What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Krucial Log

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
ive been getting alot of popups recent…and the desktop is taking 4ver 2 load…not sure wuts goin on…also muh pc starts 2 freeze wen ever i git online

heres muh log…thanks in advance

Logfile of HijackThis v1.99.1
Scan saved at 11:05:05 PM, on 10/13/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ishost.exe
C:\WINDOWS\System32\ismini.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
M:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hi krucialkeyz, welcome to Tom Coyote! :)

I see the C: drive has your Operating System on it, but you have HijackThis on your M: drive. Could you move or re-download HijackThis to the C: drive please. Also, make sure you put HijackThis into its own folder, so backups have a safe place to lay. This step is very important.

I see you have AVG and Zone Alarm for your anti-virus and firewall protection - thats good. But, I also see you have Norton on your computer. Its not a good idea to have more than one AV and Firewall as they can conflict and cause all sorts of problems. Let me know which you would like to keep or remove in your next post.
_____________________________

You should now have HijackThis on your C: drive in its own folder. Please locate it, and rename it from HijackThis to scanner.exe

Next, I would like to see another log from HijackThis (scanner.exe).
  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button. It will open a Notepad file.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
Please post the following:

1) Info regarding AV and Firewall
2) Uninstall list
3) New HijackThis log
Post #3
ok

Norton came wit my pc but 4 some reason it didnt seem to work correctly…i just uninstalled it.

i like avast so far it seems to be doinf the job..i have avg also but im not running it..should i uninstall that one also?



heres the uninstall list

Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Reader 6.0
AIM Pro
ArcSoft ShowBiz 2
avast! Antivirus
AVG Free Edition
CCleaner (remove only)
Cool Edit Pro 2.0
Easy Internet Sign-up
FL Studio 5
HijackThis 1.99.1
HP Deskjet Preloaded Printer Drivers
HP Instant Support
HP Organize
HP Photo & Imaging 3.1
HP Photo and Imaging 2.0 - Photosmart Cameras
HP PSC & OfficeJet 3.0
HP Software Update
HPIZ311
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
InterVideo WinDVD Player
KBD
LiveReg (Symantec Corporation)
LiveUpdate 1.90 (Symantec Corporation)
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft ActiveSync 4.0
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft Office Standard Edition 2003
Microsoft Plus! Digital Media Edition
Microsoft Works 7.0
Multimedia Card Reader
MUSICMATCH® Jukebox
NVIDIA GART Driver
PC Connect for CASSIOPEIA 1.01
PC-Doctor for Windows
Photosmart 140,240,7200,7600,7700,7900 Series
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
Quicken 2004
RealOne Player
RecordNow!
SBC Yahoo! Applications
SBC Yahoo! DSL Home Networking Installer
Security Update for Windows XP (KB913433)
Slyder from Hewlett-Packard Desktops (remove only)
Sonic Update Manager
SpamSubtract
SpywareBlaster v3.5.1
Steinberg Cubase SX v2.01
toolkit
Updates from HP
User Profile Hive Cleanup Service
VSToolbar for Internet Explorer
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB824146
Windows XP Hotfix - KB833407
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB891781
Windows XP Hotfix (SP2) [See Q329115 for more information]
Windows XP Hotfix (SP2) [See q329256 for more information]
Windows XP Hotfix (SP2) [See Q329390 for more information]
Windows XP Hotfix (SP2) [See Q329834 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q328310
Windows XP Hotfix (SP2) Q329112
Windows XP Hotfix (SP2) Q329170
Windows XP Hotfix (SP2) Q329909
Windows XP Hotfix (SP2) Q331953
Windows XP Hotfix (SP2) Q331958
Windows XP Hotfix (SP2) Q810565
Windows XP Hotfix (SP2) Q810577
Windows XP Hotfix (SP2) Q810833
Windows XP Hotfix (SP2) Q811789
Windows XP Hotfix (SP2) Q814033
Windows XP Hotfix (SP2) Q814995
Windows XP Hotfix (SP2) Q815485
Windows XP Hotfix (SP2) Q817287
Windows XP Hotfix (SP2) Q817606
XoftSpy 3.42
Yahoo! Install Manager
Zone Deluxe Games
ZoneAlarm Pro




and heres the new log file

Logfile of HijackThis v1.99.1
Scan saved at 1:37:42 PM, on 10/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ishost.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\WINDOWS\System32\ismini.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
M:\Program Files\Image-Line\FLStudio5\FL.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\System32\msiexec.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [DeleteMe] "C:\WINDOWS\System32\cmd.exe" /c "C:\WINDOWS\Temp\DeleteMe.bat"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #4
Hi again krucialkeyz! :)

I would remove AVG also, and just keep Avast running and ZoneAlarm Pro.

Click Start > Run > type in appwiz.cpl and hit enter. From the list uninstall the following, if present:

AVG Free Edition
LiveReg (Symantec Corporation)
LiveUpdate 1.90 (Symantec Corporation)
VSToolbar for Internet Explorer


You should now have HijackThis on your C: drive in its own folder. Please locate it, and rename it from HijackThis to scanner.exe

You havn't done this. Rename HijackThis and post a new log please. If you need help with this part, let me know.
Post #5
ok sorry about that..heres the new log


Logfile of HijackThis v1.99.1
Scan saved at 8:24:52 PM, on 10/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\System32\krebatvv.dll
O2 - BHO: (no name) - {278B661A-14A8-D8B0-6AF4-03088B866149} - C:\WINDOWS\System32\unaoakg.dll
O2 - BHO: (no name) - {9D1B6E58-8CB4-4026-9AD4-8B243CB16635} - C:\WINDOWS\System32\vtutr.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: vtutr - C:\WINDOWS\System32\vtutr.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O20 - Winlogon Notify: winmqx32 - winmqx32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6
Hi again krucialkeyz! :)

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • A file called vundofix.txt will be created in your C: drive. Please keep it safe as I'll need to see it soon.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
_________________________________

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!
_________________________________

Please post the following:

1) Contents of C:\vundofix.txt
2) Contents of C:\rapport.txt
3) New HijackThis log and Uninstall list
Post #7
ok so here we go buddy :wavey:

this is the vundofix txt


VundoFix V6.2.2

Checking Java version…

Scan started at 8:43:51 PM 10/14/2006

Listing files found while scanning….

C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\kddpttyk.dll
C:\WINDOWS\system32\krebatvv.dll
C:\WINDOWS\system32\mmvjcbtb.dll
C:\WINDOWS\system32\tuvwvvs.dll
C:\WINDOWS\system32\uhvjsul.dll
C:\WINDOWS\system32\unaoakg.dll
C:\WINDOWS\system32\viwgvoul.dll
C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.bak2
C:\WINDOWS\system32\xudkerbb.dll
C:\WINDOWS\system32\uwveivfx.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\WINDOWS\System32\vtutr.dll
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.bak2
C:\WINDOWS\System32\rtutv.ini
C:\WINDOWS\System32\rtutv.bak2

Beginning removal…

Attempting to delete C:\WINDOWS\system32\geebx.dll
C:\WINDOWS\system32\geebx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kddpttyk.dll
C:\WINDOWS\system32\kddpttyk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\krebatvv.dll
C:\WINDOWS\system32\krebatvv.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mmvjcbtb.dll
C:\WINDOWS\system32\mmvjcbtb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvwvvs.dll
C:\WINDOWS\system32\tuvwvvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uhvjsul.dll
C:\WINDOWS\system32\uhvjsul.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\unaoakg.dll
C:\WINDOWS\system32\unaoakg.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\viwgvoul.dll
C:\WINDOWS\system32\viwgvoul.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtutr.dll
C:\WINDOWS\system32\vtutr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rtutv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\rtutv.bak2
C:\WINDOWS\system32\rtutv.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\xudkerbb.dll
C:\WINDOWS\system32\xudkerbb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\uwveivfx.exe
C:\WINDOWS\system32\uwveivfx.exe Has been deleted!

Attempting to delete C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll Could not be deleted.

Attempting to delete C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.2.2

Checking Java version…

Scan started at 9:02:19 PM 10/14/2006

Listing files found while scanning….

C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe

Beginning removal…

Attempting to delete C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\services.dll Has been deleted!

