[Gameman007]

Getting popups all over the place. Spyware pages, casino popups. Don't know specifically which Trojan. Ran Xoftspy, Trojan Hunter, and Norton Anti-virus but apparently something was missed. Here is my HijackThis log

Logfile of HijackThis v1.99.1
Scan saved at 4:21:27 PM, on 06/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\Apps\Counterspy\sunThreatEngine.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\GoBack\GBPoll.exe
E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
E:\Apps\Counterspy\SunProtectionServer.exe
D:\WINDOWS\system32\sstray.exe
E:\Apps\CloneCD\CloneCDTray.exe
E:\Apps\Counterspy\sunserver.exe
D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Apps\AnyDVD\AnyDVD.exe
D:\Program Files\QuickTime\qttask.exe
E:\Apps\TrojanHunter 4.6\THGuard.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Apps\Maximus\SmallCD.exe
E:\Apps\HP710 XP\Bin\HPOstr05.exe
D:\Program Files\GoBack\GBTray.exe
E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
E:\Apps\Spy Sweeper\WRSSSDK.exe
D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
e:\apps\HP710 XP\bin\HPOVDX05.EXE
D:\WINDOWS\system32\hpoipm07.exe
D:\WINDOWS\system32\wininet.exe
D:\WINDOWS\system32\wininet.exe
D:\WINDOWS\system32\wininet.exe
D:\WINDOWS\system32\wininet.exe
D:\WINDOWS\system32\wininet.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\wininet.exe
D:\Program Files\Internet Explorer\iexplore.exe
E:\Apps\Analyze This\Analyze This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Local Spool Net support DLL - {327C2850-C90E-4D37-AA9E-10AD9BACA46C} - D:\WINDOWS\System32\localsplnet.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AECA2065-4ED8-4670-B795-81811C50020F} - D:\WINDOWS\system32\vtstr.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Apps\Systemworks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - E:\Apps\SpoofStick\SpoofStick.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [MOD] e:\apps\muamgr.exe
O4 - HKLM\..\Run: [CloneCDTray] "E:\Apps\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SunServer] E:\Apps\Counterspy\sunserver.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe
O4 - HKLM\..\Run: [ccApp] D:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AnyDVD] E:\Apps\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "E:\Apps\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: SmallCD.lnk = E:\Apps\Maximus\SmallCD.exe
O4 - Global Startup: HP OfficeJet Series 700 Startup.lnk = E:\Apps\HP710 XP\Bin\HPOstr05.exe
O4 - Global Startup: GoBack.lnk = D:\Program Files\GoBack\GBTray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://D:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Apps\Aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.h...staller_gmn.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefend...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125772621655
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall....ivex/hcImpl.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comne...login-devel.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {C77FB8C0-8B6D-440E-AC26-2BD39E97E8F2} (SpdTCtl Class) - http://speedtest.ade...TESTACTIVEX.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: vtstr - D:\WINDOWS\system32\vtstr.dll
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - D:\WINDOWS\system32\svshost.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GBPoll - Roxio, Inc. - D:\Program Files\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - E:\Apps\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Hopefully you can find out what's causing this mess. plus I get a popup SM something can't open and IE closes. Thanks in advance.

Bill

[Advertisements]

Hi there,
Anybody working on this? Now my icons seem stuck and the computer's crawling. Please help. Thanks,

Bill

[Gameman007]

Hi there,
Anybody working on this? Now my icons seem stuck and the computer's crawling. Please help. Thanks,

Bill

[loophole]

Hi!

Please run a scan with HijackThis and check the following lines for removal:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: Local Spool Net support DLL - {327C2850-C90E-4D37-AA9E-10AD9BACA46C} - D:\WINDOWS\System32\localsplnet.dll

O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - D:\WINDOWS\system32\svshost.dll

Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Exit HijackThis.

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

• Save it to your desktop.
• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  D:\WINDOWS\system32\wininet.exe
  D:\WINDOWS\system32\svshost.dll
  D:\WINDOWS\System32\localsplnet.dll
  
  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

AFTER the reboot

Please download VundoFix.exe to your desktop

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.


Thanks

Edited by loophole, 06 September 2006 - 09:17 PM.

[Gameman007]

Thanks Loophole!! Hopefully this mess of a computer will be cleared up!

Here is the new Hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 3:36:24 PM, on 07/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
E:\Apps\Counterspy\sunThreatEngine.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\GoBack\GBPoll.exe
E:\Apps\Counterspy\SunProtectionServer.exe
E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
D:\WINDOWS\system32\sstray.exe
E:\Apps\CloneCD\CloneCDTray.exe
E:\Apps\Counterspy\sunserver.exe
D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Apps\AnyDVD\AnyDVD.exe
D:\Program Files\QuickTime\qttask.exe
E:\Apps\TrojanHunter 4.6\THGuard.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Apps\Maximus\SmallCD.exe
D:\Program Files\GoBack\GBTray.exe
E:\Apps\HP710 XP\Bin\HPOstr05.exe
E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
E:\Apps\Spy Sweeper\WRSSSDK.exe
D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
e:\apps\HP710 XP\bin\HPOVDX05.EXE
D:\WINDOWS\system32\hpoipm07.exe
E:\Apps\Firefox\firefox.exe
E:\Apps\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FAC9A184-A1AC-4B40-8BB3-372CD0440FFD} - D:\WINDOWS\system32\vtstr.dll (file missing)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Apps\Systemworks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - E:\Apps\SpoofStick\SpoofStick.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CloneCDTray] "E:\Apps\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SunServer] E:\Apps\Counterspy\sunserver.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe
O4 - HKLM\..\Run: [ccApp] D:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AnyDVD] E:\Apps\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "E:\Apps\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: SmallCD.lnk = E:\Apps\Maximus\SmallCD.exe
O4 - Global Startup: GoBack.lnk = D:\Program Files\GoBack\GBTray.exe
O4 - Global Startup: HP OfficeJet Series 700 Startup.lnk = E:\Apps\HP710 XP\Bin\HPOstr05.exe
O8 - Extra context menu item: &AOL Toolbar search - res://D:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Apps\Aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.h...staller_gmn.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125772621655
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall....ivex/hcImpl.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comne...login-devel.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {C77FB8C0-8B6D-440E-AC26-2BD39E97E8F2} (SpdTCtl Class) - http://speedtest.ade...TESTACTIVEX.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GBPoll - Roxio, Inc. - D:\Program Files\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Apps\Systemworks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - E:\Apps\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

and here is the vundoFix log:


VundoFix V6.1.4

Checking Java version...

Java version is 1.5.0.6

Scan started at 2:36:45 PM 07/09/2006

Listing files found while scanning....

D:\WINDOWS\system32\ddcawwt.dll
D:\WINDOWS\system32\vtstr.dll
D:\WINDOWS\system32\rtstv.ini
D:\WINDOWS\system32\rtstv.bak1
D:\WINDOWS\system32\rtstv.bak2
D:\WINDOWS\system32\rtstv.ini2
D:\WINDOWS\system32\rtstv.tmp

Beginning removal...

Attempting to delete D:\WINDOWS\system32\ddcawwt.dll
D:\WINDOWS\system32\ddcawwt.dll Has been deleted!

Attempting to delete D:\WINDOWS\system32\vtstr.dll
D:\WINDOWS\system32\vtstr.dll Could not be deleted.

Attempting to delete D:\WINDOWS\system32\rtstv.ini
D:\WINDOWS\system32\rtstv.ini Has been deleted!

Attempting to delete D:\WINDOWS\system32\rtstv.bak1
D:\WINDOWS\system32\rtstv.bak1 Has been deleted!

Attempting to delete D:\WINDOWS\system32\rtstv.bak2
D:\WINDOWS\system32\rtstv.bak2 Has been deleted!

Attempting to delete D:\WINDOWS\system32\rtstv.ini2
D:\WINDOWS\system32\rtstv.ini2 Has been deleted!

Attempting to delete D:\WINDOWS\system32\rtstv.tmp
D:\WINDOWS\system32\rtstv.tmp Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.1.4

Checking Java version...

Java version is 1.5.0.6

Scan started at 3:03:25 PM 07/09/2006

Listing files found while scanning....

D:\WINDOWS\system32\vtstr.dll

Beginning removal...

Attempting to delete D:\WINDOWS\system32\vtstr.dll
D:\WINDOWS\system32\vtstr.dll Has been deleted!

Performing Repairs to the registry.
Done!


Should I clear out my GoBack and XP Restore history yet?

Thanks again.

Bill

Edited by Gameman007, 07 September 2006 - 01:43 PM.

[loophole]

No, not yet. I have a feeling theres more that hijack cant see

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

After that

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report along with a new hijackthis log.

Edited by loophole, 07 September 2006 - 08:52 PM.

[Gameman007]

Hi Loophole,

Thanks again!! Here is the HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 3:55:03 PM, on 08/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Apps\Counterspy\sunThreatEngine.exe
D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
D:\Program Files\GoBack\GBPoll.exe
E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
E:\Apps\Counterspy\SunProtectionServer.exe
D:\WINDOWS\system32\sstray.exe
E:\Apps\CloneCD\CloneCDTray.exe
E:\Apps\Counterspy\sunserver.exe
D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Common Files\Symantec Shared\ccApp.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Apps\AnyDVD\AnyDVD.exe
D:\Program Files\QuickTime\qttask.exe
E:\Apps\TrojanHunter 4.6\THGuard.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
E:\Apps\Maximus\SmallCD.exe
E:\Apps\Spy Sweeper\WRSSSDK.exe
D:\Program Files\GoBack\GBTray.exe
E:\Apps\HP710 XP\Bin\HPOstr05.exe
D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
e:\apps\HP710 XP\bin\HPOVDX05.EXE
D:\WINDOWS\system32\hpoipm07.exe
D:\Program Files\America Online 9.0\waol.exe
D:\Program Files\America Online 9.0\shellmon.exe
D:\Program Files\Common Files\Aol\aoltpspd.exe
E:\Apps\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FAC9A184-A1AC-4B40-8BB3-372CD0440FFD} - D:\WINDOWS\system32\vtstr.dll (file missing)
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Apps\Systemworks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - E:\Apps\SpoofStick\SpoofStick.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [CloneCDTray] "E:\Apps\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SunServer] E:\Apps\Counterspy\sunserver.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program Files\SymNetDrv\SNDMon.exe
O4 - HKLM\..\Run: [ccApp] D:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] D:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AnyDVD] E:\Apps\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "E:\Apps\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: SmallCD.lnk = E:\Apps\Maximus\SmallCD.exe
O4 - Global Startup: GoBack.lnk = D:\Program Files\GoBack\GBTray.exe
O4 - Global Startup: HP OfficeJet Series 700 Startup.lnk = E:\Apps\HP710 XP\Bin\HPOstr05.exe
O8 - Extra context menu item: &AOL Toolbar search - res://D:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\Common Files\aolshare\Coach\en_en\player\plugin\ToolBar.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Apps\Aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...rl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.h...staller_gmn.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125772621655
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall....ivex/hcImpl.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comne...login-devel.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemreq...m/sysreqlab.cab
O16 - DPF: {C77FB8C0-8B6D-440E-AC26-2BD39E97E8F2} (SpdTCtl Class) - http://speedtest.ade...TESTACTIVEX.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...rl/SymAData.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/...s/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{708CA322-BA0C-4549-9D8C-B6E6035C4789}: NameServer = 205.188.146.145
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GBPoll - Roxio, Inc. - D:\Program Files\GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Apps\Systemworks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Apps\Systemworks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - E:\Apps\SYSTEM~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - E:\Apps\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

The Panda log is in the next reply the posts seem to cut off before the end.

Edited by Gameman007, 08 September 2006 - 02:37 PM.

[Gameman007]

Here is the Panda log:


Incident Status Location

Adware:adware/adsmart Not disinfected d:\windows\system32\vx.tll
Potentially unwanted tool:application/winfixer2005 Not disinfected d:\windows\downloaded program files\UWA6P_0001_N56M1011NetInstaller.exe
Spyware:Cookie/Atwola Not disinfected C:\WINDOWS\Cookies\bill@atwola[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\WINDOWS\Cookies\bill@questionmarket[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/AdDynamix Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/CentrPort Not disinfected C:\WINDOWS\Cookies\bill@centrport[1].txt
Spyware:Cookie/Overture Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/Banner Not disinfected C:\WINDOWS\Cookies\bill@banner[1].txt
Spyware:Cookie/888 Not disinfected C:\WINDOWS\Cookies\bill@888[1].txt
Spyware:Cookie/888 Not disinfected C:\WINDOWS\Cookies\bill@888[2].txt
Spyware:Cookie/Cassava Not disinfected C:\WINDOWS\Cookies\bill@cassava[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\WINDOWS\Cookies\bill@atdmt[2].txt
Spyware:Cookie/2o7 Not disinfected C:\WINDOWS\Cookies\bill@2o7[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\WINDOWS\Cookies\bill@serving-sys[2].txt
Spyware:Cookie/Com.com Not disinfected C:\WINDOWS\Cookies\bill@com[2].txt
Spyware:Cookie/Atwola Not disinfected C:\WINDOWS\Cookies\bill@atwola[2].txt
Spyware:Cookie/FastClick Not disinfected C:\WINDOWS\Cookies\bill@fastclick[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\WINDOWS\Cookies\bill@mediaplex[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\WINDOWS\Cookies\bill@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/Linksynergy Not disinfected C:\WINDOWS\Cookies\bill@linksynergy[1].txt
Spyware:Cookie/Maxserving Not disinfected C:\WINDOWS\Cookies\bill@maxserving[1].txt
Spyware:Cookie/Advertising Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/DomainSponsor Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/YieldManager Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/SpyLog Not disinfected C:\WINDOWS\Cookies\bill@spylog[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\WINDOWS\Cookies\bill@cgi-bin[1].txt
Spyware:Cookie/Falkag Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/Clickbank Not disinfected C:\WINDOWS\Cookies\bill@clickbank[1].txt
Spyware:Cookie/2o7 Not disinfected C:\WINDOWS\Cookies\anyuser@2o7[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/Hitbox Not disinfected C:\WINDOWS\Cookies\bill@hitbox[1].txt
Spyware:Cookie/WUpd Not disinfected C:\WINDOWS\Cookies\bill@revenue[1].txt
Spyware:Cookie/WebPower Not disinfected C:\WINDOWS\Cookies\bill@webpower[2].txt
Spyware:Cookie/Sextracker Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/Sextracker Not disinfected C:\WINDOWS\Cookies\[email protected][1].txt
Spyware:Cookie/Sextracker Not disinfected C:\WINDOWS\Cookies\bill@sextracker[2].txt
Spyware:Cookie/HotLog Not disinfected C:\WINDOWS\Cookies\bill@hotlog[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\WINDOWS\Cookies\bill@tribalfusion[1].txt
Spyware:Cookie/2o7 Not disinfected C:\WINDOWS\Cookies\bill@2o7[3].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\WINDOWS\Cookies\[email protected][2].txt
Spyware:Cookie/Advertising Not disinfected C:\WINDOWS\Cookies\bill@advertising[1].txt
Spyware:Cookie/Advertising Not disinfected C:\WINDOWS\Cookies\anyuser@advertising[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\WINDOWS\Cookies\bill@statcounter[1].txt
Spyware:Cookie/2o7 Not disinfected C:\WINDOWS\Cookies\bill@2o7[4].txt
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.club.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.cdfreaks.com/]
Spyware:Cookie/Serving-sys Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.fastclick.net/]
Spyware:Cookie/Doubleclick Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.doubleclick.net/]
Spyware:Cookie/Atwola Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.advertising.com/]
Spyware:Cookie/BurstNet Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.burstnet.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.maxserving.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.trafficmp.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.maxserving.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.realmedia.com/]
Spyware:Cookie/Valueclick Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.valueclick.com/]
Spyware:Cookie/Adrevolver Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.ads.pointroll.com/]
Spyware:Cookie/Mediaplex Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.mediaplex.com/]
Spyware:Cookie/Clicktracks Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.stats1.clicktracks.com/]
Spyware:Cookie/WUpd Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[.revenue.net/]
Spyware:Cookie/DomainSponsor Not disinfected D:\RECYCLED\NPROTECT\00200541.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.club.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.cdfreaks.com/]
Spyware:Cookie/Serving-sys Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.fastclick.net/]
Spyware:Cookie/Doubleclick Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.doubleclick.net/]
Spyware:Cookie/Atwola Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.advertising.com/]
Spyware:Cookie/BurstNet Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.burstnet.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.maxserving.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.trafficmp.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.maxserving.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.realmedia.com/]
Spyware:Cookie/Valueclick Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.valueclick.com/]
Spyware:Cookie/Adrevolver Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.ads.pointroll.com/]
Spyware:Cookie/Mediaplex Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.mediaplex.com/]
Spyware:Cookie/Clicktracks Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.stats1.clicktracks.com/]
Spyware:Cookie/WUpd Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[.revenue.net/]
Spyware:Cookie/DomainSponsor Not disinfected D:\RECYCLED\NPROTECT\00199395.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.club.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.cdfreaks.com/]
Spyware:Cookie/Serving-sys Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.fastclick.net/]
Spyware:Cookie/Doubleclick Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.doubleclick.net/]
Spyware:Cookie/Atwola Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.advertising.com/]
Spyware:Cookie/BurstNet Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.burstnet.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.maxserving.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.trafficmp.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.maxserving.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.realmedia.com/]
Spyware:Cookie/Valueclick Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.valueclick.com/]
Spyware:Cookie/Adrevolver Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.ads.pointroll.com/]
Spyware:Cookie/Mediaplex Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.mediaplex.com/]
Spyware:Cookie/Clicktracks Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.stats1.clicktracks.com/]
Spyware:Cookie/WUpd Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[.revenue.net/]
Spyware:Cookie/DomainSponsor Not disinfected D:\RECYCLED\NPROTECT\00199390.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.club.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.cdfreaks.com/]
Spyware:Cookie/Serving-sys Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.fastclick.net/]
Spyware:Cookie/Doubleclick Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.doubleclick.net/]
Spyware:Cookie/Atwola Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.advertising.com/]
Spyware:Cookie/BurstNet Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.burstnet.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.maxserving.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.trafficmp.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.maxserving.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.realmedia.com/]
Spyware:Cookie/Valueclick Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.valueclick.com/]
Spyware:Cookie/Adrevolver Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.ads.pointroll.com/]
Spyware:Cookie/Mediaplex Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.mediaplex.com/]
Spyware:Cookie/Clicktracks Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.stats1.clicktracks.com/]
Spyware:Cookie/WUpd Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[.revenue.net/]
Spyware:Cookie/DomainSponsor Not disinfected D:\RECYCLED\NPROTECT\00199391.MOZ[landing.domainsponsor.com/]
Spyware:Spyware/Virtumonde Not disinfected D:\RECYCLED\NPROTECT\00200036.dll
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.club.cdfreaks.com/]
Spyware:Cookie/Cd Freaks Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.cdfreaks.com/]
Spyware:Cookie/Serving-sys Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.serving-sys.com/]
Spyware:Cookie/Atlas DMT Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.atdmt.com/]
Spyware:Cookie/QuestionMarket Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.questionmarket.com/]
Spyware:Cookie/FastClick Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.fastclick.net/]
Spyware:Cookie/Doubleclick Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.doubleclick.net/]
Spyware:Cookie/Atwola Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.atwola.com/]
Spyware:Cookie/Advertising Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.advertising.com/]
Spyware:Cookie/BurstNet Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.burstnet.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.maxserving.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.trafficmp.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/Maxserving Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.maxserving.com/]
Spyware:Cookie/YieldManager Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[ad.yieldmanager.com/]
Spyware:Cookie/RealMedia Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.realmedia.com/]
Spyware:Cookie/Valueclick Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.valueclick.com/]
Spyware:Cookie/Adrevolver Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.adrevolver.com/]
Spyware:Cookie/PointRoll Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.ads.pointroll.com/]
Spyware:Cookie/Mediaplex Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.mediaplex.com/]
Spyware:Cookie/Clicktracks Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.stats1.clicktracks.com/]
Spyware:Cookie/WUpd Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[.revenue.net/]
Spyware:Cookie/DomainSponsor Not disinfected D:\RECYCLED\NPROTECT\00200134.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/Cd Freaks Not disinfected

[loophole]

Hi

Did you run ATF Cleaner? alot of thos entries should have went away. Please run it again if you did.

killbox

• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  d:\windows\system32\vx.tll
  d:\windows\downloaded program files\UWA6P_0001_N56M1011NetInstaller.exe
  
  
  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

after the reboot

1) Right-click the Recycle Bin icon, and choose Properties.
2) Select the Global tab.
3) Select the "Use One Settings for All Drives" radio button.
4) Select the Recycle Bin tab.
5) Select the "Standard Recycle Bin" radio button.
6) Change the text in the Title box to "Recycle Bin."
7) Uncheck "Show Norton Protection Status" if possible.
8) Select the Norton Protection tab.
9) Select a drive and uncheck Enable Protection. Repeat for each drive.
10) Select the "Also Empty Protected Files" option.
11) Click OK twice.
12) Reboot the computer.

Hows the computer running

[Gameman007]

Hi Loophole,

The computer is running perfectly!! No popups and faster than it's run in ages. Thanks again for all your time and help!!

Bill

[loophole]

Glad to hear it. Just do the below and we are done

Please run a scan with HijackThis and check the following lines for removal:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: (no name) - {FAC9A184-A1AC-4B40-8BB3-372CD0440FFD} - D:\WINDOWS\system32\vtstr.dll (file missing)

Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Exit HijackThis.

We have a couple of last steps to perform and then you're all set.

First, let's reset your hidden/system files and folders if we unhid them. System files are hidden for a reason and we don't want to have them openly available and susceptible to accidental deletion.
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Under the Hidden files and folders heading UNSELECT Show hidden files and folders.
* CHECK the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
Next, let's clean your restore points and set a new one:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Restart your computer.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
[/list]System Restore will now be active again.

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them:

• SpywareBlaster to help prevent spyware from installing in the first place.
• SpywareGuard to catch and block spyware before it can execute.
• IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

You should also have a good firewall. Here are 3 free ones available for personal use:

• Sygate Personal Firewall
• Kerio Personal Firewall
• ZoneAlarm

and a good antivirus (these are also free for personal use):

• AVG Anti-Virus
• Avast Home Edition

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

monthly. And to keep your system clean run these free malware scanners

• AdAware SE Personal
• Spybot Search & Destroy

weekly, and be aware of what emails you open and websites you visit.

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?