[Raezer]

Made an earlier post, but I hadn't followed proper instructions *coughs*

I keep finding the virus in my Windows\ststem32 folders "msso.exe" and "iplg.exe" being the last ones. Seems to generate a new exe each time?

After having done all checks/scans etc here is my new log;

Logfile of HijackThis v1.99.1
Scan saved at 09:16:36, on 29/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
L:\WINDOWS\System32\smss.exe
L:\WINDOWS\system32\winlogon.exe
L:\WINDOWS\system32\services.exe
L:\WINDOWS\system32\lsass.exe
L:\WINDOWS\System32\Ati2evxx.exe
L:\WINDOWS\system32\svchost.exe
L:\WINDOWS\System32\svchost.exe
L:\WINDOWS\system32\spoolsv.exe
l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
L:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
l:\PROGRA~1\mcafee.com\vso\mcshield.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
L:\WINDOWS\system32\Ati2evxx.exe
L:\WINDOWS\Explorer.EXE
L:\PROGRA~1\mcafee.com\agent\mcagent.exe
L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE
L:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
l:\progra~1\mcafee.com\vso\mcvsescn.exe
L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
L:\WINDOWS\System32\qttask.exe
L:\WINDOWS\System32\ctfmon.exe
L:\Program Files\Messenger\msmsgs.exe
L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
L:\WINDOWS\System32\wuauclt.exe
L:\Program Files\Windows Media Player\wmplayer.exe
L:\Program Files\MSN Messenger\MsnMsgr.Exe
l:\progra~1\mcafee.com\vso\mcvsftsn.exe
L:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
L:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
L:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
L:\Program Files\BT Yahoo! Help\bin\mpbtn.exe
l:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
L:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
L:\Documents and Settings\Dave.HOME-00UYRL42JL\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0D4822D9-38AF-1742-C18E-C086C715E5B7} - L:\WINDOWS\apijs32.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - l:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - L:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] L:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QveCtl2Tray] L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE L:\Program Files\Philips\PSA2\skin
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [MCAgentExe] l:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] L:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "l:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "l:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Motive SmartBridge] L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [MPFExe] L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "M:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [QuickTime Task] L:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] L:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] L:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "L:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "m:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MsnMsgr] "L:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BT Yahoo! Help.lnk = L:\Program Files\BT Yahoo! Help\bin\matcli.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://L:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - L:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: L:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113552149197
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://downloads.bro...tivePreQual.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...474/mcfscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - L:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - L:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - l:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - L:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: RadClock - Unknown owner - L:\WINDOWS\system32\RadClock.exe

Isn't a fatal virus as Macafee picks up and deletes, but a few secs later I get a new warning message... meh.

Please assist, many thanks.

[Advertisements]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update and reboot.

Before we tackle the infections on your machine, I need you to do something very important. It is not a good idea to run HijackThis from a "temp" location. Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

once these are done, please post a new HJT log in THIS thread in a reply. Please don't start another topic!

[Kat]

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update and reboot.

Before we tackle the infections on your machine, I need you to do something very important. It is not a good idea to run HijackThis from a "temp" location. Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

once these are done, please post a new HJT log in THIS thread in a reply. Please don't start another topic!

[Raezer]

Hi Kat,

Thanks for the quick reply

I think I installed SP1 already but didn't reboot... I rebooted now but when I try to add 1a I only get offer SP2. I had some issues with that cocking up my Nero and some other apps last time. Do you recommend I install it anyway?

