What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

adw_winstool.b

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
i have been working on my daughters computer trying to clean it up. one virus scanner told us she had ADW_Winstool.B and it could not get rid of it. How do i do that and does anyone see anything else from hijack this that needs to go.

thank you for your help

Logfile of HijackThis v1.99.1
Scan saved at 4:00:32 PM, on 8/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Software by Design\TrayTool.exe
C:\Program Files\YCIII\YankClip.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [36b223e11bd9] C:\WINDOWS\System32\cfgmgr32.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - Startup: Tray Tools 2000.lnk = C:\Program Files\Software by Design\TrayTool.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Program Files\YCIII\YankClip.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SmartUI.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search for using AltaVista - C:\Program Files\Search Bar\SBIEAddon\AltaVista.html
O8 - Extra context menu item: Search for using Excite - C:\Program Files\Search Bar\SBIEAddon\Excite.html
O8 - Extra context menu item: Search for using Google - C:\Program Files\Search Bar\SBIEAddon\Google.html
O8 - Extra context menu item: Search for using HotBot - C:\Program Files\Search Bar\SBIEAddon\HotBot.html
O8 - Extra context menu item: Search for using Lycos - C:\Program Files\Search Bar\SBIEAddon\Lycos.html
O8 - Extra context menu item: Search for using Yahoo - C:\Program Files\Search Bar\SBIEAddon\Yahoo.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1….g/GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154292067033
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
Post #2
First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan and a new hijackthis log please.
Post #3
i did what you said and ran ewido. when i applied all actions it said there was an error while quarantining downloader-wintool.a. here is the ewido report and the hijack this report: thanks for your help

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 1:42:52 PM 8/16/2006

+ Scan result:



C:\Documents and Settings\Jeff\Application Data\osms.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP33\A0000737.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Temp\backups\backup-20060814-183912-594.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\tаskmgr.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\toolbar.dll -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\WTA1\WinTA.cab/WToolsA.exe -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~490848.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~502773.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~540051.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~540199.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~540651.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~563535.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~587382.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~638341.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~645839.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~647873.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~667632.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~668580.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~670003.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~674731.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~702678.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~795539.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~872180.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Local Settings\Temp\~882962.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Downloads\trace.zip/nc.exe -> Backdoor.Ncx.a : Cleaned with backup (quarantined).
C:\WINDOWS\bfmncqv.dll -> Downloader.Lemmy.t : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\~640869.tmp -> Downloader.Wintool.a : Error during cleaning.
C:\WINDOWS\Temp\~703396.tmp -> Downloader.Wintool.a : Error during cleaning.
C:\WINDOWS\Temp\~749846.tmp -> Downloader.Wintool.a : Error during cleaning.
C:\WINDOWS\Temp\~760089.tmp -> Downloader.Wintool.a : Error during cleaning.
C:\WINDOWS\Temp\~793149.tmp -> Downloader.Wintool.a : Error during cleaning.
C:\Documents and Settings\Jeff\Cookies\jeff@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Cookies\jeff@clickbank[2].txt -> TrackingCookie.Clickbank : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Cookies\jeff@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Jeff\Cookies\jeff@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\WINDOWS\msbbi.exe -> Trojan.Imiserv.c : Cleaned with backup (quarantined).


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 2:00:38 PM, on 8/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\Program Files\Software by Design\TrayTool.exe
C:\Program Files\YCIII\YankClip.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\system32\devldr32.exe
C:\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Startup: Tray Tools 2000.lnk = C:\Program Files\Software by Design\TrayTool.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Program Files\YCIII\YankClip.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SmartUI.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search for using AltaVista - C:\Program Files\Search Bar\SBIEAddon\AltaVista.html
O8 - Extra context menu item: Search for using Excite - C:\Program Files\Search Bar\SBIEAddon\Excite.html
O8 - Extra context menu item: Search for using Google - C:\Program Files\Search Bar\SBIEAddon\Google.html
O8 - Extra context menu item: Search for using HotBot - C:\Program Files\Search Bar\SBIEAddon\HotBot.html
O8 - Extra context menu item: Search for using Lycos - C:\Program Files\Search Bar\SBIEAddon\Lycos.html
O8 - Extra context menu item: Search for using Yahoo - C:\Program Files\Search Bar\SBIEAddon\Yahoo.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1….g/GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154292067033
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
Post #4
1. Download this file - combofix.exe http://download.bleepingcomputer.com/sUBs/combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Open HijackThis, click Config, click Misc Tools
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.



