[pgb]

Hello there,
I'm having a terrible time with this Danger : Spyware desktop. I've tried everything I have learnt from this site i.e ran Ad-Aware SE, Spybot ... still no luck .... would be most grateful for some

Here is my hijack this log..

Thank you

Logfile of HijackThis v1.99.1
Scan saved at 12:08:25 AM, on 4/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Kbr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\WINDOWS\System32\ntddetect.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Vog] C:\WINDOWS\Kbr.exe
O4 - HKLM\..\Run: [Vil] C:\WINDOWS\System32\Ppk.exe
O4 - HKLM\..\Run: [Vfa] C:\WINDOWS\System32\Obd.exe
O4 - HKLM\..\Run: [Usl] C:\WINDOWS\System32\Gbb.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Uls] C:\WINDOWS\System32\Qrt.exe
O4 - HKLM\..\Run: [Uli] C:\WINDOWS\Bih.exe
O4 - HKLM\..\Run: [Uil] C:\WINDOWS\System32\Nte.exe
O4 - HKLM\..\Run: [Ufc] C:\WINDOWS\System32\Dje.exe
O4 - HKLM\..\Run: [Ubo] C:\WINDOWS\Nik.exe
O4 - HKLM\..\Run: [Tqv] C:\WINDOWS\System32\Dmu.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Tbb] C:\WINDOWS\System32\App.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Snu] C:\WINDOWS\System32\Gvm.exe
O4 - HKLM\..\Run: [Sls] C:\WINDOWS\Rkh.exe
O4 - HKLM\..\Run: [Ska] C:\WINDOWS\System32\Mjn.exe
O4 - HKLM\..\Run: [Seu] C:\WINDOWS\System32\Iof.exe
O4 - HKLM\..\Run: [See] C:\WINDOWS\Pas.exe
O4 - HKLM\..\Run: [rzvogi] C:\WINDOWS\System32\bmnshd.exe
O4 - HKLM\..\Run: [Rta] C:\WINDOWS\System32\Hqe.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Qtu] C:\WINDOWS\Neh.exe
O4 - HKLM\..\Run: [Qsj] C:\WINDOWS\System32\Jnr.exe
O4 - HKLM\..\Run: [Qsc] C:\WINDOWS\System32\Tjd.exe
O4 - HKLM\..\Run: [Qjr] C:\WINDOWS\System32\Bkd.exe
O4 - HKLM\..\Run: [Qfb] C:\WINDOWS\Itu.exe
O4 - HKLM\..\Run: [Qas] C:\WINDOWS\Kgh.exe
O4 - HKLM\..\Run: [Qap] C:\WINDOWS\Flk.exe
O4 - HKLM\..\Run: [Pvr] C:\WINDOWS\Dhb.exe
O4 - HKLM\..\Run: [Pfc] C:\WINDOWS\Jhb.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [Ota] C:\WINDOWS\For.exe
O4 - HKLM\..\Run: [Oqq] C:\WINDOWS\Kii.exe
O4 - HKLM\..\Run: [Oov] C:\WINDOWS\System32\Jff.exe
O4 - HKLM\..\Run: [Onr] C:\WINDOWS\Muk.exe
O4 - HKLM\..\Run: [Onf] C:\WINDOWS\Cde.exe
O4 - HKLM\..\Run: [Ogo] C:\WINDOWS\Htu.exe
O4 - HKLM\..\Run: [Oep] C:\WINDOWS\System32\Uja.exe
O4 - HKLM\..\Run: [Obh] C:\WINDOWS\System32\Quj.exe
O4 - HKLM\..\Run: [Nut] C:\WINDOWS\Rhg.exe
O4 - HKLM\..\Run: [ntddetect] C:\WINDOWS\System32\ntddetect.exe
O4 - HKLM\..\Run: [NetSpyProtector] C:\Program Files\NetSpy Protector\netspyprotector.exe
O4 - HKLM\..\Run: [Nco] C:\WINDOWS\Hio.exe
O4 - HKLM\..\Run: [Msg] C:\WINDOWS\System32\Kbl.exe
O4 - HKLM\..\Run: [Mbg] C:\WINDOWS\Vhi.exe
O4 - HKLM\..\Run: [Les] C:\WINDOWS\Lde.exe
O4 - HKLM\..\Run: [Lbj] C:\WINDOWS\Mqn.exe
O4 - HKLM\..\Run: [Lai] C:\WINDOWS\System32\Geq.exe
O4 - HKLM\..\Run: [Lag] C:\WINDOWS\System32\Psj.exe
O4 - HKLM\..\Run: [Kct] C:\WINDOWS\Csv.exe
O4 - HKLM\..\Run: [Jvd] C:\WINDOWS\Rhd.exe
O4 - HKLM\..\Run: [Iuj] C:\WINDOWS\System32\Nji.exe
O4 - HKLM\..\Run: [Isa] C:\WINDOWS\Ugl.exe
O4 - HKLM\..\Run: [Hvf] C:\WINDOWS\System32\Tnm.exe
O4 - HKLM\..\Run: [Hoi] C:\WINDOWS\System32\Rjh.exe
O4 - HKLM\..\Run: [Him] C:\WINDOWS\Kjg.exe
O4 - HKLM\..\Run: [Hgn] C:\WINDOWS\Due.exe
O4 - HKLM\..\Run: [Hfj] C:\WINDOWS\Ilu.exe
O4 - HKLM\..\Run: [Gsu] C:\WINDOWS\Rok.exe
O4 - HKLM\..\Run: [Gpc] C:\WINDOWS\System32\Lhv.exe
O4 - HKLM\..\Run: [Gov] C:\WINDOWS\Idr.exe
O4 - HKLM\..\Run: [Gmr] C:\WINDOWS\Dqh.exe
O4 - HKLM\..\Run: [Fak] C:\WINDOWS\Etn.exe
O4 - HKLM\..\Run: [Esp] C:\WINDOWS\Ctp.exe
O4 - HKLM\..\Run: [Esh] C:\WINDOWS\Svb.exe
O4 - HKLM\..\Run: [Ekv] C:\WINDOWS\System32\Eqd.exe
O4 - HKLM\..\Run: [Eef] C:\WINDOWS\Pfc.exe
O4 - HKLM\..\Run: [Dvt] C:\WINDOWS\Tfj.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [Clu] C:\WINDOWS\Mik.exe
O4 - HKLM\..\Run: [Cjf] C:\WINDOWS\System32\Njq.exe
O4 - HKLM\..\Run: [Cfg] C:\WINDOWS\Rrq.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Bmn] C:\WINDOWS\System32\Eru.exe
O4 - HKLM\..\Run: [Bca] C:\WINDOWS\System32\Qsf.exe
O4 - HKLM\..\Run: [Apb] C:\WINDOWS\Gag.exe
O4 - HKLM\..\Run: [Akt] C:\WINDOWS\System32\Jcc.exe
O4 - HKLM\..\Run: [Pco] C:\WINDOWS\Nnc.exe
O4 - HKLM\..\Run: [Etl] C:\WINDOWS\System32\Iik.exe
O4 - HKLM\..\Run: [For] C:\WINDOWS\Ucb.exe
O4 - HKLM\..\Run: [Jlc] C:\WINDOWS\Jrk.exe
O4 - HKLM\..\Run: [Grq] C:\WINDOWS\Ipg.exe
O4 - HKLM\..\Run: [Cjv] C:\WINDOWS\System32\Too.exe
O4 - HKLM\..\Run: [Mgs] C:\WINDOWS\System32\Sek.exe
O4 - HKLM\..\Run: [Kmg] C:\WINDOWS\Lro.exe
O4 - HKLM\..\Run: [Jpd] C:\WINDOWS\Ppo.exe
O4 - HKLM\..\Run: [Jjp] C:\WINDOWS\Jhg.exe
O4 - HKLM\..\Run: [Jsr] C:\WINDOWS\Rcu.exe
O4 - HKLM\..\Run: [Gam] C:\WINDOWS\System32\Hje.exe
O4 - HKLM\..\Run: [Dho] C:\WINDOWS\Nrq.exe
O4 - HKLM\..\Run: [Pda] C:\WINDOWS\System32\Sqq.exe
O4 - HKLM\..\Run: [Upc] C:\WINDOWS\System32\Bek.exe
O4 - HKLM\..\Run: [Qbo] C:\WINDOWS\Hao.exe
O4 - HKLM\..\Run: [Eli] C:\WINDOWS\Kkq.exe
O4 - HKLM\..\Run: [Uqf] C:\WINDOWS\System32\Evf.exe
O4 - HKLM\..\Run: [Gus] C:\WINDOWS\System32\Utf.exe
O4 - HKLM\..\Run: [Kjc] C:\WINDOWS\Irb.exe
O4 - HKLM\..\Run: [Rkv] C:\WINDOWS\Jeo.exe
O4 - HKLM\..\Run: [Gqo] C:\WINDOWS\System32\Tie.exe
O4 - HKLM\..\Run: [Jim] C:\WINDOWS\System32\Cnp.exe
O4 - HKLM\..\Run: [Itt] C:\WINDOWS\System32\Nnc.exe
O4 - HKLM\..\Run: [Hnt] C:\WINDOWS\System32\Pec.exe
O4 - HKLM\..\Run: [Lht] C:\WINDOWS\System32\Hjc.exe
O4 - HKLM\..\Run: [Sve] C:\WINDOWS\System32\Osp.exe
O4 - HKLM\..\Run: [Ohm] C:\WINDOWS\System32\Dbj.exe
O4 - HKLM\..\Run: [Ssm] C:\WINDOWS\System32\Rvb.exe
O4 - HKLM\..\Run: [Isq] C:\WINDOWS\Gpf.exe
O4 - HKLM\..\RunServices: [ntddetect] C:\WINDOWS\System32\ntddetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - C:\WINDOWS\System32\remove_me.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - C:\WINDOWS\System32\remove_me.dll (file missing) (HKCU)
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://69.50.166.213...hm::/update.exe
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Advertisements]

Hi pgb and welcome to the Geeks to Go Forums.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"

3. I want you to run at least one, and preferably both, of the following FREE online antivirus scanners, making sure that you choose to do a "complete scan" and letting the program fix everything it finds. It is also necessary to REBOOT your system after running each program.

TrendMicro Free Virus Scanner and Panda Software Online Virus Scanner.


4. I would also like you to download and run a free trial version of an anti-trojan program called Trojan Hunter: Trojan Hunter . Let it scan your whole system and remove anything it finds.

REBOOT your system.

5. I want you to download the most current versionof Ad-Aware and Spybot Search and Destroy, install, configure, update and run them according to the instructions provided below (In my signature panel)

Remember, it is important that you REBOOT your system after having run each one

6. It is now time to run HijackThis with all windows closed excepr for HijackThis, click on SCAN, produce a log and Post it back into this thread.

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

Regards,

Trevuren

[Trevuren]

Hi pgb and welcome to the Geeks to Go Forums.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

My name is Trevuren and I will be helping you with your log.

1. Go to Geeks to Go
. Click on My Controls at the top right hand corner of the window. (make sure you have signed in first)
. In the left hand column, click "View Topics"
. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"

3. I want you to run at least one, and preferably both, of the following FREE online antivirus scanners, making sure that you choose to do a "complete scan" and letting the program fix everything it finds. It is also necessary to REBOOT your system after running each program.

TrendMicro Free Virus Scanner and Panda Software Online Virus Scanner.


4. I would also like you to download and run a free trial version of an anti-trojan program called Trojan Hunter: Trojan Hunter . Let it scan your whole system and remove anything it finds.

REBOOT your system.

5. I want you to download the most current versionof Ad-Aware and Spybot Search and Destroy, install, configure, update and run them according to the instructions provided below (In my signature panel)

Remember, it is important that you REBOOT your system after having run each one

6. It is now time to run HijackThis with all windows closed excepr for HijackThis, click on SCAN, produce a log and Post it back into this thread.

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

Regards,

Trevuren

[pgb]

Hello Trevuren,

I did as you instructed ... here is my new log. I also have attached the activescan log from the Panda virus scan in case it is of help .

Thanking you again for your help.