Here is my new log... hopefully it shows I have SP1a

Logfile of HijackThis v1.99.1
Scan saved at 10:30:18, on 29/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
L:\WINDOWS\System32\smss.exe
L:\WINDOWS\system32\winlogon.exe
L:\WINDOWS\system32\services.exe
L:\WINDOWS\system32\lsass.exe
L:\WINDOWS\System32\Ati2evxx.exe
L:\WINDOWS\system32\svchost.exe
L:\WINDOWS\System32\svchost.exe
L:\WINDOWS\system32\spoolsv.exe
l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
L:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
l:\PROGRA~1\mcafee.com\vso\mcshield.exe
L:\WINDOWS\system32\Ati2evxx.exe
L:\WINDOWS\Explorer.EXE
L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE
L:\PROGRA~1\mcafee.com\agent\mcagent.exe
L:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
l:\progra~1\mcafee.com\vso\mcvsescn.exe
L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
L:\WINDOWS\System32\qttask.exe
L:\WINDOWS\System32\ctfmon.exe
L:\Program Files\Messenger\msmsgs.exe
M:\progra~1\valve\steam\steam.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
L:\WINDOWS\System32\wuauclt.exe
L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
l:\progra~1\mcafee.com\vso\mcvsftsn.exe
L:\Program Files\MSN Messenger\MsnMsgr.Exe
L:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
L:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
L:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
L:\Program Files\BT Yahoo! Help\bin\mpbtn.exe
l:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
L:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0D4822D9-38AF-1742-C18E-C086C715E5B7} - L:\WINDOWS\apijs32.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - l:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - L:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] L:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QveCtl2Tray] L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE L:\Program Files\Philips\PSA2\skin
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [MCAgentExe] l:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] L:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "l:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "l:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Motive SmartBridge] L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [MPFExe] L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "M:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [QuickTime Task] L:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] L:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] L:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "L:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "m:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MsnMsgr] "L:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BT Yahoo! Help.lnk = L:\Program Files\BT Yahoo! Help\bin\matcli.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://L:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - L:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: L:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113552149197
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://downloads.bro...tivePreQual.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...474/mcfscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - L:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - L:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - l:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - L:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: RadClock - Unknown owner - L:\WINDOWS\system32\RadClock.exe

Oh, I also have the about: blank problem, eeek!

Dave

[Kat]

yeah, go ahead and do SP2, then post me a fresh log after the update and we'll get you cleaned up!!

[Raezer]

Okies... here it is;

Logfile of HijackThis v1.99.1
Scan saved at 09:21:06, on 30/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
L:\WINDOWS\System32\smss.exe
L:\WINDOWS\system32\winlogon.exe
L:\WINDOWS\system32\services.exe
L:\WINDOWS\system32\lsass.exe
L:\WINDOWS\System32\Ati2evxx.exe
L:\WINDOWS\system32\svchost.exe
L:\WINDOWS\System32\svchost.exe
L:\WINDOWS\system32\spoolsv.exe
l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
L:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
l:\PROGRA~1\mcafee.com\vso\mcshield.exe
L:\WINDOWS\System32\wuauclt.exe
L:\WINDOWS\system32\Ati2evxx.exe
L:\WINDOWS\Explorer.EXE
L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE
L:\PROGRA~1\mcafee.com\agent\mcagent.exe
L:\PROGRA~1\mcafee.com\agent\mcupdate.exe
L:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
L:\WINDOWS\System32\qttask.exe
L:\Program Files\Internet Explorer\IEXPLORE.EXE
L:\WINDOWS\System32\ctfmon.exe
L:\Program Files\Messenger\msmsgs.exe
L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
l:\progra~1\mcafee.com\vso\mcvsescn.exe
L:\Program Files\MSN Messenger\MsnMsgr.Exe
L:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
L:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
L:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
l:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
L:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
l:\progra~1\mcafee.com\vso\mcvsftsn.exe
L:\Program Files\BT Yahoo! Help\bin\mpbtn.exe
L:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0D4822D9-38AF-1742-C18E-C086C715E5B7} - L:\WINDOWS\apijs32.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - l:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - L:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] L:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QveCtl2Tray] L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE L:\Program Files\Philips\PSA2\skin
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [MCAgentExe] l:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] L:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "l:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "l:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Motive SmartBridge] L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [MPFExe] L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "M:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [QuickTime Task] L:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] L:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] L:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "L:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "m:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MsnMsgr] "L:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BT Yahoo! Help.lnk = L:\Program Files\BT Yahoo! Help\bin\matcli.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://L:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - L:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: L:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113552149197
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://downloads.bro...tivePreQual.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...474/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CB1775A-F776-454A-BB68-BD055EBF5A59}: NameServer = 194.72.9.55 194.74.65.86
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CB1775A-F776-454A-BB68-BD055EBF5A59}: NameServer = 194.72.9.55 194.74.65.86
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - L:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - L:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - l:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - L:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: RadClock - Unknown owner - L:\WINDOWS\system32\RadClock.exe

Thanks again

[Kat]

Before we begin the fix, can you please go to http://www.howtotell.com and click on "Windows Validation Assistant" - then tell me what it says?! Thanks!!

[Raezer]

Meh, I can't install the Active X control... working on it now

[Raezer]

"The Windows Valiadtion Assistan failed to run properly. Please verify that you are running a supported OS, and your internet Explorer security settings allow signed ActiveX controls to run"

Went into Tools, Internet Options, Security, Custom and changed it but getting no joy...

Nooooooooooooooooooooooo!

[Raezer]

Also, I don't get the Info Bar pop-up "This site might require the following active X control: 'Product Gatherer' from 'Microsoft Corporation'.

Thus I can't right click and follow instructions.

[Raezer]

Yup, have tried a few things over the course of the day but none appear to work... am now stuck.

I also took time to delete some unwanted programs so I am adding a new HJT log;

Logfile of HijackThis v1.99.1
Scan saved at 00:04:57, on 01/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
L:\WINDOWS\System32\smss.exe
L:\WINDOWS\system32\winlogon.exe
L:\WINDOWS\system32\services.exe
L:\WINDOWS\system32\lsass.exe
L:\WINDOWS\System32\Ati2evxx.exe
L:\WINDOWS\system32\svchost.exe
L:\WINDOWS\System32\svchost.exe
L:\WINDOWS\system32\spoolsv.exe
l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
L:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
l:\PROGRA~1\mcafee.com\vso\mcshield.exe
L:\WINDOWS\system32\Ati2evxx.exe
L:\WINDOWS\Explorer.EXE
L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE
L:\PROGRA~1\mcafee.com\agent\mcagent.exe
L:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
L:\WINDOWS\System32\qttask.exe
l:\progra~1\mcafee.com\vso\mcvsescn.exe
L:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
L:\WINDOWS\System32\ctfmon.exe
L:\Program Files\Messenger\msmsgs.exe
M:\progra~1\valve\steam\steam.exe
L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
L:\Program Files\MSN Messenger\MsnMsgr.Exe
L:\Program Files\Sony Ericsson\Mobile\audevicemgr.exe
L:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
L:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
l:\progra~1\mcafee.com\vso\mcvsftsn.exe
l:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
L:\Program Files\BT Yahoo! Help\bin\mpbtn.exe
L:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
L:\WINDOWS\System32\wuauclt.exe
L:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://L:\WINDOWS\system32\skfhe.dll/sp.html#93256
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0D4822D9-38AF-1742-C18E-C086C715E5B7} - L:\WINDOWS\apijs32.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - l:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - L:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] L:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QveCtl2Tray] L:\Program Files\Philips\PSA2\skin\QveCplSk.EXE L:\Program Files\Philips\PSA2\skin
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [MCAgentExe] l:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] L:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "l:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "l:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "L:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Motive SmartBridge] L:\PROGRA~1\BTYAHO~1\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [MPFExe] L:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "M:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [QuickTime Task] L:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] L:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] L:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "L:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "m:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "L:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [MsnMsgr] "L:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BT Yahoo! Help.lnk = L:\Program Files\BT Yahoo! Help\bin\matcli.exe
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: SATARaid.lnk = ?
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://L:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - L:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: L:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptoda...pdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113552149197
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://downloads.bro...tivePreQual.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...474/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CB1775A-F776-454A-BB68-BD055EBF5A59}: NameServer = 194.72.9.55 194.74.65.86
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CB1775A-F776-454A-BB68-BD055EBF5A59}: NameServer = 194.72.9.55 194.74.65.86
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - L:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - L:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - l:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - L:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - l:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - L:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: RadClock - Unknown owner - L:\WINDOWS\system32\RadClock.exe

[Kat]

I am sorry, but we cannot help you on this site unless you have a valid copy of Windows. Until I see an upgrade to at least SP1, I cannot help you with your fix. Thanks for your understanding.

[Raezer]

Um, well I DLd service packs 1 and 2.... does my log not show it?

I did have a problem when I re-installed and seem to have some old XP files on C: Drive which is why I have a new volume, "L".

[Raezer]

Please view the attached screencapture of the updated SPs... can you help?

Attached Thumbnails

• 

[Raezer]

Hi,

I still can't get the active x to allow the program. I am also getting queried on Active X when I join my regular Counter-Strike: Source server too. Is this somehow related?

I don't know what else to do, and I can't face a total re-install... please help!