[johnsiek]

Logfile of HijackThis v1.99.1
Scan saved at 2:12:47 PM, on 31/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
her is what hij came up with any help ?
for som odd resson spy bot freezes up also
thanks john
hope you a have a solution
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Panicware\Pop-Up Stopper Anti-Spyware\PWISVC.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Panicware\Pop-Up Stopper Anti-Spyware\PUSAS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Updater.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\JOHNSI~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
D:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.c...ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.c...ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.c...ODQ6NTo5&Terms=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.canada.co...lton/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startnow.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.c...ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.c...ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\Program Files\Panicware\Pop-Up Stopper Anti-Spyware\PWIBHO.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CInterfaceObj Object - {58F07DD3-924D-4141-BC74-299F523A95F1} - C:\WINDOWS\pxwma.dll
O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\Program Files\Panicware\Pop-Up Stopper Anti-Spyware\PWITB.DLL
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\ASUSTek\ASUSDVD XP\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [fMFHZAUx] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [aMVGUgUw] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ekFJQcox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [fYFJZw1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [RkpHTk1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [dAFHW51v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [cAVHWw1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [eIFJRs1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [cEVGW1Ex] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [fM0GUgow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [YEpGZ9ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [aAVHUsUx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [cU0HV9ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [QYVGXw1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ZkpGVwox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [YUpGU5Ux] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [QIpHYAox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ZAFGYc1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [QkVJYA1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [eQFHQc1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [dwFJX9Ux] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ag0HWoUx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [QwFGZsow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [dAFGS51x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ZQpGVgEx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [eI0GSc1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [QgFGUgUw] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [fE0GS91x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ckVGZ5ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [dw0GX91v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [cEVJTw1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [ZEFJTgEx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe
O4 - HKLM\..\Run: [bM0HQgUw] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [bg0HT9ov] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [QMFHW5Ew] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [fU0HY11w] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [fAFHSwEx] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [fM0HWkow] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [ZMVGT9Ex] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [dIpGTc1w] C:\PROGRA~1\uxpptvux\coACH8BN.exe
O4 - HKLM\..\Run: [Xmeopnlp] C:\Program Files\Gtymul\Qpovj.exe
O4 - HKLM\..\Run: [Media Gateway] C:\PROGRA~1\MEDIAG~1\MEDIAG~1.EXE
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0826] "C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0826NetInstaller.exe"
O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Shareaza] "D:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [ares] "D:\Program Files\Ares\Ares.exe" -h
O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\Quicken\QWDLLS.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Microsoft® JavaScript® Console - {19ECFB06-C477-4008-A3E4-ED347EEDEE65} - C:\WINDOWS\system32\comdlg32.ocx
O9 - Extra 'Tools' menuitem: JavaScript Console - {19ECFB06-C477-4008-A3E4-ED347EEDEE65} - C:\WINDOWS\system32\comdlg32.ocx
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Program\partypokernet.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Program\partypokernet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft® JavaScript® Console - {19ECFB06-C477-4008-A3E4-ED347EEDEE65} - C:\WINDOWS\system32\comdlg32.ocx (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {19ECFB06-C477-4008-A3E4-ED347EEDEE65} - C:\WINDOWS\system32\comdlg32.ocx (HKCU)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O13 - FTP Prefix: http://www.myexexex....p?said=pfxp&qq=
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://pcpitstop.com...p/PCPitStop.CAB
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {DE910060-8EFB-44B9-B492-75180696643F} (iiittt Class) - http://www.hotsearch...lbar30/hsrb.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pop-Up Stopper Anti-Spyware Service (PWISVC) - Panicware, Inc. - C:\Program Files\Panicware\Pop-Up Stopper Anti-Spyware\PWISVC.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Welcome johnsiek to Geeks to Go!

I am currently reviewing your log, and will post back with instructions shortly.

[g2i2r4]

Welcome johnsiek to Geeks to Go!

I am currently reviewing your log, and will post back with instructions shortly.

[g2i2r4]

Thank you for your patience.

You are running HijackThis from its zipped archive.
Please create a new folder for it and unzip the program into it.

***

Please disable SpybotSD’s protection, as it may hinder the removal of the infection. You can enable it after you're clean.

Open Spybot and click on Mode and check Advanced Mode
Check yes to next window.
Click on Tools in bottom left hand corner.
Click on Resident icon.
Uncheck Teatimer box and/or Uncheck Resident.
Close Spybot.

***

Open HijackThis

• Click on the configure button on the bottom right
• Click on the tab "Misc Tools"
• Click on the Box that says "Uninstall Manager"
• Click on
  Media Gateway
  SpyKiller
• Click on Delete this entry
• Click "Yes"

Close HijackThis.

***

Please download and install AdAware SE 1.06.
Check Here on how setup and use it - please make sure you update it first.

***

Please download, install, and update the free version of Ewido trojan scanner:

• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Run Ewido --- When you run it for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
• From the main ewido screen, click on update in the left menu, then click the Start update button.
• After the update finishes (the status bar at the bottom will display "Update successful")
• Exit Ewido. DO NOT scan yet.

***

Download about:buster by RubbeRDuckY.
Update About:Buster

• Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
• Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
• Click "OK" at the prompt with instructions.
• Click "Update" and then "Check For Update" to begin the update process.
• If any updates exist please download them by clicking "Download Update" then click the X to close that window.
• Now close About:Buster

***

Download CWShredder.

Update CWShredder

• Open CWShredder and click I AGREE
• Click Check For Update
• Close CWShredder

***

Download the Killbox.
Unzip it to the desktop

Double-click on Killbox.exe to run it. Place the following lines (complete paths) in bold in the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each

C:\Program Files\uxpptvux\coACH8BN.exe
C:\Program Files\uxpptvux\RoQAfsxM.exe
C:\Program Files\Gtymul\Qpovj.exe
C:\Program Files\MEDIAG~1\MEDIAG~1.EXE
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0826NetInstaller.exe
D:\SpyKiller\spykiller.exe

For these file, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.
Click "No" at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually.

***

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

***

Please run About:Buster:

• Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
• Click Yes to allow it to shutdown explorer.exe.
• It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
• When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
• Reboot your computer into safe mode again

Run about:buster again following the same instructions as above, this time without the restart at the end.

***

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

***

Open HijackThis
Place a check against each of the following, making sure you get them all and not any others by mistake:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.c...ODQ6NTo5&Terms=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.c...ODQ6NTo5&Terms=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.c...ODQ6NTo5&Terms=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startnow.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.c...ODQ6NTo5&Terms=

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.c...ODQ6NTo5&Terms=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: Shell=

O2 - BHO: (no name) - SOFTWARE - (no file)

O2 - BHO: CInterfaceObj Object - {58F07DD3-924D-4141-BC74-299F523A95F1} -
C:\WINDOWS\pxwma.dll

O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)

O4 - HKLM\..\Run: [fMFHZAUx] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [aMVGUgUw] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ekFJQcox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [fYFJZw1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [RkpHTk1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [dAFHW51v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [cAVHWw1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [eIFJRs1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [cEVGW1Ex] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [fM0GUgow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [YEpGZ9ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [aAVHUsUx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [cU0HV9ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [QYVGXw1v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ZkpGVwox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [YUpGU5Ux] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [QIpHYAox] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ZAFGYc1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [QkVJYA1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [eQFHQc1w] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [dwFJX9Ux] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ag0HWoUx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [QwFGZsow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [dAFGS51x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ZQpGVgEx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [eI0GSc1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [QgFGUgUw] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [fE0GS91x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ckVGZ5ow] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [dw0GX91v] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [cEVJTw1x] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [ZEFJTgEx] C:\PROGRA~1\uxpptvux\RoQAfsxM.exe

O4 - HKLM\..\Run: [bM0HQgUw] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [bg0HT9ov] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [QMFHW5Ew] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [fU0HY11w] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [fAFHSwEx] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [fM0HWkow] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [ZMVGT9Ex] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [dIpGTc1w] C:\PROGRA~1\uxpptvux\coACH8BN.exe

O4 - HKLM\..\Run: [Xmeopnlp] C:\Program Files\Gtymul\Qpovj.exe

O4 - HKLM\..\Run: [Media Gateway] C:\PROGRA~1\MEDIAG~1\MEDIAG~1.EXE

O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe

O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0826] "C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0826NetInstaller.exe"

O4 - HKCU\..\Run: [SpyKiller] D:\SpyKiller\spykiller.exe /startup

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Program\partypokernet.exe

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Program\partypokernet.exe

O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)

O13 - FTP Prefix: http://www.myexexex....p?said=pfxp&qq=

O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup.../bridge-c18.cab

O16 - DPF: {DE910060-8EFB-44B9-B492-75180696643F} (iiittt Class) - http://www.hotsearch...lbar30/hsrb.cab

Close all programs leaving only HijackThis running.
Click on Fix Checked when finished and exit HijackThis.

***

Scan with AdAware and let it remove any bad files found.

***

Next, run Ewido again.

• Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
• If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
• When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

***

Finally, restart your computer in normal mode and please post a new HijackThis log, the About:Buster log as well as the log from the Ewido scan.



EDIT:
As there has been no reply from the original poster for more than two weeks this topic is now closed.

If you are the original poster and still need assistance, please send me a PM.

Edited by g2i2r4, 10 September 2005 - 11:17 AM.