[jrollz]

Having Aurora issues also...please help

This is a scan from trojan hunter before i did the HJT scan.....

File scan
Error: Unable to delete temporary file E:\DOCUME~1\Jeffrey\LOCALS~1\Temp\TrojanHunter.exe (The system cannot find the file specified)
Warning: Unable to unpack UPX-packed file E:\Program Files\AdbeRdr60_enu_full.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\System Volume Information\_restore{E7C70C0E-41E2-45FE-A200-9CEA99CC6273}\RP354\A0034406.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\System Volume Information\_restore{E7C70C0E-41E2-45FE-A200-9CEA99CC6273}\RP356\A0036425.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\System Volume Information\_restore{E7C70C0E-41E2-45FE-A200-9CEA99CC6273}\RP356\A0036433.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\System Volume Information\_restore{E7C70C0E-41E2-45FE-A200-9CEA99CC6273}\RP356\A0036439.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\System Volume Information\_restore{E7C70C0E-41E2-45FE-A200-9CEA99CC6273}\RP356\A0036447.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\WINDOWS\jkfjnnitkal.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\WINDOWS\Nail.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\WINDOWS\svcproc.exe (Add to ignore list)
Warning: Unable to unpack UPX-packed file E:\WINDOWS\system32\hqdfuc.exe (Add to ignore list)
No trojan files found


HJT log


Logfile of HijackThis v1.99.1
Scan saved at 10:44:27 AM, on 5/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\System32\wdfmgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Raxco\PerfectDisk\PDSched.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
E:\WINDOWS\Explorer.exe
E:\Program Files\NetLimiter\NetLimiter.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\WINDOWS\system32\Sktempdm.exe
E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
E:\program files\aim95\aim.exe
E:\Program Files\Washer\washer.exe
e:\windows\system32\hqdfuc.exe
E:\WINDOWS\system32\ctfoconv.exe
E:\WINDOWS\system32\Skdaemon.exe
E:\WINDOWS\System32\SKSMAILD.EXE
E:\WINDOWS\System32\alg.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\PROGRA~1\WINZIP\winzip32.exe
E:\Program Files\TrojanHunter 3.8\TrojanHunter.exe
E:\Documents and Settings\Jeffrey\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe E:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Detect Kbd Daemon] SK2000DM.EXE
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [mydhmnj] e:\windows\system32\hqdfuc.exe
O4 - HKLM\..\RunServicesOnce: [washindex] E:\Program Files\Washer\washidx.exe "Jeffrey"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [AIM] E:\program files\aim95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Washer] E:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [Koq2RkKEi] ctfoconv.exe
O4 - Startup: LimeWire On Startup.lnk = E:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\program files\aim95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O20 - Winlogon Notify: WB - E:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - E:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Edited by jrollz, 11 May 2005 - 09:31 AM.

[Advertisements]

Updated HJT log scan...help please... THANKS

Logfile of HijackThis v1.99.1
Scan saved at 12:12:37 PM, on 5/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\System32\wdfmgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Raxco\PerfectDisk\PDSched.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
E:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
E:\WINDOWS\Explorer.exe
E:\WINDOWS\System32\alg.exe
E:\Program Files\NetLimiter\NetLimiter.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\WINDOWS\system32\Sktempdm.exe
E:\WINDOWS\system32\Skdaemon.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
e:\windows\system32\hxbqyh.exe
E:\WINDOWS\System32\SKSMAILD.EXE
E:\program files\aim95\aim.exe
E:\Program Files\Washer\washer.exe
E:\WINDOWS\system32\ctfoconv.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Messenger\msmsgs.exe
E:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe E:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Detect Kbd Daemon] SK2000DM.EXE
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [lprknqv] e:\windows\system32\hxbqyh.exe
O4 - HKLM\..\RunServicesOnce: [washindex] E:\Program Files\Washer\washidx.exe "Jeffrey"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] E:\program files\aim95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Washer] E:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [Koq2RkKEi] ctfoconv.exe
O4 - Startup: LimeWire On Startup.lnk = E:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\program files\aim95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O20 - Winlogon Notify: WB - E:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - E:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Edited by jrollz, 11 May 2005 - 05:30 PM.

[jrollz]

Updated HJT log scan...help please... THANKS

Logfile of HijackThis v1.99.1
Scan saved at 12:12:37 PM, on 5/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\csrss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\WINDOWS\System32\wdfmgr.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Raxco\PerfectDisk\PDSched.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
E:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
E:\WINDOWS\Explorer.exe
E:\WINDOWS\System32\alg.exe
E:\Program Files\NetLimiter\NetLimiter.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
E:\WINDOWS\system32\Sktempdm.exe
E:\WINDOWS\system32\Skdaemon.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
e:\windows\system32\hxbqyh.exe
E:\WINDOWS\System32\SKSMAILD.EXE
E:\program files\aim95\aim.exe
E:\Program Files\Washer\washer.exe
E:\WINDOWS\system32\ctfoconv.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Messenger\msmsgs.exe
E:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=Explorer.exe E:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\TrojanHunter 3.8\THGuard.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] E:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Detect Kbd Daemon] SK2000DM.EXE
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] E:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [lprknqv] e:\windows\system32\hxbqyh.exe
O4 - HKLM\..\RunServicesOnce: [washindex] E:\Program Files\Washer\washidx.exe "Jeffrey"
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] E:\program files\aim95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Washer] E:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\Run: [Koq2RkKEi] ctfoconv.exe
O4 - Startup: LimeWire On Startup.lnk = E:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\program files\aim95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O20 - Winlogon Notify: WB - E:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - E:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Edited by jrollz, 11 May 2005 - 05:30 PM.

[jrollz]

Assistance please

[jrollz]

lalallala

[Metallica]

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml


Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Regards,

[jrollz]

Thanks Metallica for helping me out. Here's what i got. When i ran hijackthis, i did not see the (F2 - REG:system.ini Shell=Explorer.exe C:\WINDOWS\Nail.exe) file to check and fix.

+ Created on: 9:28:13 PM, 5/19/2005
+ Report-Checksum: 9243874E

+ Date of database: 5/19/2005
+ Version of scan engine: v3.0

+ Duration: 18 min
+ Scanned Files: 56134
+ Speed: 50.07 Files/Second
+ Infected files: 117
+ Removed files: 117
+ Files put in quarantine: 117
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: No

+ Scanned items:
E:\
F:\

+ Scan result:
E:\Documents and Settings\Jeffrey\Cookies\jeffrey@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Cookies\jeffrey@com[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Cookies\jeffrey@tribalfusion[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Cookies\[email protected][1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Cookies\jeffrey@zedo[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Local Settings\Temporary Internet Files\Content.IE5\AJHMVYF9\Duad[1].exe -> Trojan.Agent.ay -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Local Settings\Temporary Internet Files\Content.IE5\AJHMVYF9\Nail[1].exe -> Trojan.Nail -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Local Settings\Temporary Internet Files\Content.IE5\IX4BEPY5\aurora[1].exe -> Spyware.BetterInternet.c -> Cleaned with backup
E:\Documents and Settings\Jeffrey\Local Settings\Temporary Internet Files\Content.IE5\WNXTNJ5Q\Poller[1].exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01075761.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01075762.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01075777.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01075889.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01076031.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01076198.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01076348.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01076809.EXE -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01076812.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077004.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077013.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077047.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077049.EXE -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077175 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077181.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077190.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077224 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077230.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077240.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077601 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077606.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077626.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077748.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077754.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077755.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077774.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077776 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01077926.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078249 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078253.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078602 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078605.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078649.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078845 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01078849.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079011 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079015.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079074 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079077.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079376 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079380.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079403.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079419 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079425.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079463.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079487.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079493.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079523 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079529.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079755 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079814 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01079820.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080319 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080322.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080781 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080783.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080815.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080863.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080909 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080913.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080952.exe -> Spyware.ConsCorr -> Cleaned with backup
E:\RECYCLER\NPROTECT\01080957.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081055 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081059.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081086.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081125.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081140.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081543.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081699.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081745.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081749.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081755 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081759.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081826 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081829.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081876 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081878.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081904.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081911.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081934.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081936 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01081943.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082018.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082021 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082094 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082097.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082116.exe -> Trojan.Agent.ay -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082273 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082276.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082618 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082655.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082684.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082716 -> Spyware.BetterInternet -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082782.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082798.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082805.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\RECYCLER\NPROTECT\01082826.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\WINDOWS\.exe -> Spyware.BetterInternet -> Cleaned with backup
E:\WINDOWS\autoload.exe -> Not-A-Virus.Tool.Autoloader -> Cleaned with backup
E:\WINDOWS\dlmax.dll -> Spyware.DlMax.a -> Cleaned with backup
E:\WINDOWS\farmmext.exe -> Spyware.ConsCorr -> Cleaned with backup
E:\WINDOWS\jkfjnnitkal.exe -> Spyware.BetterInternet -> Cleaned with backup
E:\WINDOWS\systb.dll -> Spyware.ImiBar.d -> Cleaned with backup
E:\WINDOWS\system32\ddtjds.exe -> Trojan.Agent.cp -> Cleaned with backup
E:\WINDOWS\system32\instsrv.exe -> Spyware.BargainBuddy -> Cleaned with backup
E:\WINDOWS\tdtb.exe -> Trojan.Imiserv.c -> Cleaned with backup
E:\WINDOWS\wupdsnff.exe -> Spyware.BetterInternet -> Cleaned with backup
E:\WINDOWS\wupdt.exe -> TrojanDownloader.Intexp.c -> Cleaned with backup


::Report End

Logfile of HijackThis v1.99.1
Scan saved at 9:31:15 PM, on 5/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\explorer.exe
E:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - E:\WINDOWS\dlmax.dll (file missing)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - E:\WINDOWS\systb.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O20 - Winlogon Notify: WB - E:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

I hope i did everything right.

[Metallica]

Great job.


Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - E:\WINDOWS\dlmax.dll (file missing)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - E:\WINDOWS\systb.dll (file missing)

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab

Then reboot and post a new log.

Regards,

[jrollz]

Here it is....

Logfile of HijackThis v1.99.1
Scan saved at 5:44:31 AM, on 5/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\NetLimiter\NetLimiter.exe
E:\Program Files\AIM95\aim.exe
E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
E:\Program Files\ewido\security suite\ewidoctrl.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
E:\WINDOWS\System32\nvsvc32.exe
E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\Program Files\Raxco\PerfectDisk\PDSched.exe
E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - E:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NetLimiter] E:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKCU\..\Run: [AIM] E:\Program Files\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: E:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O20 - Winlogon Notify: WB - E:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Unknown owner - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - E:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Metallica]

That is one clean log to go.

Is your computer behaving accordingly?

Please have a look at my site for some tips on how to remove and prevent spyware.

Regards,

[jrollz]

Thanks Metallica....yes my machine looks to be back at normal now....no more aurora popups...

Just a side question now.... did the ewido program i DL'd take over the norton antivirus program because i tried opening up norton and it wouldnt open up.
Thanks again

[Metallica]

It should be possible to run them alongside.

Is the icon missing in your systray or is that the one you are trying to use to open the controls?

Regards,

[jrollz]

yea its missing in the system tray as well as the norton internet security icon....I tried opening the norton antivirus from start>all programs and nothing would show...norton internet security would show though.....my system tray doesnt have all the stuff i use to you have before when turnin on the computer but everything else seems to run fine.....so far...

[Metallica]

Better reinstall Norton before something takes advantage of your vulnerability.

Regards,

[jrollz]

alright...thanks for everything....this post can be closed i guess

THANKS

[Metallica]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.