What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Help with my log

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Can anyone please help with my log???

Logfile of HijackThis v1.99.1
Scan saved at 20:26:59, on 1/8/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Documents and Settings\Vicki\My Documents\My Music\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\PACIFI~1\Utils\Poker.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [nokiasetup] rundll32
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\regclean.exe"
O4 - Global Startup: Philips Wireless Notebook Adapter Utility.lnk = C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html…GB_ZBzeb032YYGB
O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: [removed] (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Video Poker - http://download.games.yahoo.com/games/clients/y/vpt0_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/games/clients/y/ot0_x.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {3712452C-CA44-4ED6-1843-3D143171ED3C} - http://69.72.207.216/1/rdgGB1380.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119982422049
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
Post #2 last edited
gikster :D

Welcome to Tom Coyote . Sorry about the delay in responding but we are as most times just overwhelmed with logs.

You may want to print this out as we will be in Safemode with not internet access for most of the fix.

Download the Stand Alone Version of CWShredder to your desktop.
  • Open CWShredder
  • Check for Updates
  • Close out the program. <– Dont run it yet




    Download and install the 30 day trial of AVG Anti-Spyware 7.5 to your desktop.
    • Once you have downloaded AVG Anti-Spyware 7.5, locate the icon on the desktop and double-click it to launch the set up program.
    • Once the setup is complete you will need run AVG and update the definition files.
    • On the main screen select the icon Update then select the Update now link.
    • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
    • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
    • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
    • Under Reports
    • Select Automatically generate report after every scan
    • Un-Select Only if threats were found
    • Close AVG Anti-Spyware 7.5 <– Do not run the scan yet.




    Open HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html…GB_ZBzeb032YYGB" target="_blank">http://bar.mywebsearch.com/menusearch.html…GB_ZBzeb032YYGB
    O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe

    O15 - Trusted Zone: *.05p.com (HKLM)
    O15 - Trusted Zone: *.clickspring.net (HKLM)
    O15 - Trusted Zone: *.mt-download.com (HKLM)
    O15 - Trusted Zone: *.my-internet.info (HKLM)
    O15 - Trusted Zone: *.scoobidoo.com (HKLM)
    O15 - Trusted Zone: *.searchmiracle.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: [removed] (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab" target="_blank">http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab" target="_blank">http://www.errorguard.com/installation/Install.cab
    O16 - DPF: {3712452C-CA44-4ED6-1843-3D143171ED3C} - http://69.72.207.216/1/rdgGB1380.exe" target="_blank">http://69.72.207.216/1/rdgGB1380.exe
    O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB" target="_blank">http://advnt01.com/dialer/internazionale_ver10.CAB




    Boot your computer into Safemode
    • Go to Start> Shut Off your Computer> Restart
    • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
    • This will bring up a menu.
    • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
    • Then press the Enter on your Keyboard
    Tutorial if you need it How to boot into Safemode






    Open CWShredder
  • Double-click on CWShredder.exe.
  • Click Fix and click OK at the prompt.
  • CWShredder will scan and clean your system of CWS files.
  • Click Next and then Exit .
Still in Safemode


IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning process:
  • Launch AVG Anti-Spyware 7.5 by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG Anti-Spyware 7.5
Reboot normally


Download: DelDomains and save it to the desktop.
  • Close all open windows and your browser
  • Right Click DelDomains.inf and select > Install
  • Reboot your computer
Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up




I need to see the AVG Log and a New HJT log.
Post #5
Ok, have done all that you asked. I saved the file onto my desktop but when I came back out of safe mode the file was gone!

Have rebooted a few tmes now but is running very slow.

Have posted new HJT log below.Thanks for the help again.

Logfile of HijackThis v1.99.1
Scan saved at 12:09:25, on 2/11/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\regclean.exe"
O4 - Global Startup: Philips Wireless Notebook Adapter Utility.lnk = C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119982422049
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168289428263
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
Post #6
gikster :D

Welcome back, glad we didn't lose you.

Your HJT log looks fine, I don't see any bad entries on it and all the bad stuff you removed is gone. When you ran AVG, did you check off to save a log file?? You may be able to open AVG and under reports you should see it in there. I need to see what it removed and what it didn't .

DID CWShredder find and remove anything ?? In order to help you I need to know what is taking place, keep in mind that I am on a computer thousands of miles away from you and not sitting down in front of your PC, you are my eyes.

Run this other cleaner.
If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner



Lets clean out your System Restore Program, this is a windows program and is safe to do, this is something you want to do after we clean bad files from your system as they are backed up in this program and when this program gets real full it can effect system performance. I cant emphasize enough how important it is to create a new restore point

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Reboot your System

Turn ON System Restore.
  • Right-click My Computer.
  • ClickProperties.
  • Click the System Restore tab.
  • UN-Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Create a new Restore Point <– Very Important
  • Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
    You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this
System Restore Tutorial <– If you need it



Now defrag your hard drive, if you never have done this it will slow you down.

Go to Start> All Programs> Assessories > System Tools> Disk Defragmenter. This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.


After you have done all the above, run this free online virus scan from Panda, it may pick up entries that are not showing up on your log.

Run Panda's ActiveScan from here and perform a full system scan.
  • Once you are on the Panda site click the "Scan your PC" button
  • A new window will open…click the big "Check Now" button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
  • If you are on a slow connection it will take about 15 minuites for the scanner to load.
  • Click on "Local Disks" to start the scan
  • Once scan is done, click "see report" then "save report"
  • Save the log someplace you can find
  • 12. Reboot
  • Post the Panda scan results in your next reply

After we deem your system clean, you need to open IE and go to Tools> Windows updates and download and install Service Pack 2 and all the Critical Updates , your Operating System is out of date and letting all the bad guys in. .DO NOT INSTALL ANY DRIVER FILES i


So, let me see the AVG log if you can get it , the Panda report and a New HJT log please.
Post #7
Hi, that took a while.

CWshredder did not find anything.
Have found the AVG log and panda. also new hjt log

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 15:21:05 1/26/2007

+ Scan result:



