Trojan horse lop A [RESOLVED]

Because you have the lop infection we first going to see where it hides, you do that as followed

Download Findlop by Metallica. Unzip it to your desktop.
Double click findlop.bat. It will open a notepad file.
Copy the content of that file and past it here in your reply.

Perform an online scan with Internet Explorer with Panda ActiveScan

• Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
• Click Scan Now
• Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls

Begin the scan by selecting My Computer

• If it finds any malware, it will offer you a report.
• Click on see report. Then click Save report

Post the contents of the report in your next reply along with a new HJT log

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan

Please post:
1: fresh hijackThis log
2: panda log
3: findlop log

Here's my findlop, I shall have to do the other two tonight when I get home from work.

[TRACE] Enumerating jobs and queues
[TRACE] Activating job 'AF48B5A7918F2757.job'
[TRACE] Printing all job properties

ApplicationName: 'c:\docume~1\vick\applic~1\second~1\logbarbknob.exe'
Parameters: ''
WorkingDirectory: ''
Comment: ''
Creator: 'Vick'
Priority: NORMAL
MaxRunTime: 259200000 (3d 0:00:00)
IdleWait: 10
IdleDeadline: 60
MostRecentRun: 04/09/2006 19:00:00
NextRun: 04/26/2006 9:00:00
StartError: S_OK
ExitCode: 0
Status: SCHED_S_TASK_READY
ScheduledWorkItem Flags:
DeleteWhenDone = 0
Suspend = 0
StartOnlyIfIdle = 0
KillOnIdleEnd = 0
RestartOnIdleResume = 0
DontStartIfOnBatteries = 0
KillIfGoingOnBatteries = 0
RunOnlyIfLoggedOn = 1
SystemRequired = 0
Hidden = 1
TaskFlags: 0

1 Trigger

Trigger 0:
Type: Daily
DaysInterval: 1
StartDate: 10/08/1997
EndDate: 00/00/0000
StartTime: 00:00
MinutesDuration: 1440
MinutesInterval: 60
Flags:
HasEndDate = 0
KillAtDuration = 0
Disabled = 0

Edited by lenore2, 27 April 2006 - 01:05 AM.

Panda scan

Incident Status Location

Spyware:spyware/media-motor Not disinfected c:\windows\unstall.exe
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.advertising.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.atdmt.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.advertising.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.winfixer.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.xmts.net/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.2o7.net/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.burstnet.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.adviva.net/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.apmebf.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.overture.com/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.adtech.de/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.realmedia.com/]
Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.targetnet.com/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.bravenet.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.fastclick.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.bfast.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.questionmarket.com/]
Spyware:Cookie/24/7 Realmedia Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.atwola.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[sel.as-eu.falkag.net/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.statcounter.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.maxserving.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.xiti.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.hitbox.com/]
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.did-it.com/]
Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.seeq.com/]
Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[www48.seeq.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.toplist.cz/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.belnk.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[landing.domainsponsor.com/]
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[searchportal.information.com/]
Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.tickle.com/]
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.gostats.com/]
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.offeroptimizer.com/]
Spyware:Cookie/Tucows Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\jigwzb7f.Default User\cookies.txt[.tucows.com/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\k4ejyyld.default\cookies.txt[.bravenet.com/]
Spyware:Cookie/Rightmedia Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\k4ejyyld.default\cookies.txt[rightmedia.net/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Becka\Application Data\Mozilla\Firefox\Profiles\k4ejyyld.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Becka\Cookies\becka@2o7[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Becka\Cookies\becka@adrevolver[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Becka\Cookies\becka@adrevolver[3].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Becka\Cookies\becka@adtech[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Becka\Cookies\becka@advertising[1].txt
Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Becka\Cookies\becka@adviva[2].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][2].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Becka\Cookies\becka@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Becka\Cookies\becka@atwola[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Becka\Cookies\becka@bluestreak[1].txt
Spyware:Cookie/Bs.serving-sys Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Becka\Cookies\becka@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Becka\Cookies\becka@mediaplex[1].txt
Spyware:Cookie/Microsofte Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Becka\Cookies\becka@questionmarket[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Becka\Cookies\becka@serving-sys[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Becka\Cookies\becka@statcounter[1].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Becka\Cookies\[email protected][2].txt
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Becka\Cookies\becka@xmts[2].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Becka\Cookies\becka@zedo[1].txt
Potentially unwanted tool:Application/ErrorSafe Not disinfected C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\6g80s3yw.default\Cache\ACD008F5d01
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\6g80s3yw.default\cookies.txt[.errorsafe.com/]
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\6g80s3yw.default\cookies.txt[stats1.reliablestats.com/]
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\6g80s3yw.default\cookies.txt[.winfixer.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Dom\Cookies\dom@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Dom\Cookies\dom@atdmt[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Dom\Cookies\dom@doubleclick[2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Dom\Cookies\dom@mediaplex[1].txt


Hijack this-Logfile of HijackThis v1.99.1
Scan saved at 08:06:14, on 27/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CConnect\CConnect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Becka\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wwe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Please open Notepad, and copy/paste the code in the white box below into a new text file. Save it as "delete.bat" With the quotation marks and save it on your Desktop.

@ECHO OFF
attrib -s -r -h c:\docume~1\vick\applic~1\second~1\*.*
del /q c:\docume~1\vick\applic~1\second~1\*.*
rd /q /s c:\docume~1\vick\applic~1\second~1
attrib -s -r -h "C:\windows\tasks\AF48B5A7918F2757.job"
del "C:\windows\tasks\AF48B5A7918F2757.job"
attrib -s -r -h "c:\windows\unstall.exe"
del "c:\windows\unstall.exe"

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Double click the file Delete.bat that we save on your desktop now, a dos window will flash, this is normal.

after this, please reboot back into normal mode and give me a status update on your machine.
Skate

Edited by skate_punk_21, 27 April 2006 - 10:13 PM.

I've done everything you told me to do up there, I'm assuming you want me to post another Hijack this log? here's one anyway.

Logfile of HijackThis v1.99.1
Scan saved at 08:08:57, on 28/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5346.0005)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CConnect\CConnect.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Becka\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wwe.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....cid={SUB_CLCID}
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

Everything looks super from here

Congratulations Your Log is Clean!!

Now we have a few cleanup items...


Hidden Files/Folders
Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is DISABLED. Also make sure that the System Files and Folders are NOT showing / visible. Lastly, CHECK the Hide protected operating system files option.


System Restore
Turn off System Restore by Clicking Start > right-click My Computer and then click Properties. Click the System Restore tab > Check "Turn off System Restore" or "Turn off System Restore on all drives". Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this. Click OK.

-->To Turn system restore back on: Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.


Preventative Measures
This is a good time to set up protection against further attacks. Read How Did I Get Infected In The First Place?.

Also Consider...

• SpywareBlaster to help prevent spyware from installing in the first place.
  
• SpywareGuard to catch and block spyware before it can execute.
  
• IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

You should also have a good firewall. Here are 4 free ones available for personal use:

• ZoneAlarm
  
• Avast Antivirus/Firewall
  
• Tiny Personal Firewall
  
• OutPost Firewall

How is she running now? Any further problems? If not, Good work, and Happy Computing!

Those are about as close as I can get to party icons! Excellent.

I shall do the cleanup in a bit, I'm currently at work

I'll let you know once I've done the cleanups what shes like

Well I've done the clean up and she seems good. If not better than before.

Cheers dude!

Good to hear! glad i could help you out
Skate

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.