In your next post, please include
new hijackthis log
combofix log
uninstall list
Post #5
here is combofix
uninstall list
hijack this results

Start Time= Wed 08/16/2006 15:39:43.14
Running from: C:\Documents and Settings\[removed]\Desktop

QuickScan did not find any signs of infected files

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-08-16 12:03:56 ( .D… ) "C:\Program Files\ewido anti-spyware 4.0"
2006-08-15 18:56:22 ( .D… ) "C:\Program Files\Spybot - Search & Destroy"
2006-08-15 17:17:12 ( .D… ) "C:\Program Files\Safer Networking"
2006-08-15 11:28:28 127075 ( A…. ) "C:\WINDOWS\system32\javaws.exe"
2006-08-15 11:28:28 49247 ( A…. ) "C:\WINDOWS\system32\javaw.exe"
2006-08-15 11:28:28 49245 ( A…. ) "C:\WINDOWS\system32\java.exe"
2006-08-15 11:28:12 ( .D… ) "C:\Program Files\Common Files\Java"
2006-08-09 12:29:16 2 ( A…. ) "C:\WINDOWS\system32\wnsapisu.exe"
2006-08-09 12:29:04 ( .D… ) "C:\Program Files\Common Files\?racle"
2006-07-31 12:03:06 ( .D… ) "C:\Program Files\Windows Defender"
2006-07-30 20:34:00 ( .D… ) "C:\Program Files\messenger"
2006-07-30 20:23:50 47564 ( A.SHR ) "C:\NTDETECT.COM"
2006-07-30 15:41:18 ( .D… ) "C:\Program Files\OfficeUpdate11"
2006-07-30 14:40:32 ( .D… ) "C:\Documents and Settings\Jeff\Application Data\AVG7"
2006-07-30 14:40:06 499712 ( A…. ) "C:\WINDOWS\system32\msvcp71.dll"
2006-07-30 14:39:48 ( .D… ) "C:\Program Files\Grisoft"
2006-07-27 06:24:46 679424 ( A…. ) "C:\WINDOWS\system32\inetcomm.dll"
2006-07-26 15:06:24 ( .D… ) "C:\Program Files\Common Files\ç?sks"
2006-07-21 09:47:10 ( .D… ) "C:\Documents and Settings\Jeff\Application Data\?ymantec"
2006-07-21 01:24:44 72704 ( A…. ) "C:\WINDOWS\system32\hlink.dll"
2006-07-14 08:31:40 332288 ( A…. ) "C:\WINDOWS\system32\netapi32.dll"
2006-07-13 06:33:28 8453632 ( A…. ) "C:\WINDOWS\system32\shell32.dll"
2006-07-06 08:07:12 ( .D… ) "C:\Documents and Settings\Jeff\Application Data\?racle"
2006-07-06 08:06:14 ( .D… ) "C:\Program Files\??crosoft"
2006-07-05 03:55:02 984064 ( A…. ) "C:\WINDOWS\system32\kernel32.dll"
2006-06-26 10:37:10 148480 ( A…. ) "C:\WINDOWS\system32\dnsapi.dll"
2006-06-26 10:37:10 8192 ( A…. ) "C:\WINDOWS\system32\rasadhlp.dll"
2006-06-20 10:41:24 ( .D… ) "C:\Program Files\W?nSxS"
2006-06-19 16:20:42 702768 ( ….. ) "C:\WINDOWS\system32\WgaLogon.dll"
2006-05-19 05:59:42 111616 ( A…. ) "C:\WINDOWS\system32\dhcpcsvc.dll"
2006-05-19 05:59:42 94720 ( A…. ) "C:\WINDOWS\system32\iphlpapi.dll"


(((((((((((((((((((((((((((((((((((((( Files Created - Last 30days )))))))))))))))))))))))))))))))))))))))))))


2006-08-15 17:09 78,488 C:\WINDOWS\system32\XMD5.dll
2006-08-15 11:28 49,247 C:\WINDOWS\system32\javaw.exe
2006-08-15 11:28 49,245 C:\WINDOWS\system32\java.exe
2006-08-15 11:28 127,075 C:\WINDOWS\system32\javaws.exe
2006-07-31 11:29 127,208 C:\WINDOWS\system32\mucltui.dll
2006-07-30 18:48 11,776 C:\WINDOWS\system32\spnpinst.exe
2006-07-30 16:33 332,288 C:\WINDOWS\system32\netapi32.dll
2006-07-30 15:08 1,082,368 C:\WINDOWS\system32\esent.dll
2006-07-30 14:40 499,712 C:\WINDOWS\system32\msvcp71.dll
2006-07-30 14:07 22,752 C:\WINDOWS\system32\spupdsvc.exe
2006-07-30 14:01 8,192 C:\WINDOWS\system32\bitsprx2.dll
2006-07-30 14:01 7,168 C:\WINDOWS\system32\bitsprx3.dll
2006-07-30 14:01 351,232 C:\WINDOWS\system32\winhttp.dll
2006-07-30 14:01 18,944 C:\WINDOWS\system32\qmgrprxy.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"iIWiper"="C:\\Program Files\\iISystem Wiper\\SystemWiper.exe m"
"EM_EXEC"="C:\\PROGRA~1\\Logitech\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"
"ClickZap"=""
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0\\bin\\jusched.exe"
"spywarebot"="C:\\Program Files\\SpywareBot\\SpywareBot.exe -boot"
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="http://www.ca-realty.com/Banners/about_barry.gif"
"SubscribedURL"="http://www.ca-realty.com/Banners/about_barry.gif"
"FriendlyName"=""
"Flags"=dword:00002001
"Position"=hex:2c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,e8,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,a6,01,09,48,e9,77,88,32,e8,77,ff,ff,ff,ff,de,60,\
e7,77,d0,e0,7d,01

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,58,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,58,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,58,02,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdRoarUpdate]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ARUpdate"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDetect.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SDetect"
"hkey"="HKLM"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysUpd]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sysupd"
"hkey"="HKCU"
"inimapping"="0"

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system
DisableRegistryTools REG_DWORD 0 (0x0)

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WinDefend


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: Wed 08/16/2006 15:40:04.29
ComboFix ver 06.07.15/30 - This logfile is located at C:\ComboFix.txt

3D Groove Playback Engine
Ad-Aware SE Professional
Adobe Acrobat 4.0, 5.0
Adobe Flash Player 9 ActiveX
AudioHQ
AVG Free Edition
Brother MFL Pro Suite
CorelDRAW 10
CorelDRAW 10
Creative Surround Mixer
CyberCalc v2.1 by CyberMetrics
Edmark Algebra Calculator
ewido anti-spyware 4.0
FUJIFILM USB Driver
Google Toolbar for Internet Explorer
HijackThis 1.99.1
iISystem Wiper 2.1
iolo technologies' System Mechanic
J2SE Runtime Environment 5.0
Karen's WhoIs
LiveReg (Symantec Corporation)
Logitech MouseWare 9.42 .1
Logitech User's Guide
Microsoft Office XP Professional
Microsoft Publisher 2002
Nero - Burning Rom (Web installer)
Norton Utilities 2002 for Windows
Paint Shop Pro 7 ESD
Panicware Pop-Up Stopper Pro
PaperPort 8.0 SE
Powertoys For Windows XP
RealOne Player
RunAlyzer
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Sims Plus! SimsZip
SnagIt 5
Sony USB Driver
SpeedStream 2604 DSL/Cable Router
Spy Sweeper
Spybot - Search & Destroy 1.4
StudyWorks 2002
The Sims Art Studio
The Sims Makin' Magic
Trogladite Software SendTo 1.6
Tweak-XP
Ulead Photo Express 4.0 My Custom Edition
Ulead VideoStudio version 4.0 SE Basic
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Viewpoint Media Player
Windows Defender
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinDriversBackup
WINForms 2000
WinRAR archiver
WinZip
Yankee Clipper III

Logfile of HijackThis v1.99.1
Scan saved at 3:46:02 PM, on 8/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\Program Files\Software by Design\TrayTool.exe
C:\Program Files\YCIII\YankClip.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\system32\devldr32.exe
C:\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Startup: Tray Tools 2000.lnk = C:\Program Files\Software by Design\TrayTool.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Program Files\YCIII\YankClip.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SmartUI.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search for using AltaVista - C:\Program Files\Search Bar\SBIEAddon\AltaVista.html
O8 - Extra context menu item: Search for using Excite - C:\Program Files\Search Bar\SBIEAddon\Excite.html
O8 - Extra context menu item: Search for using Google - C:\Program Files\Search Bar\SBIEAddon\Google.html
O8 - Extra context menu item: Search for using HotBot - C:\Program Files\Search Bar\SBIEAddon\HotBot.html
O8 - Extra context menu item: Search for using Lycos - C:\Program Files\Search Bar\SBIEAddon\Lycos.html
O8 - Extra context menu item: Search for using Yahoo - C:\Program Files\Search Bar\SBIEAddon\Yahoo.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1….g/GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154292067033
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
Post #6
Not much there.

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post as well as a bew hijackthis log please.
Post #7
here is the kapersky report:

Wednesday, August 16, 2006 10:04:02 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 17/08/2006
Kaspersky Anti-Virus database records: 215678


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 108617
Number of viruses found 18
Number of infected objects 61 / 0
Number of suspicious objects 4
Duration of the scan process 02:01:21

Infected Object Name Virus Name Last Action
C:\all_icons.exe/data0002/data0002/data0001 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe/data0002/data0002 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe/data0002 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe/data0004/data0002/data0001 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe/data0004/data0002 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe/data0004 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\all_icons.exe NSIS: infected - 6 skipped

C:\AVG7QT.DAT Infected: Trojan.Win32.Qhost.ha skipped

C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\53a13e864a141b63131ad345b72e810b_0f9bd5b8-421d-4992-b719-8b653e13615d Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\WDLog-07312006-120314.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SpywareBOT2.zip/Progress.exe Suspicious: Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SpywareBOT2.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0000728.exe.bac_a02012 Infected: not-a-virus:AdWare.Win32.PurityScan.er skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0000729.dll.bac_a02012 Infected: not-a-virus:AdWare.Win32.PurityScan.en skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0001085.exe.bac_a00272/data0001 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0001085.exe.bac_a00272 NSIS: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0001085.exe.bac_a00272 CryptFF.b: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0001086.exe.bac_a00272 Infected: Trojan.Win32.VB.sx skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\A0001087.exe.bac_a00272 Infected: not-a-virus:AdWare.Win32.IEDriver.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\cfgmgr32.exe.bac_a02012 Infected: not-a-virus:AdWare.Win32.IEDriver.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\DictComp3s.exe.bac_a02012 Infected: Trojan.Win32.VB.sx skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\dnyyzil.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\movies.exe.bac_a02012/data0001 Infected: Trojan-Clicker.Win32.Instas.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\movies.exe.bac_a02012 NSIS: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\movies.exe.bac_a02012 CryptFF.b: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\temp.frC814.bac_a02012 Infected: not-a-virus:AdWare.Win32.Midadle.c skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\update_1.exe.bac_a02012/data0002 Infected: not-a-virus:AdWare.Win32.WinFetcher.e skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\update_1.exe.bac_a02012 NSIS: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\update_1.exe.bac_a02012 CryptFF.b: infected - 1 skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~311789.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~497430.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~522551.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~535460.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~640869.tmp.bac_a00272 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~640869.tmp.bac_a01008 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~640869.tmp.bac_a02012 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~703396.tmp.bac_a00272 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~703396.tmp.bac_a01008 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~703396.tmp.bac_a02012 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~727036.tmp.bac_a02012 Infected: not-a-virus:AdWare.Win32.Wintol.l skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~749846.tmp.bac_a00272 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~749846.tmp.bac_a01008 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~749846.tmp.bac_a02012 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~760089.tmp.bac_a00272 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~760089.tmp.bac_a01008 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~760089.tmp.bac_a02012 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~793149.tmp.bac_a00272 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~793149.tmp.bac_a01008 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\.housecall\Quarantine\~793149.tmp.bac_a02012 Infected: Trojan-Downloader.Win32.Wintool.a skipped

C:\Documents and Settings\Jeff\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst/Personal Folders/Deleted Items/06 Dec 2002 08:25 from yurgen_plaq:Japanese girl VS playboy.rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Mail MS Mail: suspicious - 1 skipped

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{27C4EEEF-7164-4814-A8EF-5536270348DD} Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\History\History.IE5\MSHist012006081620060817\index.dat Object is locked skipped

C:\Documents and Settings\Jeff\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Jeff\ntuser.dat Object is locked skipped

C:\Documents and Settings\Jeff\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Downloads\ariskkey.exe/data0002 Infected: not-a-virus:PSWTool.Win32.Aster.55 skipped

C:\Downloads\ariskkey.exe/data0003 Infected: not-a-virus:PSWTool.Win32.Aster.55 skipped

C:\Downloads\ariskkey.exe NSIS: infected - 2 skipped

C:\Downloads\BSINSTALL.exe/WISE0038.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.bx skipped

C:\Downloads\BSINSTALL.exe WiseSFX: infected - 1 skipped

C:\Downloads\BSINSTALL.exe WiseSFX Dropper: infected - 1 skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP44\A0001272.dll Infected: Trojan-Downloader.Win32.Lemmy.t skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP44\A0001273.exe.tcf/msbb.exe Infected: not-a-virus:AdWare.Win32.180Solutions skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP44\A0001273.exe.tcf CAB: infected - 1 skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP44\A0001273.exe.tcf MimarSinan: infected - 1 skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP44\A0001273.exe.tcf UPX: infected - 1 skipped

C:\System Volume Information\_restore{03DC267E-E749-4D24-805B-D67F13951BFF}\RP50\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{13911FCC-47D0-4009-8F10-4543E2EC1105}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\ajj.exe Infected: not-a-virus:AdWare.Win32.Aureate.d skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\sam Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\security Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\etc\hosts Infected: Trojan.Win32.Qhost.ha skipped

C:\WINDOWS\system32\drivers\etc\hosts.bak Infected: Trojan.Win32.Qhost.ha skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\woinstall.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.EZula.ak skipped

C:\WINDOWS\woinstall.exe WiseSFX: infected - 1 skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 11:46:16 AM, on 8/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Fast.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Software by Design\TrayTool.exe
C:\Program Files\YCIII\YankClip.exe
C:\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - Startup: Tray Tools 2000.lnk = C:\Program Files\Software by Design\TrayTool.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Program Files\YCIII\YankClip.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SmartUI.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search for using AltaVista - C:\Program Files\Search Bar\SBIEAddon\AltaVista.html
O8 - Extra context menu item: Search for using Excite - C:\Program Files\Search Bar\SBIEAddon\Excite.html
O8 - Extra context menu item: Search for using Google - C:\Program Files\Search Bar\SBIEAddon\Google.html
O8 - Extra context menu item: Search for using HotBot - C:\Program Files\Search Bar\SBIEAddon\HotBot.html
O8 - Extra context menu item: Search for using Lycos - C:\Program Files\Search Bar\SBIEAddon\Lycos.html
O8 - Extra context menu item: Search for using Yahoo - C:\Program Files\Search Bar\SBIEAddon\Yahoo.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1….g/GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154292067033
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
Post #8
Click here to run ActiveScan.
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Paste the contents of the Panda scan report along with a new HijackThis Log in your next reply.
Post #9
it is very confusing how one program tells you you are clean and then another tells you have viruses. thank you again for all your time and effort

results from panda


Incident Status Location

Adware:adware/swimsuitnetwork Not disinfected c:\windows\system32\MYDLL.dll
Adware:adware/sidesearch Not disinfected c:\windows\sepsd.bin
Adware:adware/ezula Not disinfected c:\windows\woinstall.exe
Adware:Adware/Clicker Not disinfected C:\all_icons.exe
Adware:Adware/PurityScan Not disinfected C:\Program Files\??crosoft\spoolsv.exe
Possible Virus. Not disinfected C:\RECYCLER\S-1-5-21-1292428093-436374069-1957994488-1003\Dc4.exe
Adware:Adware/KeenValue Not disinfected C:\WINDOWS\Downloaded Program Files\imloader.exe

hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 3:17:51 PM, on 8/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Fast.exe
C:\Program Files\iISystem Wiper\SystemWiper.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\Program Files\Software by Design\TrayTool.exe
C:\Program Files\YCIII\YankClip.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hijack this\HijackThis.exe
C:\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iIWiper] C:\Program Files\iISystem Wiper\SystemWiper.exe m
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - Startup: Tray Tools 2000.lnk = C:\Program Files\Software by Design\TrayTool.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Program Files\YCIII\YankClip.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SmartUI.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Search for using AltaVista - C:\Program Files\Search Bar\SBIEAddon\AltaVista.html
O8 - Extra context menu item: Search for using Excite - C:\Program Files\Search Bar\SBIEAddon\Excite.html
O8 - Extra context menu item: Search for using Google - C:\Program Files\Search Bar\SBIEAddon\Google.html
O8 - Extra context menu item: Search for using HotBot - C:\Program Files\Search Bar\SBIEAddon\HotBot.html
O8 - Extra context menu item: Search for using Lycos - C:\Program Files\Search Bar\SBIEAddon\Lycos.html
O8 - Extra context menu item: Search for using Yahoo - C:\Program Files\Search Bar\SBIEAddon\Yahoo.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/big/1.1….g/GoogleNav.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1154292067033
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2003012…all/xscan53.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI