TO Crustyoldbloke:
Here is everything you asked for.
First Question: I cannot Ctrl+Alt+Delete and get the Task Manager. It says that it has been disabled by my admin??
Second question: No, I do not reconize the address Level 3 Communications,Inc.1025 Eldorado Blvd. Broomfield, CO, US.
I did everything else that you specified in your directions. However, my internet connection I had to manually set up? I think I deleted it somehow?? It says: "Disconnected:Firewalled"
When I connected to the net it set me to about:blank??? What the heck? PLEASE ADVISE. I think I'm screwing it up more because I have no idea what I am doing??
HIJACK SCAN
Logfile of HijackThis v1.99.1
Scan saved at 9:24:18 PM, on 8/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2001.exe
C:\WINDOWS\System32\mrtMngr.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Charlotte Deardorff\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Media Card Companion Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2001.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) -
https://support.micr...ActiveX/odc.cabO16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) -
http://community.web...otoUploader.CABO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
EWIDO SCAN
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------
+ Created on: 8:58:25 PM, 8/26/2005
+ Report-Checksum: 3F11C470
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{18EAFE7B-570B-346C-ADEF-9CDDA8A1986F} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7E2B347A-52AA-597F-9371-80822A8D1263} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A9BB7C1A-E63B-E0A9-63EB-7124FA52D1B0} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C9368290-DE0B-80FF-0E2D-8933F6CA1A46} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FFF5092F-7172-4018-827B-FA5868FB0478} -> Spyware.ZToolbar : Cleaned with backup
HKLM\SOFTWARE\Classes\iefeatsl.ViewSource -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\iefeatsl.ViewSource\CLSID -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\iefeatsl.ViewSource\CurVer -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Image.Image -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Image.Image\CLSID -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Image.Image\CurVer -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\Interface\{6DEEE498-08CC-43F0-BCA0-DBB5A25C9501} -> Spyware.SimpleBar : Cleaned with backup
HKLM\SOFTWARE\Classes\ShowSearch.ViewSource -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ShowSearch.ViewSource\CLSID -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ShowSearch.ViewSource\CurVer -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\TypeLib\{84C94803-B5EC-4491-B2BE-7B113E013B77} -> Spyware.SimpleBar : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.activator -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.activator\CLSID -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.activator\CurVer -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CLSID -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CurVer -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CLSID -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CurVer -> Spyware.Azsearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFF5092F-7172-4018-827B-FA5868FB0478} -> Spyware.ZToolbar : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{FD9BC004-8331-4457-B830-4759FF704C22} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Submit URL -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-240772092-3833581854-4065617495-1006\Software\d78ffc13 -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-240772092-3833581854-4065617495-1006\Software\d78ffc13\red81542 -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-240772092-3833581854-4065617495-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\{587DBF2D-9145-4c9e-92C2-1F953DA73773} -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-240772092-3833581854-4065617495-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\{FD9BC004-8331-4457-B830-4759FF704C22} -> Spyware.CoolWebSearch : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Application Data\msny\msny32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Application Data\winpw\mssearch.dll.new -> Spyware.WinShow : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@doubleclick[2].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte
[email protected][1].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@trafic[1].txt -> Spyware.Cookie.Trafic : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Cookies\charlotte deardorff@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\Charlotte Deardorff\Local Settings\Temp\5.qtdfmp -> TrojanDownloader.Small.awa : Cleaned with backup
C:\Documents and Settings\Parker Deardorff\Application Data\iedy\iedy.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\Documents and Settings\Parker Deardorff\Application Data\iedy\mssearch.dll -> Spyware.WinShow : Cleaned with backup
C:\Documents and Settings\Parker Deardorff\Application Data\sysih\mssearch.dll -> Spyware.WinShow : Cleaned with backup
C:\Documents and Settings\Parker Deardorff\Application Data\syslw\mssearch.dll -> Spyware.WinShow : Cleaned with backup
C:\Documents and Settings\Parker Deardorff\Application Data\windc\mssearch.dll -> Spyware.WinShow : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc10.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc11.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc12.txt -> Spyware.Cookie.Centrport : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc13.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc17.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc18.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc19.txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc20.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc7.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc8.txt -> Spyware.Cookie.Advertising : Cleaned with backup
C:\RECYCLER\S-1-5-21-240772092-3833581854-4065617495-1005\Dc9.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\WINDOWS\bnaiay.dat:bltgs -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\control.ini:fpfgg -> TrojanDownloader.Agent.kd : Cleaned with backup
C:\WINDOWS\crfe32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crhe32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crld32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crpf32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crpk32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crrn32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\crxp.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\d3ap32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\d3be32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\d3hx.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\d3js.dll -> TrojanDownloader.WinShow.ag : Cleaned with backup
C:\WINDOWS\d3nr32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\d3zh.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\DtcInstall.log:xqqli -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\explorer.exe:ttala -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\explorer.scf:uamoc -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\Greenstone.bmp:arbef -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\iis6.log:ununk -> TrojanDownloader.Agent.kd : Cleaned with backup
C:\WINDOWS\image.new -> TrojanDownloader.WinShow.ag : Cleaned with backup
C:\WINDOWS\javagf.exe:nwqgb -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\javagg32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\javavj32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\javavu.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\javazk32.dll -> TrojanDownloader.Wintrim.be : Cleaned with backup
C:\WINDOWS\msxmidi.exe -> TrojanDownloader.WinShow.p : Cleaned with backup
C:\WINDOWS\River Sumida.bmp:zxnvdq -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\setupact.log:rygaft -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\vxh8jkdq5.exe -> TrojanDownloader.Small.awa : Cleaned with backup
C:\WINDOWS\system32\ztoolb009.dll -> Spyware.Zbar : Cleaned with backup
C:\WINDOWS\system32\ztoolb010.dll -> Spyware.Zbar : Cleaned with backup
C:\WINDOWS\WTLIBPUB.INI:twtull -> Spyware.OneMoreSearch : Cleaned with backup
C:\WINDOWS\yacs.log:lgvko -> TrojanDownloader.Agent.bq : Cleaned with backup
::Report End