Apparently I have a number of infections. Before initiating this post I did the following:
1. Physically remove and reinstall cd rom,
2. regedit upper & lower filter remove associated with Roxio program removal, (MS Knowledgebase)
3. Deleted IDE & COM1 drivers and restart reinstall,
4. Disabled COM1 to eliminate IRQ conflict - conflict still reported after reboot even though COM1 disabled,
5. Run the entire dell diagnostics HW tests - no errors found
6. Rebooted after almost every step
7. Used cd rom trouble shooter all the way to reinstall windows.
8. Ran AdAware - no problems reported
9. Ran Spybot S&D - no problems reported
10. Ran Chkdsk - no problems reported
11. Ran SFC /Scannow - sfc requested my Windows XP Home Edition CD ROM for files in the DLL Cache. The response is that "the CD provided is the wrong CD." Could this be because my restore disk is Service Pack 1 and I have upgraded to Service Pack 2 and subsequent security fixes from the Windows Update page?
When I selected More Information - "the possible reasons for this problem: You have inserted the wrong CD (i.e. a different Windows product CD than the version installed), [or] the CD-ROM in your system is not functioning."
Carrying on...
11A. Ran Bit Defender online scan. It reported the abcxx.chm reported below. It also reported a number of Norton Antivirus exploits which it cleaned. Attempted to run Symantec online scan - problems with IE6. Downloaded but did not run Kapersky on line scan.
I then began to surf the web for help, and came across your excellent site. Following your instructions, I did the following:
12. Ran Panda Active Scan - see results below
13. Ran ATF-Cleaner.exe, set restore point just in case. Cannot seem to delete prior restore points.
14. Ran AVG in safe mode - see results below
15. Ran HJT in normal mode - see results below
Here is Panda Active Scan Result:
Incident Status Location
Dialer:Dialer.NQ Not disinfected C:\abcxx.chm[/on-line.exe]
Hacktool:Exploit/CodeBase.S Not disinfected C:\abcxx.chm[/1.htm]
Spyware:Spyware/Fstb Not disinfected C:\abcxx.chm[/htm2chm_explorer]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Guest\Cookies\guest@atwola[1].txt
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-5f5d0f17-5ddaf183.class
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-64c92d2-1a79a4a7.class
Adware:Adware/CWS Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-7fd6bea0-2fc4abef.class
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1e651dfe-59fa632a.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-1ecdead5-15837f6d.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-36790540-7c95dd55.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-773440b9-6b22fd9e.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counters.jar-e08a237-7f769aaa.zip[Gummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv12.jar-1cae9e4d-5c8b0e43.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv12.jar-1cae9e4d-5c8b0e43.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv293.jar-6d33d688-63b120d3.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv293.jar-6d33d688-63b120d3.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv428.jar-60a88436-4177833e.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv428.jar-60a88436-4177833e.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv428.jar-79a2800c-441e855b.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv453.jar-37ead35f-4b92687e.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv453.jar-37ead35f-4b92687e.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-3ebe35db-6ce8bcca.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv493.jar-3ebe35db-6ce8bcca.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv500.jar-25804f0e-69eb5f19.zip[Dummy.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv500.jar-25804f0e-69eb5f19.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv637.jar-4c1bbbd6-6d54a056.zip[Matrix.class]
Hacktool:Exploit/ByteVerify Not disinfected C:\Documents and Settings\Slingshot\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv637.jar-4c1bbbd6-6d54a056.zip[Dummy.class]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Slingshot.ORION\Application Data\Mozilla\Firefox\Profiles\7mq74qta.default\cookies.txt[ad.yieldmanager.com/]
Here is AVG Scan:
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 5:45:34 PM 8/5/2007
+ Scan result:
HKLM\SYSTEM\ControlSet006\Services\Eventlog\System\gv3 -> Adware.SuperBar : Cleaned with backup (quarantined).
::Report end
Here is HJT Scan:
Logfile of HijackThis v1.99.1
Scan saved at 6:00:13 PM, on 8/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Documents and Settings\Slingshot.ORION\Desktop\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Norton AntiVirus\navapsvc.exe
F:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
f:\Program Files\Logitech\MouseWare\system\em_exec.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Documents and Settings\Slingshot.ORION\Desktop\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
F:\Program Files\Hijackthis\HijackThis.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://update.micros...t.aspx?ln=en-us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "f:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Documents and Settings\Slingshot.ORION\Desktop\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Documents and Settings\Slingshot.ORION\Desktop\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: I - Unknown owner - C:\DOCUME~1\SLINGS~1.ORI\LOCALS~1\Temp\I.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - F:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Appreciate any help you might be able to provide. This has been a long road just to get here. Thanks. Slingshot03.