What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help with my Nephew's Computer

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Well, my nephew called me from school the other night and said he was having some problems with his computer and asked me to look at the system.

As soon as I booted up the computer, I knew we had some problems with a number of suspect VBasic Projects openiing up with errors. Anyway, it looks like Norton Anti-Virus went on vacation and couldn't help. I took a few quick stabs at cleaning it up, but there are some baddies in here that I know I am not capable of resolving. :(

I pulled the computer LAN connection, and am not allowing it onto the Internet until I get it nice and clean!


Here is the HijackThis Log—>

Logfile of HijackThis v1.99.1
Scan saved at 6:36:27 PM, on 11/16/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\AOL\1156018395\ee\AOLSoftware.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\feazhhjA.exe
C:\windows_e53.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\COMMON~1\SCURIT~1\wucrtupd.exe
C:\WINDOWS\system32\?icrosoft\w?wexec.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\System32\sdjdm.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,exqhwnq.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156018395\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [feazhhjA] C:\WINDOWS\feazhhjA.exe
O4 - HKLM\..\Run: [nuve071d] RUNDLL32.EXE w8cd5082.dll,n 006e0717000000038cd5082
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [windows] C:\\windows_e53.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Osat] "C:\PROGRA~1\COMMON~1\SCURIT~1\wucrtupd.exe" -vt yazr
O4 - HKCU\..\Run: [Phkxn] C:\WINDOWS\system32\?icrosoft\w?wexec.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\System32\dmonwv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.adsextend.net
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)
O18 - Filter: text/html - {889A88EA-6A7A-44A8-86B6-A568EB90F243} - C:\WINDOWS\System32\p2jlseh8.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Here is the output from the ComboFix Log –>

ComboFix 06.11.9 - Running from: "C:\Combofix"

((((((((((((((((((((((((((((((((((((((((((((( Qoologic's Log )))))))))))))))))))))))))))))))))))))))))))))))))))


* * * PRE-RUN - Filepaths extracted from the Registry * * * * * * * * * * * * * * * * * * * * * *


O4 - HKCU\…\Run C:\WINDOWS\system32\cssymi.exe
O4 - HKLM\…\Run C:\WINDOWS\System32\cssymi.exe
F2 -REG:system.ini: Shell C:\WINDOWS\System32\sdjdm.exe
F2 -REG:system.ini: UserInit C:\WINDOWS\system32\exqhwnq.exe


* * * PRE-RUN - Filepaths extracted by Memory Dump * * * * * * * * * * * * * * * * * * * * * *


C:\WINDOWS\system32\cssymi.exe
C:\WINDOWS\system32\ibsydqc.dll
C:\WINDOWS\system32\exqhwnq.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ubfas.exe
C:\WINDOWS\boygd.dll
C:\WINDOWS\system32\iqhcx.dat
C:\WINDOWS\system32\sdjdm.exe


* * * POST-RUN - Files in the Quarantine folder * * * * * * * * * * * * * * * * * * * * * * * * *


06-11-09 15:57 127488 ubfas.exe.qoo
06-11-15 21:38 127488 iqhcx.dat.qoo
06-11-09 15:57 127488 cssymi.exe.qoo
06-11-09 15:57 51712 ibsydqc.dll.qoo
06-11-09 15:57 28672 sdjdm.exe.qoo
06-11-09 15:57 23552 exqhwnq.exe.qoo
06-11-11 12:14 53 ncbpep.dat.qoo

DO NOT DELETE ANY FILES FROM THIS DIRECTORY UNLESS INSTRUCTED TO


((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\Dylan Havelka\Application Data\Dxccwrd.dll
C:\Documents and Settings\Dylan Havelka\Application Data\Dxcdmns.dll
C:\Documents and Settings\Dylan Havelka\Application Data\Dxcknwrd.dll
C:\Documents and Settings\Dylan Havelka\Application Data\Dxcuknwrd.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\teller2.chk
C:\dfndrff_e53.exe
C:\deskbar.exe
C:\deskbar_e53.exe
C:\nwnmff_e53.exe
C:\RDFX4.exe
C:\WINDOWS\system32\tpuninstall.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Program Files\batty2
C:\Program Files\Cowabanga
C:\Program Files\Deskbar
C:\Program Files\network monitor
C:\WINDOWS\system32\dmonwv.dll

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Documents and Settings\Dylan Havelka\Application Data\CROSOF~1
C:\QooBox\Purity\Documents and Settings\Dylan Havelka\Application Data\SMANTE~1
C:\QooBox\Purity\Documents and Settings\Dylan Havelka\Application Data\YSTEM~1
C:\QooBox\Purity\Documents and Settings\Dylan Havelka\My Documents\YSTEM3~1
C:\QooBox\Purity\Program Files\Common Files\SCURIT~1
C:\QooBox\Purity\Program Files\Common Files\YMANTE~1
C:\QooBox\Purity\Program Files\Common Files\SCURIT~1\SCURIT~1
C:\QooBox\Purity\Program Files\Common Files\SCURIT~1\wucrtupd.exe
C:\QooBox\Purity\WINDOWS\MANTEC~1
C:\QooBox\Purity\WINDOWS\SEMBLY~1
C:\QooBox\Purity\WINDOWS\system32\ICROSO~1
C:\QooBox\Purity\WINDOWS\system32\ICROSO~1\w?wexec.exe


((((((((((((((((((((((((((((((( Files Created from 2006-10-16 to 2006-11-16 ))))))))))))))))))))))))))))))))))


2006-11-14 20:36 10,344 –a—— C:\WINDOWS\system32\drivers\symlcbrd.sys
2006-11-14 20:30 87,808 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2006-11-14 20:30 107,696 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-11-11 13:11 832,474 —hs—- C:\WINDOWS\system32\rrutv.bak2
2006-11-10 15:26 726,894 —hs—- C:\WINDOWS\system32\rrutv.ini2
2006-11-10 14:48 131,072 –a—— C:\WINDOWS\system32\rkupginstaller.exe
2006-11-09 16:25 45,056 –a—— C:\command.exe
2006-11-09 16:11 696,990 —hs—- C:\WINDOWS\system32\rrutv.bak1
2006-11-09 16:10 692,276 ——— C:\WINDOWS\system32\vturr.dll
2006-11-09 16:01 413,581 –a—— C:\WINDOWS\system32\awvtq.dll
2006-11-09 16:00 434,176 –a—— C:\windows_e53.exe
2006-11-09 15:58 1,284 –a—— C:\WINDOWS\system32\nuve071d.sys
2006-11-09 15:57 471 –a—— C:\WINDOWS\boygd.dll
2006-11-09 15:57 277,376 -r-hs—- C:\WINDOWS\feazhhjA.exe
2006-11-09 15:57 178,306 –a—— C:\WINDOWS\ac3_0008.exe
2006-11-09 15:56 45,056 –a—— C:\WINDOWS\System32nrnqetwbz.exe
2006-11-09 15:56 28,672 –a—— C:\WINDOWS\system32\hlvi6wkjc.exe
2006-11-09 15:56 24,576 –a—— C:\WINDOWS\System32ysjaevwx.exe
2006-11-09 15:56 24,576 –a—— C:\WINDOWS\system32\ysjaevwx.exe
2006-11-09 15:56 217,276 –a—— C:\WINDOWS\srviuzko.exe
2006-11-09 15:56 0 –a—— C:\WINDOWS\System32hlvi6wkjc.exe
2006-11-05 14:06 86,016 –a—— C:\WINDOWS\unvise32qt.exe
2006-11-05 14:04 38,229 ——— C:\WINDOWS\system32\drivers\StMp3Rec.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-16 18:53 ——– d——– C:\Program Files\Common Files
2006-11-15 22:13 ——– d——– C:\Program Files\Common Files\Symantec Shared
2006-11-15 21:07 ——– d——– C:\Program Files\PSCastor
2006-11-15 20:28 ——– d——– C:\Program Files\Online Services
2006-11-15 20:28 ——– d——– C:\Program Files\ComPlus Applications
2006-11-15 18:23 ——– d——– C:\Program Files\Adobe
2006-11-15 18:22 ——– d——– C:\Documents and Settings\Dylan Havelka\Application Data\Leadertech
2006-11-15 07:35 ——– d——– C:\Program Files\Screensavers.com
2006-11-15 07:32 ——– d——– C:\Program Files\Viewpoint
2006-11-15 07:28 ——– d——– C:\Program Files\Common Files\Adobe
2006-11-14 21:00 ——– d—s—- C:\Documents and Settings\Dylan Havelka\Application Data\Microsoft
2006-11-14 20:54 ——– d——– C:\Documents and Settings\Dylan Havelka\Application Data\Symantec
2006-11-14 20:43 ——– d——– C:\Program Files\Norton Internet Security
2006-11-14 20:39 ——– d——– C:\Program Files\Symantec
2006-11-09 16:12 ——– d——– C:\Documents and Settings\Dylan Havelka\Application Data\SearchToolbarCorp
2006-11-09 16:11 ——– d——– C:\Program Files\VSAdd-in
2006-11-09 15:56 ——– d——– C:\Program Files\MSN Gaming Zone
2006-11-09 01:01 2 –a—— C:\WINDOWS\system32\wapiit.exe
2006-11-05 14:07 ——– d——– C:\Program Files\QuickTime
2006-11-05 14:07 ——– d——– C:\Program Files\InstallShield Installation Information
2006-11-05 14:07 ——– d——– C:\Documents and Settings\Dylan Havelka\Application Data\Apple Computer
2006-11-05 14:06 ——– d——– C:\Program Files\iTunes
2006-11-05 14:04 ——– d——– C:\Program Files\iPod
2006-11-05 14:00 ——– d——– C:\Program Files\Common Files\InstallShield
2006-10-08 16:17 ——– d——– C:\Documents and Settings\Dylan Havelka\Application Data\acccore
2006-10-08 16:16 ——– d——– C:\Program Files\Common Files\Nullsoft
2006-10-08 16:16 ——– d——– C:\Program Files\Common Files\aolshare
2006-10-08 16:16 ——– d——– C:\Program Files\Common Files\AOL
2006-10-08 16:16 ——– d——– C:\Program Files\AOL
2006-10-08 16:16 ——– d——– C:\Program Files\AOD
2006-10-07 10:22 ——– d——– C:\Program Files\AIM
2006-10-07 10:11 6447468 –a—— C:\WINDOWS\Celebrit.scr
2006-10-07 09:56 45056 –a—— C:\WINDOWS\system32\sstunst2.exe
2006-09-15 16:16 53248 –a—— C:\WINDOWS\uni_e6h.exe
2006-09-09 12:15 310482 –a—— C:\WINDOWS\run2.exe
2006-08-20 20:22 18432 –a—— C:\WINDOWS\ss3unstl.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe"
"Osat"="\"C:\\PROGRA~1\\COMMON~1\\SCURIT~1\\wucrtupd.exe\" -vt yazr"
"Phkxn"="C:\\WINDOWS\\system32\\?icrosoft\\w?wexec.exe"
"Aim6"="\"C:\\Program Files\\Common Files\\AOL\\Launch\\AOLLaunch.exe\" /d locale=en-US ee://aol/imApp"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"C-Media Mixer"="Mixer.exe /startup"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1156018395\\ee\\AOLSoftware.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_03\\bin\\jusched.exe"
"IPHSend"="C:\\Program Files\\Common Files\\AOL\\IPHSend\\IPHSend.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"feazhhjA"="C:\\WINDOWS\\feazhhjA.exe"
"nuve071d"="RUNDLL32.EXE w8cd5082.dll,n 006e0717000000038cd5082"
"windows"="C:\\\\windows_e53.exe"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SSC_UserPrompt"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\UsrPrmpt.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="http://rds.yahoo.com/_ylt=A9gnMin8jedE4NAAWUmjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=12dom8mmb/EXP=1156112252/**http%3a//www.soccer-desktop.com/store/p1-wp-pl-Cisse-v2.jpg"
"SubscribedURL"="http://rds.yahoo.com/_ylt=A9gnMin8jedE4NAAWUmjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=12dom8mmb/EXP=1156112252/**http%3a//www.soccer-desktop.com/store/p1-wp-pl-Cisse-v2.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,6a,02,00,00,e1,00,00,00,90,01,00,00,2c,01,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,c4,00,00,00,a4,00,00,00,90,01,00,00,2c,01,\
00,00,01,00,00,40