Attempting to delete C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe
C:\Program Files\Common Files\{3044211B-0A28-1033-1125-030416200001}\Update.exe Has been deleted!

Performing Repairs to the registry.
Done!




This is the rapport txt

SmitFraudFix v2.109

Scan done at 21:20:59.25, Sat 10/14/2006
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ismini.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Owner\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Owner\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End



Heres my new log


Logfile of HijackThis v1.99.1
Scan saved at 9:27:59 PM, on 10/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE
C:\WINDOWS\System32\svchost.exe
C:\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\System32\krebatvv.dll (file missing)
O2 - BHO: (no name) - {278B661A-14A8-D8B0-6AF4-03088B866149} - C:\WINDOWS\System32\unaoakg.dll (file missing)
O2 - BHO: (no name) - {BB975054-41B2-4AC4-BF15-8340642932D7} - C:\WINDOWS\System32\vtutr.dll (file missing)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O20 - Winlogon Notify: winmqx32 - winmqx32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8
Hi again krucialkeyz - Good job! :)

You may wish to Print or Save the following instructions, as the internet will not be available once in Safe Mode!

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. Do not use it yet.

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________________________

Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\System32\krebatvv.dll (file missing)
O2 - BHO: (no name) - {278B661A-14A8-D8B0-6AF4-03088B866149} - C:\WINDOWS\System32\unaoakg.dll (file missing)
O2 - BHO: (no name) - {BB975054-41B2-4AC4-BF15-8340642932D7} - C:\WINDOWS\System32\vtutr.dll (file missing)

O20 - Winlogon Notify: winmqx32 - winmqx32.dll (file missing)

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis
______________________________________________

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________________________

Double-click ATF Cleaner.exe to open it.

Under Main select the following: Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Click Exit on the Main menu to close the program.
______________________________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot back into Normal Mode.
______________________________________________

Please post the following:

1) AVG Anti-Spyware log
2) New Uninstall list
3) New HijackThis log

Let me know how things are. :)
Post #9
thank you. these programs have been finding alot of malware, trojans and a virus on my pc…you've also been alot of help…thank you

heres avg anti-spyware log

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 4:32:17 PM 10/15/2006

+ Scan result:



M:\RECYCLER\S-1-5-21-1123561945-1960408961-682003330-1003\Dd39\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Cleaned with backup (quarantined).
M:\WINDOWS\WEB\Wallpaper\APImages\WinterWonderland\ezstub.exe -> Adware.EZula : Cleaned with backup (quarantined).
M:\WINDOWS\lbbho.dll -> Adware.Neon : Cleaned with backup (quarantined).
M:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0000821.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
M:\WINDOWS\NDNuninstall4_85.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001238.dll -> Adware.Virtumionde : Cleaned with backup (quarantined).
C:\VundoFix Backups\tuvwvvs.dll.bad -> Adware.Virtumionde : Cleaned with backup (quarantined).
C:\WINDOWS\system32\actskn45.ocx -> Downloader.IstBar : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP1\A0000008.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP1\A0000053.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP1\A0000060.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP1\A0000238.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP1\A0000253.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP2\A0000334.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP3\A0000369.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP3\A0000386.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP3\A0000399.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP3\A0000408.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000419.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000432.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000442.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000457.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000468.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000477.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000490.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP4\A0000505.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP5\A0000573.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP6\A0000658.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP6\A0000675.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ismini.exe -> Downloader.Zlob.aee : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001237.dll -> Logger.VBStat.e : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001241.dll -> Logger.VBStat.e : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001243.dll -> Logger.VBStat.e : Cleaned with backup (quarantined).
C:\VundoFix Backups\mmvjcbtb.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined).
C:\VundoFix Backups\viwgvoul.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined).
C:\VundoFix Backups\xudkerbb.dll.bad -> Logger.VBStat.e : Cleaned with backup (quarantined).
:mozilla.225:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.45:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.434:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Ad-logics : Cleaned.
:mozilla.155:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.174:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.115:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.172:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.173:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.163:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.164:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.165:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.166:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.167:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.168:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.169:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.126:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Centrport : Cleaned.
:mozilla.202:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.203:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Com : Cleaned.
M:\Documents and Settings\Owner\Cookies\owner@com[2].txt -> TrackingCookie.Com : Cleaned.
:mozilla.34:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.35:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.436:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Euniverseads : Cleaned.
:mozilla.439:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Euniverseads : Cleaned.
:mozilla.19:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.20:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.21:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.22:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.23:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.24:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.25:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.26:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.27:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.38:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.55:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.56:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.230:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Gator : Cleaned.
:mozilla.239:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Goclick : Cleaned.
:mozilla.216:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.217:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.218:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.220:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.221:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.365:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.441:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.442:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.443:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.444:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.125:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.206:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.382:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.383:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.384:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.28:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.29:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Qksrv : Cleaned.
:mozilla.36:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.37:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.162:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Revenue : Cleaned.
:mozilla.373:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.374:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.375:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.376:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.30:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.31:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.32:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.33:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.421:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Specificclick : Cleaned.
M:\Documents and Settings\Owner\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned.
:mozilla.253:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Targetnet : Cleaned.
:mozilla.149:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.150:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.151:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.152:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.153:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.154:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
:mozilla.124:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.72:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.73:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.74:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.75:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.76:M:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\default.c20\cookies.txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001235.dll -> Trojan.BHO.g : Cleaned with backup (quarantined).
C:\VundoFix Backups\kddpttyk.dll.bad -> Trojan.BHO.g : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP7\A0001257.exe -> Trojan.Starter.65 : Cleaned with backup (quarantined).
C:\VundoFix Backups\Update.exe.bad -> Trojan.Starter.65 : Cleaned with backup (quarantined).


::Report end





The New Uninstall list



Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Reader 6.0
AIM Pro
ArcSoft ShowBiz 2
avast! Antivirus
AVG Anti-Spyware 7.5
CCleaner (remove only)
Cool Edit Pro 2.0
Easy Internet Sign-up
FL Studio 5
HijackThis 1.99.1
HP Deskjet Preloaded Printer Drivers
HP Instant Support
HP Organize
HP Photo & Imaging 3.1
HP Photo and Imaging 2.0 - Photosmart Cameras
HP PSC & OfficeJet 3.0
HP Software Update
HPIZ311
Intel® Extreme Graphics Driver
IntelliMover Data Transfer Demo
InterVideo WinDVD Player
KBD
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft ActiveSync 4.0
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft Office Standard Edition 2003
Microsoft Plus! Digital Media Edition
Microsoft Works 7.0
Multimedia Card Reader
MUSICMATCH® Jukebox
NVIDIA GART Driver
PC Connect for CASSIOPEIA 1.01
PC-Doctor for Windows
Photosmart 140,240,7200,7600,7700,7900 Series
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
Quicken 2004
RealOne Player
RecordNow!
SBC Yahoo! Applications
SBC Yahoo! DSL Home Networking Installer
Security Update for Windows XP (KB913433)
Slyder from Hewlett-Packard Desktops (remove only)
Sonic Update Manager
SpamSubtract
SpywareBlaster v3.5.1
Steinberg Cubase SX v2.01
toolkit
Updates from HP
User Profile Hive Cleanup Service
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB824146
Windows XP Hotfix - KB833407
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB891781
Windows XP Hotfix (SP2) [See Q329115 for more information]
Windows XP Hotfix (SP2) [See q329256 for more information]
Windows XP Hotfix (SP2) [See Q329390 for more information]
Windows XP Hotfix (SP2) [See Q329834 for more information]
Windows XP Hotfix (SP2) Q327979
Windows XP Hotfix (SP2) Q328310
Windows XP Hotfix (SP2) Q329112
Windows XP Hotfix (SP2) Q329170
Windows XP Hotfix (SP2) Q329909
Windows XP Hotfix (SP2) Q331953
Windows XP Hotfix (SP2) Q331958
Windows XP Hotfix (SP2) Q810565
Windows XP Hotfix (SP2) Q810577
Windows XP Hotfix (SP2) Q810833
Windows XP Hotfix (SP2) Q811789
Windows XP Hotfix (SP2) Q814033
Windows XP Hotfix (SP2) Q814995
Windows XP Hotfix (SP2) Q815485
Windows XP Hotfix (SP2) Q817287
Windows XP Hotfix (SP2) Q817606
XoftSpy 3.42
Yahoo! Install Manager
Zone Deluxe Games
ZoneAlarm Pro



and finally heres the new hijack log


Logfile of HijackThis v1.99.1
Scan saved at 4:49:46 PM, on 10/15/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YPAGER.EXE
C:\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #10
Hi krucialkeyz! :)

Looks like Norton left a service behind. Its not uncommon for it leave leftovers behind. :angry: Let try this:

To uninstall Norton go to HERE and follow the instructions to use the Online Removal Tool. (This requires you to use Internet Explorer, as an Active X component has to be installed).

If you have problems with the online uninstaller, follow the instructions HERE, downloading the Removal Tool to your computer.

Once that is done, please post a new HijackThis log to make sure the service is gone, and let me know how things are. :)
Post #11
:thumbup:

my pc has loaded alot quicker these past few times that i have restarted it

you are a true life saver

heres the new hijack log



Logfile of HijackThis v1.99.1
Scan saved at 6:07:08 PM, on 10/15/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\hijackthis\scanner.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1158440117062
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #12
Hi krucialkeyz! I'm glad things are better for you, and your log is clean too. :)

You can delete VundoFix and SmitfruadFix as they are not needed anymore.

Here are some measures you can take to stay more secure online:

For XP users.
It's a good idea to Flush your System Restore points after ridding yourself of malware: You can clean this by doing the following:
  • Click Start | Help and Support | Undo changes to your computer with System Restore.
  • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
  • Close the Help and Support Center box.
  • Click Start | Run and type Cleanmgr
  • Select (C: ) then click OK.
  • Click the More Options tab.
  • Click Clean Up in the System Restore Section.
This will remove all previous restore points except the newly created one.

Secure your Internet Explorer by going here and following the instructions there.

Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera.

Remember to keep your Anti-Virus and Firewall programs updated at all times.

Install and keep updated, Spybot Search & Destroy.
Run them both on a regular basis, following the manufacturer's recommendations.

Install and keep updated, SpywareGuard

Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.

Clear your Temp folders.
Go to Start > Control Panel > Internet Options.
Under the General tab click the Delete Files… button; check the Delete all offline content box and press OK. Next, click the Delete Cookies… button and press OK

Go to "Start" -> "Run" and type in the box: "cleanmgr" press OK. Select the drive where your Operating System is installed (Default is C:) and press OK. Let Disk Cleanup scan your system for files to remove (it takes a few minutes!). On the next screen make sure these 3 options are checked
  • Temporary Files
  • Temporary Internet Files
  • Recycle Bin
and then press "OK" to remove:

Go to Start > Find/Search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents from within the following folders:
C:\Windows\temp
C:\temp <– if you have one.
Note: Empty the contents but do not delete the folder(s).

Clear out temp files from the following location. Change "username" to whatever you have on your computer.
C:\Documents and Settings\username\Local Settings\Temp\
In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Empty the Recycle Bin!

If you have any more problems, post back. Otherwise, respond once more so we may archive this thread. :)
Post #13
Ok there are a few temp files that said they cannot be deleted because there in use. :rant2: not sure what they apply to because the only programs I running are zone alarm and avast… i have the windows sp2, i need to install it but havent because i wanted to rid the machine of all the junk 1st, and didnt know if would be safe to do so i installed the spyware guard, havent ran it yet i also installed spybot search and destroy spybot found a few problems…alexa related,asta killer,searchtoolbarcorp and Smitfraud not sure what to do
Post #14 last edited

Ok there are a few temp files that said they cannot be deleted because there in use. :rant2:


not sure what they apply to because the only programs I running are zone alarm and avast…

Try ATF Cleaner again and see if that helps. You can also go into Safe Mode and cleaning the Temp files when they should not be in use.


i have the windows sp2, i need to install it but havent because i wanted to rid the machine of all the junk 1st, and didnt know if would be safe to do so

You can get that now.


i installed the spyware guard, havent ran it yet

Install when you want. It will only take a minute or so.


i also installed spybot search and destroy
spybot found a few problems…alexa related,asta killer,searchtoolbarcorp and Smitfraud

Did Spybot manage to Fix the entries it found?


Answer any questions above, and let me know how things work out.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI