[pecar]

Hello... I have a problem... My PC works very slowly... There are active proceses, but it stops... What should I do?.. My Spy/Ad-ware remover is BPS Spyware Remover and my antivirus software is NOD32, but i have often problems with virus win32/troyandownloader.dyfica.tu troyan in file c\temp\optimize.exe

What should i do ?

Here is my HijackThis log:

Logfile of HijackThis v1.98.1
Scan saved at 10:45:34, on 23.2.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
C:\WINNT\System32\gah95on6.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\UFDisk\UFDisk Format Tool\iFormat.exe
C:\uros\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.24ur.com"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5Cnetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINNT\System32\gah95on6.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [sqlstr] C:\WINNT\System32\sqlstr.exe
O4 - HKCU\..\Run: [vb6stkit] C:\WINNT\System32\vb6stkit.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: iFormat.lnk = C:\Program Files\UFDisk\UFDisk Format Tool\iFormat.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A4BE3F9-D407-4534-987E-E7132B281F2E} (Piezzo ActiveX) - http://www.ex-co.be/ex-co/Piezzo.cab
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.13....chm::/file.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c382.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9E8D2FA1-591C-11D0-BF52-0020AF32BD64} (Borland Midas DSBase 1) - http://www.ex-co.be/ex-co/Midas.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/zd/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{50958C07-AAB0-459A-87AA-FDBD6EFC756A}: NameServer = 212.18.32.12,193.2.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA3A81B4-CF0C-4D28-9FB2-DA8C7283809B}: NameServer = 216.35.46.6,213.197.128.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O20 - AppInit_DLLs: PAVWAIT.DLL

[Advertisements]

Hi and welcome pecar,
If your still looking to resolve this issue,
Please see the following Topic Make sure you have the latest version of Ad-aware and Spybot configure them according to the instructions and run a scan on your system please, Also run the online virus scans,

After you have done that if the following still exist please remove them using HJT


Please restart HJT put a check next to the following, close all open windows and click “ Fix Checked”.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINNT\System32\gah95on6.exe
O4 - HKCU\..\Run: [sqlstr] C:\WINNT\System32\sqlstr.exe
O4 - HKCU\..\Run: [vb6stkit] C:\WINNT\System32\vb6stkit.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.13....chm::/file.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c382.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

Reboot to safe mode ( by tapping the F8 key on start up ) make sure you can view all hidden folders/files View Hidden Folders search for and delete the above files highlighted in BOLD Check Add/Remove programs and delete the folder of the files highlighted in RED

Restart your computer, restart HJT and post back a fresh log.

[don77]

Hi and welcome pecar,
If your still looking to resolve this issue,
Please see the following Topic Make sure you have the latest version of Ad-aware and Spybot configure them according to the instructions and run a scan on your system please, Also run the online virus scans,

After you have done that if the following still exist please remove them using HJT


Please restart HJT put a check next to the following, close all open windows and click “ Fix Checked”.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINNT\System32\gah95on6.exe
O4 - HKCU\..\Run: [sqlstr] C:\WINNT\System32\sqlstr.exe
O4 - HKCU\..\Run: [vb6stkit] C:\WINNT\System32\vb6stkit.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.13....chm::/file.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c382.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

Reboot to safe mode ( by tapping the F8 key on start up ) make sure you can view all hidden folders/files View Hidden Folders search for and delete the above files highlighted in BOLD Check Add/Remove programs and delete the folder of the files highlighted in RED

Restart your computer, restart HJT and post back a fresh log.

[pecar]

This is my new Log:


Logfile of HijackThis v1.99.1
Scan saved at 9:54:03, on 7.3.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\System32\internat.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
C:\WINNT\explorer.exe
C:\uros\HijackThis-nov.exe
C:\Program Files\AdTools Service\AdTools.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.24ur.com"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5Cnetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\PROGRA~1\LAVASOFT\AD-AWA~1\AD-AWARE.EXE" "+b1"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A4BE3F9-D407-4534-987E-E7132B281F2E} (Piezzo ActiveX) - http://www.ex-co.be/ex-co/Piezzo.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9E8D2FA1-591C-11D0-BF52-0020AF32BD64} (Borland Midas DSBase 1) - http://www.ex-co.be/ex-co/Midas.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/zd/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{50958C07-AAB0-459A-87AA-FDBD6EFC756A}: NameServer = 212.18.32.12,193.2.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA3A81B4-CF0C-4D28-9FB2-DA8C7283809B}: NameServer = 216.35.46.6,213.197.128.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O20 - AppInit_DLLs: PAVWAIT.DLL
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[don77]

Getting there,

Please restart HJT put a check next to the following, close all open windows and click “Fix Checked”

O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe

Next reboot to safe mode ( By tapping the F8 key on start up) Make sure you can view all Hidden Files/Folders search for and delete the files highlighted in BOLD

C:\Program Files\AdTools Service\AdToolsKeep.exe <--Delete Folder
C:\Program Files\AdTools Service\AdTools.exe <-- Delete Folder


Restart your computer, Post back a fresh log please

[pecar]

Hello!

Is there anything to do, for speed up my PC ?!


Fresh log:

Logfile of HijackThis v1.99.1
Scan saved at 12:11:34, on 8.3.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\System32\internat.exe
C:\uros\HijackThis-nov.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.24ur.com"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5Cnetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKCU\..\Run: [internat.exe] internat.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A4BE3F9-D407-4534-987E-E7132B281F2E} (Piezzo ActiveX) - http://www.ex-co.be/ex-co/Piezzo.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9E8D2FA1-591C-11D0-BF52-0020AF32BD64} (Borland Midas DSBase 1) - http://www.ex-co.be/ex-co/Midas.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/zd/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{50958C07-AAB0-459A-87AA-FDBD6EFC756A}: NameServer = 212.18.32.12,193.2.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA3A81B4-CF0C-4D28-9FB2-DA8C7283809B}: NameServer = 216.35.46.6,213.197.128.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O20 - AppInit_DLLs: PAVWAIT.DLL
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Aluria Spyware Eliminator Service (ASEService) - Unknown owner - C:\PROGRA~1\ALURIA~1\ASE\ASEServ.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Firebird Server (InterBaseServer) - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[don77]

Hi pecar
I am truely sorry for overlooking your post Just about a month and no reply from me, Again sorry about that,


Nice job your log is clean !
How is it running ?
Please use the following suggestion to help prevent reinfection

Download the following program, For keeping crap off your system to begin with
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests. Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox. Restrict the actions of potentially dangerous sites in Internet Explorer.
Download Spyware Blaster

Keep Ad-aware and Spybot handy, Check them for updates prior to running and run them weekly
Same with your Anti Virus,

For an added check run an online virus scan, you can use one of the 2 below,
TrendMicro's HouseCall
ActiveScan

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
For ease use the following program
Download and install Cleanup
Run "Cleanup" and when it has finished, Reboot

Remeber to Check Windows for updates


Cleaning out your Temp folders ( see above) Also running Ad-aware and free online virus scan to make sure your infection free will also help,

[don77]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.