Couple nights ago my PC caught a sickness that I just cannot make go away. Happy to find you guys here helping folks, no prob for me donating here. I was frustrated enough to pay someone else to fix or help me fix it anyway.

What it does.

At first it started cascading pop ups and when I tried to bring up "task manager" it prompted that I was blocked by the Admin. This is my home PC so naturally I usually have acess to this.

It launches IE and goes to different web pages trying to sell me different "security" products (attempts this about once every 3min). I also only use FireFox which seems unaffected as this sickness only makes IE pop up unexpectedly.

It pops up a "system alerts" from my lower right bar (next to the clock) It doesnt let me turn off the alerts. They just keep comming back as IE opens unexpectedly. The alert in the bar is a blinking Red triangle with an "!" in it.

It also keeps replacing the same three icons on my desktop. Titles (Error Cleaner) (Privacy Protector) (Spyware&Protection). Each with its own unique logo.

Its also mimicking the Windows security pop up that usually comes up center screen. Again trying to get me to download so called "anti spyware" It even says (recomended) like windows does.




What I've done.

I've followed every step in the Self Help and then some. ATF cleaner downloaded and ran. Spybot S&D updated/ran/rebooted. Adaware updated and ran Full Scan/rebooted. AVG antiSpyware updated and ran in Safe Mode. It was only after the last step that all was quiet in Firefox. Until I opened IE for a look, and boom, the red triangle alert started flashing in the bottom right corner, and now IE fires up and tries to get online by itself again, going to those scum websites. Im back where i started.

So heres my AVG log followed by the Hijack log that I will run right now.

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:40:37 PM 6/26/2007

+ Scan result:



C:\Program Files\Microsoft AntiSpyware\Quarantine\59A0F5D4-641A-4BB5-A897-D8353C\4D005846-2E57-40BC-8C34-6E188C -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\7232DBB7-38D2-4110-80AF-FC8604\C819617F-0287-408E-82C7-29A791 -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\79DE42D5-3C44-4C48-8899-5C798F\6DC5CEE3-D6D5-4CA6-A7DC-A0D0DF -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\7E00D45D-D1E8-4217-8D3F-F13FB21592AD0-9C67-4760-AE56-3FBA1A -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\D0AF6C93-2983-49BC-A519-05F9A2\709D6ECD-B98E-46EE-81DF-681942 -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\F7B3EC51-ADEE-45D2-A263-11736C\5310494C-1F74-4D86-BE9B-E7F949 -> Adware.FindSpy : Cleaned.
C:\Program Files\Microsoft AntiSpyware\Quarantine\FA7B8143-7E57-494B-AC3B-1D939D\458081C8-9745-4F1F-BB46-A1C448 -> Adware.FindSpy : Cleaned.
C:\WINDOWS\system32\spoolsrv32.exe -> Adware.FindSpy : Cleaned.
C:\WINDOWS\system32\wmwkhlsj\wmwkhlsj1.exe -> Adware.UltimateDefender : Cleaned.
C:\WINDOWS\system32\wmwkhlsj\wmwkhlsj2.exe -> Adware.UltimateDefender : Cleaned.
C:\WINDOWS\system32\wmwkhlsj\wmwkhlsj3.exe -> Adware.UltimateDefender : Cleaned.
C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP230\A0044141.exe -> Dialer.Hacker : Cleaned.
:mozilla.76:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\e9xpsrpm.gf\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.143:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\e9xpsrpm.gf\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.146:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\e9xpsrpm.gf\cookies.txt -> TrackingCookie.Webtrends : Cleaned.


::Report end


Hijack Log.


Logfile of HijackThis v1.99.1
Scan saved at 11:25:51 PM, on 6/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\edghypqn.exe
C:\WINDOWS\system32\ProtEX32.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cscript.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cscript.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gomyron.com/NjU2NA==/2/3560/homepage/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper Basic\CCHelper.dll
O2 - BHO: MSVPS System - {49CF52D7-8D58-4E22-A874-AAD721F5B523} - C:\WINDOWS\ddesupport.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Pa&nicware Pop-Up Stopper Basic - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0} - C:\Program Files\Panicware\Pop-Up Stopper Basic\popuppro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [edghypqn.exe] C:\WINDOWS\system32\edghypqn.exe
O4 - HKLM\..\Run: [Protections] C:\WINDOWS\system32\ProtEX32.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange.com/Control/MultiSelectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange.com/Control/MLXClientUtils.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange.com/Control/IRCSharc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…463/mcfscan.cab
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - E:\Player\__CDS2.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: msole - {DD00C7F8-DDE1-4E30-9FB4-3D911E7BC68A} - C:\WINDOWS\msole.dll
O21 - SSODL: msdde - {C1C2FC67-DDF4-4CFA-8EEB-7CFFB9681122} - C:\WINDOWS\msdde.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





Sorry if i've done anything wrong as far as trying to get help. A 20. donation to the charity/web crew of your choice for whatever blessed soul helps me figure this out.

Best Regards, David / DarkEarth.