[aprilsuccess]

I did everything on your list several times and the malware is still here. I have the bad one that everyone talks about, abetterinternet, the shortcuts being added to my desktop, nail, etc. And it doesn't want to die! Help me kill it PLEASE! I also downloaded the Nailfix and ran it in safe mode then ran Ewido (2nd day report below which didn't find anything) I have checked to make sure I have all of the latest updates...
I also have spysweeper which I got before finding you guys and that one keeps alerting that a file called fva keeps trying to start. That one tries to run about every 45 seconds.
Here are the log files from ewido and hijackthis...Ewido didn't find anything the 2nd day when I ran it in safe mode, but then when I rebooted, ewido popped up alerts and I got more pop-ups. Please help!

Thank you so much!
April

Ewido day 1:
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 5:44:43 PM, 6/9/2005
+ Report-Checksum: 485373FE

+ Date of database: 6/9/2005
+ Version of scan engine: v3.0

+ Duration: 94 min
+ Scanned Files: 513975
+ Speed: 90.66 Files/Second
+ Infected files: 19
+ Removed files: 19
+ Files put in quarantine: 19
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053170.exe -> TrojanDownloader.Small.hs -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053171.exe -> Spyware.SmartPops -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053172.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053173.exe -> Trojan.Favadd.o -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053174.exe -> Trojan.Delf.cf -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053175.exe -> Trojan.Delf.cf -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053176.dll -> Spyware.ToolBar.AlexaBar.a -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053177.exe -> TrojanDownloader.Qoologic.q -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053178.exe -> TrojanDownloader.IstBar -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053179.dll -> Trojan.Delf.cf -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053180.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053181.dll -> TrojanDownloader.Qoologic.q -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053182.cpl -> TrojanDownloader.Qoologic.p -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053183.dll -> TrojanDownloader.Qoologic.p -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053184.exe -> TrojanDownloader.Qoologic.n -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053185.dll -> Spyware.Winsta -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053186.exe -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053187.dll -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP332\A0053188.dll -> TrojanDownloader.Qoologic.q -> Cleaned with backup


::Report End

Ewido day 2 (in safe mode)
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 11:21:32 AM, 6/10/2005
+ Report-Checksum: F6EF4BC

+ Date of database: 6/9/2005
+ Version of scan engine: v3.0

+ Duration: 129 min
+ Scanned Files: 516177
+ Speed: 66.63 Files/Second
+ Infected files: 0
+ Removed files: 0
+ Files put in quarantine: 0
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\

+ Scan result:
No infected files found!


::Report End



Logfile of HijackThis v1.99.1
Scan saved at 11:41:02 AM, on 6/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\EXPLORER.EXE
C:\Program Files\ewido\security suite\SecuritySuite.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\April\Desktop\security tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.floridasmart.com"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\SYSTEM32\gl9q0.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Norton PasswordManager] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {D1AFB197-5F24-49f4-9571-2F28A9798936}
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [u78Q3sS] mdmrxy.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [fva] C:\WINDOWS\System32\fva.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [fwr4RietU] mcdtcprx.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Write a Review... - http://client.alexa....ions/review.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.neededware.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange...ectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange...ClientUtils.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange...ol/IRCSharc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[Advertisements]

Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Right click on this link http://www.greyknigh...lO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

Viewpoint

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\SYSTEM32\gl9q0.dll (file missing)
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [u78Q3sS] mdmrxy.exe
O4 - HKLM\..\Run: [fva] C:\WINDOWS\System32\fva.exe
O4 - HKCU\..\Run: [fwr4RietU] mcdtcprx.exe
O15 - Trusted Zone: http://www.neededware.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\Program Files\Viewpoint\
mdmrxy.exe
C:\WINDOWS\System32\fva.exe
mcdtcprx.exe

Restart and run a new HijackThis scan. Save the log file and post it here.

Please run this online virus scan:
ActiveScan

Copy the results of the ActiveScan and paste them here

[greyknight17]

Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Right click on this link http://www.greyknigh...lO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

Viewpoint

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Bucket Class - {00000001-C003-4A2F-9142-7CB1D78DE6C1} - C:\WINDOWS\tct101.dll (file missing)
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\SYSTEM32\gl9q0.dll (file missing)
O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [u78Q3sS] mdmrxy.exe
O4 - HKLM\..\Run: [fva] C:\WINDOWS\System32\fva.exe
O4 - HKCU\..\Run: [fwr4RietU] mcdtcprx.exe
O15 - Trusted Zone: http://www.neededware.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\Program Files\Viewpoint\
mdmrxy.exe
C:\WINDOWS\System32\fva.exe
mcdtcprx.exe

Restart and run a new HijackThis scan. Save the log file and post it here.

Please run this online virus scan:
ActiveScan

Copy the results of the ActiveScan and paste them here

[aprilsuccess]

Ok, did it. Note, there was also a file next to the windows\system32\fva.exe that was created at the same time - windows\system32\fvaaeg05.dll - should I delete that one also? And when I did a search for viewpoint, it found c:/programfiles/aim/sysfiles/viewpoint.exe...

When I rebooted, dell support popped up with several messages that I need to download the latest Microsoft updates, should I do this now or wait until we are done?

Here's the Hijack Log, the Panda ActiveScan is running now...I will post it in a few...

Logfile of HijackThis v1.99.1
Scan saved at 2:00:44 PM, on 6/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\April\Desktop\security tools\HijackThis.exe
C:\Program Files\Dell Support\DSBrws.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.floridasmart.com"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Norton PasswordManager] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {D1AFB197-5F24-49f4-9571-2F28A9798936}
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Write a Review... - http://client.alexa....ions/review.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange...ectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange...ClientUtils.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange...ol/IRCSharc.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[greyknight17]

Yes, delete that file that was created around the same date. Also delete that viewpoint.exe in the aim subdirectory folder.

Did you install Alexa? If not, uninstall it. If so, you may keep it.

Yes, you may install the updates now.

Your log is clean.

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer and uncheck the same box to enable System Restore.

Make sure to get the latest updates for Windows and Internet Explorer at http://v5.windowsupd...t.aspx?ln=en-us.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

[aprilsuccess]

no such luck, activescan found all kinds of stuff and I'm still getting the alerts on spysweeper - its that stupid fva again. I'm running ad-aware again and it's finding a bunch of stuff also. I'm going to go through all of the steps again and delete those other 2 files and re-send the hijackthis report. If there is anything else I should do extra this time, let me know. thanks

[aprilsuccess]

here is the activescan log if this helps:

Incident Status Location

Spyware:Spyware/Dyfuca No disinfected Windows Registry
Adware:Adware/PortalScan No disinfected C:\WINDOWS\System32\winupdt.008
Adware:Adware/Apropos No disinfected C:\DOCUME~1\April\LOCALS~1\Temp\AutoUpdate0
Adware:Adware/Fizzle No disinfected C:\Program Files\FwBarTemp
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\April\Favorites\Casino & Carrers
Adware:Adware/PowerSearch No disinfected C:\WINDOWS\System32\stlb2.xml
Adware:Adware/Searchforit No disinfected C:\Program Files\sf
Adware:Adware/Novo No disinfected Windows Registry
Virus:W32/Bagle.pwdzip Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-11.org\Inbox[Info.zip]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Inbox[~000272.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Inbox[~000347.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Inbox[~000370.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Inbox[~000407.@x@]
Virus:W32/Bagle.CA.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Inbox[I_know_you.zip][123456.exe]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Trash[~000039.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Trash[~000055.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Trash[~000067.@x@]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Trash[~000071.@x@]
Virus:W32/Bagle.CA.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-2.org\Trash[I_know_you.zip][123456.exe]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[postcard_work.zip][data.rtf .scr]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[~000081.txt]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[message.scr]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[summary2004.zip][details.txt .pif]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[details.zip][data.rtf .scr]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[readme.zip][details.txt .pif]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[attach.zip][data.rtf .scr]
Virus:W32/Netsky.P.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-3.org\Inbox[screensaver_anne.txt .pif]
Virus:JS/Illwill.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-4.org\Inbox[new__price.zip][price.html]
Virus:W32/Bagle.AM.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-4.org\Inbox[new__price.zip][price.exe]
Virus:JS/Illwill.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-4.org\Trash[new__price.zip][price.html]
Virus:W32/Bagle.AM.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-4.org\Trash[new__price.zip][price.exe]
Virus:W32/Sober.V.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-5.org\Inbox[error-mail_info.zip][Winzipped-Text_Data.txt .pif]
Virus:W32/Mytob.AS.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-5.org\Inbox[body.zip][body.pif]
Virus:W32/Sober.V.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-5.org\Trash[error-mail_info.zip][Winzipped-Text_Data.txt .pif]
Virus:W32/Mytob.AS.worm Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.floridasmart-5.org\Trash[body.zip][body.pif]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Inbox[game_xxo.zip][data.rtf .scr]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Inbox[msg_admin.zip][details.txt .pif]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Inbox[document.zip][data.rtf .scr]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Trash[game_xxo.zip][data.rtf .scr]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Trash[msg_admin.zip][details.txt .pif]
Virus:W32/FunLove.4096 Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-4.net\Trash[document.zip][data.rtf .scr]
Virus:Trj/Mitglieder.DC Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-5.com\Inbox[3.zip][01_05_2005.exe]
Virus:Trj/Mitglieder.DC Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart-5.com\Trash[3.zip][01_05_2005.exe]
Virus:Trj/Citifraud.A Disinfected C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\Mail\mail.surfsmart.net\Inbox[~000303.@x@]
Adware:Adware/Apropos No disinfected C:\Documents and Settings\April\Local Settings\Temp\AutoUpdate0\AutoUpdate.exe
Adware:Adware/Envolo No disinfected C:\Documents and Settings\April\Local Settings\Temp\AutoUpdate0\auto_update_uninstall.exe
Adware:Adware/Envolo No disinfected C:\Documents and Settings\April\Local Settings\Temp\AutoUpdate0\setup.inf
Adware:Adware/Envolo No disinfected C:\Documents and Settings\April\Local Settings\Temporary Internet Files\Content.IE5\0SZ0M564\AutoUpdaterInstaller[1].exe
Virus:W32/Sircam Renamed C:\Documents and Settings\April\My Documents\1business\bizplans\ipowersports.txt[Reference book.doc.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[card.zip][card.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[trash.zip][trash.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[regards.zip][regards.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[note.zip][note.htm.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[warez.zip][warez.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[found.zip][found.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[undefinied_posting.zip][undefinied_posting.rtf.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[product.zip][product.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[image.zip][image.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[transfer.zip][transfer.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[story.zip][story.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[injection_454543403.zip][injection_454543403.doc.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[mydate.zip][mydate.txt.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Inbox[your_stuff.zip][your_stuff.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[talk.zip][talk.rtf.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[dinner.zip][dinner.htm.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[material_mail2.zip][material_mail2.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[webcam.zip][webcam.rtf.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[msg2.zip][msg2.doc.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[warez.zip][warez.txt.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[dinner_aboutyou.zip][dinner_aboutyou.rtf.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[part2.zip][part2.doc.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[454543403.zip][454543403.htm.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[trash_454543403.zip][trash_454543403.txt.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[warez.zip][warez.txt.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[naked2.zip][naked2.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[msg_warez.zip][msg_warez.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[note.zip][note.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[note.zip][note.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[injection.zip][injection.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[concert.zip][concert.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[final.zip][final.rtf.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[transfer_yours.zip][transfer_yours.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[card.zip][card.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[trash.zip][trash.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[regards.zip][regards.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[note.zip][note.htm.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[warez.zip][warez.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[found.zip][found.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[undefinied_posting.zip][undefinied_posting.rtf.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[product.zip][product.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[your_stuff.zip][your_stuff.com]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[mydate.zip][mydate.txt.pif]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[injection_454543403.zip][injection_454543403.doc.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[story.zip][story.doc.scr]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[transfer.zip][transfer.exe]
Virus:W32/Netsky.C.worm Disinfected C:\Documents and Settings\Monkey\Application Data\Mozilla\Profiles\default\btqojhbh.slt\Mail\mail.tarell.com\Trash[image.zip][image.doc.scr]
Virus:Trj/Downloader.CZM Disinfected C:\RECYCLER\S-1-5-21-1525513258-2063234544-1337654111-1007\Dc2.exe
Adware:Adware/Novo No disinfected C:\WINDOWS\drvi\ixxamocmse.dll
Adware:Adware/Transponder No disinfected C:\WINDOWS\fcgulc.exe
Virus:Trj/Downloader.CZZ Disinfected C:\WINDOWS\ikhmlqe.sys
Adware:Adware/Mirar No disinfected C:\WINDOWS\SYSTEM32\Cache\876004.exe
Spyware:Spyware/Dyfuca No disinfected C:\WINDOWS\SYSTEM32\Cache\optimize7.exe
Spyware:Spyware/SurfSideKick No disinfected C:\WINDOWS\SYSTEM32\Cache\SSK3_B5 Advagency.exe
Virus:Trj/Downloader.CZM Disinfected C:\WINDOWS\SYSTEM32\epx30105.exe
Virus:Trj/Downloader.CZM Disinfected C:\WINDOWS\SYSTEM32\fvaaeg05.dll
Virus:Trj/Downloader.CZZ Disinfected C:\WINDOWS\SYSTEM32\ikhmlqe.sys
Adware:Adware/PowerSearch No disinfected C:\WINDOWS\SYSTEM32\stlb2.xml
Adware:Adware/Mirar No disinfected C:\WINDOWS\SYSTEM32\WinNB57.dll
Adware:Adware/PortalScan No disinfected C:\WINDOWS\SYSTEM32\winupdt.008
Adware:Adware/PortalScan No disinfected C:\WINDOWS\SYSTEM32\winupdt.bin

[aprilsuccess]

OK this time looks good. No alerts so far. Here is the log....I'm going to download the llatest MS updates now that things look good and spywareblaster to try to keep it clean.
please let me know if this looks good....thanks


Logfile of HijackThis v1.99.1
Scan saved at 5:57:34 PM, on 6/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Documents and Settings\April\Desktop\security tools\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.floridasmart.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.floridasmart.com"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\April\Application Data\Mozilla\Profiles\default\e12g23hx.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Norton PasswordManager] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {D1AFB197-5F24-49f4-9571-2F28A9798936}
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Write a Review... - http://client.alexa....ions/review.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange...ectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange...ClientUtils.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange...ol/IRCSharc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[greyknight17]

OK, I took a look and your Panda scan shows lots of files that couldn't be removed. I want you to delete those files (or folders if no filename was given) yourself. They should be simple to follow on. Just delete the file/folder right after the words No disinfected. Delete all those and you should be ok now.

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.