C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc4.exe -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\180solutions -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\salm -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\msbb -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\sais -> Adware.180Solutions : Cleaned with backup (quarantined).
HKLM\SOFTWARE\salm -> Adware.180Solutions : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\983723.exe -> Adware.AdWast : Cleaned with backup (quarantined).
C:\WINDOWS\wast2.exe -> Adware.AdWast : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\ADMCache\adm54.tmp/asm.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\ADMCache\adm54.tmp/asmps.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\altnet\Setup.exe -> Adware.Altnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\altnet\adm25.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\altnet\admdloader.dll -> Adware.Altnet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\altnet\admfdi.dll -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet -> Adware.Altnet : Error during cleaning.
HKLM\SOFTWARE\Altnet\ADM -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\ADM\ADMCache -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\Dashboard -> Adware.Altnet : Error during cleaning.
HKLM\SOFTWARE\Altnet\Dashboard\Settings -> Adware.Altnet : Error during cleaning.
HKLM\SOFTWARE\Altnet\Dashboard\Setup -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\Dashboard\Temp Internet Shares -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\DownloadManager -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\LocalFiles -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Altnet\TopSearch -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM.ADM -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM.ADM.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM.ADM\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM.ADM\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADM4.ADM4\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\Altnet Signing Module.EXE -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\adm.EXE -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\SigningModule.SigningModule -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\SigningModule.SigningModule.1 -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CLSID -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\SigningModule.SigningModule\CurVer -> Adware.Altnet : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AltnetDM -> Adware.Altnet : Cleaned with backup (quarantined).
C:\WINDOWS\banner.dll -> Adware.Banex : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20051122-144120-795.dll -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_03_08.data.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_04_03.data.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_04_24.data.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_05_09.patch -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_05_09.patch.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_06_04.patch -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_06_28.patch -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_07_04.data.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\2005_07_16.data.zip -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\Uninstall.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\ad.dat -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\bin -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\bin\adv.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\bin\adx.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1116348872.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1116840565.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1117967532.enc -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1119382303.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1120126216.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1120281591.enc -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1120309479.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\t1121520583.dec -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Program Files\BullsEye Network\ub.dat -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\bbchk.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\exdl.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\exdl0.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\exdl1.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\exul.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\exul1.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\javexulm.vxd -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mac80ex.idf/C:/Program Files/BullsEye Network/bin/adv.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mac80ex.idf/C:/Program Files/BullsEye Network/bin/adx.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mac80ex.idf/C:/Program Files/BullsEye Network/bin/bargains.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mac80ex.idf/C:/WINDOWS/System32/msbe.dll -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\mqexdlm.srg -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/bbchk.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/exdl.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/exul.exe -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/javexulm.vxd -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/mqexdlm.srg -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADP.UrlCatcher -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADP.UrlCatcher.1 -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ADP.UrlCatcher\CLSID -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BargainBuddy -> Adware.BargainBuddy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\eXactUtil -> Adware.BargainBuddy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\bi155351.exe -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\temp\lc.exe -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\localNRD.dll -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\localNrd.cab/localNRD.dll -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\localNrd.cab/preInsln.exe -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\preInsln.exe -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\localNRD.dll -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\localNrd.cab/localNRD.dll -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\localNrd.cab/preInsln.exe -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\preInsln.exe -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\WINDOWS\localNRD.dll -> Adware.BiSpy : Cleaned with backup (quarantined).
C:\WINDOWS\preInsln.exe -> Adware.BiSpy : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WinAdToolsX.Installer -> Adware.BlazeFind : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\WinAdToolsX.Installer\CLSID -> Adware.BlazeFind : Cleaned with backup (quarantined).
HKLM\SOFTWARE\BTV -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Wast -> Adware.BroadCastPC : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BTB.IEToolbar -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BTB.IEToolbar.1 -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BTB.IEToolbar\CLSID -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BTB.IEToolbar\CurVer -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{0850F1B8-5E28-3200-DD4B-55C41D308220} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{B52E3C41-4C24-A0B0-FF69-942DA3A2191A} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{C7B34876-7D12-9532-1D04-0BB7B63DC8FA} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20051122-144120-770.dll -> Adware.EZula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Adware -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Adware.1 -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Adware\CLSID -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Adware\CurVer -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Hider -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Hider.1 -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Hider\CLSID -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\BHO.Hider\CurVer -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Netstat -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Webext -> Adware.Ezula : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ToolbarBestToolbarsToolbar.BestToolbarsToolbarObject -> Adware.FizzleBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ToolbarBestToolbarsToolbar.BestToolbarsToolbarObject.1 -> Adware.FizzleBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ToolbarBestToolbarsToolbar.BestToolbarsToolbarObject\CLSID -> Adware.FizzleBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\ToolbarBestToolbarsToolbar.BestToolbarsToolbarObject\CurVer -> Adware.FizzleBar : Cleaned with backup (quarantined).
C:\Program Files\Grokster\fsg_4203.exe -> Adware.Gator : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20051122-174252-735.dll -> Adware.HideOne : Cleaned with backup (quarantined).
C:\WINDOWS\system32\bho.dll -> Adware.HideOne : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20051122-174252-498.dll -> Adware.HotSearchBar : Cleaned with backup (quarantined).
C:\WINDOWS\system32\nsw2D.dll -> Adware.HotSearchBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Policies\Avenue Media -> Adware.InternetOptimizer : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL -> Adware.MyWaySpeed : Cleaned with backup (quarantined).
C:\WINDOWS\system32\P2P Networking v125.cpl -> Adware.P2PNet : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\pcs_0009.exe -> Adware.Pacer : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\backup-20040804-194345-470.dll -> Adware.PeerNet : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\powerscan.exe -> Adware.PowerScan : Cleaned with backup (quarantined).
C:\WINDOWS\system32\ojv.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\MEDIATICKETSINSTALLER.MediaTicketsInstallerCtrl.1 -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Program Files\SideFind -> Adware.SideFind : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{68DCCD3E-2073-4915-A5DC-A445A55876AD}\RP82\A0084852.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\backup-20040804-194345-881.dll -> Adware.VB : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\ngsw31.dll -> Adware.VB : Cleaned with backup (quarantined).
C:\WINDOWS\ngsw31.dll -> Adware.VB : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\djtopr1150.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\webrebates.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc3\WebRebates0.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc3\WebRebates1.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc3\disp1150.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\temp\WebRebates_Auto_InstallSilent_Euro.exe -> Adware.WebRebates : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WCPR -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20041112-123435-315.dll -> Adware.WinAD : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc2\WinAdTools.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc2\WinRatchet.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc2\WinWrench.dll -> Adware.WinAD : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\VacPro.internazionale_ver3 -> Dialer.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\VacPro.internazionale_ver3\Clsid -> Dialer.Generic : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netut80ex.vxd/C:/WINDOWS/System32/msexreg.exe -> Dialer.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\localNrd.cab/polall1l.exe -> Downloader.Agent.ae : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\localNrd.cab/polall1l.exe -> Downloader.Agent.ae : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\polmx2.cab/polmx2.exe -> Downloader.Agent.ae : Cleaned with backup (quarantined).
C:\WINDOWS\Coffee Bean.bmp:soznp -> Downloader.Agent.an : Cleaned with backup (quarantined).
C:\WINDOWS\comsetup.log:lprsj -> Downloader.Agent.an : Cleaned with backup (quarantined).
C:\WINDOWS\desktop.ini:dpcyd -> Downloader.Agent.bq : Cleaned with backup (quarantined).
C:\WINDOWS\maxlink.ini:tkwad -> Downloader.Agent.bq : Cleaned with backup (quarantined).
C:\WINDOWS\msoffice.ini:xmsyu -> Downloader.Agent.cd : Cleaned with backup (quarantined).
C:\WINDOWS\system32\fvp.dll -> Downloader.Agent.oc : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\iinstall.exe -> Downloader.IstBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\sidefind.exe -> Downloader.IstBar : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\btv_1001.exe -> Downloader.RVP.e : Cleaned with backup (quarantined).
C:\Program Files\Windows Media Player\wmplayer.exe.tmp -> Downloader.Small.bem : Cleaned with backup (quarantined).
C:\WINDOWS\MatAdown.dll -> Downloader.Small.zk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\MatAdown.dll -> Downloader.Small.zk : Cleaned with backup (quarantined).
C:\Program Files\Internet Explorer\qxglbwxs.exe -> Downloader.Small.zo : Cleaned with backup (quarantined).
C:\WINDOWS\msxmidi.exe -> Downloader.Small.zo : Cleaned with backup (quarantined).
C:\temp\NCasePackage.exe -> Dropper.180Solutions.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\b2search_v17.exe -> Dropper.Agent.abb : Cleaned with backup (quarantined).
C:\WINDOWS\system32\trafficsector_b2search.exe -> Dropper.Agent.abb : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Local Settings\Temp\ICD4.tmp\internazionale_ver10.ocx -> Hijacker.Adpower.n : Cleaned with backup (quarantined).
C:\HJT\backups\backup-20070126-142026-498.dll -> Hijacker.Adpower.n : Cleaned with backup (quarantined).
C:\WINDOWS\system32\trkgif.exe -> Hijacker.VB.ex : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup (quarantined).
C:\WINDOWS\system32\requester.10.exe -> Proxy.Delf.h : Cleaned with backup (quarantined).
C:\Documents and Settings\Vicki\Cookies\vicki@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\new\Cookies\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\new\Cookies\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\Vicki\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Vicki\Cookies\vicki@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned.


::Report end



Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salmau.dat
Adware:adware/exact.bargainbuddy Not disinfected c:\windows\system32\exclean.exe
Adware:adware/wupd Not disinfected c:\windows\system32\ide21201.vxd
Adware:adware/pacimedia Not disinfected c:\windows\system32\PSof1.exe
Adware:adware/bigtrafficnet Not disinfected C:\Documents and Settings\Vicki\Favorites\1111\1111.url
Spyware:spyware/betterinet Not disinfected c:\windows\inf\banner.inf
Adware:adware/fastvideoplayer Not disinfected c:\windows\inf\fvp.inf
Adware:adware/localnrd Not disinfected c:\windows\inf\localNrd.inf
Adware:adware/adroar Not disinfected c:\windows\cpruninst.exe
Potentially unwanted tool:application/altnet Not disinfected c:\windows\smdat32a.sys
Potentially unwanted tool:application/bestoffer Not disinfected c:\windows\smdat32m.sys
Adware:adware program Not disinfected c:\windows\system32\cache32dsrf4535dfs
Potentially unwanted tool:application/myway Not disinfected c:\program files\MyWay
Potentially unwanted tool:application/regclean32 Not disinfected C:\Documents and Settings\Vicki\Application Data\Registry Cleaner
Dialer:dialer.asl Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\moduleusage\C:/WINDOWS/Downloaded Program Files/internazionale_ver10.ocx
Adware:adware/activesearch Not disinfected Windows Registry
Potentially unwanted tool:application/funweb Not disinfected hkey_current_user\software\Fun Web Products
Potentially unwanted tool:application/mywebsearch Not disinfected hkey_current_user\software\MyWebSearch
Spyware:spyware/sysren Not disinfected Windows Registry
Adware:adware/searchaid Not disinfected Windows Registry
Adware:adware/dyfuca Not disinfected Windows Registry
Adware:adware/ist.sidefind Not disinfected Windows Registry
Adware:adware/webext Not disinfected Windows Registry
Adware:adware/purityscan Not disinfected Windows Registry
Adware:adware/ist.istbar Not disinfected Windows Registry
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@apmebf[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@atdmt[2].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@casalemedia[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@mediaplex[1].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@tradedoubler[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Vicki\Cookies\vicki@tribalfusion[1].txt
Adware:Adware/Adblaster Not disinfected C:\Documents and Settings\Vicki\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\backup-20040804-194345-565.dll
Potentially unwanted tool:Application/MyWay Not disinfected C:\Documents and Settings\Vicki\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\backup-20040804-194345-801.dll
Adware:Adware/LocalNRD Not disinfected C:\Documents and Settings\Vicki\Local Settings\Temp\THI6AF7.tmp\localNrd.inf
Adware:Adware/LocalNRD Not disinfected C:\Documents and Settings\Vicki\Local Settings\Temp\THICE.tmp\localNrd.inf
Spyware:Spyware/SurfSideKick Not disinfected C:\Documents and Settings\Vicki\Local Settings\Temp\trafficsector_installerV5a.exe
Virus:Trj/Downloader.QV Disinfected C:\Documents and Settings\Vicki\My Documents\hijackthis\hijack\backups\backup-20041111-205646-328.inf
Potentially unwanted tool:Application/FunWeb Not disinfected C:\HJT\backups\backup-20070126-142023-771.inf
Potentially unwanted tool:Application/MyWay Not disinfected C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE
Adware:Adware/WUpd Not disinfected C:\RECYCLER\S-1-5-21-1021868453-4127011996-160315367-500\Dc2\Info.txt
Adware:Adware/Exact.BargainBuddy Not disinfected C:\WINDOWS\autoheal.exe[angelex.exe]
Hacktool:HackTool/SRunner.B Not disinfected C:\WINDOWS\autoheal.exe[instsrv.exe]
Adware:Adware/Exact.BargainBuddy Not disinfected C:\WINDOWS\autoheal.exe[msexreg.exe]
Adware:Adware/Fastvideoplayer Not disinfected C:\WINDOWS\Downloaded Program Files\fvp.inf
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\eylnt.dll
Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\inf\biini.inf
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\inf\flashtlk.inf
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\nexjn.dll
Adware:Adware/Adblaster Not disinfected C:\WINDOWS\ngpw34.dll
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\ODBCINST.INI:lpgbn
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\system32\bctjy.dll
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\system32\ctfad.dll
Spyware:Spyware/SafeSurf Not disinfected C:\WINDOWS\system32\InstallerV5a.exe
Hacktool:HackTool/SRunner.B Not disinfected C:\WINDOWS\system32\instsrv.exe
Adware:Adware/SearchAid Not disinfected C:\WINDOWS\system32\tkxtb.dll
Logfile of HijackThis v1.99.1
Scan saved at 18:27:25, on 2/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\update\update.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Philips Wireless Notebook Adapter Utility.lnk = C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119982422049
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168289428263
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
Post #8
gikster,

Your log is basically clean, but I am looking at quite a few bad files that Panda has found.


Open Hijackthis
  • Go to Misc Tools> Open Uninstall Manager.
  • Click on Save List.
  • The list will open in Notepad.
  • Copy and Paste the List into this thread
Post #9
Ad-aware 6 Personal Adobe Acrobat 5.0 aspi ATI Control Panel ATI Display Driver AVG 6.0 Anti-Virus - FREE Edition AVG Anti-Spyware 7.5 Bejeweled 2 Deluxe 1.0 BT Broadband Help CCHelp CCleaner (remove only) CCScore Conexant 56K ACLink Modem Conexant AC-Link Audio CR2 Easy CD Creator 5 Basic ESSAdpt ESSANUP ESSBrwr ESSCAM ESSCDBK ESScore ESSgui ESShelp ESSini ESSPCD ESSTUTOR ESSvpaht ESSvpot FinePixViewer Ver.4.0 FUJIFILM USB Driver HijackThis 1.99.1 hp deskjet 5600 HP Memories Disc HP Photo and Imaging 2.0 - Deskjet Series hp print screen utility HP Wireless LAN ImageMixer VCD for FinePix Inactive HP Printer Drivers (Remove only) InterActual Player InterVideo WinDVD iPod for Windows 2006-01-10 iTunes Kodak EasyShare software KSU Macromedia Flash Player 8 Macromedia Shockwave Player MGI PhotoSuite III SE (Remove Only) Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft Excel 2000 SR-1 Microsoft Office 2000 Professional Microsoft Word 2002 Microsoft Works 7.0 MicroStaff WINASPI NT Morpheus 5.3 (remove only) MSN Messenger 7.0 MSXML 4.0 SP2 (KB925672) Notebook Utilities Notifier One-Touch Buttons OTtBP Pacific Poker Panda ActiveScan PaperPort 7.01 PCDLNCH Philips Wireless Notebook Adapter 11a/g QuickTime RAW FILE CONVERTER LE Registrar Lite 2.00 Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB921883) SFR SFR2 Shanghai Great Moments version 2.0 Shockwave Spybot - Search & Destroy 1.3 SpywareBlaster v3.2 Sygate Personal Firewall Synaptics Pointing Device Driver The Sims Deluxe Edition Theme Hospital Total Club Manager 2004 TOTAL CLUB MANAGER 2005 Update for Windows XP (KB898461) Update for Windows XP (KB910437) Viewpoint Media Player Visioneer Scanner Windows Backup Utility Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB890859 Windows XP Service Pack 2 WinMX WinZip WinZip Self-Extractor Worms2 ZoneAlarm Pro
Post #10
You have a file sharing program installed, these things sometimes bring bad things with it. You also have downloaded a some games, these to sometimes bring things with it that where not expected. Its your call but I suggest you uninstall these programs.

Morpheus 5.3 (remove only)
Pacific Poker
Viewpoint Media Player


I am still concerned about what Panda found, lets run this tool and see what it comes up with.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
  • If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    [external image: Posted Image]
    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
Post #11
Ok here goes backup-20040804-194345-801.dll;C:\Documents and Settings\Vicki\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip;Adware.MyWay;Incurable.Moved.; backup-20070126-142023-548.dll;C:\HJT\backups;Adware.SpywareStorm;Incurable.Moved.; MCCWrapper.dll;C:\Program Files\Common Files\Motive;Probably DLOADER.Trojan;Incurable.Moved.; MY2NS.EXE;C:\Program Files\MyWay\myBar\1.bin;Adware.MyWay;Incurable.Moved.; pv.exe;C:\Program Files\PacificPoker;Program.PrcView.3725;Incurable.Moved.; PPWEBCAP.EXE;C:\Program Files\ScanSoft\PaperPort;Probably DLOADER.Trojan;Incurable.Moved.; autoheal.exe;C:\WINDOWS;Adware.BargainBuddy;Incurable.Moved.; instsrv.exe;C:\WINDOWS\system32;Tool.SrvRunner;Incurable.Moved.; dnary.mdb;C:\WINDOWS\system32\ias;Probably SCRIPT.Virus;Incurable.Moved.;
Post #12
Thats good, now run the free online scan from Trendmicro, it will remove any bad files.


Please run Trend Micro House Call
  • Click Scan now. It's free!
  • Read and put a Check next to Yes I accept the terms of use.
  • Click the Launching HouseCall>> button.
  • Under "Browser plug-in" Installing and using Housecall kernel, click the Starting HouseCall>> button.
  • You may receive a prompt to install the ActiveX, click install.
  • If you are taken back to the main page, click Launching HouseCall>> button again.
  • Under Scan complete computer for malware, grayware, and vulnerabilities click the Next>> button.
  • Please be patient while it installs, updates, and scans your system.
  • Once the scan is complete, it will take you to the summary page.
  • Under Cleanup options, choose clean all detected infections automatically.
  • Click the Clean now>> button.
  • If anything was found you may be prompted to run the scan again, you can just close the browser window.
  • When the scan is finished, please restart your computer.

Post this report and a new HJT log and hopefully all will be gone.
Post #13
Here it is, the online scan deleted alot of things, still running very slow

Logfile of HijackThis v1.99.1
Scan saved at 19:57:45, on 2/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\carpserv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Philips Wireless Notebook Adapter Utility.lnk = C:\Program Files\philips\Philips54MbpsWirelessNotebookAdapterUtility\PHILIPSMonitor.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119982422049
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1168289428263
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe
Post #14
It would help if I saw the log from Housecall as it may tip us off to an infection. Your HJT log is clean, I see nothing bad on it.

Sometimes a slow computer is not always related to Malware or a Virus, there could be some programs conflicting with each other slowing you down. What I do on my own system is every few months I uninstall any programs that I am not using nor do I ever intend to use, you will be surprised how this cleans things out and improves performance.

All the scans you ran seemed to clean out a lot of junk, there are just a few things left we can try.

Click here to download AVG Anti Rootkit and save it to your desktop.
  • Double-click on the AVG_AntiRootkit_1.0.0.13.exe file to run it.
  • Click "I Agree" to agree to the EULA.
  • By default it will install to "G:\Program Files\GRISOFT\AVG Anti-Rootkit Beta".
  • Click "Next" to begin the installation then click "Install".
  • It will then ask you to reboot now to finish the installation.
  • Click "Finish" and your computer will reboot.
  • After it reboots, double-click on the AVG Anti-Rootkit Beta shortcut that is now on your desktop.
  • Click on the "Perform in-depth search" button to begin the scan.
  • The scan will take a while so be patient and let it complete.
  • When the scan is finished, click the "Save result to file" button.
  • Save the scan results to your desktop then come back here to copy and paste the results in your next reply to this thread.

Then boot your computer to Safemode and run HJT to Scan and Save a Log file, there is an infection going around that will show up in Safemode.

Post the AVG log and a New HJT log from Safemode.

Ken :D

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI