[infeckerty]

my mom hates getting [bleep] pop-ups so i agreed to help her clean this nasty infection from her OS .

here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 13:25:07, on 16/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
c:\Program Files\Common Files\Symantec Shared\Security

Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe
c:\windows\system32\gxtljej.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\2005529104345_mcinfo.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works

Shared\WkUFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Warez P2P Client\warez.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works

Shared\wkcalrem.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing Deluxe

15\MiniMavis.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and

Settings\HP_Administrator\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://ie.redirect.h...me&locale=EN_GB

&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://ie.redirect.h...arch&locale=EN_

GB&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar

= http://g.msn.co.uk/0SEENGB/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

= http://runonce.msn.com/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://ie.redirect.h...me&locale=EN_GB

&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://ie.redirect.h...arch&locale=EN_

GB&c=Q404&bd=pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page

=

http://ie.redirect.h...me&locale=EN_GB

&c=Q404&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection

Wizard,ShellNext = http://http//
R3 - URLSearchHook: (no name) -

{00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program

Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: MyWebSearch Search Assistant BHO -

{00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program

Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} -

C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: URLLink Class -

{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program

Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: AuroraHandlerObj Class -

{4AA870AC-8427-42a4-B92E-ECD956197489} -

C:\WINDOWS\AuroraHandler.dll
O2 - BHO: (no name) - {73D0527E-DA77-40E1-A70B-FA96C598357B} -

C:\DOCUME~1\TWOTIG~1\APPLIC~1\OWNSMA~1\bib remote.exe
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} -

C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} -

C:\WINDOWS\system32\rtneg3.dll
O2 - BHO: Web assistant -

{9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program

Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO -

{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN

Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -

c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: EpsonToolBandKicker Class -

{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} -

C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}

- c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program

Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL

Toolbar\toolbar.dll
O3 - Toolbar: EPSON Web-To-Page -

{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) -

{BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -

C:\Program Files\MSN Apps\MSN

Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F}

- c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program

Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common

Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI

Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTDVDDET] C:\Program

Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105

ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105

ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program

Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common

Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection]

"C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HE.EXE /P31

"EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo

RX620"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msci]

C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\2005529104345_mcinfo.exe

/insfin
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft

Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program

Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program

Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program

Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SsAAD.exe]

C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin]

C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32

C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [procwipedatesecond] C:\Documents and

Settings\All Users\Application Data\shim 2 proc wipe\Tick

Part.exe
O4 - HKLM\..\Run: [ihhisvv] c:\windows\system32\gxtljej.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program

Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft

Money\System\Money Express.exe"
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program

Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P

Client\warez.exe" -h
O4 - HKCU\..\Run: [SendPop]

C:\DOCUME~1\HP_ADM~1\APPLIC~1\PROGRA~1\32 bind gpl.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program

Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program

Files\AOL 9.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk =

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick

Launch.lnk = C:\Program Files\Microsoft

Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program

Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Personal Coach.lnk = C:\Program

Files\Broderbund\Mavis Beacon Teaches Typing Deluxe

15\MiniMavis.exe
O8 - Extra context menu item: &AOL Toolbar search -

res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search -

http://bar.mywebsear...?p=ZRxdm103YYNL
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Encarta &Definition -

http://uk.encarta.ms...nary/quickDicti

onary.htm
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL

Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL

Toolbar\toolbar.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com -

{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Money Viewer -

{E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program

Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl

Class) -

http://www.lizardtec...uplugin/en_US/D

jVuControl_en_US.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia

Authorware Web Player Control) -

http://courses.learn...ric_paper2000_v

2/module07/aware_player/awswaxf.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows

Genuine Advantage) -

http://go.microsoft....204&clcid=0x409
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -

http://ak.imgfarm.co...cts/ei-2/Popula

rScreenSaversFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

http://download.av.a...cinsctl/en-us/4,

0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo

Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {83229950-AD1D-4B94-8304-F56E95AFACF7}

(CSurgientTerminal Object) -

http://microsoft.dem.../proxy/srdp.cab
O16 - DPF: {84818113-96C5-11D2-BE39-006008BF4DD5} (ViewDirector

Object) -

http://www.scotlands...XControl/viewdw

32.ocx
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller

Class) -

http://dm.screensave.../sinstaller.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft

RDP Client Control (redist)) -

http://microsoft.dem...chNet/msrdp.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage

Class) - http://64.0.86.243/a...sCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn...tupdownloader.c

ab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -

http://download.av.a...gdmgr/en-us/1,0

,0,21/mcgdmgr.cab
O17 -

HKLM\System\CCS\Services\Tcpip\..\{1642E06F-A80F-4AF5-A71E-53F4

91580D3B}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui -

C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America

Online, Inc. - C:\Program Files\Common

Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) -

Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec

Corporation - c:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec

Corporation - c:\Program Files\Common Files\Symantec

Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) -

Symantec Corporation - c:\Program Files\Common Files\Symantec

Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - c:\Program Files\Common Files\Symantec

Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative

Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer,

Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program

Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc)

- Symantec Corporation - c:\Program Files\Norton

AntiVirus\navapsvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program

Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Remote Packet Capture Protocol v.0

(experimental) (rpcapd) - Unknown owner -

%ProgramFiles%\WinPcap\rpcapd.exe" -d -f

"%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - c:\Program

Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) -

Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\SNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation -

C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony

Corporation - C:\Program Files\Common Files\Sony

Shared\AVLib\SSScsiSV.exe
O23 - Service: System Startup Service (SvcProc) - Unknown

owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation -

c:\Program Files\Common Files\Symantec Shared\Security

Center\SymWSC.exe

will get on in the meantime using some of th recommended tools and methods you nice folks have provided.

thanx again.

oh .. here is spyware doctor log.

this looks very scarey, i wish i had the option of a full re-installtion .. but I don`t ..

Spyware Doctor Activity Report
Generated on 16/08/2005 13:42:53 Spyware Doctor Homepage PCTools Homepage Technical Support


Scans (basic information only):

Scan Results:
scan start: 16/08/2005 13:43:03
scan stop: 16/08/2005 13:45:44
scanned items: 101076
found items: 135
found and ignored: 0
tools used: General Scanner, Process Scanner, LSP Scanner, Registry Scanner, Cookie Scanner, Browser Scanner, Disk Scanner



Infection Name Location Risk
FUNWEBPRODUCTS multiple Medium
SaveNow multiple Medium
TSADBOT multiple Medium
FUNWEBPRODUCTS explorer.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
CWS Unknown Variant explorer.exe (C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL) Medium
FUNWEBPRODUCTS explorer.exe (C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL) Medium
FUNWEBPRODUCTS CCAPP.EXE (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS CTHELPER.EXE (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
Spyblocs AOLSP Scheduler.exe (C:\WINDOWS\system32\aamd532.DLL) Medium
FUNWEBPRODUCTS SSAAD.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS MWSOEMON.EXE (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe) Medium
FUNWEBPRODUCTS MWSOEMON.EXE (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS warez.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS IEXPLORE.EXE (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS MiniMavis.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS waol.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
FUNWEBPRODUCTS waol.exe (C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL) Medium
FUNWEBPRODUCTS waol.exe (C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL) Medium
FUNWEBPRODUCTS notepad.exe (C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll) Medium
CWS Unknown Variant IEXPLORE.EXE (C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL) Medium
FUNWEBPRODUCTS IEXPLORE.EXE (C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL) Medium
FUNWEBPRODUCTS HKCR\CLSID\{147A976E-EEE1-4377-8EA7-4716E4CDD239} Medium
FUNWEBPRODUCTS HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} Medium
FUNWEBPRODUCTS HKCR\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} Medium
FUNWEBPRODUCTS HKCR\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} Medium
FUNWEBPRODUCTS HKCR\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} Medium
FUNWEBPRODUCTS HKCR\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14} Medium
FUNWEBPRODUCTS HKCR\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA} Medium
FUNWEBPRODUCTS HKCR\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB} Medium
FUNWEBPRODUCTS HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179} Medium
FUNWEBPRODUCTS HKCR\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF} Medium
FUNWEBPRODUCTS HKCR\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} Medium
FUNWEBPRODUCTS HKCR\CLSID\{A9571378-68A1-443d-B082-284F960C6D17} Medium
FUNWEBPRODUCTS HKCR\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} Medium
FUNWEBPRODUCTS HKCR\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} Medium
FUNWEBPRODUCTS HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} Medium
FUNWEBPRODUCTS HKCR\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} Medium
FUNWEBPRODUCTS HKCR\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C} Medium
FUNWEBPRODUCTS HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} Medium
FUNWEBPRODUCTS HKCR\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} Medium
FUNWEBPRODUCTS HKCR\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477} Medium
FUNWEBPRODUCTS HKCR\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554} Medium
FUNWEBPRODUCTS HKCR\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} Medium
FUNWEBPRODUCTS HKCR\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14} Medium
FUNWEBPRODUCTS HKCR\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} Medium
FUNWEBPRODUCTS HKCR\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C} Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\FunWebProducts Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Fun Web Products Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\MyWebSearch Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\FocusInteractive Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform##FunWebProducts Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run##MyWebSearch Email Plugin Medium
FUNWEBPRODUCTS HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\sources##f3PopularScreensavers Medium
FUNWEBPRODUCTS HKCU\Software\FunWebProducts Medium
FUNWEBPRODUCTS HKCU\Software\MyWebSearch Medium
IPInsight HKLM\software\classes\tldctl2.urllink High
IPInsight HKLM\software\classes\tldctl2.urllink.1 High
Radlight HKLM\software\classes\tldctl2.urllink\clsid Medium
Tracking Cookie hp_administrator@realmedia[1].txt Medium
Tracking Cookie hp_administrator@apmebf[2].txt Medium
Tracking Cookie hp_administrator@casalemedia[2].txt Medium
Tracking Cookie hp_administrator@statcounter[1].txt Medium
Tracking Cookie hp_administrator@dcsxd61n26twkfbzjfrdz9k14_7m7b[1].txt Medium
Tracking Cookie [email protected][2].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@fastclick[1].txt Medium
Tracking Cookie hp_administrator@infospace[1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@yadro[2].txt Medium
Tracking Cookie hp_administrator@questionmarket[1].txt Medium
Tracking Cookie hp_administrator@bluestreak[1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@atdmt[2].txt Medium
Tracking Cookie hp_administrator@cgi-bin[2].txt Medium
Tracking Cookie hp_administrator@mywebsearch[1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@geekstogo[1].txt Medium
Tracking Cookie hp_administrator@trafficmp[2].txt Medium
Tracking Cookie hp_administrator@lop[2].txt Medium
Tracking Cookie hp_administrator@abetterinternet[1].txt Medium
Tracking Cookie hp_administrator@cgi-bin[3].txt Medium
Tracking Cookie [email protected][2].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@qksrv[2].txt Medium
Tracking Cookie hp_administrator@cgi-bin[4].txt Medium
Tracking Cookie hp_administrator@247realmedia[1].txt Medium
Tracking Cookie hp_administrator@adorigin[1].txt Medium
Tracking Cookie hp_administrator@tradedoubler[2].txt Medium
Tracking Cookie hp_administrator@mediaplex[1].txt Medium
Tracking Cookie [email protected][2].txt Medium
Tracking Cookie hp_administrator@overture[1].txt Medium
Tracking Cookie hp_administrator@hitbox[2].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@bravenet[1].txt Medium
Tracking Cookie hp_administrator@revenue[2].txt Medium
Tracking Cookie hp_administrator@zedo[2].txt Medium
Tracking Cookie hp_administrator@atwola[2].txt Medium
Tracking Cookie hp_administrator@advertising[1].txt Medium
Tracking Cookie hp_administrator@2o7[2].txt Medium
Tracking Cookie hp_administrator@adviva[1].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie hp_administrator@spylog[1].txt Medium
Tracking Cookie hp_administrator@cgi-bin[1].txt Medium
Tracking Cookie hp_administrator@sextracker[2].txt Medium
Tracking Cookie hp_administrator@sexlist[1].txt Medium
Tracking Cookie hp_administrator@doubleclick[1].txt Medium
Tracking Cookie hp_administrator@paycounter[2].txt Medium
Tracking Cookie [email protected][1].txt Medium
Tracking Cookie [email protected][1].txt Medium
FUNWEBPRODUCTS {147A976E-EEE1-4377-8EA7-4716E4CDD239} Medium
FUNWEBPRODUCTS {147A976F-EEE1-4377-8EA7-4716E4CDD239} Medium
FUNWEBPRODUCTS {3DC201FB-E9C9-499C-A11F-23C360D7C3F8} Medium
FUNWEBPRODUCTS {63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} Medium
FUNWEBPRODUCTS {7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} Medium
FUNWEBPRODUCTS {8E6F1832-9607-4440-8530-13BE7C4B1D14} Medium
FUNWEBPRODUCTS {938AA51A-996C-4884-98CE-80DD16A5C9DA} Medium
FUNWEBPRODUCTS {98D9753D-D73B-42D5-8C85-4469CDA897AB} Medium
FUNWEBPRODUCTS {9AFB8248-617F-460d-9366-D71CDEDA3179} Medium
FUNWEBPRODUCTS {9FF05104-B030-46FC-94B8-81276E4E27DF} Medium
FUNWEBPRODUCTS {A4730EBE-43A6-443e-9776-36915D323AD3} Medium
FUNWEBPRODUCTS {A9571378-68A1-443d-B082-284F960C6D17} Medium
FUNWEBPRODUCTS {ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} Medium
FUNWEBPRODUCTS C:\Program Files\MyWebSearch\bar\Cache\files.ini Medium
FUNWEBPRODUCTS C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S Medium
FUNWEBPRODUCTS C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S Medium
FUNWEBPRODUCTS C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S Medium
Spyblocs C:\WINDOWS\system32\aamd532.dll Medium
Conducent TimeSink C:\WINDOWS\system32\Addon2VB.dll Medium
FUNWEBPRODUCTS C:\WINDOWS\system32\f3PSSavr.scr Medium
Conducent TimeSink C:\WINDOWS\tsad.dll Medium

Edited by infeckerty, 16 August 2005 - 06:49 AM.

[Advertisements]

Step 1

http://www.newdotnet.com/removal.html

Step 2

Uninstall MyWebSearch under Add/Remove Software

Step 3

Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Download CleanUp
Install the program, dont run it yet, we will later.

Please download this file: Nailfix Utility
Save it to your desktop.
DO NOT run it yet.

To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, start tapping press F8 key.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Now scan with HJT and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HJT, then click the Fix Checked button. Close HJT.

Now run the CleanUp program:

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Running CleanUp

• Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• When CleanUp starts go to the Options button (right side of CleanUp screen)
• Move the arrow down to "Custom CleanUp!"
• Now place a checkmark next to the following (Make sure nothing else is checked!):
  • Delete Cookies
    This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
  • Empty Recycle Bins
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Then click on the CleanUp button. This will take a short while, let it do its thing.
• When asked to reboot system select No
• Close CleanUp

Finally, restart your computer back into Normal Mode and please post a new HJT log, as well as the ewido report log from the Ewido scan by using Add Reply

Regards,

[Metallica]

Step 1

http://www.newdotnet.com/removal.html

Step 2

Uninstall MyWebSearch under Add/Remove Software

Step 3

Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")
• Exit ewido. DO NOT scan yet.

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Download CleanUp
Install the program, dont run it yet, we will later.

Please download this file: Nailfix Utility
Save it to your desktop.
DO NOT run it yet.

To reboot into SafeMode with Windows XP, you can follow these steps from Microsoft:

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, start tapping press F8 key.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click on nailfix.exe.
Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Now open ewido and do a scan of your system.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Now scan with HJT and place a checkmark next to each of the following items:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HJT, then click the Fix Checked button. Close HJT.

Now run the CleanUp program:

*IMPORTANT NOTE*
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp

Running CleanUp

• Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
• When CleanUp starts go to the Options button (right side of CleanUp screen)
• Move the arrow down to "Custom CleanUp!"
• Now place a checkmark next to the following (Make sure nothing else is checked!):
  • Delete Cookies
    This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
  • Empty Recycle Bins
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Then click on the CleanUp button. This will take a short while, let it do its thing.
• When asked to reboot system select No
• Close CleanUp

Finally, restart your computer back into Normal Mode and please post a new HJT log, as well as the ewido report log from the Ewido scan by using Add Reply

Regards,