[poster_boy101]

My computer has constant popups and now recently while on msn my dumb [bleep] accepted a link that gave me a WORM that sends messages to everyone on my contact list. I downloaded HijackThis and this is what shows up. Can you smart people please help and tell me what I should delete!

Logfile of HijackThis v1.99.1
Scan saved at 10:47:30 AM, on 5/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
D:\program files\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\gaSrve.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\run.exe
C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe
D:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
c:\alg.exe
C:\DOCUME~1\TOMLUN~1\LOCALS~1\Temp\nnmtx.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\msvc.exe
C:\WINDOWS\System32\mouseutils.exe
c:\windows\system32\xpr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Tom Lundhild\Local Settings\Temporary Internet Files\Content.IE5\OVQNQ1IL\FxKelvir[1].exe
C:\lbs.exe
C:\Documents and Settings\Tom Lundhild\Local Settings\Temporary Internet Files\Content.IE5\VHF5ABUZ\hijackthis[1]\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll
O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\hgfhf.dll
O4 - HKLM\..\Run: [EPSON Stylus CX5200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX5200" /O6 "USB001" /M "Stylus CX5200"
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\program files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Qtime] C:\WINDOWS\nrchk.exe /i
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\canada.exe -N
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gaSrve] C:\WINDOWS\gaSrve.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitesxl32.exe
O4 - HKLM\..\Run: [OFFICEXP] OFFICEXP.exe
O4 - HKLM\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] c:\windows\system32\xpr.exe
O4 - HKLM\..\Run: [Windows Mouse Utilities] mouseutils.exe
O4 - HKLM\..\RunServices: [OFFICEXP] OFFICEXP.exe
O4 - HKLM\..\RunServices: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - HKLM\..\RunServices: [Windows Mouse Utilities] mouseutils.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [OFFICEXP] OFFICEXP.exe
O4 - HKCU\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112860457797
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: OFFICEXP - Unknown owner - C:\WINDOWS\System32\OFFICEXP.exe" -netsvcs (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

THANK YOUUUU.

[Advertisements]

Hello poster_boy101 and Welcome to G2G!!!

Thats is a seriously nasty infection you have and there is only 1 way I know how to begin!

Since there is no Antivirus Software installed,these steps will be a bit easier!

Please Print out these Instructions if possible!!!!

1.Create a folder on the Desktop>>Right Click the Desktop and Select New>>Folder>>Name it whatever you like!
Anything you are asked to download,please place it in this folder!

2.Locate the Zip folder for HijackThis>>Move it to the New Folder>>Unzip it and Extract All Files>>Now its in a Permanent folder!!

3.Use the link below:
http://forums.subrat...?showtopic=3466

4.From the above link,Download Hoster to the New Folder,Unzip and Extract All Files!
Run the program and Press "Restore Original Hosts" and press "OK". Exit Program!!

5.Since you allready have Microsoft AntiSpyware,please Update it Now!!

6.Download,Install,Configure and Update Kaspersky just as described in the link!

7.Restart in Safe Mode,How to start the computer in Safe mode (here are instructions if you need them)
http://service1.syma...src=sec_doc_nam

8.Once in Safe Mode,Open Kaspersky and Microsoft AntiSpyware,DO NOT run them yet,just open them and leave them be for now!

9.Right Click the Taskbar,near the Clock,Select Task Manager>>Select Processes>>Click the Tab labeled Image Name
(DO NOT close the Task Manager)

10.Locate these 2 Processes:
RunDll32.exe
and
Explorer.exe

11.Right Click RunDll32.exe and Select End Process

12.Right Click Explorer.exe and Select End Process
This will cause the TaskBar and Desktop to disappear,dont panic,this is normal and will cause no harm to the PC!!

13.Go back to Kaspersky and begin the Scan just as described in the Link!
It will take several hours to complete!!
Once Complete,delete all it finds and close out the program!

14.Scan the PC with Microsoft AntiSpyware,delete all it finds and close out the program!

15.Use the Task Manager to Restart the PC(Just Click Shut Down and then Select Restart)

16.Once back in Normal Mode,Download and Run these 2 Programs:
CCleaner:
http://www.filehippo...d_ccleaner.html
This is to help keep those Temporary Files Cleaned Up,all you will want to use on this is the Opening Page(Windows Tab)Just Click Run Cleaner and let it do its thing!

CleanUp! 4.0:
http://cleanup.stevengould.org/
Just Scroll through the Page and locate this Line:
So download CleanUp! now and reap the benefits of a clean machine.
If that Link doesnt work,just go to Google.com and Search for CleanUp!
It should be the First Return!!
Once Installed,Open and Click CleanUp! and When Prompted to Log Off,do so!

17.Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK!

Make Sure Normal Startup is Checked!!

Select the tab labeled Startup and put a Check by every box there!!

Click Apply>>OK>>Follow the Prompts to Restart!!

18.Once all is complete and you are Restarted in Normal Mode,Scan the PC with HijackThis and Post those results!

19.Lets see how we did,Have the PC scanned here:
http://www.pandasoft...n_principal.htm

You will have to be using Internet Explorer for the Scan to work!
Please take the time to do this Scan,its a Critical Step!
The Scan will produce a report,please post that Report along with the fresh HijackThis log!

20.Any Questions at all,Feel Free to ask away!!!

Edited by Cretemonster, 01 May 2005 - 04:07 PM.

[Wizard]

Hello poster_boy101 and Welcome to G2G!!!

Thats is a seriously nasty infection you have and there is only 1 way I know how to begin!

Since there is no Antivirus Software installed,these steps will be a bit easier!

Please Print out these Instructions if possible!!!!

1.Create a folder on the Desktop>>Right Click the Desktop and Select New>>Folder>>Name it whatever you like!
Anything you are asked to download,please place it in this folder!

2.Locate the Zip folder for HijackThis>>Move it to the New Folder>>Unzip it and Extract All Files>>Now its in a Permanent folder!!

3.Use the link below:
http://forums.subrat...?showtopic=3466

4.From the above link,Download Hoster to the New Folder,Unzip and Extract All Files!
Run the program and Press "Restore Original Hosts" and press "OK". Exit Program!!

5.Since you allready have Microsoft AntiSpyware,please Update it Now!!

6.Download,Install,Configure and Update Kaspersky just as described in the link!

7.Restart in Safe Mode,How to start the computer in Safe mode (here are instructions if you need them)
http://service1.syma...src=sec_doc_nam

8.Once in Safe Mode,Open Kaspersky and Microsoft AntiSpyware,DO NOT run them yet,just open them and leave them be for now!

9.Right Click the Taskbar,near the Clock,Select Task Manager>>Select Processes>>Click the Tab labeled Image Name
(DO NOT close the Task Manager)

10.Locate these 2 Processes:
RunDll32.exe
and
Explorer.exe

11.Right Click RunDll32.exe and Select End Process

12.Right Click Explorer.exe and Select End Process
This will cause the TaskBar and Desktop to disappear,dont panic,this is normal and will cause no harm to the PC!!

13.Go back to Kaspersky and begin the Scan just as described in the Link!
It will take several hours to complete!!
Once Complete,delete all it finds and close out the program!

14.Scan the PC with Microsoft AntiSpyware,delete all it finds and close out the program!

15.Use the Task Manager to Restart the PC(Just Click Shut Down and then Select Restart)

16.Once back in Normal Mode,Download and Run these 2 Programs:
CCleaner:
http://www.filehippo...d_ccleaner.html
This is to help keep those Temporary Files Cleaned Up,all you will want to use on this is the Opening Page(Windows Tab)Just Click Run Cleaner and let it do its thing!

CleanUp! 4.0:
http://cleanup.stevengould.org/
Just Scroll through the Page and locate this Line:
So download CleanUp! now and reap the benefits of a clean machine.
If that Link doesnt work,just go to Google.com and Search for CleanUp!
It should be the First Return!!
Once Installed,Open and Click CleanUp! and When Prompted to Log Off,do so!

17.Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK!

Make Sure Normal Startup is Checked!!

Select the tab labeled Startup and put a Check by every box there!!

Click Apply>>OK>>Follow the Prompts to Restart!!

18.Once all is complete and you are Restarted in Normal Mode,Scan the PC with HijackThis and Post those results!

19.Lets see how we did,Have the PC scanned here:
http://www.pandasoft...n_principal.htm

You will have to be using Internet Explorer for the Scan to work!
Please take the time to do this Scan,its a Critical Step!
The Scan will produce a report,please post that Report along with the fresh HijackThis log!

20.Any Questions at all,Feel Free to ask away!!!

Edited by Cretemonster, 01 May 2005 - 04:07 PM.

[poster_boy101]

First of all I just want to say thank you for your help, I did all the steps you asked me to take and learned alot. Here are the results from my latest Hijackthis scan:
Logfile of HijackThis v1.99.1
Scan saved at 11:03:55 AM, on 5/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
D:\program files\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\alg.exe
C:\WINDOWS\System32\mouseutils.exe
C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Tom Lundhild\Desktop\Cleanup\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R3 - Default URLSearchHook is missing
O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\hgfhf.dll
O4 - HKLM\..\Run: [EPSON Stylus CX5200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX5200" /O6 "USB001" /M "Stylus CX5200"
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\program files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Qtime] C:\WINDOWS\nrchk.exe /i
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitesxl32.exe
O4 - HKLM\..\Run: [OFFICEXP] OFFICEXP.exe
O4 - HKLM\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] C:\alg.exe
O4 - HKLM\..\Run: [Windows Mouse Utilities] mouseutils.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
O4 - HKLM\..\Run: [KASP] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe"
O4 - HKLM\..\RunServices: [OFFICEXP] OFFICEXP.exe
O4 - HKLM\..\RunServices: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - HKLM\..\RunServices: [Windows Mouse Utilities] mouseutils.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [OFFICEXP] OFFICEXP.exe
O4 - HKCU\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112860457797
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: OFFICEXP - Unknown owner - C:\WINDOWS\System32\OFFICEXP.exe" -netsvcs (file missing)
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe



and here are the results from the ActiveScan

Virus:Trj/Agent.NE Disinfected Operating system
Possible Virus. No disinfected C:\alg.exe
Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/DealHelper No disinfected C:\WINDOWS\System32\newmsrdk
Adware:Adware/WUpd No disinfected Windows Registry
Adware:Adware/EliteBar No disinfected C:\WINDOWS\EliteSideBar
Possible Virus. No disinfected C:\alg.exe
Adware:Adware/Webdir No disinfected C:\WINDOWS\pludll.exe
Adware:Adware/Webdir No disinfected C:\WINDOWS\webdir.dll
Adware:Adware/BrilliantDigitalNo disinfected D:\bdcore.dll
Adware:Adware/Minibug No disinfected D:\stuff\Sysfiles\WxBug.EXE



THANK YOUUUU.... but now what should I do to get rid of the rest?

[Wizard]

Cool,You got the Security Suite!!!

How Ya like it,definatly will be my next purchase!!!

Download LQfix.zip:
http://users.pandora...atchy/LQfix.zip
Unzip it and save it to your desktop, don't use it yet!!

Unregister this DLL,to do this:

Click Start>>>Click Run>>>Copy&Paste the Text below into the Text Box and Click OK!

regsvr32 /u hgfhf.dll
If you get an error message,try it like this:
regsvr32 /u C:\WINDOWS\hgfhf.dll

Do the Same for these

regsvr32 /u webdir.dll
If you get an error message,try it like this:
regsvr32 /u C:\WINDOWS\webdir.dll

regsvr32 /u bdcore.dll
If you get an error message,try it like this:
regsvr32 /u D:\bdcore.dll


Now,lets Stop and Delete a Service that may be running:

Click Start>>>Click Run>>>Copy&Paste the Bold Text below into the Text Box and Click OK!

sc stop OFFICEXP

after that

sc delete OFFICEXP

Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!

R3 - Default URLSearchHook is missing

O2 - BHO: CDllBho Object - {5A5B6916-ED71-4531-8018-E792DD44156E} - C:\WINDOWS\hgfhf.dll

O4 - HKLM\..\Run: [Qtime] C:\WINDOWS\nrchk.exe /i

O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitesxl32.exe

O4 - HKLM\..\Run: [OFFICEXP] OFFICEXP.exe

O4 - HKLM\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe

O4 - HKLM\..\Run: [Anti-Virus Update Scheduler V1.39.12R] C:\alg.exe

O4 - HKLM\..\Run: [Windows Mouse Utilities] mouseutils.exe

O4 - HKLM\..\RunServices: [OFFICEXP] OFFICEXP.exe

O4 - HKLM\..\RunServices: [Windows Update Manager] C:\WINDOWS\wupdate.exe

O4 - HKLM\..\RunServices: [Windows Mouse Utilities] mouseutils.exe

O4 - HKCU\..\Run: [OFFICEXP] OFFICEXP.exe

O4 - HKCU\..\Run: [Windows Update Manager] C:\WINDOWS\wupdate.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab

O23 - Service: OFFICEXP - Unknown owner - C:\WINDOWS\System32\OFFICEXP.exe" -netsvcs (file missing)

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!

Reboot into SAFE MODE(Tap F8 when restarting)
Here is a link on how to boot into Safe Mode:
http://service1.syma...src=sec_doc_nam

After restarting in Safe Mode,Configure Windows to Show All Hidden Files and Folders,this must be done after restarting in Safe Mode!!
Here is a link to help with that:
http://www.bleepingc...showtutorial=62

Locate and Delete:

C:\alg.exe<< File only and in that location only!!

C:\WINDOWS\nrchk.exe<< File only!!

C:\WINDOWS\wupdate.exe<< File only!!

C:\WINDOWS\pludll.exe<< File only!!

C:\WINDOWS\webdir.dll<< File only!!

C:\WINDOWS\webdir.dll<< File only!!

C:\WINDOWS\EliteSideBar<< Should be a folder!!

C:\windows\system32\elitesxl32.exe<< File only!!

C:\WINDOWS\System32\mouseutils.exe<< File only!!

C:\WINDOWS\System32\OFFICEXP.exe<< File only and in that location only!!

C:\WINDOWS\System32\newmsrdk<< Not sure if this is a file or a folder!!

D:\bdcore.dll<< File only!!

D:\program files\qttask.exe<< File only and in that location only!!

D:\stuff\Sysfiles\WxBug.EXE<< File only!!

Please keep a list of any files that could not be located or could not be deleted,I will need to know that Info!!

Now, Doubleclick LQfix.bat that you saved on your desktop before!

A Dos Window will open and close again, this is normal!

Restart Normal,Scan the PC with HijackThis again and Post those results!

[poster_boy101]

ok, so I did all the steps you took me to take. A couple of the files you asked me to delete were not there. I could not find:
C:\windows\webdir.ll
C:\alg.exe
C:\windows\nrchk.exe
C:\windows\wupdate.exe
C:\system32\elitesxl32.exe
C:\system32\mouseutils.exe
C:\system32\officexp.exe
C:\system32\newmsrdk

here is my new hijackthis report:

Logfile of HijackThis v1.99.1
Scan saved at 8:16:13 PM, on 5/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Microsoft AntiSpyware\gcasSWUpdater.exe
C:\Documents and Settings\Tom Lundhild\Desktop\Cleanup\HijackThis.exe

O4 - HKLM\..\Run: [EPSON Stylus CX5200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX5200" /O6 "USB001" /M "Stylus CX5200"
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\program files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] D:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
O4 - HKLM\..\Run: [KASP] "C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112860457797
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

THANKS A MILLON

[Wizard]

OK,Great Info,lets play it Safe!!!

Download Pocket KillBox from here:
http://www.bleepingc...les/killbox.php
There is a Direct Download and a description of what the Program does inside this link.

Open Pocket KillBox and in the Open Box labeled "Full Path of File to Delete"

Copy&Paste the Below,one at a time into that Open Box:

C:\windows\webdir.ll
C:\alg.exe
C:\windows\nrchk.exe
C:\windows\wupdate.exe
C:\system32\elitesxl32.exe
C:\system32\mouseutils.exe
C:\system32\officexp.exe
C:\system32\newmsrdk

Put a Tick by:
"Standard File Kill"

Click the Red Circle with the White X in the middle to delete!

You will see other options you can check if any of these give you problems like:

"End Explorer Shell while Killing File"
"Unregister .dll before Deleting File"
"Deltree"

Use any of these selections if you need to!!

Post back and tell me how many Killbox said didnt exist!

[poster_boy101]

none of them where there.
so now what should i do?

ps. your a LIFE SAVER

[Wizard]

OK,sorry it took me so long to get back to ya,the man who pays me,actually required that I work for my paycheck!!! LOL!!

So,How is everything running now?

OK,MSN Messanger,was the origin of this,correct??

I think its best that you completely Uninstall and ReInstall MSN Messanger!!!

There is a folder that is associated with the program,it located in:

C:\Documents and Settings\My Received Files<<< Delete that Folder!

Before Re Installing Messanger,disable the System Restore feature in Windows XP Here's a link on how to do this:
http://service1.syma...src=sec_doc_nam

Now,Restart the PC and go ahead and Re Enable System Restore!

Once Restarted,you should be Safe to Re Install Messanger!!

Please do one more Online Scan so we can be sure we got everything!!!

http://support.f-sec.../home/ols.shtml
or
http://www.ravantivirus.com/scan/

Save any results they produce and post them back here!!!

Let me see a fresh HijackThis log also!!!