Logfile of HijackThis v1.99.1
Scan saved at 5:32:41 PM, on 4/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Kbr.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Vog] C:\WINDOWS\Kbr.exe
O4 - HKLM\..\Run: [Vil] C:\WINDOWS\System32\Ppk.exe
O4 - HKLM\..\Run: [Vfa] C:\WINDOWS\System32\Obd.exe
O4 - HKLM\..\Run: [Usl] C:\WINDOWS\System32\Gbb.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Uls] C:\WINDOWS\System32\Qrt.exe
O4 - HKLM\..\Run: [Uli] C:\WINDOWS\Bih.exe
O4 - HKLM\..\Run: [Uil] C:\WINDOWS\System32\Nte.exe
O4 - HKLM\..\Run: [Ufc] C:\WINDOWS\System32\Dje.exe
O4 - HKLM\..\Run: [Ubo] C:\WINDOWS\Nik.exe
O4 - HKLM\..\Run: [Tqv] C:\WINDOWS\System32\Dmu.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Tbb] C:\WINDOWS\System32\App.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Snu] C:\WINDOWS\System32\Gvm.exe
O4 - HKLM\..\Run: [Sls] C:\WINDOWS\Rkh.exe
O4 - HKLM\..\Run: [Ska] C:\WINDOWS\System32\Mjn.exe
O4 - HKLM\..\Run: [Seu] C:\WINDOWS\System32\Iof.exe
O4 - HKLM\..\Run: [See] C:\WINDOWS\Pas.exe
O4 - HKLM\..\Run: [rzvogi] C:\WINDOWS\System32\bmnshd.exe
O4 - HKLM\..\Run: [Rta] C:\WINDOWS\System32\Hqe.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Qtu] C:\WINDOWS\Neh.exe
O4 - HKLM\..\Run: [Qsj] C:\WINDOWS\System32\Jnr.exe
O4 - HKLM\..\Run: [Qsc] C:\WINDOWS\System32\Tjd.exe
O4 - HKLM\..\Run: [Qjr] C:\WINDOWS\System32\Bkd.exe
O4 - HKLM\..\Run: [Qfb] C:\WINDOWS\Itu.exe
O4 - HKLM\..\Run: [Qas] C:\WINDOWS\Kgh.exe
O4 - HKLM\..\Run: [Qap] C:\WINDOWS\Flk.exe
O4 - HKLM\..\Run: [Pvr] C:\WINDOWS\Dhb.exe
O4 - HKLM\..\Run: [Pfc] C:\WINDOWS\Jhb.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [Ota] C:\WINDOWS\For.exe
O4 - HKLM\..\Run: [Oqq] C:\WINDOWS\Kii.exe
O4 - HKLM\..\Run: [Oov] C:\WINDOWS\System32\Jff.exe
O4 - HKLM\..\Run: [Onr] C:\WINDOWS\Muk.exe
O4 - HKLM\..\Run: [Onf] C:\WINDOWS\Cde.exe
O4 - HKLM\..\Run: [Ogo] C:\WINDOWS\Htu.exe
O4 - HKLM\..\Run: [Oep] C:\WINDOWS\System32\Uja.exe
O4 - HKLM\..\Run: [Obh] C:\WINDOWS\System32\Quj.exe
O4 - HKLM\..\Run: [Nut] C:\WINDOWS\Rhg.exe
O4 - HKLM\..\Run: [Nco] C:\WINDOWS\Hio.exe
O4 - HKLM\..\Run: [Msg] C:\WINDOWS\System32\Kbl.exe
O4 - HKLM\..\Run: [Mbg] C:\WINDOWS\Vhi.exe
O4 - HKLM\..\Run: [Les] C:\WINDOWS\Lde.exe
O4 - HKLM\..\Run: [Lbj] C:\WINDOWS\Mqn.exe
O4 - HKLM\..\Run: [Lai] C:\WINDOWS\System32\Geq.exe
O4 - HKLM\..\Run: [Lag] C:\WINDOWS\System32\Psj.exe
O4 - HKLM\..\Run: [Kct] C:\WINDOWS\Csv.exe
O4 - HKLM\..\Run: [Jvd] C:\WINDOWS\Rhd.exe
O4 - HKLM\..\Run: [Iuj] C:\WINDOWS\System32\Nji.exe
O4 - HKLM\..\Run: [Isa] C:\WINDOWS\Ugl.exe
O4 - HKLM\..\Run: [Hvf] C:\WINDOWS\System32\Tnm.exe
O4 - HKLM\..\Run: [Hoi] C:\WINDOWS\System32\Rjh.exe
O4 - HKLM\..\Run: [Him] C:\WINDOWS\Kjg.exe
O4 - HKLM\..\Run: [Hgn] C:\WINDOWS\Due.exe
O4 - HKLM\..\Run: [Hfj] C:\WINDOWS\Ilu.exe
O4 - HKLM\..\Run: [Gsu] C:\WINDOWS\Rok.exe
O4 - HKLM\..\Run: [Gpc] C:\WINDOWS\System32\Lhv.exe
O4 - HKLM\..\Run: [Gov] C:\WINDOWS\Idr.exe
O4 - HKLM\..\Run: [Gmr] C:\WINDOWS\Dqh.exe
O4 - HKLM\..\Run: [Fak] C:\WINDOWS\Etn.exe
O4 - HKLM\..\Run: [Esp] C:\WINDOWS\Ctp.exe
O4 - HKLM\..\Run: [Esh] C:\WINDOWS\Svb.exe
O4 - HKLM\..\Run: [Ekv] C:\WINDOWS\System32\Eqd.exe
O4 - HKLM\..\Run: [Eef] C:\WINDOWS\Pfc.exe
O4 - HKLM\..\Run: [Dvt] C:\WINDOWS\Tfj.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [Clu] C:\WINDOWS\Mik.exe
O4 - HKLM\..\Run: [Cjf] C:\WINDOWS\System32\Njq.exe
O4 - HKLM\..\Run: [Cfg] C:\WINDOWS\Rrq.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Bmn] C:\WINDOWS\System32\Eru.exe
O4 - HKLM\..\Run: [Bca] C:\WINDOWS\System32\Qsf.exe
O4 - HKLM\..\Run: [Apb] C:\WINDOWS\Gag.exe
O4 - HKLM\..\Run: [Akt] C:\WINDOWS\System32\Jcc.exe
O4 - HKLM\..\Run: [Pco] C:\WINDOWS\Nnc.exe
O4 - HKLM\..\Run: [Etl] C:\WINDOWS\System32\Iik.exe
O4 - HKLM\..\Run: [For] C:\WINDOWS\Ucb.exe
O4 - HKLM\..\Run: [Jlc] C:\WINDOWS\Jrk.exe
O4 - HKLM\..\Run: [Grq] C:\WINDOWS\Ipg.exe
O4 - HKLM\..\Run: [Cjv] C:\WINDOWS\System32\Too.exe
O4 - HKLM\..\Run: [Mgs] C:\WINDOWS\System32\Sek.exe
O4 - HKLM\..\Run: [Kmg] C:\WINDOWS\Lro.exe
O4 - HKLM\..\Run: [Jpd] C:\WINDOWS\Ppo.exe
O4 - HKLM\..\Run: [Jjp] C:\WINDOWS\Jhg.exe
O4 - HKLM\..\Run: [Jsr] C:\WINDOWS\Rcu.exe
O4 - HKLM\..\Run: [Gam] C:\WINDOWS\System32\Hje.exe
O4 - HKLM\..\Run: [Dho] C:\WINDOWS\Nrq.exe
O4 - HKLM\..\Run: [Pda] C:\WINDOWS\System32\Sqq.exe
O4 - HKLM\..\Run: [Upc] C:\WINDOWS\System32\Bek.exe
O4 - HKLM\..\Run: [Qbo] C:\WINDOWS\Hao.exe
O4 - HKLM\..\Run: [Eli] C:\WINDOWS\Kkq.exe
O4 - HKLM\..\Run: [Uqf] C:\WINDOWS\System32\Evf.exe
O4 - HKLM\..\Run: [Gus] C:\WINDOWS\System32\Utf.exe
O4 - HKLM\..\Run: [Kjc] C:\WINDOWS\Irb.exe
O4 - HKLM\..\Run: [Rkv] C:\WINDOWS\Jeo.exe
O4 - HKLM\..\Run: [Gqo] C:\WINDOWS\System32\Tie.exe
O4 - HKLM\..\Run: [Jim] C:\WINDOWS\System32\Cnp.exe
O4 - HKLM\..\Run: [Itt] C:\WINDOWS\System32\Nnc.exe
O4 - HKLM\..\Run: [Hnt] C:\WINDOWS\System32\Pec.exe
O4 - HKLM\..\Run: [Lht] C:\WINDOWS\System32\Hjc.exe
O4 - HKLM\..\Run: [Sve] C:\WINDOWS\System32\Osp.exe
O4 - HKLM\..\Run: [Ohm] C:\WINDOWS\System32\Dbj.exe
O4 - HKLM\..\Run: [Ssm] C:\WINDOWS\System32\Rvb.exe
O4 - HKLM\..\Run: [Isq] C:\WINDOWS\Gpf.exe
O4 - HKLM\..\Run: [Ddd] C:\WINDOWS\System32\Gli.exe
O4 - HKLM\..\Run: [Hit] C:\WINDOWS\Kmn.exe
O4 - HKLM\..\Run: [Bks] C:\WINDOWS\System32\Ego.exe
O4 - HKLM\..\Run: [Vqu] C:\WINDOWS\Una.exe
O4 - HKLM\..\Run: [Kqq] C:\WINDOWS\Lqb.exe
O4 - HKLM\..\Run: [Jlb] C:\WINDOWS\System32\Cjm.exe
O4 - HKLM\..\Run: [Kuk] C:\WINDOWS\Efc.exe
O4 - HKLM\..\Run: [Prj] C:\WINDOWS\System32\Ugs.exe
O4 - HKLM\..\Run: [Jfv] C:\WINDOWS\Iov.exe
O4 - HKLM\..\Run: [Jqq] C:\WINDOWS\System32\Lsi.exe
O4 - HKLM\..\Run: [Fbv] C:\WINDOWS\System32\For.exe
O4 - HKLM\..\Run: [Cas] C:\WINDOWS\Pir.exe
O4 - HKLM\..\Run: [Ivs] C:\WINDOWS\Ara.exe
O4 - HKLM\..\Run: [Iuc] C:\WINDOWS\System32\Kgg.exe
O4 - HKLM\..\Run: [Ipb] C:\WINDOWS\Ufg.exe
O4 - HKLM\..\Run: [Omb] C:\WINDOWS\System32\Bik.exe
O4 - HKLM\..\Run: [Kjl] C:\WINDOWS\Qrd.exe
O4 - HKLM\..\Run: [Rfq] C:\WINDOWS\System32\Utl.exe
O4 - HKLM\..\Run: [Hav] C:\WINDOWS\Bfq.exe
O4 - HKLM\..\Run: [Egu] C:\WINDOWS\System32\Ckg.exe
O4 - HKLM\..\Run: [Vhb] C:\WINDOWS\System32\Hns.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Jac] C:\WINDOWS\Udh.exe
O4 - HKLM\..\Run: [Abp] C:\WINDOWS\Ols.exe
O4 - HKLM\..\Run: [Kll] C:\WINDOWS\Vqq.exe
O4 - HKLM\..\Run: [Ufr] C:\WINDOWS\Gnl.exe
O4 - HKLM\..\Run: [Fif] C:\WINDOWS\System32\Nqp.exe
O4 - HKLM\..\Run: [Gbl] C:\WINDOWS\Usi.exe
O4 - HKLM\..\Run: [Ikp] C:\WINDOWS\System32\Qbc.exe
O4 - HKLM\..\Run: [Gqe] C:\WINDOWS\System32\Sts.exe
O4 - HKLM\..\Run: [Nan] C:\WINDOWS\Plo.exe
O4 - HKLM\..\Run: [Ljv] C:\WINDOWS\System32\Cea.exe
O4 - HKLM\..\Run: [Qqj] C:\WINDOWS\Pnt.exe
O4 - HKLM\..\Run: [Fvq] C:\WINDOWS\Mop.exe
O4 - HKLM\..\Run: [Gcf] C:\WINDOWS\System32\Dlo.exe
O4 - HKLM\..\Run: [Vsp] C:\WINDOWS\Rft.exe
O4 - HKLM\..\Run: [Trv] C:\WINDOWS\Khe.exe
O4 - HKLM\..\Run: [Lmg] C:\WINDOWS\System32\Ruu.exe
O4 - HKLM\..\Run: [Cjq] C:\WINDOWS\Fni.exe
O4 - HKLM\..\Run: [Aad] C:\WINDOWS\Hkd.exe
O4 - HKLM\..\Run: [Ggb] C:\WINDOWS\System32\Vgd.exe
O4 - HKLM\..\Run: [Gnb] C:\WINDOWS\System32\Ved.exe
O4 - HKLM\..\Run: [Tha] C:\WINDOWS\Knl.exe
O4 - HKLM\..\Run: [Tfv] C:\WINDOWS\System32\Ljp.exe
O4 - HKLM\..\Run: [Hdd] C:\WINDOWS\System32\Rvq.exe
O4 - HKLM\..\Run: [Vqp] C:\WINDOWS\System32\Koi.exe
O4 - HKLM\..\Run: [Sos] C:\WINDOWS\System32\Fof.exe
O4 - HKLM\..\Run: [Ttp] C:\WINDOWS\Gek.exe
O4 - HKLM\..\Run: [Ndj] C:\WINDOWS\System32\Omj.exe
O4 - HKLM\..\Run: [Ast] C:\WINDOWS\System32\Tlu.exe
O4 - HKLM\..\Run: [Pan] C:\WINDOWS\System32\Ngu.exe
O4 - HKLM\..\Run: [Huk] C:\WINDOWS\Bnu.exe
O4 - HKLM\..\Run: [Eig] C:\WINDOWS\System32\Jrp.exe
O4 - HKLM\..\Run: [Bea] C:\WINDOWS\System32\Qfe.exe
O4 - HKLM\..\Run: [Eil] C:\WINDOWS\Btm.exe
O4 - HKLM\..\Run: [Bsp] C:\WINDOWS\System32\Pao.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.iframedollars.biz
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc...m::/on-line.exe
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://69.50.166.213...hm::/update.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Attached Files

•  Activescan.txt   81.06KB   746 downloads

[Trevuren]

Hi pqb,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.


Please download Winhelp2002's Deldomains.inf to your desktop.

Right-click on the deldomains.inf file and select Install

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection.
Right-click on the deldomains.inf file and select Install

-------------------------------
Now let's do some work on your log:

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Close all browser windows and RUN HijackThis.
. Click the SCAN button to produce a log.
. Click the Config button located in the lower right hand corner of the HijackThis window.
. When the new screen opens, find and click the Miscellaneous Tools button.
. Then choose the Open Process Manager button.
. From the list of processes, hilight the following items by clicking them, ONE AT A TIME, then DELETE them by clicking the KILL button:

C:\WINDOWS\Kbr.exe

Once all items have been KILLED, click the Back button which will return you to the HijackThis main window. Now place a check mark beside each one of the following items:

R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Vog] C:\WINDOWS\Kbr.exe
O4 - HKLM\..\Run: [Vil] C:\WINDOWS\System32\Ppk.exe
O4 - HKLM\..\Run: [Vfa] C:\WINDOWS\System32\Obd.exe
O4 - HKLM\..\Run: [Usl] C:\WINDOWS\System32\Gbb.exe
O4 - HKLM\..\Run: [Uls] C:\WINDOWS\System32\Qrt.exe
O4 - HKLM\..\Run: [Uli] C:\WINDOWS\Bih.exe
O4 - HKLM\..\Run: [Uil] C:\WINDOWS\System32\Nte.exe
O4 - HKLM\..\Run: [Ufc] C:\WINDOWS\System32\Dje.exe
O4 - HKLM\..\Run: [Ubo] C:\WINDOWS\Nik.exe
O4 - HKLM\..\Run: [Tqv] C:\WINDOWS\System32\Dmu.exe
O4 - HKLM\..\Run: [Tbb] C:\WINDOWS\System32\App.exe
O4 - HKLM\..\Run: [Snu] C:\WINDOWS\System32\Gvm.exe
O4 - HKLM\..\Run: [Sls] C:\WINDOWS\Rkh.exe
O4 - HKLM\..\Run: [Ska] C:\WINDOWS\System32\Mjn.exe
O4 - HKLM\..\Run: [Seu] C:\WINDOWS\System32\Iof.exe
O4 - HKLM\..\Run: [See] C:\WINDOWS\Pas.exe
O4 - HKLM\..\Run: [rzvogi] C:\WINDOWS\System32\bmnshd.exe
O4 - HKLM\..\Run: [Rta] C:\WINDOWS\System32\Hqe.exe
O4 - HKLM\..\Run: [Qtu] C:\WINDOWS\Neh.exe
O4 - HKLM\..\Run: [Qsj] C:\WINDOWS\System32\Jnr.exe
O4 - HKLM\..\Run: [Qsc] C:\WINDOWS\System32\Tjd.exe
O4 - HKLM\..\Run: [Qjr] C:\WINDOWS\System32\Bkd.exe
O4 - HKLM\..\Run: [Qfb] C:\WINDOWS\Itu.exe
O4 - HKLM\..\Run: [Qas] C:\WINDOWS\Kgh.exe
O4 - HKLM\..\Run: [Qap] C:\WINDOWS\Flk.exe
O4 - HKLM\..\Run: [Pvr] C:\WINDOWS\Dhb.exe
O4 - HKLM\..\Run: [Pfc] C:\WINDOWS\Jhb.exe
O4 - HKLM\..\Run: [Ota] C:\WINDOWS\For.exe
O4 - HKLM\..\Run: [Oqq] C:\WINDOWS\Kii.exe
O4 - HKLM\..\Run: [Oov] C:\WINDOWS\System32\Jff.exe
O4 - HKLM\..\Run: [Onr] C:\WINDOWS\Muk.exe
O4 - HKLM\..\Run: [Onf] C:\WINDOWS\Cde.exe
O4 - HKLM\..\Run: [Ogo] C:\WINDOWS\Htu.exe
O4 - HKLM\..\Run: [Oep] C:\WINDOWS\System32\Uja.exe
O4 - HKLM\..\Run: [Obh] C:\WINDOWS\System32\Quj.exe
O4 - HKLM\..\Run: [Nut] C:\WINDOWS\Rhg.exe
O4 - HKLM\..\Run: [Nco] C:\WINDOWS\Hio.exe
O4 - HKLM\..\Run: [Msg] C:\WINDOWS\System32\Kbl.exe
O4 - HKLM\..\Run: [Mbg] C:\WINDOWS\Vhi.exe
O4 - HKLM\..\Run: [Les] C:\WINDOWS\Lde.exe
O4 - HKLM\..\Run: [Lbj] C:\WINDOWS\Mqn.exe
O4 - HKLM\..\Run: [Lai] C:\WINDOWS\System32\Geq.exe
O4 - HKLM\..\Run: [Lag] C:\WINDOWS\System32\Psj.exe
O4 - HKLM\..\Run: [Kct] C:\WINDOWS\Csv.exe
O4 - HKLM\..\Run: [Jvd] C:\WINDOWS\Rhd.exe
O4 - HKLM\..\Run: [Iuj] C:\WINDOWS\System32\Nji.exe
O4 - HKLM\..\Run: [Isa] C:\WINDOWS\Ugl.exe
O4 - HKLM\..\Run: [Hvf] C:\WINDOWS\System32\Tnm.exe
O4 - HKLM\..\Run: [Hoi] C:\WINDOWS\System32\Rjh.exe
O4 - HKLM\..\Run: [Him] C:\WINDOWS\Kjg.exe
O4 - HKLM\..\Run: [Hgn] C:\WINDOWS\Due.exe
O4 - HKLM\..\Run: [Hfj] C:\WINDOWS\Ilu.exe
O4 - HKLM\..\Run: [Gsu] C:\WINDOWS\Rok.exe
O4 - HKLM\..\Run: [Gpc] C:\WINDOWS\System32\Lhv.exe
O4 - HKLM\..\Run: [Gov] C:\WINDOWS\Idr.exe
O4 - HKLM\..\Run: [Gmr] C:\WINDOWS\Dqh.exe
O4 - HKLM\..\Run: [Fak] C:\WINDOWS\Etn.exe
O4 - HKLM\..\Run: [Esp] C:\WINDOWS\Ctp.exe
O4 - HKLM\..\Run: [Esh] C:\WINDOWS\Svb.exe
O4 - HKLM\..\Run: [Ekv] C:\WINDOWS\System32\Eqd.exe
O4 - HKLM\..\Run: [Eef] C:\WINDOWS\Pfc.exe
O4 - HKLM\..\Run: [Dvt] C:\WINDOWS\Tfj.exe
O4 - HKLM\..\Run: [Clu] C:\WINDOWS\Mik.exe
O4 - HKLM\..\Run: [Cjf] C:\WINDOWS\System32\Njq.exe
O4 - HKLM\..\Run: [Cfg] C:\WINDOWS\Rrq.exe
O4 - HKLM\..\Run: [Bmn] C:\WINDOWS\System32\Eru.exe
O4 - HKLM\..\Run: [Bca] C:\WINDOWS\System32\Qsf.exe
O4 - HKLM\..\Run: [Apb] C:\WINDOWS\Gag.exe
O4 - HKLM\..\Run: [Akt] C:\WINDOWS\System32\Jcc.exe
O4 - HKLM\..\Run: [Pco] C:\WINDOWS\Nnc.exe
O4 - HKLM\..\Run: [Etl] C:\WINDOWS\System32\Iik.exe
O4 - HKLM\..\Run: [For] C:\WINDOWS\Ucb.exe
O4 - HKLM\..\Run: [Jlc] C:\WINDOWS\Jrk.exe
O4 - HKLM\..\Run: [Grq] C:\WINDOWS\Ipg.exe
O4 - HKLM\..\Run: [Cjv] C:\WINDOWS\System32\Too.exe
O4 - HKLM\..\Run: [Mgs] C:\WINDOWS\System32\Sek.exe
O4 - HKLM\..\Run: [Kmg] C:\WINDOWS\Lro.exe
O4 - HKLM\..\Run: [Jpd] C:\WINDOWS\Ppo.exe
O4 - HKLM\..\Run: [Jjp] C:\WINDOWS\Jhg.exe
O4 - HKLM\..\Run: [Jsr] C:\WINDOWS\Rcu.exe
O4 - HKLM\..\Run: [Gam] C:\WINDOWS\System32\Hje.exe
O4 - HKLM\..\Run: [Dho] C:\WINDOWS\Nrq.exe
O4 - HKLM\..\Run: [Pda] C:\WINDOWS\System32\Sqq.exe
O4 - HKLM\..\Run: [Upc] C:\WINDOWS\System32\Bek.exe
O4 - HKLM\..\Run: [Qbo] C:\WINDOWS\Hao.exe
O4 - HKLM\..\Run: [Eli] C:\WINDOWS\Kkq.exe
O4 - HKLM\..\Run: [Uqf] C:\WINDOWS\System32\Evf.exe
O4 - HKLM\..\Run: [Gus] C:\WINDOWS\System32\Utf.exe
O4 - HKLM\..\Run: [Kjc] C:\WINDOWS\Irb.exe
O4 - HKLM\..\Run: [Rkv] C:\WINDOWS\Jeo.exe
O4 - HKLM\..\Run: [Gqo] C:\WINDOWS\System32\Tie.exe
O4 - HKLM\..\Run: [Jim] C:\WINDOWS\System32\Cnp.exe
O4 - HKLM\..\Run: [Itt] C:\WINDOWS\System32\Nnc.exe
O4 - HKLM\..\Run: [Hnt] C:\WINDOWS\System32\Pec.exe
O4 - HKLM\..\Run: [Lht] C:\WINDOWS\System32\Hjc.exe
O4 - HKLM\..\Run: [Sve] C:\WINDOWS\System32\Osp.exe
O4 - HKLM\..\Run: [Ohm] C:\WINDOWS\System32\Dbj.exe
O4 - HKLM\..\Run: [Ssm] C:\WINDOWS\System32\Rvb.exe
O4 - HKLM\..\Run: [Isq] C:\WINDOWS\Gpf.exe
O4 - HKLM\..\Run: [Ddd] C:\WINDOWS\System32\Gli.exe
O4 - HKLM\..\Run: [Hit] C:\WINDOWS\Kmn.exe
O4 - HKLM\..\Run: [Bks] C:\WINDOWS\System32\Ego.exe
O4 - HKLM\..\Run: [Vqu] C:\WINDOWS\Una.exe
O4 - HKLM\..\Run: [Kqq] C:\WINDOWS\Lqb.exe
O4 - HKLM\..\Run: [Jlb] C:\WINDOWS\System32\Cjm.exe
O4 - HKLM\..\Run: [Kuk] C:\WINDOWS\Efc.exe
O4 - HKLM\..\Run: [Prj] C:\WINDOWS\System32\Ugs.exe
O4 - HKLM\..\Run: [Jfv] C:\WINDOWS\Iov.exe
O4 - HKLM\..\Run: [Jqq] C:\WINDOWS\System32\Lsi.exe
O4 - HKLM\..\Run: [Fbv] C:\WINDOWS\System32\For.exe
O4 - HKLM\..\Run: [Cas] C:\WINDOWS\Pir.exe
O4 - HKLM\..\Run: [Ivs] C:\WINDOWS\Ara.exe
O4 - HKLM\..\Run: [Iuc] C:\WINDOWS\System32\Kgg.exe
O4 - HKLM\..\Run: [Ipb] C:\WINDOWS\Ufg.exe
O4 - HKLM\..\Run: [Omb] C:\WINDOWS\System32\Bik.exe
O4 - HKLM\..\Run: [Kjl] C:\WINDOWS\Qrd.exe
O4 - HKLM\..\Run: [Rfq] C:\WINDOWS\System32\Utl.exe
O4 - HKLM\..\Run: [Hav] C:\WINDOWS\Bfq.exe
O4 - HKLM\..\Run: [Egu] C:\WINDOWS\System32\Ckg.exe
O4 - HKLM\..\Run: [Vhb] C:\WINDOWS\System32\Hns.exe
O4 - HKLM\..\Run: [Jac] C:\WINDOWS\Udh.exe
O4 - HKLM\..\Run: [Abp] C:\WINDOWS\Ols.exe
O4 - HKLM\..\Run: [Kll] C:\WINDOWS\Vqq.exe
O4 - HKLM\..\Run: [Ufr] C:\WINDOWS\Gnl.exe
O4 - HKLM\..\Run: [Fif] C:\WINDOWS\System32\Nqp.exe
O4 - HKLM\..\Run: [Gbl] C:\WINDOWS\Usi.exe
O4 - HKLM\..\Run: [Ikp] C:\WINDOWS\System32\Qbc.exe
O4 - HKLM\..\Run: [Gqe] C:\WINDOWS\System32\Sts.exe
O4 - HKLM\..\Run: [Nan] C:\WINDOWS\Plo.exe
O4 - HKLM\..\Run: [Ljv] C:\WINDOWS\System32\Cea.exe
O4 - HKLM\..\Run: [Qqj] C:\WINDOWS\Pnt.exe
O4 - HKLM\..\Run: [Fvq] C:\WINDOWS\Mop.exe
O4 - HKLM\..\Run: [Gcf] C:\WINDOWS\System32\Dlo.exe
O4 - HKLM\..\Run: [Vsp] C:\WINDOWS\Rft.exe
O4 - HKLM\..\Run: [Trv] C:\WINDOWS\Khe.exe
O4 - HKLM\..\Run: [Lmg] C:\WINDOWS\System32\Ruu.exe
O4 - HKLM\..\Run: [Cjq] C:\WINDOWS\Fni.exe
O4 - HKLM\..\Run: [Aad] C:\WINDOWS\Hkd.exe
O4 - HKLM\..\Run: [Ggb] C:\WINDOWS\System32\Vgd.exe
O4 - HKLM\..\Run: [Gnb] C:\WINDOWS\System32\Ved.exe
O4 - HKLM\..\Run: [Tha] C:\WINDOWS\Knl.exe
O4 - HKLM\..\Run: [Tfv] C:\WINDOWS\System32\Ljp.exe
O4 - HKLM\..\Run: [Hdd] C:\WINDOWS\System32\Rvq.exe
O4 - HKLM\..\Run: [Vqp] C:\WINDOWS\System32\Koi.exe
O4 - HKLM\..\Run: [Sos] C:\WINDOWS\System32\Fof.exe
O4 - HKLM\..\Run: [Ttp] C:\WINDOWS\Gek.exe
O4 - HKLM\..\Run: [Ndj] C:\WINDOWS\System32\Omj.exe
O4 - HKLM\..\Run: [Ast] C:\WINDOWS\System32\Tlu.exe
O4 - HKLM\..\Run: [Pan] C:\WINDOWS\System32\Ngu.exe
O4 - HKLM\..\Run: [Huk] C:\WINDOWS\Bnu.exe
O4 - HKLM\..\Run: [Eig] C:\WINDOWS\System32\Jrp.exe
O4 - HKLM\..\Run: [Bea] C:\WINDOWS\System32\Qfe.exe
O4 - HKLM\..\Run: [Eil] C:\WINDOWS\Btm.exe
O4 - HKLM\..\Run: [Bsp] C:\WINDOWS\System32\Pao.exe
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc...m::/on-line.exe
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://69.50.166.213...hm::/update.exe

Now with all the items selected, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode

*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.


Using Windows Explorer, locate the following files and delete them (if they are present):

C:\WINDOWS\Kbr.exe
C:\WINDOWS\System32\Ppk.exe
C:\WINDOWS\System32\Obd.exe
C:\WINDOWS\System32\Gbb.exe
C:\WINDOWS\System32\Qrt.exe
C:\WINDOWS\Bih.exe
C:\WINDOWS\System32\Nte.exe
C:\WINDOWS\System32\Dje.exe
C:\WINDOWS\Nik.exe
C:\WINDOWS\System32\Dje.exe
C:\WINDOWS\System32\Dmu.exe
C:\WINDOWS\System32\App.exe
C:\WINDOWS\System32\Gvm.exe
C:\WINDOWS\Rkh.exe
C:\WINDOWS\System32\Mjn.exe
C:\WINDOWS\System32\Iof.exe
C:\WINDOWS\Pas.exe
C:\WINDOWS\System32\bmnshd.exe
C:\WINDOWS\System32\Hqe.exe
C:\WINDOWS\Neh.exe
C:\WINDOWS\System32\Jnr.exe
C:\WINDOWS\System32\Tjd.exe
C:\WINDOWS\System32\Bkd.exe
C:\WINDOWS\Itu.exe
C:\WINDOWS\Kgh.exe
C:\WINDOWS\Flk.exe
C:\WINDOWS\Dhb.exe
C:\WINDOWS\Jhb.exe
C:\WINDOWS\For.exe
C:\WINDOWS\Kii.exe
C:\WINDOWS\System32\Jff.exe
C:\WINDOWS\Muk.exe
C:\WINDOWS\Cde.exe
C:\WINDOWS\Htu.exe
C:\WINDOWS\System32\Uja.exe
C:\WINDOWS\System32\Quj.exe
C:\WINDOWS\Rhg.exe
C:\WINDOWS\Hio.exe
C:\WINDOWS\System32\Kbl.exe
C:\WINDOWS\Vhi.exe
C:\WINDOWS\Lde.exe
C:\WINDOWS\Mqn.exe
C:\WINDOWS\System32\Geq.exe
C:\WINDOWS\System32\Psj.exe
C:\WINDOWS\Csv.exe
C:\WINDOWS\Rhd.exe
C:\WINDOWS\System32\Nji.exe
C:\WINDOWS\Ugl.exe
C:\WINDOWS\System32\Tnm.exe
C:\WINDOWS\System32\Rjh.exe
C:\WINDOWS\Kjg.exe
C:\WINDOWS\Due.exe
C:\WINDOWS\Ilu.exe
C:\WINDOWS\Rok.exe
C:\WINDOWS\System32\Lhv.exe
C:\WINDOWS\Idr.exe
C:\WINDOWS\Dqh.exe
C:\WINDOWS\Etn.exe
C:\WINDOWS\Ctp.exe
C:\WINDOWS\Svb.exe
C:\WINDOWS\System32\Eqd.exe
C:\WINDOWS\Pfc.exe
C:\WINDOWS\Tfj.exe
C:\WINDOWS\Mik.exe
C:\WINDOWS\System32\Njq.exe
C:\WINDOWS\Rrq.exe
C:\WINDOWS\System32\Eru.exe
C:\WINDOWS\System32\Qsf.exe
C:\WINDOWS\Gag.exe
C:\WINDOWS\System32\Jcc.exe
C:\WINDOWS\Nnc.exe
C:\WINDOWS\System32\Iik.exe
C:\WINDOWS\Ucb.exe
C:\WINDOWS\Jrk.exe
C:\WINDOWS\Ipg.exe
C:\WINDOWS\System32\Too.exe
C:\WINDOWS\System32\Sek.exe
C:\WINDOWS\Lro.exe
C:\WINDOWS\Ppo.exe
C:\WINDOWS\Jhg.exe
C:\WINDOWS\Rcu.exe
C:\WINDOWS\System32\Hje.exe
C:\WINDOWS\Nrq.exe
C:\WINDOWS\System32\Sqq.exe
C:\WINDOWS\System32\Bek.exe
C:\WINDOWS\Hao.exe
C:\WINDOWS\Kkq.exe
C:\WINDOWS\System32\Evf.exe
C:\WINDOWS\System32\Utf.exe
C:\WINDOWS\Irb.exe
C:\WINDOWS\Jeo.exe
C:\WINDOWS\System32\Tie.exe
C:\WINDOWS\System32\Cnp.exe
C:\WINDOWS\System32\Nnc.exe
C:\WINDOWS\System32\Pec.exe
C:\WINDOWS\System32\Hjc.exe
C:\WINDOWS\System32\Osp.exe
C:\WINDOWS\System32\Dbj.exe
C:\WINDOWS\System32\Rvb.exe
C:\WINDOWS\Gpf.exe
C:\WINDOWS\System32\Gli.exe
C:\WINDOWS\Kmn.exe
C:\WINDOWS\System32\Ego.exe
C:\WINDOWS\Una.exe
C:\WINDOWS\Lqb.exe
C:\WINDOWS\System32\Cjm.exe
C:\WINDOWS\Efc.exe
C:\WINDOWS\System32\Ugs.exe
C:\WINDOWS\Iov.exe
C:\WINDOWS\System32\Lsi.exe
C:\WINDOWS\System32\For.exe
C:\WINDOWS\Pir.exe
C:\WINDOWS\Ara.exe
C:\WINDOWS\System32\Kgg.exe
C:\WINDOWS\Ufg.exe
C:\WINDOWS\System32\Bik.exe
C:\WINDOWS\Qrd.exe
C:\WINDOWS\System32\Utl.exe
C:\WINDOWS\Bfq.exe
C:\WINDOWS\System32\Ckg.exe
C:\WINDOWS\System32\Hns.exe
C:\WINDOWS\Udh.exe
C:\WINDOWS\Ols.exe
C:\WINDOWS\Vqq.exe
C:\WINDOWS\System32\Nqp.exe
C:\WINDOWS\Usi.exe
C:\WINDOWS\System32\Qbc.exe
C:\WINDOWS\System32\Sts.exe
C:\WINDOWS\Plo.exe
C:\WINDOWS\System32\Cea.exe
C:\WINDOWS\Pnt.exe
C:\WINDOWS\Mop.exe
C:\WINDOWS\System32\Dlo.exe
C:\WINDOWS\Rft.exe
C:\WINDOWS\Khe.exe
C:\WINDOWS\System32\Ruu.exe
C:\WINDOWS\Fni.exe
C:\WINDOWS\Hkd.exe
C:\WINDOWS\System32\Vgd.exe
C:\WINDOWS\System32\Ved.exe
C:\WINDOWS\Knl.exe
C:\WINDOWS\System32\Ljp.exe
C:\WINDOWS\System32\Rvq.exe
C:\WINDOWS\System32\Koi.exe
C:\WINDOWS\System32\Fof.exe
C:\WINDOWS\Gek.exe
C:\WINDOWS\System32\Omj.exe
C:\WINDOWS\System32\Tlu.exe
C:\WINDOWS\System32\Ngu.exe
C:\WINDOWS\Bnu.exe
C:\WINDOWS\System32\Jrp.exe
C:\WINDOWS\System32\Qfe.exe
C:\WINDOWS\Btm.exe
C:\WINDOWS\System32\Pao.exe

Exit Explorer, and REBOOT BACK INTO NORMAL MODE

Finally,RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everytjhing looks now.

Regards,

Trevuren

[pgb]

Hi Trevuren,
I'm having problems with deldomains. First of all when I right-click it, I don't see a "save target as" I see "save link as" and after I save, I get nothing when I right click. It opens as a notepad file when I left click!!!
I'am using Mozilla Firefox...should i be using IE ??

regards
pgb

[Trevuren]

Hi pqb,

Try this,

1) Left click on the link in my post
2)A box appears asking you what to do. Click on SAVE
3) Another mini screen appears asking you where to save it, what to call it and what type of file it is.

Save: On your Desktop
Name of File: DelDomains.inf
Type of file: Setup Information

4) Go to your desktop and right click on the file. A box appears with a lot of options in it. One of the options available is INSTALL. Choose that option

5) That should do it. I just ran it on mine and it worked like that.


Regards,

Trevuren

[pgb]

Hi there,
Here is the latest hijack log...
Logfile of HijackThis v1.99.1
Scan saved at 11:21:24 AM, on 4/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\Brj.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\ctfmon.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Hkk] C:\WINDOWS\System32\Qlo.exe
O4 - HKLM\..\Run: [Srl] C:\WINDOWS\Brj.exe
O4 - HKLM\..\Run: [Uja] C:\WINDOWS\System32\Dmg.exe
O4 - HKLM\..\Run: [Inv] C:\WINDOWS\System32\Vvh.exe
O4 - HKLM\..\Run: [Cif] C:\WINDOWS\Mbt.exe
O4 - HKLM\..\Run: [Pbn] C:\WINDOWS\Dka.exe
O4 - HKLM\..\Run: [Fsg] C:\WINDOWS\System32\Pnh.exe
O4 - HKLM\..\Run: [Gju] C:\WINDOWS\Vut.exe
O4 - HKLM\..\Run: [Vsg] C:\WINDOWS\Chh.exe
O4 - HKLM\..\Run: [Eqn] C:\WINDOWS\System32\Aks.exe
O4 - HKLM\..\Run: [Efo] C:\WINDOWS\System32\Hii.exe
O4 - HKLM\..\Run: [Aog] C:\WINDOWS\Mgh.exe
O4 - HKLM\..\Run: [Jrd] C:\WINDOWS\System32\Qrn.exe
O4 - HKLM\..\Run: [Vpo] C:\WINDOWS\System32\Smm.exe
O4 - HKLM\..\Run: [Piv] C:\WINDOWS\System32\Qhc.exe
O4 - HKLM\..\Run: [Jqo] C:\WINDOWS\Vfc.exe
O4 - HKLM\..\Run: [Hqs] C:\WINDOWS\System32\Idf.exe
O4 - HKLM\..\Run: [Qgc] C:\WINDOWS\Oip.exe
O4 - HKLM\..\Run: [Dqs] C:\WINDOWS\Bta.exe
O4 - HKLM\..\Run: [Mbr] C:\WINDOWS\System32\Dgu.exe
O4 - HKLM\..\Run: [Rct] C:\WINDOWS\Ueb.exe
O4 - HKLM\..\Run: [Kso] C:\WINDOWS\System32\Jor.exe
O4 - HKLM\..\Run: [Mbn] C:\WINDOWS\System32\Dft.exe
O4 - HKLM\..\Run: [Tpm] C:\WINDOWS\System32\Uvi.exe
O4 - HKLM\..\Run: [Vvc] C:\WINDOWS\System32\Mcu.exe
O4 - HKLM\..\Run: [Hic] C:\WINDOWS\Khj.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Thanks for taking the time to help me on thisjava script:add_smilie("")
smile.gif

[Trevuren]

Hi pqb,

The files that we will be deleting at the end of the fix may not go the first time. This infection has a history of often requiring more forceful means

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Now let's do some work on your log:

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Close all browser windows and RUN HijackThis.
. Click the SCAN button to produce a log.
. Click the Config button located in the lower right hand corner of the HijackThis window.
. When the new screen opens, find and click the Miscellaneous Tools button.
. Then choose the Open Process Manager button.
. From the list of processes, hilight the following items by clicking them, ONE AT A TIME, then DELETE them by clicking the KILL button:

C:\WINDOWS\Brj.exe

Once all items have been KILLED, click the Back button which will return you to the HijackThis main window. Now place a check mark beside each one of the following items:

O4 - HKLM\..\Run: [Hkk] C:\WINDOWS\System32\Qlo.exe
O4 - HKLM\..\Run: [Srl] C:\WINDOWS\Brj.exe
O4 - HKLM\..\Run: [Uja] C:\WINDOWS\System32\Dmg.exe
O4 - HKLM\..\Run: [Inv] C:\WINDOWS\System32\Vvh.exe
O4 - HKLM\..\Run: [Cif] C:\WINDOWS\Mbt.exe
O4 - HKLM\..\Run: [Pbn] C:\WINDOWS\Dka.exe
O4 - HKLM\..\Run: [Fsg] C:\WINDOWS\System32\Pnh.exe
O4 - HKLM\..\Run: [Gju] C:\WINDOWS\Vut.exe
O4 - HKLM\..\Run: [Vsg] C:\WINDOWS\Chh.exe
O4 - HKLM\..\Run: [Eqn] C:\WINDOWS\System32\Aks.exe
O4 - HKLM\..\Run: [Efo] C:\WINDOWS\System32\Hii.exe
O4 - HKLM\..\Run: [Aog] C:\WINDOWS\Mgh.exe
O4 - HKLM\..\Run: [Jrd] C:\WINDOWS\System32\Qrn.exe
O4 - HKLM\..\Run: [Vpo] C:\WINDOWS\System32\Smm.exe
O4 - HKLM\..\Run: [Piv] C:\WINDOWS\System32\Qhc.exe
O4 - HKLM\..\Run: [Jqo] C:\WINDOWS\Vfc.exe
O4 - HKLM\..\Run: [Hqs] C:\WINDOWS\System32\Idf.exe
O4 - HKLM\..\Run: [Qgc] C:\WINDOWS\Oip.exe
O4 - HKLM\..\Run: [Dqs] C:\WINDOWS\Bta.exe
O4 - HKLM\..\Run: [Mbr] C:\WINDOWS\System32\Dgu.exe
O4 - HKLM\..\Run: [Rct] C:\WINDOWS\Ueb.exe
O4 - HKLM\..\Run: [Kso] C:\WINDOWS\System32\Jor.exe
O4 - HKLM\..\Run: [Mbn] C:\WINDOWS\System32\Dft.exe
O4 - HKLM\..\Run: [Tpm] C:\WINDOWS\System32\Uvi.exe
O4 - HKLM\..\Run: [Vvc] C:\WINDOWS\System32\Mcu.exe
O4 - HKLM\..\Run: [Hic] C:\WINDOWS\Khj.exe
O9 - Extra button: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {AAE062B2-3DAE-40C3-BE6D-D06A5511E502} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)


Now with all the items selected, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode

*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.


Using Windows Explorer, locate the following files/folders, and delete them (if they are present):

C:\WINDOWS\Brj.exe
C:\WINDOWS\System32\Qlo.exe
C:\WINDOWS\System32\Dmg.exe
C:\WINDOWS\System32\Vvh.exe
C:\WINDOWS\Mbt.exe
C:\WINDOWS\Dka.exe
C:\WINDOWS\System32\Pnh.exe
C:\WINDOWS\Vut.exe
C:\WINDOWS\Chh.exe
C:\WINDOWS\System32\Aks.exe
C:\WINDOWS\System32\Hii.exe
C:\WINDOWS\Mgh.exe
C:\WINDOWS\System32\Qrn.exe
C:\WINDOWS\System32\Smm.exe
C:\WINDOWS\System32\Qhc.exe
C:\WINDOWS\Vfc.exe
C:\WINDOWS\System32\Idf.exe
C:\WINDOWS\Oip.exe
C:\WINDOWS\Bta.exe
C:\WINDOWS\System32\Dgu.exe
C:\WINDOWS\Ueb.exe
C:\WINDOWS\System32\Jor.exe
C:\WINDOWS\System32\Dft.exe
C:\WINDOWS\System32\Uvi.exe
C:\WINDOWS\System32\Mcu.exe
C:\WINDOWS\Khj.exe
C:\WINDOWS\System32\intlmain.dll

Exit Explorer, and REBOOT BACK INTO NORMAL MODE

Finally,RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everytjhing looks now.

[b]Regards,

Trevuren

[pgb]

Hi Trevuren,

Below is the new log.
A few things I must tell you. When I run in safe mode, the desk top is black with a few of the icons that appear on the Danger : spyware red desktop in view. To get to explorer, I have to run task manager and click new task. I thought that information may be of benefit to you as to where this bug is living on my computer.

Thanks again for your help.

Logfile of HijackThis v1.99.1
Scan saved at 1:19:39 PM, on 4/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\Iru.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [Nbq] C:\WINDOWS\System32\Iru.exe
O4 - HKLM\..\Run: [Leo] C:\WINDOWS\Ngv.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Trevuren]

Hi pgb,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
-
The following items are malware and must be fixed
The following explains how to remove items from your computer that are malware. These must be fixed now!

Please set your system to show all files; please see here if you're unsure how to do this.

Close all browser windows and RUNHijackThis..
Click the SCAN button to produce a log..
Click the Config button located in the lower right hand corner of the HijackThis window..
When the new screen opens, find and click the Miscellaneous Tools button then choose the Open Process Manager button.
From the list of processes, hilight the following items by clicking them, ONE AT A TIME, then DELETE them by clicking the KILL button:

C:\WINDOWS\System32\Iru.exe

After all the designated processes have been stopped, clicking on the BACK button will bring you back to the main HJT screen.

Close all programs leaving only HijackThis running. Place a check mark beside each of the following entries:

O4 - HKLM\..\Run: [Nbq] C:\WINDOWS\System32\Iru.exe
O4 - HKLM\..\Run: [Leo] C:\WINDOWS\Ngv.exe

When all items have been selected, click on Fix checked When finished, exit HijackThis.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files and delete them:

C:\WINDOWS\System32\Iru.exe
C:\WINDOWS\Ngv.exe

Exit Explorer, and reboot as normal afterwards.

Post back a fresh HijackThis log for review.

Regards,

Trevuren

[pgb]

Hi there,

Here is my new log ..

Logfile of HijackThis v1.99.1
Scan saved at 10:32:23 PM, on 4/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\Eir.exe
C:\WINDOWS\System32\ctfmon.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Qpr] C:\WINDOWS\System32\Udu.exe
O4 - HKLM\..\Run: [Ict] C:\WINDOWS\Dlj.exe
O4 - HKLM\..\Run: [Ofh] C:\WINDOWS\Oct.exe
O4 - HKLM\..\Run: [Nqt] C:\WINDOWS\System32\Ccp.exe
O4 - HKLM\..\Run: [Fdb] C:\WINDOWS\Eir.exe
O4 - HKLM\..\Run: [Vnr] C:\WINDOWS\System32\Pja.exe
O4 - HKLM\..\Run: [Pvm] C:\WINDOWS\System32\Epk.exe
O4 - HKLM\..\Run: [Ioa] C:\WINDOWS\Tdd.exe
O4 - HKLM\..\Run: [Sgk] C:\WINDOWS\System32\Mrc.exe
O4 - HKLM\..\Run: [Gkb] C:\WINDOWS\System32\Mpp.exe
O4 - HKLM\..\Run: [Ipo] C:\WINDOWS\Cci.exe
O4 - HKLM\..\Run: [Jsi] C:\WINDOWS\Ava.exe
O4 - HKLM\..\Run: [Hic] C:\WINDOWS\Lok.exe
O4 - HKLM\..\Run: [Vfa] C:\WINDOWS\System32\Jft.exe
O4 - HKLM\..\Run: [Hcs] C:\WINDOWS\System32\Duq.exe
O4 - HKLM\..\Run: [Ndf] C:\WINDOWS\System32\Lkj.exe
O4 - HKLM\..\Run: [Uhe] C:\WINDOWS\System32\Ail.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

regards
pgb

[Trevuren]

Hi pqb,

Well that wasn't a resounding success. Let's give it a bit wider scope

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Now let's do some work on your log:

First we need to make all files and folders VISIBLE:

Go to start>control panel>folder options>view (tab)
*choose to "show hidden files and folders,"
*uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
*Close the window with ok
*All hidden files will now be visible

Close all browser windows and RUN HijackThis.
. Click the SCAN button to produce a log.
. Click the Config button located in the lower right hand corner of the HijackThis window.
. When the new screen opens, find and click the Miscellaneous Tools button.
. Then choose the Open Process Manager button.
. From the list of processes, hilight the following items by clicking them, ONE AT A TIME, then DELETE them by clicking the KILL button:

C:\WINDOWS\Eir.exe
C:\BITWARE\NT\bwprnmon.exe

Once all items have been KILLED, click the Back button which will return you to the HijackThis main window. Now place a check mark beside each one of the following items:

O4 - HKLM\..\Run: [Qpr] C:\WINDOWS\System32\Udu.exe
O4 - HKLM\..\Run: [Ict] C:\WINDOWS\Dlj.exe
O4 - HKLM\..\Run: [Ofh] C:\WINDOWS\Oct.exe
O4 - HKLM\..\Run: [Nqt] C:\WINDOWS\System32\Ccp.exe
O4 - HKLM\..\Run: [Fdb] C:\WINDOWS\Eir.exe
O4 - HKLM\..\Run: [Vnr] C:\WINDOWS\System32\Pja.exe
O4 - HKLM\..\Run: [Pvm] C:\WINDOWS\System32\Epk.exe
O4 - HKLM\..\Run: [Ioa] C:\WINDOWS\Tdd.exe
O4 - HKLM\..\Run: [Sgk] C:\WINDOWS\System32\Mrc.exe
O4 - HKLM\..\Run: [Gkb] C:\WINDOWS\System32\Mpp.exe
O4 - HKLM\..\Run: [Ipo] C:\WINDOWS\Cci.exe
O4 - HKLM\..\Run: [Jsi] C:\WINDOWS\Ava.exe
O4 - HKLM\..\Run: [Hic] C:\WINDOWS\Lok.exe
O4 - HKLM\..\Run: [Vfa] C:\WINDOWS\System32\Jft.exe
O4 - HKLM\..\Run: [Hcs] C:\WINDOWS\System32\Duq.exe
O4 - HKLM\..\Run: [Ndf] C:\WINDOWS\System32\Lkj.exe
O4 - HKLM\..\Run: [Uhe] C:\WINDOWS\System32\Ail.exe
O4 - Global Startup: BitWare Print Monitor.lnk = C:\BITWARE\NT\bwprnmon.exe


Now with all the items selected, delete them by clicking the FIX checked button. Close the HijackThis window and Reboot Your System in Safe Mode

How to use the F8 method to Start Your Computer in Safe Mode

*Restart the computer.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.


Using Windows Explorer, locate the following files/folders, and delete them (if they are present):

FILES

C:\WINDOWS\Eir.exe
C:\WINDOWS\System32\Udu.exe
C:\WINDOWS\Dlj.exe
C:\WINDOWS\Oct.exe
C:\WINDOWS\System32\Ccp.exe
C:\WINDOWS\System32\Pja.exe
C:\WINDOWS\System32\Epk.exe
C:\WINDOWS\Tdd.exe
C:\WINDOWS\System32\Mrc.exe
C:\WINDOWS\System32\Mpp.exe
C:\WINDOWS\Cci.exe
C:\WINDOWS\Ava.exe
C:\WINDOWS\Lok.exe
C:\WINDOWS\System32\Jft.exe
C:\WINDOWS\System32\Duq.exe
C:\WINDOWS\System32\Lkj.exe
C:\WINDOWS\System32\Ail.exe

FOLDERS (with all their content)

C:\BITWARE

Exit Explorer, and REBOOT BACK INTO NORMAL MODE

Finally,RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everytjhing looks now.

Regards,

Trevuren

[pgb]

Hi there Trevulen,
Here is my new log

I deleted three html files I found in system 32 one called pop-up and another desktop the third cant remember its name ... so now I dont get the red Danger: spyware desktop .. its just blue .. but i still cant change it in display..
still cant right click on it ...

Regards
pgb

Logfile of HijackThis v1.99.1
Scan saved at 6:38:00 AM, on 4/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Trevuren]

Hi pqb,

Your log is looking very good at this point.

Let's try this on your screen:

Click "Start", "Settings", and then click "Control Panel".
Open the "Display" applet.
Click on "Desktop", "Customise Display..." and "Web".
In the box under "Web pages" look for a checkbox named "Security". If found select it and click "Delete".

REBOOT and post a fresh HJT log.


Regards,

Trevuren

[pgb]

Hi Trevuren,
I don't see a security checkbox ....
Here is the latest log.

Regards,
pgb

Logfile of HijackThis v1.99.1
Scan saved at 12:44:57 PM, on 4/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\quickenw-2\QWDLLS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Philip\Application Data\Mozilla\Profiles\default\3d00psut.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\quickenw-2\BILLMIND.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\quickenw-2\QWDLLS.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe