Please be aware ive done what you asked and my windows xp start bar has been removed. it has been replaced with windows classic and i cannot switch back as it seems to have been removed from my pc. please tell me how to get this back.
also while running the online virus scan my antivirus detected a worm and i aborted the connection. everything else was done and i attach the updated hjt log and the ewido report.
HJT LOG:
Logfile of HijackThis v1.99.1
Scan saved at 15:52:04, on 18/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HJT\HijackThis.exe
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted IP range: 67.19.178.84
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.micros...b?1121530998421O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoft.../as5/asinst.cabO21 - SSODL: DriverWizard - {A169B3E6-6977-B33A-0DA4-5624B10C0BED} - c:\program files\driver wizard\yqrnq6.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
EWIDO REPORT:
--------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 15:40:51, 18/07/2005
+ Report-Checksum: CAF7607
+ Scan result:
:mozilla.20:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.31:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.43:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
:mozilla.45:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
:mozilla.46:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.53:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
:mozilla.54:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.55:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
:mozilla.57:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.58:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Adviva : Cleaned with backup
:mozilla.63:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.64:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.65:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.66:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.67:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.68:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.69:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.70:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.71:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.72:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.73:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.74:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.75:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.76:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.77:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.78:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.79:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.80:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.81:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.82:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.84:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.85:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.88:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.89:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.90:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.91:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.92:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.93:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.104:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.105:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.106:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.111:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.120:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.122:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.123:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
:mozilla.124:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.125:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.126:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup
:mozilla.127:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.128:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.186:C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\7ccsxk1p.default\cookies.txt -> Spyware.Cookie.Ivwbox : Cleaned with backup
C:\WINDOWS\system\svchosthook.dll -> Backdoor.Agent.iw : Cleaned with backup
C:\WINDOWS\system32\abirvalg32.dll -> TrojanProxy.Small.cn : Cleaned with backup
C:\WINDOWS\system32\vxgame1.exe -> TrojanDropper.Small.acg : Cleaned with backup
C:\WINDOWS\system32\vxh8jkdq1.exe -> TrojanDownloader.Agent.qx : Cleaned with backup
C:\WINDOWS\system32\vxh8jkdq8.exe -> TrojanDownloader.Agent.qx : Cleaned with backup
::Report End