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"=""
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
"Source"=""
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ec,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
"Source"="http://mud.mm-a7.yimg.com/image/2425012218"
"SubscribedURL"="http://mud.mm-a7.yimg.com/image/2425012218"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,da,00,00,00,23,00,00,00,87,00,00,00,6b,00,00,00,ee,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,da,00,00,00,23,00,00,00,87,00,00,00,6b,00,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,56,05,86,bb,e9,77,b0,8d,e8,77,ff,ff,ff,ff,83,9a,\
e7,77,50,21,23,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\4]
"Source"="http://rds.yahoo.com/_ylt=A9gnMiAZj.dEmRsAygyjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=138pvrmnj/EXP=1156112537/**http%3a//www2.ac-lyon.fr/etab/ecoles/ec-01/romans-ferrari/moustapha/images/drogba1.jpg"
"SubscribedURL"="http://rds.yahoo.com/_ylt=A9gnMiAZj.dEmRsAygyjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=138pvrmnj/EXP=1156112537/**http%3a//www2.ac-lyon.fr/etab/ecoles/ec-01/romans-ferrari/moustapha/images/drogba1.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,22,01,00,00,e0,00,00,00,90,01,00,00,2c,01,00,00,f0,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,a2,01,00,00,e1,00,00,00,90,01,00,00,2c,01,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,47,05,86,bb,e9,77,b0,8d,e8,77,ff,ff,ff,ff,83,9a,\
e7,77,c8,26,bc,02

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\5]
"Source"="http://rds.yahoo.com/_ylt=A9gnMiYdkOdEMBoA.FyjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=123s2po0v/EXP=1156112797/**http%3a//img17.exs.cx/img17/9194/ThierryHenry.png"
"SubscribedURL"="http://rds.yahoo.com/_ylt=A9gnMiYdkOdEMBoA.FyjzbkF;_ylu=X3oDMTA4NDgyNWN0BHNlYwNwcm9m/SIG=123s2po0v/EXP=1156112797/**http%3a//img17.exs.cx/img17/9194/ThierryHenry.png"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,1a,ff,ff,ff,39,00,00,00,00,04,00,00,00,03,00,00,f2,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,da,00,00,00,e1,00,00,00,00,04,00,00,00,03,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,10,05,86,bb,e9,77,b0,8d,e8,77,ff,ff,ff,ff,83,9a,\
e7,77,60,1f,b7,02

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\6]
"Source"="http://backgroundsarchive.com/images/pub/16/16026r35lv4atmw.jpg"
"SubscribedURL"="http://backgroundsarchive.com/images/pub/16/16026r35lv4atmw.jpg"
"FriendlyName"=""
"Flags"=dword:00000001
"Position"=hex:2c,00,00,00,b4,ff,ff,ff,3a,00,00,00,20,03,00,00,58,02,00,00,f4,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,58,02,00,00,35,00,00,00,20,03,00,00,58,02,\
00,00,01,00,00,40
"RestoredStateInfo"=hex:dc,ff,4e,07,86,bb,e9,77,b0,8d,e8,77,ff,ff,ff,ff,83,9a,\
e7,77,18,59,d9,02

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\7]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,00,00,f6,\
03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturr

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Dylan Havelka.job

Completion time: 06-11-16 18:55:50.07
C:\ComboFix.txt … 06-11-16 18:55

Thanks in advance,

Svenman
Post #2
hi svenman,


first boot computer into safe mode, you reach safe mode by tapping the f8 key during a computer restart.
chose the first option safe mode. once in safe mode we will use hjt, might want to copy/paste the rest of this into notepad and save it so you can read it in safe mode:

scan with HJT, put a checkmark beside the items below, close all windows and click fix checked
(iam going by the older hjt log, if you dont see some of these dont worry about it)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\System32\sdjdm.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,exqhwnq.exe

O4 - HKLM\..\Run: [feazhhjA] C:\WINDOWS\feazhhjA.exe
O4 - HKLM\..\Run: [nuve071d] RUNDLL32.EXE w8cd5082.dll,n 006e0717000000038cd5082
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [windows] C:\\windows_e53.exe
O4 - HKCU\..\Run: [Osat] "C:\PROGRA~1\COMMON~1\SCURIT~1\wucrtupd.exe" -vt yazr
O4 - HKCU\..\Run: [Phkxn] C:\WINDOWS\system32\?icrosoft\w?wexec.exe
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.adsextend.net
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)

O18 - Filter: text/html - {889A88EA-6A7A-44A8-86B6-A568EB90F243} - C:\WINDOWS\System32\p2jlseh8.dll

still in safe mode do this:
Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

click start->settings->control panel->internet options->programs tab->RESET WEB SETTINGS
—————————————————————————
reboot normally, go out and grab either avg antispyware or SuperantiSpyware:

AVG:
http://www.ewido.net/en/download/

superAntiSpyware:
http://www.superantispyware.com/

download, install update then scan with one or the other.
after scanning and a reboot (one of the scanners may request a reboot)please rescan and post a new hjt log.

shelf life
Post #3
Thanks Shelf Life - That has done the trick. I am pretty certain that got everything, but I will upload the HJT Log below for your review. :thumbup:

One additional question - I have Norton AntiVirus 2006 installed on this system. It definitely slows down the computer. I'd like to go with an alternative solution that isn't such a resource hog. I'm not opposed to purchasing the Super AntiSpyware software as well as another anti-Virus application. Can you recommend software that might perform better?

Thanks for all of your help, and have a terrific Thanksgiving,

Svenman

HJT File Below:

Logfile of HijackThis v1.99.1
Scan saved at 11:39:08 AM, on 11/23/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\AOL\1156018395\ee\aolsoftware.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
O2 - BHO: (no name) - {4146D6C5-6995-4F42-B669-AC58254DE0B3} - (no file)
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {A16AC1F4-BCA7-4401-B5F5-22240F78E776} - (no file)
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156018395\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Phkxn] C:\WINDOWS\system32\?icrosoft\w?wexec.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Post #4
hi svenman,

one more to go. look in add/remove programs panel for this: if found uninstall it.
OIN

if not in list visit this link for the uninstaller:
http://www.purityscan.com/uninstall.html
———————————————————-
run hjt once more and have it remove this line:

O4 - HKCU\..\Run: [Phkxn] C:\WINDOWS\system32\?icrosoft\w?wexec.exe
————————————————————

Can you recommend software that might perform better

these are free for home users. ive only used avg, all are good. try one out for afew days see if you like it and how it performs on your computer. dont like it? uninstall and try another one. they all have paid versions also

Free for home users:
avast! 4 Home Edition Download
AVG free version 7.0
AntiVir Personal Edition
Clam Win

most of these have trial versions also i think you can try out first. all are good, it all comes down to how you like it, easy to use? bogs the computer down? confusing? (uninstall norton first, then reboot before installing another)

http://usa.kaspersky.com/downloads/trial-versions.php
http://www.trendmicro.com/en/home/global/enterprise.htm

superantispyware is great, also avg antispyware, lavasofts ad aware and spybot search and destroy. there are loads that are worthless. check this link for legit and trustworthy ones:

http://www.spywarewarrior.com/rogue_anti-spyware.htm
——————————————————————————-
rescan and post another hjt log.
shelf life

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI