[hoopy]

please please please can someone help me get rid of derbiz it is driving me mad! i have the desktop icon constantly even though i keep removing it from add and remove programs.

Here is my hijack this:


Logfile of HijackThis v1.99.1
Scan saved at 20:45:03, on 15/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Linda1\My Documents\My Received Files\hgijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliteacy32.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINNT\system32\temp532.exe -N
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FC08B59-0583-469F-A2CE-3C978332CEA0}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Hello

We are sorry for the delay in replying to your post, if your still need help please post a current HijackThis.log.

Thank you

Kc

[hoopy]

thankyou here it is now:



Logfile of HijackThis v1.99.1
Scan saved at 19:14:50, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\eliteacy32.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINNT\system32\temp532.exe -N
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[hoopy]

hi there! i have done the hijack this log and ticked all the ones you told me to, but im sorry if i sound stupid!! but i dont understand the bit where i have to use internet explorer to locate files and folders do i do all this in safe mode?
many thanks
Claire

[hoopy]

actually im really sorry i am being stupid!!1 i have just read through it again and it says windows explorer not internet explorer!!!! just ignore that other one!!!

[hoopy]

hiya i done everything, although when i downloaded pocket killbox there was no files called c:\winnt\system32\elite...... and c:\winnt\system32\temp532.....
but here is the hijack this log and the panda log:


Incident Status Location

Adware:Adware/nCase No disinfected Windows Registry
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Favorites\Casino & Adult
Adware:Adware/Midaddle No disinfected C:\WINNT\system32\preuninstall.exe
Spyware:Spyware/LinkReplacer No disinfected Windows Registry
Spyware:Spyware/LinkReplacer No disinfected C:\WINNT\system32\uninst.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteclw32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteynf32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitedpb32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitehhr32.exe
Spyware:Spyware/LinkReplacer No disinfected C:\WINNT\system32\PreUninstall.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitejlv32.exe
Adware:Adware/Startpage.SJ No disinfected C:\WINNT\system32\eliteerror32.dat
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitedoolsav.dat
Adware:Adware/Startpage.SJ No disinfected C:\WINNT\system32\elitegsx32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitefvy32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\eliteohl32.exe
Adware:Adware/Startpage.CM No disinfected C:\WINNT\system32\elitemhg32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitehwl32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitewym32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitexkt32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteryx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexom32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteajj32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitehih32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitetzn32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitebyj32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitevdp32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetgx32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitemij32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitelgy32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitejpd32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitejzt32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyro32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitenrk32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyuy32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitemxs32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitesas32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitedso32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitevyk32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitexkw32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteaxn32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitecln32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitedii32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitefpp32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitekeu32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitednv32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitekmt32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteowv32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetua32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitetru32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitejke32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteyri32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitefbs32.exe
Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\eliteaaz32.exe
Virus:Trj/Downloader.CFN Disinfected C:\WINNT\system32\elitelsj32.exe
Virus:Trj/Downloader.CFN Disinfected C:\WINNT\system32\eliteldi32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexoc32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitebym32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitektl32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteekd32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitesoz32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteroh32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteoho32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteojg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteveg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteyrv32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitenri32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitelin32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteewg32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteuzf32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteggo32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitegov32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitetcr32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliterfk32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitevam32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitecdu32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitednl32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexay32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitemoj32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteigm32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteaer32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitelvx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteowj32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitexyi32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitehlx32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteacy32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitegsu32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteztc32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\eliteugr32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\elitevbv32.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\system32\temperror32.dat
Adware:Adware/EliteBar No disinfected C:\WINNT\protector_update.exe
Adware:Adware/EliteBar No disinfected C:\WINNT\sideb.exe
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr1350\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCDAF\EliteToolBar version 60.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frE4AC\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5F8A\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr30E2\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frEF83\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr5AAD\EliteSideBar 08.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr875C\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frDBB2\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frCB22\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7479\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.fr7348\EliteToolBar.dll
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Linda1\Local Settings\Temp\temp.frC637\EliteToolBar.dll
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\djix62qj\5dkhamy3.DLL




Logfile of HijackThis v1.99.1
Scan saved at 19:32:15, on 30/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\HijackThis.exe

R3 - URLSearchHook: IncrediFindBHO Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1103412337093
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

many thanks look forward to your reply