[Resolved] xp infected with trojans 35 pakes & win32 agent cy

have major problems with pop ups and system changes.need advice on what to do. done hjt scan. what next ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Tuesday, May 20, 2008 6:14:33 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/05/2008 Kaspersky Anti-Virus database records: 786008 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 134585 Number of viruses found: 9 Number of infected objects: 18 Number of suspicious objects: 0 Duration of the scan process: 03:01:41 Infected Object Name / Virus Name / Last Action C:\805523f8bc117d1929\$shtdwn$.req Object is locked skipped C:\805523f8bc117d1929\common\eula.txt Object is locked skipped C:\805523f8bc117d1929\common\spcustom.dll Object is locked skipped C:\805523f8bc117d1929\common\spmsg.dll Object is locked skipped C:\805523f8bc117d1929\common\spuninst.exe Object is locked skipped C:\805523f8bc117d1929\common\update.exe Object is locked skipped C:\805523f8bc117d1929\sp1\ara\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ara\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\chs\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\chs\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\cht\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\cht\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\csy\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\csy\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\dan\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\dan\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\deu\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\deu\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ell\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ell\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\esn\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\esn\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\fin\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\fin\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\fra\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\fra\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\heb\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\heb\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\helpctr.exe Object is locked skipped C:\805523f8bc117d1929\sp1\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\hscupd.exe Object is locked skipped C:\805523f8bc117d1929\sp1\hscxpsp1.cab Object is locked skipped C:\805523f8bc117d1929\sp1\hun\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\hun\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ita\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ita\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\jpn\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\jpn\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\kor\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\kor\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\nld\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\nld\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\nor\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\nor\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\plk\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\plk\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ptb\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ptb\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ptg\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\ptg\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\rus\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\rus\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\sve\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\sve\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\trk\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp1\trk\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp1\update\kb840374.cat Object is locked skipped C:\805523f8bc117d1929\sp1\update\update.inf Object is locked skipped C:\805523f8bc117d1929\sp1\update\update.ver Object is locked skipped C:\805523f8bc117d1929\sp2\ara\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ara\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\chs\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\chs\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\cht\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\cht\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\csy\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\csy\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\dan\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\dan\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\deu\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\deu\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ell\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ell\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\esn\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\esn\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\fin\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\fin\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\fra\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\fra\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\heb\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\heb\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\helpctr.exe Object is locked skipped C:\805523f8bc117d1929\sp2\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\hscupd.exe Object is locked skipped C:\805523f8bc117d1929\sp2\hun\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\hun\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ita\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ita\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\jpn\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\jpn\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\kor\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\kor\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\nld\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\nld\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\nor\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\nor\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\plk\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\plk\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ptb\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ptb\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ptg\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\ptg\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\rus\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\rus\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\spmsg.dll Object is locked skipped C:\805523f8bc117d1929\sp2\spuninst.exe Object is locked skipped C:\805523f8bc117d1929\sp2\sve\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\sve\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\trk\hsc.system.errors.connection.htm.cab Object is locked skipped C:\805523f8bc117d1929\sp2\trk\hsc.system.scripts.common.js.cab Object is locked skipped C:\805523f8bc117d1929\sp2\update\eula.txt Object is locked skipped C:\805523f8bc117d1929\sp2\update\kb840374.cat Object is locked skipped C:\805523f8bc117d1929\sp2\update\spcustom.dll Object is locked skipped C:\805523f8bc117d1929\sp2\update\update.exe Object is locked skipped C:\805523f8bc117d1929\sp2\update\update.inf Object is locked skipped C:\805523f8bc117d1929\sp2\update\update.ver Object is locked skipped C:\805523f8bc117d1929\xpsp1hfm.exe Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-05182008-091114.log Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\Owner\Application Data\Motive\Acme\plugin\log\pchbtn.log Object is locked skipped C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{AB92DB55-F04D-4E7F-A87F-E7F4BCA8356C} Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008051920080520\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\ mon001.log Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\MPSampleSubmit\~.exe.xor Infected: Trojan.Win32.Agent.cyt skipped C:\Documents and Settings\Owner\Local Settings\Temp\NER12.tmp\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DFD64B.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DFD66D.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temp\~DFD76C.tmp Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\91OY3LE5\index[1].htm Infected: Trojan.JS.Pakes.l skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\A5853EY1\XPantivirus2008_v880062[1].exe Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\JVW1TMFW\rld[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.mju skipped C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Owner\NTUSER.DAT.LOG Object is locked skipped C:\Program Files\blueyonder IST\log\mpbtn.log Object is locked skipped C:\Program Files\blueyonder IST\SmartBridge\AlertFilter.log Object is locked skipped C:\Program Files\blueyonder IST\SmartBridge\log\httpclient.log Object is locked skipped C:\Program Files\blueyonder IST\SmartBridge\SmartBridge.log Object is locked skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Anytime\SignupLt.exe/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Anytime\SignupLt.exe CAB: infected - 1 skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Reinstall\SignupLt.exe/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Reinstall\SignupLt.exe CAB: infected - 1 skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Standard\SignupLt.exe/btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.b skipped C:\Program Files\Online Services\BTopenworldAnytime\Narrowband\Signup\Standard\SignupLt.exe CAB: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{DE26ADE1-E7AF-415B-AA1F-B0F1DBFF538C}\RP1407\A0208188.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mju skipped C:\System Volume Information\_restore{DE26ADE1-E7AF-415B-AA1F-B0F1DBFF538C}\RP1407\A0208190.exe Infected: Trojan.Win32.Agent.cyt skipped C:\System Volume Information\_restore{DE26ADE1-E7AF-415B-AA1F-B0F1DBFF538C}\RP1410\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Downloaded Program Files\btmailcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.g skipped C:\WINDOWS\Downloaded Program Files\btwebcontrol.dll Infected: not-a-virus:Dialer.Win32.BT.f skipped C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.a skipped C:\WINDOWS\mpcodecplg.dll Infected: not-a-virus:AdWare.Win32.Agent.acl skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\ewjcboeg.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mju skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\toyyoaup.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.mju skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped Scan process completed.

Hello chumpynuts

Welcome to the Whatthetech Malware Removal Forum, Your posting all over the forum and we cant keep track of you, reply to this thread only by using the ADD REPLY and DO NOT START ANY NEW TOPICS

Download Trendmicros Hijackthis to your desktop.
Double click it to install
Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe

• Open HJT Scan and Save a Log File, it will open in Notepad
• Go to Format and make sure Wordwrap is Unchecked
• Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.

DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

Hello,

You have quite a few infections on your system, this is going to take running a few tools to fix.

For this tool to be effective it has to be run from Safemode.

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
  this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Hey,

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\gdpwafev.dll
O2 - BHO: {29f03acc-f47e-36da-0f54-93bbac0f34ec} - {ce43f0ca-bb39-45f0-ad63-e74fcca30f92} - C:\WINDOWS\system32\fvcbohth.dll

O4 - HKUS\S-1-5-18\..\Run: [Microsoft Services] lsrv.exe (User 'SYSTEM') G
O4 - HKUS\.DEFAULT\..\Run: [Microsoft Services] lsrv.exe (User 'Default user')



Please download OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  

  C:\WINDOWS\system32\gdpwafev.dll
  C:\WINDOWS\system32\fvcbohth.dll
  C:\Windows\System32\lsrv.exe

• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
• Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
• Close OTMoveIt

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and Paste the entire report in your next reply along with a Hijackthis log.

Post the OTMoveIt log, the Malwarebytes log and a New HJT log.

chumpynuts,

Where did you get that name ? I have been at this in the forums for about 5 years and the log on names sometimes crack me up.

Your log looks clean

Run this cleaner to get rid of any temp files , sometimes places where this garbage leaves files.


Please download ATF Cleaner by Atribune to your desktop.

• This program is for XP and Windows 2000 only
• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up

• Your Java is out of date and leaving your system vulnerable.
• Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
• It should have an icon next to it:
  [external image: Posted Image]
  Select it and click Remove.
• Reboot your system.
• Then go to the Sun Microsystems and install the update
• Java Runtime Environment (JRE) 6 Update 6 <–This is what you need to download and install.
• If you chose the online installation, it will prompt you to run the program.
• If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
• Then after install you can verify your installation here Sun Java Verify

I like to to do the offline installation and save the setup file in case I may need it in the future



How is your system behaving now ??

hi ken thanks for all your help-so far.the name chumpynuts came about from a uk comedy sketch show. the sketch was based in the midlands of the u k. the chumpy part is a term of endearment to somebody you dont know.similar to your howdy doody.as for the nuts seemed like a good idea at the time.now back to the drawing board.system seems o.k. but as you say in your post it may load a little slower to start with.i have done a virus scan which is up to date. i enclose the log for your advice.apart from that i got back a lot of hard drive nearly 20gb. eTrust EZ Antivirus Version 6.2.0.21 Started scanning: 9:35:50 AM, 5/28/2008 Dat file v10124 Scanning boot sectors… Drive A: is not ready. C:\ Master Boot Record matches template, is unknown but seems OK. C:\ Partition Boot Record matches template, is OK: standard Win2000 (2). D:\ Master Boot Record matches template, is unknown but seems OK. D:\ Partition Boot Record matches template, is unknown but seems OK. Drive E: is not ready. Drive F: is not ready. Scanning file(s)… C:\805523f8bc117d1929\$shtdwn$.req - error in scanning - scan abandoned. C:\805523f8bc117d1929\xpsp1hfm.exe - error in scanning - scan abandoned. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-05182008-091114.log - unable to open file - not scanned. C:\Documents and Settings\Default User\My Documents\prog files\wrar330.exe - scan incomplete. C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - unable to open file - not scanned. C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - unable to open file - not scanned. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat - unable to open file - not scanned. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat - unable to open file - not scanned. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat - unable to open file - not scanned. C:\Documents and Settings\LocalService\NTUSER.DAT - unable to open file - not scanned. C:\Documents and Settings\LocalService\NTUSER.DAT.LOG - unable to open file - not scanned. C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - unable to open file - not scanned. C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - unable to open file - not scanned. C:\Documents and Settings\NetworkService\NTUSER.DAT - unable to open file - not scanned. C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG - unable to open file - not scanned. C:\Documents and Settings\Owner\Application Data\Motive\Acme\plugin\log\pchbtn.log - unable to open file - not scanned. C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>MagicApplet.class - Java.ByteVerify!exploit trojan. C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>OwnClassLoader.class - Java.ByteVerify!exploit trojan. C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>ProxyClassLoader.class - Java.ByteVerify!exploit trojan. C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>Installer.class - Java.Shinwow.BG trojan. C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7 contains infected files. C:\Documents and Settings\Owner\Cookies\index.dat - unable to open file - not scanned. C:\Documents and Settings\Owner\Desktop\SDFix.exe - scan incomplete. C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - unable to open file - not scanned. C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - unable to open file - not scanned. C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{A3F722B6-4284-4C5D-9352-03C8414DFF1F} - unable to open file - not scanned. C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat - unable to open file - not scanned. C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat - unable to open file - not scanned. C:\Documents and Settings\Owner\My Documents\films\Ultimate Ringtones.rar - scan incomplete. C:\Documents and Settings\Owner\My Documents\prog files\wrar330.exe - scan incomplete. C:\Documents and Settings\Owner\NTUSER.DAT - unable to open file - not scanned. C:\Documents and Settings\Owner\NTUSER.DAT.LOG - unable to open file - not scanned. C:\hiberfil.sys - unable to open file - not scanned. C:\pagefile.sys - unable to open file - not scanned. C:\Program Files\blueyonder IST\log\mpbtn.log - unable to open file - not scanned. C:\Program Files\blueyonder IST\SmartBridge\AlertFilter.log - unable to open file - not scanned. C:\Program Files\blueyonder IST\SmartBridge\log\httpclient.log - unable to open file - not scanned. C:\Program Files\blueyonder IST\SmartBridge\SmartBridge.log - unable to open file - not scanned. C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VIRUSLOG.TXT - unable to open file - not scanned. C:\Program Files\Common Files\Roxio Shared\Support\about.rtf>PBrush - unable to open file - not scanned. C:\Program Files\Common Files\Roxio Shared\Support\about.rtf>PBrush - unable to open file - not scanned. C:\Program Files\Common Files\Roxio Shared\Support\about.rtf - scan incomplete. C:\Program Files\RecordNow!\Tutorial\ENU\TutorialENU.exe - scan incomplete. C:\Program Files\RecordNow!\Tutorial\Movies\movies.exe - scan incomplete. C:\Program Files\WinRAR\WinRAR.rar - scan incomplete. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc154.m2v - unsupported file format - scan aborted. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc163.rar - scan incomplete. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc165.RAR - scan incomplete. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc166.rar - scan incomplete. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc168.zip>DVDXCOPY PLATINUM 4.0.3.8 CRACK.RAR - scan incomplete. C:\RECYCLER\S-1-5-21-3791964687-3023771741-33532248-1003\Dc168.zip - scan incomplete. C:\WINDOWS\Debug\PASSWD.LOG - unable to open file - not scanned. C:\WINDOWS\I386\WBCACHE.DE_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.EN_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.ES_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.FR_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.IT_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.NL_ - scan incomplete. C:\WINDOWS\I386\WBCACHE.SV_ - scan incomplete. C:\WINDOWS\SchedLgU.Txt - unable to open file - not scanned. C:\WINDOWS\SoftwareDistribution\ReportingEvents.log - unable to open file - not scanned. C:\WINDOWS\Sti_Trace.log - unable to open file - not scanned. C:\WINDOWS\system32\CatRoot2\edb.log - unable to open file - not scanned. C:\WINDOWS\system32\CatRoot2\tmp.edb - unable to open file - not scanned. C:\WINDOWS\system32\config\AppEvent.Evt - unable to open file - not scanned. C:\WINDOWS\system32\config\default - unable to open file - not scanned. C:\WINDOWS\system32\config\default.LOG - unable to open file - not scanned. C:\WINDOWS\system32\config\Internet.evt - unable to open file - not scanned. C:\WINDOWS\system32\config\SAM - unable to open file - not scanned. C:\WINDOWS\system32\config\SAM.LOG - unable to open file - not scanned. C:\WINDOWS\system32\config\SecEvent.Evt - unable to open file - not scanned. C:\WINDOWS\system32\config\SECURITY - unable to open file - not scanned. C:\WINDOWS\system32\config\SECURITY.LOG - unable to open file - not scanned. C:\WINDOWS\system32\config\software - unable to open file - not scanned. C:\WINDOWS\system32\config\software.LOG - unable to open file - not scanned. C:\WINDOWS\system32\config\SysEvent.Evt - unable to open file - not scanned. C:\WINDOWS\system32\config\system - unable to open file - not scanned. C:\WINDOWS\system32\config\system.LOG - unable to open file - not scanned. C:\WINDOWS\system32\config\systemprofile\My Documents\prog files\wrar330.exe - scan incomplete. C:\WINDOWS\system32\h323log.txt - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA - unable to open file - not scanned. C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP - unable to open file - not scanned. C:\WINDOWS\Twunk002.MTX - unable to open file - not scanned. C:\WINDOWS\wiadebug.log - unable to open file - not scanned. C:\WINDOWS\wiaservc.log - unable to open file - not scanned. C:\WINDOWS\WindowsUpdate.log - unable to open file - not scanned. D:\cmdcons\Protect.ed>PBrush - unable to open file - not scanned. D:\cmdcons\Protect.ed - scan incomplete. D:\MiniNT\Protect.ed>PBrush - unable to open file - not scanned. D:\MiniNT\Protect.ed - scan incomplete. D:\PRELOAD\Protect.ed>PBrush - unable to open file - not scanned. D:\PRELOAD\Protect.ed - scan incomplete. D:\protect.ed>PBrush - unable to open file - not scanned. D:\protect.ed - scan incomplete. D:\I386\WBCACHE.DE_ - scan incomplete. D:\I386\WBCACHE.EN_ - scan incomplete. D:\I386\WBCACHE.ES_ - scan incomplete. D:\I386\WBCACHE.FR_ - scan incomplete. D:\I386\WBCACHE.IT_ - scan incomplete. D:\I386\WBCACHE.NL_ - scan incomplete. D:\I386\WBCACHE.SV_ - scan incomplete. D:\I386\Protect.ed>PBrush - unable to open file - not scanned. D:\I386\Protect.ed - scan incomplete. D:\TOOLS\Protect.ed>PBrush - unable to open file - not scanned. D:\TOOLS\Protect.ed - scan incomplete. D:\hp\Protect.ed>PBrush - unable to open file - not scanned. D:\hp\Protect.ed - scan incomplete. D:\RECOVERY\Protect.ed>PBrush - unable to open file - not scanned. D:\RECOVERY\Protect.ed - scan incomplete. Finished scanning: 11:33:38 AM, 5/28/2008 Number of files scanned: 233676. Number of files that could not be scanned: 73 Number of archives containing infected files: 1 Number of infections: 4 Number of infected files not cleaned/deleted/renamed: 4 C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>MagicApplet.class (Java.ByteVerify!exploit trojan) C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>OwnClassLoader.class (Java.ByteVerify!exploit trojan) C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>ProxyClassLoader.class (Java.ByteVerify!exploit trojan) C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\59\107cd1bb-4e6df6b7>Installer.class (Java.Shinwow.BG trojan) once again thanks for all your help.

Hello,

Lets delete these files, Run them through OTMoveIt and post that report.

C:\WINDOWS\system32\ewjcboeg.dll
C:\WINDOWS\system32\toyyoaup.dll

Most of what your Virus scanner found are located in the Java Catch, lets flush it all out.

Go to Start > Control Panel ( up at the top left , make sure your in Classic View ) and open Java.
Then look for a tab that says cache and choose clear cache.
( Newer version might have delete Temporary Internet files, delete them)
Do that for every Java icon, if there is more than one.


You also have some bad entries in your System Restore Program, lets flush that out to and make sure you follow the instructions to create a new restore point.

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

• Right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

Reboot your computer


Turn ON System Restore.

• Right-click My Computer.
• ClickProperties.
• Click the System Restore tab.
• UN-Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

Create a new Restore Point <– Very Important

• Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
  You need to go into the Control Panel and switch to Catagory View to be able to Create a New Restore Point

System Restore Tutorial <– If you need it

Run Panda's ActiveScan and perform a full system scan. This will only run with Internet Explorer

• Once you are on the Panda site click the "Scan your PC" button
• A new window will open…click the big "Check Now" button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
• If you are on a slow connection it will take about 15 minuites for the scanner to load.
• Click on "Local Disks" to start the scan
• Once scan is done, click "see report" then "save report"
• Save the log someplace you can find
• Reboot
• Post the Panda scan results in your next reply

Post the OTMoveIt log, the Panda report and one last HJT log please

here is the otmoveit log File/Folder C:\WINDOWS\system32\ewjcboeg.dll not found. File/Folder C:\WINDOWS\system32\toyyoaup.dll not found. OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05282008_185540

Your log looks fine

But look for these and delete them if present, keep them in the Recycle Bin for a day or two to make sure you have no issues

You need to enable windows to show all files and folders, instructions Here

C:\WINDOWS\system32\twtpktrd.exe
C:\WINDOWS\system32\qnglddmc.exe
C:\WINDOWS\system32\uqyamhab.dll
C:\WINDOWS\system32\hxvydoxk.exe
C:\WINDOWS\system32\epwcqvqf.exe



Please download ATF Cleaner by Atribune to your desktop.

• This program is for XP and Windows 2000 only
• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All <–Uncheck the Recycle Bin so we don't delete those files
• Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up

How are things running now???

hola ken i have isolated the files as you suggested .done atf clean and a reboot as of this moment everything seems fine.no pop ups for the last few days and all the cleaning has freed up a lot of disk space.system loading a o k and no noticeable slowdown when its ramping up.if there is anything untoward happening do i need to put a new log up or do i use this one to reply.btw the plasic is out for a donation.