What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IMSORRYInternet Speed Monitor on left area of screen a

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
First, after doing a full system scan Norton AntiVirus detected partially removed and then fully removed theses files (NOTE: W32.Trats!inf keeps appearing still):

-W32.Trats!inf
-Downloader
-Downloader.MisleadApp
-Spyware.Ardakey

Secondly, Norton AntiVirus Security Risks Log:

Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\4PAV4HUF\10_swp[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\41YF8HI7\index[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP20.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP17.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP19.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP2.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP4C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP46.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP40.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3A.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP31.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP2B.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\bgbbyftj.dll,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\AHK1UT8D\hctp[1],Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\bhkcpcpi.dll,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\4LMN09MV\hctp[1],Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\SRT7YEBP\gamadril20071203[1],Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\blrjxpjy.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP1C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP10.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP5.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: c:\windows\system32\ctfmon.exe.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: ,Risk category: Virus,Overall Risk Impact: High,Action taken: Partially removed
Source: ,Risk category: Cookie,Overall Risk Impact: Low,Action taken: Fully removed
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP41.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP32.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP2C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\TRF79HKE\count[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP26.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP1C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP35.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP2A.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP23.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP14.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP16.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: [5_swp[1].com&affid=nm_151076_d1367e9eb6e111dca20b151076ddffff_af6ae6986aeb40958af058e8c01
b3ca5&ax=1&ed=2&mt_info=4586_0_10988] inside of [c:\documents and settings\chad\local settings\temporary internet files\content.ie5\m9mt6dsv\5_swp[1].com&affid=nm_151076_d1367e9eb6e111dca20b151076ddffff_af6ae6986aeb40958af058e8c01
b3ca5&ax=1&ed=2&mt_info=4586_0_10988],Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: [scan[1].php] inside of [c:\documents and settings\chad\local settings\temporary internet files\content.ie5\klansha3\scan[1].php],Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: [scan[1].php] inside of [c:\documents and settings\chad\local settings\temporary internet files\content.ie5\figb39sd\scan[1].php],Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: [webinst[1].cab] inside of [c:\documents and settings\chad\local settings\temporary internet files\content.ie5\4pav4huf\webinst[1].cab],Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: ,Risk category: Cookie,Overall Risk Impact: Low,Action taken: Fully removed
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP5FD.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP5FF.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMPC.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\FIGB39SD\scan[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\4LMN09MV\9_swp[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP5.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\4PAV4HUF\webinst[2].cab,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\KLANSHA3\scan[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\7Q9KDFFV\5_swp[1].htm,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Program Files\iTunes\iTunesHelper.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Removal not attempted
Source: C:\WINDOWS\system32\ctfmon.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Removal not attempted
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP16.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Program Files\iTunes\iTunesHelper.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Removal not attempted
Source: ,Risk category: Cookie,Overall Risk Impact: Low,Action taken: Removal not attempted
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMPF.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP5.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\W3WZATON\hctp[1],Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\fdqixpas.dll,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\xsikefoa.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temporary Internet Files\Content.IE5\KLANSHA3\gamadril20071203[1],Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP27.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP1B.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP12.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMPE.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Chad\Local Settings\Temp\TMP10.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP3.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP5.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP6E.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Fully removed
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP5A.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Program Files\Messenger\msmsgs.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Removal not attempted
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP2C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP14.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP30.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP28.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP1C.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP24.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP34.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP18.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP2A.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP1A.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\WINDOWS\system32\vtsqp.exe,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP32.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP22.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP36.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP16.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP20.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP26.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP1E.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\TMP2E.tmp,Risk category: Virus,Overall Risk Impact: High,Action taken: Blocked
Source: C:\Documents and Settings\Michelle\Local Settings\Temp\BIT6.tmp,Risk category: Adware,Overall Risk Impact: Medium,Action taken: Blocked
Source: ,Risk category: Cookie,Overall Risk Impact: Low,Action taken: Removal not attempted
Source: ,Risk category: Cookie,Overall Risk Impact: Low,Action taken: Removal not attempted
Source: C:\WINDOWS\system32\Sys\norton-db.exe,Risk category: Spyware,Overall Risk Impact: Medium,Action taken: Fully removed
Source: C:\WINDOWS\system32\Sys\norton-db.006,Risk category: Spyware,Overall Risk Impact: Medium,Action taken: Fully removed
Source: C:\WINDOWS\system32\Sys\norton-db.007,Risk category: Spyware,Overall Risk Impact: Medium,Action taken: Fully removed

Third and finally, Highjack This Log File:

Logfile of HijackThis v1.99.1
Scan saved at 11:43:56 AM, on 1/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GE\97769 Dual Scroll Optical Mouse\Amoumain.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinHacker] rundll32.exe C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll,HackMe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168895585250
O17 - HKLM\System\CCS\Services\Tcpip\..\{758EE9B7-17EA-42A8-9B02-0F72ADF08301}: NameServer = 85.255.115.115,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF8220CD-356A-4A05-8B9E-55521623254D}: NameServer = 85.255.115.115,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.115 85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.115 85.255.112.152
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Diskeeper - Diskeeper® Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Thank you for taking time to help me with this issue.

Chad
Post #2
Hello and welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread. Also please describe how your computer behaves at the moment.
Post #3
Well I have since uninstalled Norton Antivirus and ran Panda Security's free online program. I still need to get a new antivirus, a adware & pop-up stopper programs. But since the Panda scan I still have about 2 problems that I notice:

1. When going to a site or new page the Start menu button, the rest of the bottom toolbar, and all icons on my desktop disappears and then the system hangs for a a minute or so. And finally the images come back and the browser will go to the site I wanted to go to.

2. I thought I still had the IMSORRY search area appear on the left side of my browser, but I cannot seem to see it anymore. Oh well I guess I only have the first problem. I have noticed much more lag in my system since my problems.


Logfile of HijackThis v1.99.1
Scan saved at 9:35:55 PM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\qerdpdnx.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\GE\97769 Dual Scroll Optical Mouse\Amoumain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

F3 - REG:win.ini: load=C:\WINDOWS\system32\vtsqp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinHacker] rundll32.exe C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll,HackMe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [f40e2ff3] rundll32.exe "C:\WINDOWS\system32\dhsaqhgu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168895585250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{758EE9B7-17EA-42A8-9B02-0F72ADF08301}: NameServer = 85.255.115.115,85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF8220CD-356A-4A05-8B9E-55521623254D}: NameServer = 85.255.115.115,85.255.112.152
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.115 85.255.112.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.115 85.255.112.152
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Diskeeper - Diskeeper® Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\qerdpdnx.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #4
I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open the HijackThis Folder. Find the file HijackThis.exe, Right Click on the file and Select Rename. Rename Hijackthis.exe to Spyware.exe.


Please do not delete anything unless instructed to.

Next:

Please download FixWareout from this site:
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts.
You will be asked to reboot your computer; please do so.
Your system may take longer than usual to load; this is normal.

Once the desktop loads a text that will open (report.txt) Please save this file, you'll need to post it with a new HijackThis log.


Next:

Now lets check some settings on your system.
Enter your Control Panel and double-click on Network Connections

Then right click on your Default Connection
Usually Local Area Connection for Cable and DSL
Left click on Properties
Double-Click on the Internet Protocol (TCP/IP) item
Select the radio dial that says Obtain DNS Servers Automatically
Press OK twice to get out of the properties screen and reboot if it asks

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two


Reboot and "copy/paste" the text file (report.txt) and a new Hijackthis log

Also please describe how your computer behaves at the moment.
Post #5
Here is my (report.txt) and a new Hijackthis log as you requested in that order following my message.

I did however have the IMSORRYInternet Speed Monitor search area show up on the left side of my browser again prior to doing everything that you asked.

And as of now the IMSORRYInternet Speed Monitor search area shows up on the left side of my browser still.

Please help….
Thanks!!!

Chad S.


Username "Chad" - 01/15/2008 0:31:48 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Successfully flushed the DNS Resolver Cache.



~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
….
….
~~~~~ Misc files.
….
~~~~~ Checking for older varients.
….

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"Persistence"="C:\\WINDOWS\\System32\\igfxpers.exe"
"DiskeeperSystray"="\"C:\\Program Files\\Diskeeper Corporation\\Diskeeper\\DkIcon.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"WinHacker"="rundll32.exe C:\\PROGRA~1\\WEDGES~1\\WINHAC~1.0\\wh95.dll,HackMe"
"HostManager"="C:\\Program Files\\Common Files\\AOL\\1169473086\\ee\\AOLSoftware.exe"
"Pure Networks Port Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"SigmatelSysTrayApp"="sttray.exe"
"IntelAudioStudio"="\"C:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe\" BOOT"
"ipTray.exe"="\"C:\\Program Files\\Intel\\IDU\\iptray.exe\""
"HP Software Update"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd.exe\""
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"WheelMouse"="Amoumain.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe\""
"f40e2ff3"="rundll32.exe \"C:\\WINDOWS\\system32\\dhsaqhgu.dll\",b"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"SpySweeper"="C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe /0"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
….
Hosts file was reset, If you use a custom hosts file please replace it…
~~~~~ End report ~~~~~




Logfile of HijackThis v1.99.1
Scan saved at 2:02:10 PM, on 1/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\qerdpdnx.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\GE\97769 Dual Scroll Optical Mouse\Amoumain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\Spyware.exe

F3 - REG:win.ini: load=C:\WINDOWS\system32\vtsqp.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: {6f608b3e-c136-92e8-4784-4ca7f15b11a6} - {6a11b51f-7ac4-4874-8e29-631ce3b806f6} - C:\WINDOWS\system32\tbajjbow.dll
O2 - BHO: (no name) - {6D4E8C80-B663-4378-9478-459F12E6B662} - C:\WINDOWS\system32\vtsqp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BndBlock4 BHO Class - {8F9E2BE3-766D-4831-BB0E-766D5B819995} - C:\Program Files\QdrDrive\QdrDrive9.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\byxyywt.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinHacker] rundll32.exe C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll,HackMe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [f40e2ff3] rundll32.exe "C:\WINDOWS\system32\dhsaqhgu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168895585250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: byxyywt - byxyywt.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Diskeeper - Diskeeper® Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\qerdpdnx.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #7
Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–
  • Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
  • Please do not re-connect your machine back to the Internet until Combofix has completely finished.
——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #8
I ran ComboFix as you requested and here is the C:\ComboFix.txt" along with the new HijackThis log.

Thanks for your help thusfar!!!

Chad.



ComboFix 08-01-16.4 - Chad 2008-01-16 12:51:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.633 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Michelle\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Michelle\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Michelle\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive9.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrPack
C:\WINDOWS\cookies.ini
C:\WINDOWS\g32.txt
C:\WINDOWS\s32.txt
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000014_.tmp.dll
C:\WINDOWS\system32\_000019_.tmp.dll
C:\WINDOWS\system32\bsjytvvy.dll
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\deafqjjo.ini
C:\WINDOWS\system32\dhsaqhgu.dll
C:\WINDOWS\system32\filehhge.dll
C:\WINDOWS\system32\fudkqsxo.exe
C:\WINDOWS\system32\gaoaexaw.ini
C:\WINDOWS\system32\gsdkunhv.dll
C:\WINDOWS\system32\hlhxxvkf.dll
C:\WINDOWS\system32\hpceovmn.dll
C:\WINDOWS\system32\jkwwiklw.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mxwyppuo.dll
C:\WINDOWS\system32\ouppywxm.ini
C:\WINDOWS\system32\pniigwwm.ini
C:\WINDOWS\system32\pqstv.ini
C:\WINDOWS\system32\pqstv.ini2
C:\WINDOWS\system32\qerdpdnx.exe
C:\WINDOWS\system32\RCX5.tmp
C:\WINDOWS\system32\tbadmhrw.dll
C:\WINDOWS\system32\tbajjbow.dll
C:\WINDOWS\system32\tisdhqyb.dll
C:\WINDOWS\system32\tjdyjwui.dll
C:\WINDOWS\system32\tumtihty.dll
C:\WINDOWS\system32\ughqashd.ini
C:\WINDOWS\system32\unnlbkki.ini
C:\WINDOWS\system32\vtsqp.dll
C:\WINDOWS\system32\vtsqp.exe
C:\WINDOWS\system32\ythitmut.ini
C:\WINDOWS\system32\yvvtyjsb.ini
C:\WINDOWS\ws386.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))
.

2008-01-16 12:47 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-15 23:29 . 2008-01-15 23:29 d——– C:\Program Files\Virtools Web Player 3.5
2008-01-12 22:16 . 2008-01-12 22:16 d——– C:\Program Files\FMS
2008-01-12 19:58 . 2008-01-12 19:59 d——– C:\Program Files\eGames
2008-01-12 19:58 . 2000-03-20 23:55 118,784 –a—— C:\WINDOWS\system32\vbalNCSM6.dll
2008-01-12 19:58 . 1999-02-19 07:54 40,960 –a—— C:\WINDOWS\system32\SSubTmr6.dll
2008-01-09 20:11 . 2007-06-05 10:56 44,928 –a—— C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-01 07:17 . 2008-01-16 10:17 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2007-12-29 21:11 . 2008-01-03 01:23 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-12-29 21:11 . 2007-12-29 21:11 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-12-29 21:11 . 2008-01-03 01:23 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-29 20:37 . 2007-12-29 20:37 d——– C:\Program Files\Konami
2007-12-29 20:35 . 2007-12-29 21:25 185 –a—— C:\WINDOWS\system32\sam.ini
2007-12-29 20:32 . 2004-08-04 00:58 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-29 20:32 . 2004-08-04 00:58 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-12-29 20:31 . 2007-12-29 20:31 d——– C:\Program Files\Game Elements
2007-12-29 20:31 . 2006-02-16 09:54 487,424 –a—— C:\WINDOWS\system32\FDRpage.dll
2007-12-29 20:31 . 2005-12-09 12:24 192,512 –a—— C:\WINDOWS\system32\CreateDir.exe
2007-12-29 20:31 . 2006-01-04 16:39 77,824 –a—— C:\WINDOWS\system32\FDRdriver.dll
2007-12-29 20:31 . 2006-01-07 12:09 7,548 –a—— C:\WINDOWS\system32\drivers\Samhid.sys
2007-12-26 09:41 . 2000-07-17 13:41 70,088 –a—— C:\WINDOWS\system32\Project2-1.ocx
2007-12-26 09:41 . 2000-03-21 15:37 1,760 –a—— C:\WINDOWS\system32\objsafe.tlb
2007-12-26 09:41 . 2000-04-06 14:58 1,453 –a—— C:\WINDOWS\system32\Project2.INF
2007-12-20 11:45 . 2007-12-20 11:45 d——– C:\Documents and Settings\Default User\Application Data\Apple Computer
2007-12-20 11:37 . 2007-12-20 12:04 d–hs—- C:\WINDOWS\system32\Sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 23:44 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-09 20:01 ——— d—–w C:\Program Files\Symantec
2008-01-09 20:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-03 16:26 ——— d—–w C:\Program Files\iTunes
2007-12-30 14:16 ——— d—–w C:\Program Files\QuickTime
2007-12-16 02:39 81,622,354 —-a-w C:\SYM_REGISTRY_BACKUP.reg
2007-12-09 05:47 ——— d—–w C:\Program Files\Doblon
2007-12-09 05:43 ——— d—–w C:\Program Files\Common Files\cdrdao
2007-11-25 23:21 ——— d—–w C:\Documents and Settings\Michelle\Application Data\Apple Computer
2007-11-24 00:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-03-28 18:16 74,160 —-a-w C:\Documents and Settings\Chad\Application Data\GDIPFONTCACHEV1.DAT
.
—-a-w		   687,616 2008-01-01 13:33:07  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w			15,360 2008-01-16 15:17:59  C:\WINDOWS\system32\ctfmon .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [ ]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"Persistence"="C:\WINDOWS\System32\igfxpers.exe" [ ]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"WinHacker"="C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll" [1999-10-31 16:07 114688]
"HostManager"="C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe" [ ]
"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [ ]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [ ]
"SigmatelSysTrayApp"="sttray.exe" []
"IntelAudioStudio"="C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [ ]
"ipTray.exe"="C:\Program Files\Intel\IDU\iptray.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [ ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [ ]
"WheelMouse"="Amoumain.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyywt]
byxyywt.dll

R0 Pnp680r;Silicon Image SiI 0680 Medley Raid Controller;C:\WINDOWS\system32\DRIVERS\pnp680r.sys [2002-05-31 03:35]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2006-10-27 19:18]
S3 lgatbus;LG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\lgatbus.sys [2002-10-15 18:03]
S3 lgatmdm;LG CDMA USB Modem Drivers;C:\WINDOWS\system32\DRIVERS\lgatmdm.sys [2002-10-15 18:05]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);C:\WINDOWS\system32\DRIVERS\lgatserd.sys [2002-10-15 18:07]
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-06-18 14:19]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 18:33]
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-05-07 14:11]
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 14:18]
S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys [2006-01-07 12:09]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34b58d5c-a6bc-11db-afce-00038a000015}]
\Shell\AutoRun\command - F:\JDSecure\Windows\JDSecure31.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 13:07:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 13:10:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 18:10:49
.
2008-01-16 14:26:39 — E O F —




Logfile of HijackThis v1.99.1
Scan saved at 2:58:31 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\GE\97769 Dual Scroll Optical Mouse\Amoumain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\Spyware.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinHacker] rundll32.exe C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll,HackMe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168895585250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: byxyywt - byxyywt.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Diskeeper - Diskeeper® Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #10

I was just wondering if I should change spyware.exe back to hijackthis.exe, what do you think?

By the time you use it again it will be outdated


Can you tell me what's in this folder?
C:\WINDOWS\system32\Sys


Open notepad and copy/paste the text in the Codebox below into it:

RenV::
C:\Program Files\iTunes\iTunesHelper .exe
C:\WINDOWS\system32\ctfmon .exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyywt]


Save this as Save this as "CFScript"


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.
Post #11
You asked, "Can you tell me what's in this folder? C:\WINDOWS\system32\Sys"? I cannot find the sys folder within the system32 folder that you mentioned.
Post #13
Here are the 2 log files you requested.

The IMSORRY search area has not reappeared and the screen isn't doing the constant refresh anymore.
My system in running smoother and faster.



ComboFix 08-01-16.4 - Chad 2008-01-17 0:47:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.611 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chad\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 )))))))))))))))))))))))))))))))
.

2008-01-16 12:47 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-15 23:29 . 2008-01-15 23:29 d——– C:\Program Files\Virtools Web Player 3.5
2008-01-12 22:16 . 2008-01-12 22:16 d——– C:\Program Files\FMS
2008-01-12 19:58 . 2008-01-12 19:59 d——– C:\Program Files\eGames
2008-01-12 19:58 . 2000-03-20 23:55 118,784 –a—— C:\WINDOWS\system32\vbalNCSM6.dll
2008-01-12 19:58 . 1999-02-19 07:54 40,960 –a—— C:\WINDOWS\system32\SSubTmr6.dll
2008-01-09 20:11 . 2007-06-05 10:56 44,928 –a—— C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-01 07:17 . 2008-01-16 10:17 15,360 –a—— C:\WINDOWS\system32\ctfmon .exe
2007-12-29 21:11 . 2008-01-03 01:23 107,832 –a—— C:\WINDOWS\system32\PnkBstrB.exe
2007-12-29 21:11 . 2007-12-29 21:11 66,872 –a—— C:\WINDOWS\system32\PnkBstrA.exe
2007-12-29 21:11 . 2008-01-03 01:23 22,328 –a—— C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-29 20:37 . 2007-12-29 20:37 d——– C:\Program Files\Konami
2007-12-29 20:35 . 2007-12-29 21:25 185 –a—— C:\WINDOWS\system32\sam.ini
2007-12-29 20:32 . 2004-08-04 00:58 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-12-29 20:32 . 2004-08-04 00:58 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-12-29 20:31 . 2007-12-29 20:31 d——– C:\Program Files\Game Elements
2007-12-29 20:31 . 2006-02-16 09:54 487,424 –a—— C:\WINDOWS\system32\FDRpage.dll
2007-12-29 20:31 . 2005-12-09 12:24 192,512 –a—— C:\WINDOWS\system32\CreateDir.exe
2007-12-29 20:31 . 2006-01-04 16:39 77,824 –a—— C:\WINDOWS\system32\FDRdriver.dll
2007-12-29 20:31 . 2006-01-07 12:09 7,548 –a—— C:\WINDOWS\system32\drivers\Samhid.sys
2007-12-26 09:41 . 2000-07-17 13:41 70,088 –a—— C:\WINDOWS\system32\Project2-1.ocx
2007-12-26 09:41 . 2000-03-21 15:37 1,760 –a—— C:\WINDOWS\system32\objsafe.tlb
2007-12-26 09:41 . 2000-04-06 14:58 1,453 –a—— C:\WINDOWS\system32\Project2.INF
2007-12-20 11:45 . 2007-12-20 11:45 d——– C:\Documents and Settings\Default User\Application Data\Apple Computer
2007-12-20 11:37 . 2007-12-20 12:04 d–hs—- C:\WINDOWS\system32\Sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 23:44 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-09 20:01 ——— d—–w C:\Program Files\Symantec
2008-01-09 20:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-03 16:26 ——— d—–w C:\Program Files\iTunes
2007-12-30 14:16 ——— d—–w C:\Program Files\QuickTime
2007-12-16 02:39 81,622,354 —-a-w C:\SYM_REGISTRY_BACKUP.reg
2007-12-09 05:47 ——— d—–w C:\Program Files\Doblon
2007-12-09 05:43 ——— d—–w C:\Program Files\Common Files\cdrdao
2007-11-25 23:21 ——— d—–w C:\Documents and Settings\Michelle\Application Data\Apple Computer
2007-11-24 00:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:39 230,912 —-a-w C:\WINDOWS\system32\wmasf.dll
2007-03-28 18:16 74,160 —-a-w C:\Documents and Settings\Chad\Application Data\GDIPFONTCACHEV1.DAT
.
—-a-w		   687,616 2008-01-01 13:33:07  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w			15,360 2008-01-16 15:17:59  C:\WINDOWS\system32\ctfmon .exe


((((((((((((((((((((((((((((( snapshot@2008-01-16_13.10.37.90 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-16 17:50:59 229,376 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-17 05:47:09 229,376 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-16 17:50:59 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-17 05:47:09 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-16 17:51:00 229,376 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-17 05:47:09 229,376 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-16 17:51:00 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-17 05:47:09 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-16 17:51:00 6,766,592 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-17 05:47:10 6,766,592 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-16 17:51:00 151,552 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-17 05:47:10 151,552 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" [ ]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"Persistence"="C:\WINDOWS\System32\igfxpers.exe" [ ]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"WinHacker"="C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll" [1999-10-31 16:07 114688]
"HostManager"="C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe" [ ]
"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [ ]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [ ]
"SigmatelSysTrayApp"="sttray.exe" []
"IntelAudioStudio"="C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [ ]
"ipTray.exe"="C:\Program Files\Intel\IDU\iptray.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [ ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [ ]
"WheelMouse"="Amoumain.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyywt]
byxyywt.dll

R0 Pnp680r;Silicon Image SiI 0680 Medley Raid Controller;C:\WINDOWS\system32\DRIVERS\pnp680r.sys [2002-05-31 03:35]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2006-10-27 19:18]
S3 lgatbus;LG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\lgatbus.sys [2002-10-15 18:03]
S3 lgatmdm;LG CDMA USB Modem Drivers;C:\WINDOWS\system32\DRIVERS\lgatmdm.sys [2002-10-15 18:05]
S3 lgatserd;LG CDMA USB Modem Diagnostic Serial Port Drivers (WDM);C:\WINDOWS\system32\DRIVERS\lgatserd.sys [2002-10-15 18:07]
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-06-18 14:19]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 18:33]
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2007-05-07 14:11]
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 14:18]
S3 samhid;samhid;C:\WINDOWS\system32\drivers\samhid.sys [2006-01-07 12:09]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{34b58d5c-a6bc-11db-afce-00038a000015}]
\Shell\AutoRun\command - F:\JDSecure\Windows\JDSecure31.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-17 00:48:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-17 0:49:07
ComboFix-quarantined-files.txt 2008-01-17 05:49:00
ComboFix2.txt 2008-01-16 18:10:52
.
2008-01-16 14:26:39 — E O F —




Logfile of HijackThis v1.99.1
Scan saved at 1:22:42 AM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\GE\97769 Dual Scroll Optical Mouse\Amoumain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Intel\IDU\awServ.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis\Spyware.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinHacker] rundll32.exe C:\PROGRA~1\WEDGES~1\WINHAC~1.0\wh95.dll,HackMe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169473086\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [ipTray.exe] "C:\Program Files\Intel\IDU\iptray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168895585250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: byxyywt - byxyywt.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Program Files\Intel\IDU\awServ.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Diskeeper - Diskeeper® Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #14
You have a few infection which infects legitimate files, it can be a bit of a pain


1. Download RenV.exe by sUBs to your desktop
2. Double click on it to run it
It will search your system drive looking for any modified .exe file and will produce a log for you.
3. Please copy and paste this report to your reply.
Post #15
Here is the code you wanted me to post.



Ran on Thu 01/17/2008 -  8:44:51.32

—-a-w		   687,616 2008-01-01 13:33:07  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w			15,360 2008-01-16 15:17:59  C:\WINDOWS\system32\ctfmon .exe

 Entries:				2  (2)
 Directories:			0  Files:			 2
 Bytes:			702,976  Blocks:		1,373

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI