Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

please help! [CLOSED]


  • This topic is locked This topic is locked

#1
hoopy

hoopy

    New Member

  • Member
  • Pip
  • 6 posts
please please please can someone help me get rid of derbiz it is driving me mad! i have the desktop icon constantly even though i keep removing it from add and remove programs.

Here is my hijack this:


Logfile of HijackThis v1.99.1
Scan saved at 20:45:03, on 15/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Linda1\My Documents\My Received Files\hgijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliteacy32.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINNT\system32\temp532.exe -N
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FC08B59-0583-469F-A2CE-3C978332CEA0}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • 0

Advertisements


#2
Guest_thatman_*

Guest_thatman_*
  • Guest
Hello

We are sorry for the delay in replying to your post, if your still need help please post a current HijackThis.log.

Thank you

Kc :tazz:
  • 0

#3
hoopy

hoopy

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
thankyou here it is now:



Logfile of HijackThis v1.99.1
Scan saved at 19:14:50, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliteacy32.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINNT\system32\temp532.exe -N
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • 0

#4
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi hoopy

Please post a HJT.log done in normal mode never one done in safemode.

Please read through the instructions before you start (you may want to print this out).

Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliteacy32.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINNT\system32\temp532.exe -N

Click on Fix Checked when finished and exit HijackThis.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\Program Files\Common files\SearchUpgrader<--Delete the whole folder
[/B]Exit Explorer.Reboot as normal.

Download Pocket Killbox and unzip it; save it to your Desktop.
Run killbox and click the radio button that says Delete a file on reboot. Paste the file's one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
C:\winnt\system32\eliteacy32.exe
C:\WINNT\system32\temp532.exe -N
Let the system reboot.

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp
Please post the logs From Panda virus scan and HJT.logWe will need them to remove previous infections that have left files on your system.

Thank you

Kc :tazz:
  • 0

#5
hoopy

hoopy

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
hi there! i have done the hijack this log and ticked all the ones you told me to, but im sorry if i sound stupid!! but i dont understand the bit where i have to use internet explorer to locate files and folders do i do all this in safe mode?
many thanks
Claire
  • 0

#6
hoopy

hoopy

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
actually im really sorry i am being stupid!!1 i have just read through it again and it says windows explorer not internet explorer!!!! just ignore that other one!!!
  • 0

#7
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi hoopy

When you have completed the fix post back when you are ready.


Kc :tazz:
  • 0

#8
hoopy

hoopy

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
hiya i done everything, although when i downloaded pocket killbox there was no files called c:\winnt\system32\elite...... and c:\winnt\system32\temp532.....
but here is the hijack this log and the panda log:


Incident Status Location

Adware:Adware/nCase No disinfected Windows Registry
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Favorites\Casino & Adult
Adware:Adware/Midaddle No disinfected C:\WINNT\system32\preuninstall.exe
Spyware:Spyware/LinkReplacer No disinfected Windows Registry
Spyware:Spyware/LinkReplacer No disinfected C:\WINNT\system32\uninst.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteclw32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteynf32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitedpb32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitehhr32.exe
Spyware:Spyware/LinkReplacer No disinfected C:\WINNT\system32\PreUninstall.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitejlv32.exe
Adware:Adware/Startpage.SJ No disinfected C:\WINNT\system32\eliteerror32.dat
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitedoolsav.dat
Adware:Adware/Startpage.SJ No disinfected C:\WINNT\system32\elitegsx32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitefvy32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\eliteohl32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitemhg32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitehwl32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitewym32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitexkt32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteryx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexom32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteajj32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitehih32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitetzn32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitebyj32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitevdp32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetgx32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitemij32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitelgy32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitejpd32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitejzt32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyro32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitenrk32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyuy32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitemxs32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitesas32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitedso32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitevyk32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitexkw32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteaxn32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitecln32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitedii32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitefpp32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitekeu32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitednv32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitekmt32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteowv32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetua32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetru32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitejke32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyri32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitefbs32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteaaz32.exe
Virus:Trj/Downloader.CFN Disinfected C:\WINNT\system32\elitelsj32.exe
Virus:Trj/Downloader.CFN Disinfected C:\WINNT\system32\eliteldi32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexoc32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitebym32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitektl32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteekd32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitesoz32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteroh32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteoho32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteojg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteveg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteyrv32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitenri32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitelin32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteewg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteuzf32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteggo32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitegov32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitetcr32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliterfk32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitevam32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitecdu32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitednl32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexay32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitemoj32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteigm32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteaer32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitelvx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteowj32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexyi32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitehlx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteacy32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitegsu32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteztc32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteugr32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitevbv32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\temperror32.dat
Adware:Adware/EliteBar No disinfected C:\WINNT\protector_update.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\sideb.exe
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr1350\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCDAF\EliteToolBar version 60.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frE4AC\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5F8A\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr30E2\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frEF83\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5AAD\EliteSideBar 08.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr875C\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frDBB2\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCB22\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7479\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7348\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frC637\EliteToolBar.dll
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\djix62qj\5dkhamy3.DLL




Logfile of HijackThis v1.99.1
Scan saved at 19:32:15, on 30/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\HijackThis.exe

R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

many thanks look forward to your reply
  • 0

#9
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi hoopy

This will keep you busy

Run killbox and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
C:\Documents and Settings\Linda1\Favorites\Casino & Adult
C:\WINNT\system32\preuninstall.exe
C:\WINNT\system32\uninst.exe
C:\WINNT\system32\eliteclw32.exe
C:\WINNT\system32\eliteynf32.exe
C:\WINNT\system32\elitedpb32.exe
C:\WINNT\system32\elitehhr32.exe
C:\WINNT\system32\PreUninstall.exe
C:\WINNT\system32\elitejlv32.exe
C:\WINNT\system32\eliteerror32.dat
C:\WINNT\system32\elitedoolsav.dat
C:\WINNT\system32\elitegsx32.exe
C:\WINNT\system32\elitefvy32.exe
C:\WINNT\system32\eliteohl32.exe
C:\WINNT\system32\elitemhg32.exe
C:\WINNT\system32\elitehwl32.exe
C:\WINNT\system32\elitewym32.exe
C:\WINNT\system32\elitexkt32.exe
C:\WINNT\system32\eliteryx32.exe
C:\WINNT\system32\elitexom32.exe
C:\WINNT\system32\eliteajj32.exe
C:\WINNT\system32\elitehih32.exe
C:\WINNT\system32\elitetzn32.exe
C:\WINNT\system32\elitebyj32.exe
C:\WINNT\system32\elitevdp32.exe
C:\WINNT\system32\elitetgx32.exe
C:\WINNT\system32\elitemij32.exe
C:\WINNT\system32\elitelgy32.exe
C:\WINNT\system32\elitejpd32.exe
C:\WINNT\system32\elitejzt32.exe
C:\WINNT\system32\eliteyro32.exe
C:\WINNT\system32\elitenrk32.exe
C:\WINNT\system32\eliteyuy32.exe
C:\WINNT\system32\elitemxs32.exe
C:\WINNT\system32\elitesas32.exe
C:\WINNT\system32\elitedso32.exe
C:\WINNT\system32\elitevyk32.exe
C:\WINNT\system32\elitexkw32.exe
C:\WINNT\system32\eliteaxn32.exe
C:\WINNT\system32\elitecln32.exe
C:\WINNT\system32\elitedii32.exe
C:\WINNT\system32\elitefpp32.exe
C:\WINNT\system32\elitekeu32.exe
C:\WINNT\system32\elitednv32.exe
C:\WINNT\system32\elitekmt32.exe
C:\WINNT\system32\eliteowv32.exe
C:\WINNT\system32\elitetua32.exe
C:\WINNT\system32\elitetru32.exe
C:\WINNT\system32\elitejke32.exe
C:\WINNT\system32\eliteyri32.exe
C:\WINNT\system32\elitefbs32.exe
C:\WINNT\system32\eliteaaz32.exe
C:\WINNT\system32\elitelsj32.exe
C:\WINNT\system32\eliteldi32.exe
C:\WINNT\system32\elitexoc32.exe
C:\WINNT\system32\elitebym32.exe
C:\WINNT\system32\elitektl32.exe
C:\WINNT\system32\eliteekd32.exe
C:\WINNT\system32\elitesoz32.exe
C:\WINNT\system32\eliteroh32.exe
C:\WINNT\system32\eliteoho32.exe
C:\WINNT\system32\eliteojg32.exe
C:\WINNT\system32\eliteveg32.exe
C:\WINNT\system32\eliteyrv32.exe
C:\WINNT\system32\elitenri32.exe
C:\WINNT\system32\elitelin32.exe
C:\WINNT\system32\eliteewg32.exe
C:\WINNT\system32\eliteuzf32.exe
C:\WINNT\system32\eliteggo32.exe
C:\WINNT\system32\elitegov32.exe
C:\WINNT\system32\elitetcr32.exe
C:\WINNT\system32\eliterfk32.exe
C:\WINNT\system32\elitevam32.exe
C:\WINNT\system32\elitecdu32.exe
C:\WINNT\system32\elitednl32.exe
C:\WINNT\system32\elitexay32.exe
C:\WINNT\system32\elitemoj32.exe
C:\WINNT\system32\eliteigm32.exe
C:\WINNT\system32\eliteaer32.exe
C:\WINNT\system32\elitelvx32.exe
C:\WINNT\system32\eliteowj32.exe
C:\WINNT\system32\elitexyi32.exe
C:\WINNT\system32\elitehlx32.exe
C:\WINNT\system32\eliteacy32.exe
C:\WINNT\system32\elitegsu32.exe
C:\WINNT\system32\eliteztc32.exe
C:\WINNT\system32\eliteugr32.exe
C:\WINNT\system32\elitevbv32.exe
C:\WINNT\system32\temperror32.dat
C:\WINNT\protector_update.exe
C:\WINNT\sideb.exe
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr1350\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCDAF\EliteToolBar version 60.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frE4AC\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5F8A\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr30E2\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frEF83\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5AAD\EliteSideBar 08.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr875C\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frDBB2\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCB22\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7479\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7348\EliteToolBar.dll
C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frC637\EliteToolBar.dll
C:\Program Files\djix62qj\5dkhamy3.DLL
.
Let the system reboot.

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
Please post the logs From Panda, Ewido HJT.logWe will need them to remove previous infections that have left files on your system.

Kc :tazz:
  • 0

#10
Guest_thatman_*

Guest_thatman_*
  • Guest
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP