mypcsearch virus

xl_power Topic Starter

Post #1September 18, 2006, 5:27 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 11:44:12 AM, on 9/18/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PROMon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\System32\VTTimer.exe
C:\WINDOWS\System32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\SYSTEM~1\soap.exe
C:\WINDOWS\System32\w?wexec.exe
C:\DOCUME~1\Owner\MYDOCU~1\SSTEM3~1\mmc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {F1A3B2AA-5668-0DE4-4107-2BF00BC73BE1} - C:\WINDOWS\System32\edubc.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ;version 1.0 scott v. totman & ann merzi 1/2001
O1 - Hosts: .: (.frowning face.
O1 - Hosts: .: ).smilie face.
O1 - Hosts: .: |.not talking face.
O1 - Hosts: .: >.devilish grin face.
O1 - Hosts: .: d.grinning face.
O1 - Hosts: .: o.surprised face.
O1 - Hosts: .: p.tongue out face.
O1 - Hosts: .:(.frowning face.
O1 - Hosts: .:-(.frowning face.
O1 - Hosts: .:'(.sad face.
O1 - Hosts: .:).smilie face.
O1 - Hosts: .:-).smilie face.
O1 - Hosts: .:*).kiss face.
O1 - Hosts: .:|.not talking face.
O1 - Hosts: .:-|.not talking face.
O1 - Hosts: .:>.devilish grin face.
O1 - Hosts: .:->.devilish grin face.
O1 - Hosts: .

.grinning face.
O1 - Hosts: .:-d.grinning face.
O1 - Hosts: .

.surprised face.
O1 - Hosts: .:-o.surprised face.
O1 - Hosts: .

.tongue out face.
O1 - Hosts: .:-p.tongue out face.
O1 - Hosts: .; ).winking face.
O1 - Hosts: .; >.winking devilish grin face.
O1 - Hosts: .;).winking face.
O1 - Hosts: .;-).winking face.
O1 - Hosts: .;>.winking devilish grin face.
O1 - Hosts: .;->.winking devilish grin face.
O1 - Hosts: .;-p.winking tongue out face.
O1 - Hosts: .| ).trekkie smilie face.
O1 - Hosts: .|).trekkie smilie face.
O1 - Hosts: .|-).trekkie smilie face.
O1 - Hosts: .0:).angel face.
O1 - Hosts: .8 ).glasses smilie face.
O1 - Hosts: .8).glasses smilie face.
O1 - Hosts: .8-).glasses smilie face.
O1 - Hosts: .b ).shades smilie face.
O1 - Hosts: .

.shades smilie face.
O1 - Hosts: .b-).shades smilie face.
O2 - BHO: Band Class - {0007522A-2297-43C1-8EB1-C90B0FF20DA5} - C:\WINDOWS\enhtb.dll (file missing)
O2 - BHO: (no name) - {04230B66-8BDB-4A80-AC20-8C7CA8ADE284} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A9CBC42-35CA-4C25-BD15-2523D526B79F} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {1EEA61F9-98F5-472D-B38E-565998A79AF5} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {1FD32BE2-63CD-4125-8892-066417A83482} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {2889E56A-CE18-4974-B2D0-64871F92B888} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {2C73F8CF-B7FE-4816-A09C-4A86C3C6AD8B} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {327AC9B9-0828-4622-9B2F-37FDE8FEE020} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {3AA81664-F9AF-FC59-D29F-840A0403F09B} - C:\WINDOWS\System32\psamg.dll (file missing)
O2 - BHO: (no name) - {3B4F5F9E-61D0-49FA-A475-51A04417AD36} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {3CA362FC-20CB-4230-B57A-9E192A77B907} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {3CA9F7F2-A9BC-405A-81BF-37611FE82D51} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {3DDA0D22-E7B2-46B2-8645-2EADF815A374} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {413D0982-0980-4431-A75E-C90CBE34415E} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {420048DB-ADEC-4200-A911-C6A1B1FA5E3E} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {436AAF75-5863-4671-87B9-24238BE51AAF} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {4A5A9922-0196-4CAE-A95D-A418B4192336} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {4C040AB2-FF49-45A6-93E9-5A7670661CE0} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5BFDB0B8-A7FF-4C45-8D05-3AC902EB2CAD} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {5EDAAC92-17CC-414A-A36E-59BB5683D7FA} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {6027AF96-4FC4-440F-8838-FE51DEF85F96} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {6DF9DD06-DBF4-48AA-BF6D-C3D62EA8DFD4} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {79F06963-E4EC-4A1E-8405-9364EE7515FA} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {7B85A4BA-FA9F-4279-85B2-5C0829BDC64E} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {7D0E4B32-4A17-4E6D-BDBD-A7C63D8DDD44} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {7F8137AE-C954-4D32-BCAD-C1E6ECFBD84D} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {80803998-A098-4520-BD14-D2EA1E1EB12F} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {83218359-5FCF-4BD7-97DB-B65C63DE5CBA} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: (no name) - {8F872CA5-5CB1-450A-8ADB-790AA4852192} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {933A534D-DE16-4C56-84BD-FBC88F78D157} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {95CB3728-9827-4D34-8B62-E868F9D9B247} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {9D905606-CCFF-4F1D-A0FA-0E59F375C516} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {9E14EB8D-D7D9-405B-9F89-FFABA9E33FE4} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {9E65DD90-AA94-4991-A21E-57C7DFB83A79} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {A08517D1-0AB8-4253-B415-C1D77769617B} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {A698C001-F366-4B91-A415-DB82A60A4A55} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {A824A4E9-9F5A-4814-ACB3-A0FDE9C6D157} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {ADC2A36F-5719-4504-BF9D-3246758D65EB} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {B5BA2C21-A0F5-41D6-B9D7-C9B05AEBAC6E} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {B9815FE5-AB94-4AD9-A138-069A404004F3} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {C3D8BFEA-B395-4610-BB1E-A13B503181F6} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {C43B2694-BD53-4CA1-972C-E3CCA1F4B907} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {CB657C5A-4089-4392-A43C-07554FBB4CD1} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\Toolbar.dll (file missing)
O2 - BHO: (no name) - {CF9B2F65-E26F-4BFA-8AFA-A08075D7DA8A} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {D53C33BC-5522-4292-B3F9-0EE7E00CCE0B} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {DB2A7F33-3CE5-49BE-8B3A-2BF8D9D9C2C7} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {DC163C6F-306E-419C-98D7-A7773BD46471} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E0210AD7-7DDA-4D1E-B5CD-573ADF150A25} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E0A43222-49F4-4EFF-A236-FA1FAF6CBBE6} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E554E500-00DE-4A87-889C-344285DF95CA} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E73092BE-FB60-48DE-868E-77548CF2DBB1} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E7CCC412-8993-40CD-97F3-1E3E27C13E2F} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {E9DBA423-6AEE-4F02-A1BF-82DEE407EA44} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {EA903E41-D4E0-47BD-9737-AD92CB51F98C} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {EB6E3B49-D86E-44CD-848B-0C90A81A9D27} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {EC9E1DB9-CE54-47A2-8440-F98311973618} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {EE78BCE2-4F75-4FC4-9414-E8BB3B0A1434} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {F1A3B2AA-5668-0DE4-4107-2BF00BC73BE1} - C:\WINDOWS\System32\edubc.dll
O2 - BHO: (no name) - {F417F6FB-F754-4B60-979A-1981CA463481} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {FCCAF59B-901D-4EA7-B943-DB349C6E6BED} - C:\Program Files\Lycos\IEagent\IEagent.dll
O2 - BHO: (no name) - {FF97E25F-0B44-4C7F-B3B3-ABB583F90517} - C:\Program Files\Lycos\IEagent\IEagent.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [lVSnSU] C:\windows\temp\lVSnSU.exe
O4 - HKLM\..\Run: [2SWZKN82R5K47C] C:\WINDOWS\System32\IpvFme.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB002" /M "Stylus CX4600"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [qsshtxy] C:\WINDOWS\System32\oxpckn.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [3ZJQYJH39DMJ9J] C:\WINDOWS\System32\Pwcm74i.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O4 - Startup: PalNetaware.lnk = C:\Program Files\Paltalk\pnetaware.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri…Transporter.cab?
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158367784186
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

xl_power

Post #2September 19, 2006, 1:58 PM UTC

hjt log after ewido ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 8:34:49 AM 9/19/2006 + Scan result: HKU\S-1-5-21-515967899-920026266-725345543-1003\Software\saap -> Adware.180Solutions : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\__unin__.exe -> Adware.Altnet : Cleaned with backup (quarantined). C:\WINDOWS\system32\bH.dll -> Adware.BargainBuddy : Cleaned with backup (quarantined). C:\Program Files\Lycos\IEagent\CSBIINST.DLL -> Adware.ClearSearch : Cleaned with backup (quarantined). C:\Program Files\Lycos\IEagent\__delete_on_reboot__I_E_a_g_e_n_t_._d_l_l_ -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\143 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\206 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\339 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\348 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\387 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\675 -> Adware.ClearSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\IEagent\757 -> Adware.ClearSearch : Cleaned with backup (quarantined). [2732] C:\Program Files\Lycos\IEagent\IEagent.dll -> Adware.ClearSearch : Error during cleaning. [3000] C:\Program Files\Lycos\IEagent\IEagent.dll -> Adware.ClearSearch : Error during cleaning. HKU\S-1-5-21-515967899-920026266-725345543-1003\Software\Httper -> Adware.Httper : Cleaned with backup (quarantined). HKU\S-1-5-21-515967899-920026266-725345543-1003\Software\Httper\Settings -> Adware.Httper : Cleaned with backup (quarantined). HKLM\SOFTWARE\PerfectNav -> Adware.KeenValue : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\nnclx485.exe -> Adware.NewDotNet : Cleaned with backup (quarantined). C:\WINDOWS\system32\__delete_on_reboot__e_d_u_b_c_._d_l_l_ -> Adware.PurityScan : Cleaned with backup (quarantined). C:\WINDOWS\system32\wоwexec.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\SaveInstCsS.exe/Save.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\SaveInstCsS.exe/SaveUninst.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\SaveInstCsS.exe/Search.exe -> Adware.SaveNow : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\SWRT01.RT -> Adware.SecondThought : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\SWRT01.RT\Clsid -> Adware.SecondThought : Cleaned with backup (quarantined). HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Adware.WebSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\AUI -> Adware.WebSearch : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\btiein.dll -> Downloader.QDown.t : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\~7468877290.tmp -> Downloader.Siboco : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Local Settings\Temp\SaveInstCsS.exe/DnldStub.exe -> Downloader.Small.kl : Cleaned with backup (quarantined). C:\WINDOWS\system32\Mrohf95f.exe -> Downloader.VB.em : Cleaned with backup (quarantined). C:\WINDOWS\03wu26rd.exe -> Dropper.Small.sc : Cleaned with backup (quarantined). C:\WINDOWS\system32\calsdr.exe -> Dropper.Small.sc : Cleaned with backup (quarantined). C:\Documents and Settings\Owner\Cookies\owner@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. ::Report end

LDTate

Post #3September 21, 2006, 10:21 PM UTC

Hello and welcome to the forum.

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment.

Please use the [external image: Posted Image] Button below to reply. Thanks

✨ Ask AI

Ask AI