Hi there,

I host quite a number of websites on my Win2K3 Server and recently many of the clients have reported popups going to 888.com.

Here's the HiJackThis log from my Win2K3 Server - hope you can help!

Logfile of HijackThis v1.99.1
Scan saved at 10:11:33 AM, on 17/07/2007
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
x:\AvantGoServer\bin\httpd.exe
x:\AvantGoServer\bin\agd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
Z:\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\rcssrv.exe
y:\Tomcat\bin\tomcat5.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
y:\Tomcat\bin\tomcat5w.exe
C:\WINDOWS\System32\svchost.exe
C:\Sybase\SQL Anywhere 9\win32\dbisqlg.exe
C:\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe
X:\Sybase\camasauser.exe
Z:\Monitor\monitorservers.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
Z:\Server5\cyberagentserver.exe
Z:\Server3\cyberagentserver.exe
X:\WC5Servers\Server1\cyberagentserver.exe
C:\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe
x:\WC5Servers\server1\cyberagentserver.exe
C:\OnlineSync\sqldatasync.exe
C:\UserSync\updatemanagersync.exe
Z:\CAMDataUpdate\camsync.exe
C:\Program Files\Microsoft Visual FoxPro 9\vfp9.exe
X:\WC5Servers\Server2\cyberagentserver.exe
c:\windows\system32\inetsrv\w3wp.exe
X:\NewSites\sap\propsqlgenie.exe
c:\windows\system32\inetsrv\w3wp.exe
X:\WC5Servers\Server0\cyberagentserver.exe
x:\WC5Servers\server2\cyberagentserver.exe
c:\windows\system32\inetsrv\w3wp.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
y:\Tomcat\bin\tomcat5w.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
x:\AvantGoServer\bin\httpd.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
y:\Tomcat\bin\tomcat5w.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
x:\AvantGoServer\bin\agd.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardAdmin.htm
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ApacheTomcatMonitor] "y:\Tomcat\bin\tomcat5w.exe" //MS//Tomcat5
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [DBISQL9] "C:\Sybase\SQL Anywhere 9\win32\dbisqlg.exe" -preload
O4 - HKCU\..\Run: [SybaseCentral43] "C:\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe" -preload
O4 - Startup: CAM Sync.lnk = Z:\CAMDataUpdate\camsync.exe
O4 - Startup: Data Sync.lnk = C:\UserSync\updatemanagersync.exe
O4 - Startup: Mobilink Username updater.lnk = X:\Sybase\camasauser.exe
O4 - Startup: NewServer 2.lnk = X:\WC5Servers\Server2\cyberagentserver.exe
O4 - Startup: NewServer0.lnk = X:\WC5Servers\Server0\cyberagentserver.exe
O4 - Startup: NewServer1.lnk = X:\WC5Servers\Server1\cyberagentserver.exe
O4 - Startup: Online Data Sync.lnk = C:\OnlineSync\sqldatasync.exe
O4 - Startup: Server2.lnk = Z:\Server2\cyberagentserver.exe
O4 - Startup: Server3.lnk = Z:\Server3\cyberagentserver.exe
O4 - Startup: Server5.lnk = Z:\Server5\cyberagentserver.exe
O4 - Startup: Website Monitor.lnk = Z:\Monitor\monitorservers.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126175368343
O17 - HKLM\System\CCS\Services\Tcpip\..\{60D7D7A2-8111-4F24-BF49-928B8C55EF9A}: NameServer = 168.210.2.2,196.14.239.2
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: M-Business Relay Server for BlackBerry (AGComServiceForBlackBerry) - Unknown owner - x:\AvantGoServer\bin\agcomsvr.exe
O23 - Service: MobiLink Synchronization - mobilink_xavier (ASANYm_mobilink_xavier) - iAnywhere Solutions, Inc. - C:\Sybase\SQL Anywhere 9\win32\dbmlsrv9.exe
O23 - Service: Adaptive Server Anywhere - AGDB (ASANYs_AGDB) - iAnywhere Solutions, Inc. - x:\avantgoserver/ASA\win32\dbsrv8.exe
O23 - Service: Adaptive Server Anywhere - XAVIER_MOBILE (ASANYs_XAVIER_MOBILE) - iAnywhere Solutions, Inc. - C:\Sybase\SQL Anywhere 9\win32\dbsrv9.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: M-Business Admin Server - Unknown owner - x:\AvantGoServer\bin\httpd.exe
O23 - Service: M-Business Soap Server - Unknown owner - x:\AvantGoServer\bin\agsoap.exe
O23 - Service: M-Business Sync Server - Unknown owner - x:\AvantGoServer\bin\agd.exe
O23 - Service: SQL Server FullText Search (MSSQLSERVER) (msftesql) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe" -s:MSSQL.1 -f:MSSQLSERVER (file missing)
O23 - Service: Microsoft Search (MSSEARCH) - Unknown owner - C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe (file missing)
O23 - Service: SQL Server (MSSQLSERVER) (MSSQLSERVER) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER (file missing)
O23 - Service: SQL Server Analysis Services (MSSQLSERVER) (MSSQLServerOLAPService) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe" -s "C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Config (file missing)
O23 - Service: MySQL - Unknown owner - Z:\mysql\bin\mysqld-nt".exe (file missing)
O23 - Service: RAID Configuration Service (RAIDService) - Unknown owner - C:\WINDOWS\system32\rcssrv.exe
O23 - Service: SQL Server Agent (MSSQLSERVER) (SQLSERVERAGENT) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE" -i MSSQLSERVER (file missing)
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - y:\Tomcat\bin\tomcat5.exe

Thanks in advance!
JanVorster