.winmx.com c3525.z1304.winmx.com c3526.z1301.winmx.com c3526.z1302.winmx.com
O1 - Hosts: 209.67.209.50 c3520.z1303.winmx.com c3520.z1304.winmx.com c3521.z1301.winmx.com c3521.z1302.winmx.com c3523.z1305.winmx.com c3523.z1306.winmx.com c3524.z1303.winmx.com c3524.z1304.winmx.com c3525.z1301.winmx.com c3525.z1302.winmx.com c3527.z1305.winmx.com c3527.z1306.winmx.com c3528.z1303.winmx.com c3528.z1304.winmx.com c3529.z1301.winmx.com c3529.z1302.winmx.com c3529.z1305.winmx.com c3529.z1306.winmx.com
O1 - Hosts: 212.227.64.159 c3521.z1305.winmx.com c3521.z1306.winmx.com c3522.z1303.winmx.com c3522.z1304.winmx.com c3523.z1301.winmx.com c3523.z1302.winmx.com c3525.z1305.winmx.com c3525.z1306.winmx.com c3526.z1303.winmx.com c3526.z1304.winmx.com c3527.z1301.winmx.com c3527.z1302.winmx.com
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Security Manager\pkR.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Bell\Security Manager\FBHR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Security Manager] "C:\Program Files\Bell\Security Manager\Rps.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [NAVSCAN32.EXE] NAVSCAN32.exe
O4 - HKLM\..\RunServices: [msn] msnmsgr.exe
O4 - HKLM\..\RunServices: [Syntax] windows32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w…ntrol_en_US.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as…rl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/16546b8230cd59c38900/…ip/RdxIE601.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.mindavenue.com/Downloads/AXELPlayerAX_Win32.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://sympatico.gamesmania.com/ExentCtl.ocx
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://sympatico.zone.msn.com/binFramework…ro.cab34246.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} (BewitchedGameClass Control) - http://real.gamehouse.com/games/bewitched/launcher.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Security Manager Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\Bell\Security Manager\fws.exe
Post #2
Welcome to the forum :wavey:

You got few bugs, one of which can be a "keylogger".

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F3 - REG:win.ini: load=??? ?

F3 - REG:win.ini: run=??? ?

F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe

O4 - HKLM\..\RunServices: [NAVSCAN32.EXE] NAVSCAN32.exe

O4 - HKLM\..\RunServices: [msn] msnmsgr.exe

O4 - HKLM\..\RunServices: [Syntax] windows32.exe

O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/16546b8230cd59c38900/…ip/RdxIE601.cab

O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

C:\WINNT\system32\msnmsgr.exe <— file

C:\WINNT\system32\navscan32.exe <— file

C:\WINNT\system32\windows32.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread. :)
Post #3
Thanx for the help Micah. :) I really appreciate it as I have spent 6 hours on the phone today with techs from my "security service" company who have been of absolutely no help to me.

I removed items you suggested but when in safe mode was unable to find the 3 system32 files you refer to.
Here is my new scan log :

Logfile of HijackThis v1.99.1
Scan saved at 7:56:41 PM, on 8/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Bell\Security Manager\fws.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe
C:\Program Files\Bell\Security Manager\Rps.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ZipGenius 6\zipgenius.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\ZGTemp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O1 - Hosts: 205.238.40.2 www.winmx.com
O1 - Hosts: 205.238.40.2 err.winmx.com
O1 - Hosts: 82.195.155.5 test3201.winmx.com test3203.winmx.com test3205.winmx.com test3207.winmx.com
O1 - Hosts: 212.227.64.149 test3202.winmx.com test3204.winmx.com test3206.winmx.com test3208.winmx.com
O1 - Hosts: 67.18.233.36 c3310.z1301.winmx.com c3310.z1302.winmx.com c3312.z1305.winmx.com c3312.z1306.winmx.com c3313.z1303.winmx.com c3313.z1304.winmx.com c3314.z1301.winmx.com c3314.z1302.winmx.com c3316.z1305.winmx.com c3316.z1306.winmx.com c3317.z1303.winmx.com c3317.z1304.winmx.com c3318.z1301.winmx.com c3318.z1302.winmx.com c3318.z1305.winmx.com c3318.z1306.winmx.com c3319.z1303.winmx.com c3319.z1304.winmx.com
O1 - Hosts: 82.195.155.5 c3310.z1305.winmx.com c3310.z1306.winmx.com c3311.z1303.winmx.com c3311.z1304.winmx.com c3312.z1301.winmx.com c3312.z1302.winmx.com c3314.z1305.winmx.com c3314.z1306.winmx.com c3315.z1303.winmx.com c3315.z1304.winmx.com c3316.z1301.winmx.com c3316.z1302.winmx.com
O1 - Hosts: 209.67.209.50 c3310.z1303.winmx.com c3310.z1304.winmx.com c3311.z1301.winmx.com c3311.z1302.winmx.com c3313.z1305.winmx.com c3313.z1306.winmx.com c3314.z1303.winmx.com c3314.z1304.winmx.com c3315.z1301.winmx.com c3315.z1302.winmx.com c3317.z1305.winmx.com c3317.z1306.winmx.com c3318.z1303.winmx.com c3318.z1304.winmx.com c3319.z1301.winmx.com c3319.z1302.winmx.com c3319.z1305.winmx.com c3319.z1306.winmx.com
O1 - Hosts: 212.227.64.159 c3311.z1305.winmx.com c3311.z1306.winmx.com c3312.z1303.winmx.com c3312.z1304.winmx.com c3313.z1301.winmx.com c3313.z1302.winmx.com c3315.z1305.winmx.com c3315.z1306.winmx.com c3316.z1303.winmx.com c3316.z1304.winmx.com c3317.z1301.winmx.com c3317.z1302.winmx.com
O1 - Hosts: 67.18.233.36 c3520.z1301.winmx.com c3520.z1302.winmx.com c3522.z1305.winmx.com c3522.z1306.winmx.com c3523.z1303.winmx.com c3523.z1304.winmx.com c3524.z1301.winmx.com c3524.z1302.winmx.com c3526.z1305.winmx.com c3526.z1306.winmx.com c3527.z1303.winmx.com c3527.z1304.winmx.com c3528.z1301.winmx.com c3528.z1302.winmx.com c3528.z1305.winmx.com c3528.z1306.winmx.com c3529.z1303.winmx.com c3529.z1304.winmx.com
O1 - Hosts: 82.195.155.5 c3520.z1305.winmx.com c3520.z1306.winmx.com c3521.z1303.winmx.com c3521.z1304.winmx.com c3522.z1301.winmx.com c3522.z1302.winmx.com c3524.z1305.winmx.com c3524.z1306.winmx.com c3525.z1303.winmx.com c3525.z1304.winmx.com c3526.z1301.winmx.com c3526.z1302.winmx.com
O1 - Hosts: 209.67.209.50 c3520.z1303.winmx.com c3520.z1304.winmx.com c3521.z1301.winmx.com c3521.z1302.winmx.com c3523.z1305.winmx.com c3523.z1306.winmx.com c3524.z1303.winmx.com c3524.z1304.winmx.com c3525.z1301.winmx.com c3525.z1302.winmx.com c3527.z1305.winmx.com c3527.z1306.winmx.com c3528.z1303.winmx.com c3528.z1304.winmx.com c3529.z1301.winmx.com c3529.z1302.winmx.com c3529.z1305.winmx.com c3529.z1306.winmx.com
O1 - Hosts: 212.227.64.159 c3521.z1305.winmx.com c3521.z1306.winmx.com c3522.z1303.winmx.com c3522.z1304.winmx.com c3523.z1301.winmx.com c3523.z1302.winmx.com c3525.z1305.winmx.com c3525.z1306.winmx.com c3526.z1303.winmx.com c3526.z1304.winmx.com c3527.z1301.winmx.com c3527.z1302.winmx.com
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Bell\Security Manager\pkR.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Bell\Security Manager\FBHR.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SSA.exe] "C:\Program Files\Bell\Sympatico Security Advisor\SSA.exe"
O4 - HKLM\..\Run: [Security Manager] "C:\Program Files\Bell\Security Manager\Rps.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w…ntrol_en_US.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as…rl/LSSupCtl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {68A2C3BD-7809-11D3-8ACF-0050046F2F9A} (AXELPlayer Class) - http://www.mindavenue.com/Downloads/AXELPlayerAX_Win32.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://sympatico.gamesmania.com/ExentCtl.ocx
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://sympatico.zone.msn.com/binFramework…ro.cab34246.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} (BewitchedGameClass Control) - http://real.gamehouse.com/games/bewitched/launcher.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{150BBA55-75E3-4E90-BEF0-A8C7CB4E604C}: NameServer = 206.47.244.61 206.47.244.89
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Security Manager Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\Bell\Security Manager\fws.exe



thanx again
Post #5
Thanx I'll give that a try. It's still running kinda carp** right now. But the worst offenders appear to have vanished. My hompepage curiously redirects itself when I open my browser and quickly redirects itself back to my homepage (?)
Post #6
This was the virus you had that was the "keylogger":

WORM_SDBOT.CQ

You may consider changing online passwords/pin numbers.

If you're still not satisfied after the online scan, post again.

There are other free malware killing programs we can use.
:) :thumbup:
Post #7
Thanx. I tried to get the Micro-Housecall but the link you click to get the scan doesn't initiate, it sends me a page not found (?) I will try again later tonight and repost if I'm still experiencing issues. :)
Post #9
Due to lack of feedback:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI