This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Antivirus XP 2008

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

There is this strange virus that takes control of my task manager and wallpaper. I can't do anything. It tries to get me to download a program called Antivirus XP 2008. A friend referred me here and I'd appreciate anything that can be down.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:04 PM, on 9/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\Symantec Shared\coShared\CW\1.5\CWDefScn.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\pphcp4dj0ee6r.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {0306AFF7-50D1-4AF0-9693-44CE4054FBA4} - (no file)
O2 - BHO: (no name) - {03B902B1-9B25-4173-9468-56775C85A8D4} - (no file)
O2 - BHO: (no name) - {040B3337-2C30-49E9-A8BF-BB51F15B1ABD} - (no file)
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0ACF9D1F-7CB6-4A70-9CCD-8158CE6BBAA8} - (no file)
O2 - BHO: (no name) - {0E3F4BF4-44F1-4A85-B07F-A9440F3D28F6} - (no file)
O2 - BHO: (no name) - {0E473C05-20AE-4C90-8A11-2F851612A6AB} - (no file)
O2 - BHO: (no name) - {0EB92F9F-21A4-4DC1-B32A-2C9251022881} - (no file)
O2 - BHO: (no name) - {0F7626B6-DD11-4372-A6D0-4D2BE56D99C8} - (no file)
O2 - BHO: (no name) - {13E8BEE2-15FC-497B-AB26-51910720C48A} - (no file)
O2 - BHO: (no name) - {15C4D96A-2962-4C0A-BC28-78FD21856D22} - (no file)
O2 - BHO: (no name) - {1625E5F6-3175-4F38-A579-C83E7A188137} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: (no name) - {27F5705D-F637-455A-ABC7-4680726ED348} - (no file)
O2 - BHO: e404 helper - {2C566C34-7D72-4DC1-9BBE-1121A76698F8} - C:\Program Files\Helper\1203535178.dll (file missing)
O2 - BHO: (no name) - {2F4D7F45-EF62-41AC-AAC8-41DBDD04EF8A} - (no file)
O2 - BHO: (no name) - {33622B27-FBBA-4E37-9557-C74FA186CFFA} - (no file)
O2 - BHO: (no name) - {35F12448-1E4B-46B7-B90B-0E34C3607F5A} - (no file)
O2 - BHO: (no name) - {3A37E129-0396-4600-B1CC-0FE30FBC489F} - (no file)
O2 - BHO: (no name) - {3B644363-9BC8-43F3-8608-540AC03075E4} - (no file)
O2 - BHO: (no name) - {3DB5B33B-B81A-4853-BF98-6E1CF8F00E93} - (no file)
O2 - BHO: (no name) - {3F761A39-6FF8-4F86-AFD8-D50C8ADD58E4} - (no file)
O2 - BHO: (no name) - {42CC1A75-8975-4D6D-BD76-F6E90F7FC34D} - (no file)
O2 - BHO: (no name) - {4489DC42-6019-4930-A30D-C2A7C1630890} - C:\WINDOWS\system32\awvvt.dll (file missing)
O2 - BHO: (no name) - {4C28375F-E14B-4485-9162-7E970BFE7A92} - (no file)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5A82C81B-7674-41BA-A9ED-8269EC2897A2} - (no file)
O2 - BHO: (no name) - {5acd9a02-8253-487e-9d03-9861a9c984fa} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5BB8B2CE-EF7C-4322-9682-4B7580EAEECA} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {6181DA21-A8C0-416B-BEB2-82345241E395} - (no file)
O2 - BHO: (no name) - {6189A6FF-F253-421B-A5D2-658A65C013F8} - (no file)
O2 - BHO: (no name) - {61B3751F-29CD-44AA-9361-0A8875FF284A} - (no file)
O2 - BHO: (no name) - {62B2D5BF-B4D7-4A4F-8C15-EA025DD631A1} - (no file)
O2 - BHO: (no name) - {677D13D3-0174-4EE2-BF01-DBBC494FBA30} - (no file)
O2 - BHO: (no name) - {68B314C4-5287-4223-AB27-7D2C83FEBFC3} - (no file)
O2 - BHO: (no name) - {6A11553E-7737-4DA8-8FFD-B6842B415702} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {772CE921-5EEC-403E-B7FB-6B1219C4C443} - (no file)
O2 - BHO: (no name) - {7830F65B-8C8F-492F-BC93-1AE10994AB04} - (no file)
O2 - BHO: (no name) - {7B54CD44-3B29-472B-81E5-C8C6E7B80200} - (no file)
O2 - BHO: (no name) - {7BA618B8-689A-4D4F-B3BE-7EBA555A9208} - (no file)
O2 - BHO: (no name) - {7CDBB414-DD09-46CD-BD12-0175893A2EC6} - (no file)
O2 - BHO: (no name) - {7D08256A-040A-48FF-A0DF-8920A78596A5} - (no file)
O2 - BHO: (no name) - {7DCFC470-D7D7-4B4F-B6BF-68703EBA54FD} - (no file)
O2 - BHO: (no name) - {81613A17-4439-40CA-8EA5-06258091FF50} - (no file)
O2 - BHO: (no name) - {894599F4-1AEE-46F4-9778-FB0AC6876949} - (no file)
O2 - BHO: (no name) - {9039A09D-5495-4EDD-93C5-402F3794FD03} - (no file)
O2 - BHO: (no name) - {92952A86-DBA3-4364-AF1D-F4F448F148F1} - (no file)
O2 - BHO: (no name) - {9821178C-4842-447C-84F9-608538075A82} - (no file)
O2 - BHO: (no name) - {9ABA823F-F2AB-45FF-AF66-93E89B555B0D} - (no file)
O2 - BHO: (no name) - {9AE0D324-3789-4A50-9514-BDF21CF34DE8} - (no file)
O2 - BHO: (no name) - {A572DACF-6701-4833-B50B-797927B19618} - (no file)
O2 - BHO: (no name) - {a657eda9-f306-440f-b574-9f1b22f2b0f2} - (no file)
O2 - BHO: (no name) - {AACA6A3B-D745-4651-80BE-90438D34EBD5} - (no file)
O2 - BHO: (no name) - {ACEB16ED-0B0B-452A-A396-633C0CC71F44} - (no file)
O2 - BHO: (no name) - {B2CDC49B-16E6-49AD-9448-5E1AF40A7D73} - (no file)
O2 - BHO: (no name) - {B2E65D44-74B7-4626-83ED-5C958336183B} - (no file)
O2 - BHO: (no name) - {B60B84A4-22CF-40D6-928C-392C5583A458} - (no file)
O2 - BHO: (no name) - {B790D21D-6EEE-4877-907D-735255A89474} - (no file)
O2 - BHO: (no name) - {B84D1E98-292B-4560-94BD-B2CF40DD2026} - (no file)
O2 - BHO: (no name) - {B86A588B-BDB9-489C-9CB9-F6262D5F4768} - (no file)
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
O2 - BHO: (no name) - {C55826CC-4D72-4C75-863F-F1A1066C88A0} - (no file)
O2 - BHO: (no name) - {C82C2C07-A56B-488B-8E46-C34A4C94B459} - (no file)
O2 - BHO: (no name) - {C87E2269-29F5-4D68-B99B-0B922A0ED69F} - (no file)
O2 - BHO: (no name) - {DF8B7CD5-4833-4A65-9220-91696705072C} - (no file)
O2 - BHO: (no name) - {E2724E3E-76AC-4A97-9C44-52A3C1272074} - (no file)
O2 - BHO: (no name) - {E3CF8D4D-0C3B-4C8A-8EA9-33C9FC3F0791} - (no file)
O2 - BHO: (no name) - {e93a9cd5-5b01-4167-aa68-9dcf89542d38} - (no file)
O2 - BHO: (no name) - {EB37309D-FB81-44ED-8116-3F3EFE234A2C} - (no file)
O2 - BHO: (no name) - {EC5C1B7E-BC05-4981-A641-FE9E50653044} - (no file)
O2 - BHO: (no name) - {F026338B-83D3-48A7-B13A-681A75BD4B6F} - (no file)
O2 - BHO: (no name) - {f077b3cd-62a8-4430-9091-d2388a083c4d} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O2 - BHO: (no name) - {F1CEF16B-D46A-44B7-94BF-F16B4B1C9A5D} - (no file)
O2 - BHO: (no name) - {F2A98D87-3F34-46FE-B1EA-B208EDD661D1} - (no file)
O2 - BHO: (no name) - {F98DC67A-3E99-4BDA-8A93-3EE7C9BE8319} - (no file)
O2 - BHO: (no name) - {FA3D40BA-094C-44E4-9E47-E85168C108A7} - (no file)
O2 - BHO: (no name) - {FB7BB763-CCC0-4B1B-9860-1053A0E85869} - (no file)
O2 - BHO: (no name) - {FE8B087F-0A9D-4B73-BBFC-2E6DA793298F} - (no file)
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [SM_IAN] C:\Program Files\AdvancedCleaner Free\ian_monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [AcctMgr] "C:\Program Files\Common Files\Symantec Shared\coShared\CIM\1.5\AcctMgr.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [SMrhct4dj0ee6r] C:\Program Files\rhct4dj0ee6r\rhct4dj0ee6r.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe
O4 - HKLM\..\Policies\Explorer\Run: [mfsc1D17pB] C:\Documents and Settings\All Users\Application Data\crcxunev\arsbylgt.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B492E2C-C32F-4281-ABAE-940BF87D6233}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCE39F30-8423-4C39-AB8B-509966C211D9}: NameServer = 85.255.116.70,85.255.112.168
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.70 85.255.112.168
O20 - Winlogon Notify: jkkkiij - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\hpzipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 19226 bytes
Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.



Also tell me how your PC is running

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI