[jricks]

When I log in to Windows, during startup, IE opens (without help from me) and tries to surf to http://210.112.166.7/f1re.html.

After some scanning and investigating, it looks like I have dial.exe (and perhaps others). I used HJT to "remove" it, booted into safe mode, removed the file c:\dial.exe. The IE popup still happened and dial.exe reappeared.

Any help would be greatly appreciated. Below are the results of my HJT scan.

Thanks,

Jeff


Logfile of HijackThis v1.99.1
Scan saved at 1:22:02 AM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\taskbar.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Search Bar] C:\WINDOWS\taskbar.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [itunes] c:\dial.exe
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\RunOnce: [MicrosoftAntiSpywareCleaner] C:\Program Files\Microsoft AntiSpyware\gcASCleaner.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112744852938
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

[Advertisements]

Hi jricks and welcome to GeeksToGo! My name is Excal and I will be helping you.

I can see that you have some malware issues. This maybe a few step process in removing it. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

the first thing I need you to do is reneable anythign that you might have stopped in msconfig. I need to see a compete log and disabling things in MSconfig just hides them, does not fix them.

After that is done, please post a fresh HiJackthis log and we will start getting your computer fixed up


Thanks,



Excal

[Excal]

Hi jricks and welcome to GeeksToGo! My name is Excal and I will be helping you.

I can see that you have some malware issues. This maybe a few step process in removing it. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

the first thing I need you to do is reneable anythign that you might have stopped in msconfig. I need to see a compete log and disabling things in MSconfig just hides them, does not fix them.

After that is done, please post a fresh HiJackthis log and we will start getting your computer fixed up


Thanks,



Excal

[jricks]

Thanks for the quick reply... here's the new log with nothing disabled in msconfig:

Logfile of HijackThis v1.99.1
Scan saved at 11:20:37 AM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\taskbar.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Search Bar] C:\WINDOWS\taskbar.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [itunes] C:\dial.exe
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112744852938
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

[Excal]

hi jricks,

I can see that you have some malware issues. This maybe a few step process in removing it. I encourage you to stick with it and follow my directions as closely as possible so as to avoid complicating the problem further.

I noticed that your HiJackthis.exe is located on your desktop, make sure to save HijackThis in its own folder (i.e. C:\HJT). This is very important, so HiJackThis can save backups!

Right click on the Microsoft/Giant AntiSpyware icon (looks like a target) and click on Security Agents Status (Enabled) and click on Disable Real-time Protection. To re enable it after the fix, you follow the same steps but click on Enable Real-time Protection.




DOWNLOAD PROGRAMS

Download and install CleanUp! Here*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
We will use this program later.

Download CWShredder here to its own folder.

Update CWShredder

• Open CWShredder and click I AGREE
• Click Check For Update
• Close CWShredder

We will be using this program later.


THE FIX

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Click this link to be sure you can view hidden files.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

5. Close all browsers, windows and unneeded programs.

6. Open HiJack and do a scan.

7. Put a Check next to the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O4 - HKLM\..\Run: [itunes] C:\dial.exe
O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe

8. click the Fix Checked box

9. Please remove these entries from Add/Remove Programs in the Control Panel(if present):

180Solutions

10. Please remove the following folders using Windows Explorer (if present):

C:\Program Files\ProSiteFinder

11. Please remove just the files from the following paths using Windows Explorer (if present):

C:\dial.exe

12. Run the program CleanUp!

13. Reboot into normal mode and please run this online virus scan: ActiveScan - Save the results from the scan!

14. Please go here and upload

C:\WINDOWS\taskbar.exe

then please post the results in your next reply.

15. Please post the Active scan log and a fresh HiJackThis log. Let me know how your computer is running.

[jricks]

Ok, did the steps you outlined. Attached a new HJT log and the results of the ActiveScan. FYI, there was no 180Solutions in the Add/Remove Programs and there was no c:\windows\taskbar.exe. The IE popup issue still exists.

HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 7:56:24 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\taskbar.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijack this\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Search Bar] C:\WINDOWS\taskbar.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [itunes] c:\dialer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112744852938
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Tools\cwshredder.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe





ActiveScan Log:

Incident Status Location

Adware:Adware/WUpd No disinfected C:\Program Files\Media Gateway\MediaGateway.exe
Adware:adware/wupd No disinfected C:\WINDOWS\SYSTEM32\ide21201.vxd
Adware:adware/mediatickets No disinfected C:\DOCUMENTS AND SETTINGS\GLENN.GLENN-4WFXF9PTD\mt-uninstaller.exe
Adware:adware/ncase No disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\clientax.inf
Adware:adware/blazefind No disinfected C:\DOCUMENTS AND SETTINGS\GLENN.GLENN-4WFXF9PTD\LOCAL SETTINGS\TEMP\installer.exe
Adware:Adware/MediaTickets No disinfected C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\Local Settings\Temp\installer.exe
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\Local Settings\Temporary Internet Files\Content.IE5\HER6YUUJ\f1re[1].htm
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\mt-uninstaller.exe
Adware:Adware/WUpd No disinfected C:\Program Files\Media Gateway\MediaGateway.exe
Adware:Adware/SAHAgent No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\0AE39BA5-27D8-4041-849B-23AA05\8CC0CC18-6E60-45A6-92D1-7169EF
Adware:Adware/WUpd No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\6784B48E-0AF2-41AF-8921-1FAD5F\A943D1B6-AFC8-4F44-90C9-970C74
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\BF211486-97FF-4B38-BC45-0420A6\5ABE1AD9-784F-4FC7-80A6-CBE747
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\BF211486-97FF-4B38-BC45-0420A6\77D9175A-39E2-4750-B762-E15286
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\BF211486-97FF-4B38-BC45-0420A6\AC9FBEBE-A51C-464D-B493-885916
Adware:Adware/SAHAgent No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\F0FCDB34-7953-4669-9E44-31BC96\1B0479F7-32CF-47D3-B0D3-54FD99
Adware:Adware/nCase No disinfected C:\WINDOWS\Downloaded Program Files\clientax.inf
Adware:Adware/Gator No disinfected D:\MP3\Jayne's Laptop\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0PAZWPYF\hdplugin_1019_bundle43v5d33[1].cab
Adware:Adware/Gator No disinfected D:\MP3\Jayne's Laptop\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0PAZWPYF\hdplugin_1019_bundle43v5d33[1].cab[HDPlugin1019.dll]
Adware:Adware/Gator No disinfected D:\MP3\Jayne's Laptop\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\0PAZWPYF\hdplugin_1019_bundle43v5d33[1].cab[HDPlugin1019.inf]
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\b.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ba.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bb.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bc.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bd.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\be.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bg.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bh.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bi.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bj.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bk.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bl.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bm.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bn.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bo.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bp.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\br.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bs.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bt.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bu.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bv.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bw.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bx.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\by.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\bz.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\c.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ca.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cb.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cc.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cd.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ce.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cf.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cg.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ch.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ci.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cj.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ck.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cl.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cm.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cn.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\co.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cp.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cq.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cr.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cs.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ct.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cu.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cv.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cx.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\cz.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\d.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\da.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\db.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dd.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\de.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\df.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\di.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dl.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dn.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dp.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dr.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ds.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dt.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dv.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dw.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dy.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\dz.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\ed.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\f.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\h.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\l.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\m.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\Main.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\n.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\r.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\u.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\w.class
Adware:Adware/TopMoxie No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\x.class
Adware:Adware/MoeMoney No disinfected D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates\System\Code\y.class
Adware:Adware/FunWeb No disinfected D:\MP3\Jayne's Laptop\WINNT\Downloaded Program Files\f3initialsetup1.0.0.6.inf
Spyware:Spyware/BetterInet No disinfected D:\MP3\Jayne's Laptop\WINNT\Downloaded Program Files\flash.inf
Spyware:Spyware/BetterInet No disinfected D:\MP3\Jayne's Laptop\WINNT\inf\biini.inf
Adware:Adware/SAHAgent No disinfected D:\MP3\Jayne's Laptop\WINNT\inf\payload.inf
Adware:Adware/Adblaster No disinfected D:\MP3\Jayne's Laptop\WINNT\ngpw34.dll
Adware:Adware/Adblaster No disinfected D:\MP3\Jayne's Laptop\WINNT\ngsw31.dll

[Excal]

hi jricks,

Right click on the Microsoft/Giant AntiSpyware icon (looks like a target) and click on Security Agents Status (Enabled) and click on Disable Real-time Protection. To re enable it after the fix, you follow the same steps but click on Enable Real-time Protection.


DOWNLOAD PROGRAMS

Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

Please download ewido security suite it is a trial version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates


THE FIX

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Open up and run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan when it ask if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK
• When the scan is finished, look at the bottom of the screen and click the Save report button.
• Save the report to your desktop

Close Ewido


5. Close all browsers, windows and unneeded programs.

6. Open HiJack and do a scan.

7. Put a Check next to the following items:

O4 - HKLM\..\Run: [Search Bar] C:\WINDOWS\taskbar.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [itunes] c:\dialer.exe

8. click the Fix Checked box

9. Please remove the following folders using Windows Explorer (if present):

D:\MP3\Jayne's Laptop\Program Files\WebSavingsfromEbates
C:\Program Files\Media Gateway

10. Please run Killbox.

• Select "Delete on Reboot".
• Copy the file names below to the clipboard by highlighting them and pressing Control-C:
  
  C:\WINDOWS\taskbar.exe
  c:\dialer.exe
  C:\WINDOWS\SYSTEM32\ide21201.vxd
  C:\DOCUMENTS AND SETTINGS\GLENN.GLENN-4WFXF9PTD\mt-uninstaller.exe
  C:\WINDOWS\DOWNLOADED PROGRAM FILES\clientax.inf
  C:\Documents and Settings\Glenn.GLENN-4WFXF9PTD\mt-uninstaller.exe
  C:\WINDOWS\Downloaded Program Files\clientax.inf
  D:\MP3\Jayne's Laptop\WINNT\Downloaded Program Files\f3initialsetup1.0.0.6.inf
  D:\MP3\Jayne's Laptop\WINNT\Downloaded Program Files\flash.inf
  D:\MP3\Jayne's Laptop\WINNT\inf\biini.inf
  D:\MP3\Jayne's Laptop\WINNT\inf\payload.inf
  D:\MP3\Jayne's Laptop\WINNT\ngpw34.dll
  D:\MP3\Jayne's Laptop\WINNT\ngsw31.dll
  
  
  
• Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
• Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

11. Run the program CleanUp!

12. Reboot into normal mode and please run this online virus scan: ActiveScan - Save the results from the scan!

13. Please post the Active scan log and a fresh HiJackThis log. Let me know how your computer is running.

[jricks]

My friend (the one who helped infect my machine) took his machine to his IT folks and they ran AIMFix and it got rid of the problem. So I tried it on my machine and now the IE popup at startup isn't happening anymore. Can you take a look at this HJT log to see if I've still got any issues?

Thanks.


Logfile of HijackThis v1.99.1
Scan saved at 5:27:37 PM, on 7/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Media Gateway\MediaGateway.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijack this\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112744852938
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Tools\cwshredder.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

[Excal]

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Close all browsers, windows and unneeded programs.

5. Open HiJack and do a scan.

6. Put a Check next to the following items:

O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe

7. click the Fix Checked box

8. Please remove these entries from Add/Remove Programs in the Control Panel(if present):

Media Gateway

9. Please remove the following folders using Windows Explorer (if present):

C:\Program Files\Media Gateway


Reboot and post a fresh hijackthis log please

[jricks]

Here's the latest log after the last fix.

Thanks.


Logfile of HijackThis v1.99.1
Scan saved at 7:39:13 PM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijack this\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1112744852938
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Tools\cwshredder.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

[Excal]

Great job, it appears your computer is clean

Ensure you rehide your “hidden files and folders” back to the way they were.

Now that your system is Malware Free, it is important to reset your system Restore. Click Here to learn how to.

Might I suggest the following Free Spyware programs, if you don't already have them, for added security, you can download them at the following links. These programs work great for detection:

Ad-aware SE
Spybot S&D
Microsoft Anti-Spyware


If you are unhappy with your current antivirus and want to replace it or if you dont already have one, I suggest one of these free programs:
*Note - do not use more than one anti-virus program as it will more than likely cause conflict.

AVG
Avast
AntiVir


The following free programs are great for prevention:

SpywareBlaster 3.4
Spywareguard
IE/Spyad

A Firewall is a must! Here are 3 good free versions:
(do not have more than one firewall running on your system)

Sygate
Kerio
ZoneLabs

There are other options other than Internet Explorer for a browser, which some say have better security. Two of them are:

Firefox
Opera

If you decide to keep Internet Explorer, This site is a great source for tightening up security on It's settings.

Make sure that you keep your Operating System and IE updated with the latest Critical Security Updates from Microsoft...they usually come out once a month, on the 2nd Tuesday of each month.

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
For ease use the following program:

Cleanup
Run "Cleanup" and when it has finished, Reboot

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided. Also read How I got Infected

[jricks]

Really appreciate your help... thanks a lot!!!

[Excal]

My Pleasure



Excal

[Excal]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.