[Trevuren]

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)


Trevuren

[Advertisements]

So, do I just type in "rpcapd" in the space provided under "Delete an NT Service"?
Thanks,
Brigitte

[NoPopups]

So, do I just type in "rpcapd" in the space provided under "Delete an NT Service"?
Thanks,
Brigitte

[Trevuren]

Yes


Trevuren

[NoPopups]

OK. I did as instructed. Her eis the HJT log.
Thanks,
Brigitte

Logfile of HijackThis v1.99.1
Scan saved at 11:32:38 PM, on 9/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Real\Update_OB\realevent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [rrkmgrc] C:\WINDOWS\System32\fbnohj.exe
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322
O20 - Winlogon Notify: imgtask - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: newswSvc - Unknown owner - C:\PROGRA~1\SCOPEW~1\NEWSWA~1\newswSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Trevuren]

We want to stop, disable and delete an added service (023)

A. To stop a service and set to 'disabled'

• Go to Start > Run and type in Services.msc then click OK
  
• Click the Extended tab.
  
• Scroll down until you find the service.
  ===>Intel NCS NetService
  
• Click once on the service to highlight it.
  
• Click Stop
  
• Right-Click on the service.
  
• Click on 'Properties'
  
• Select the 'General' tab
  
• Click the Arrow-down tab on the right-hand side on the 'Start-up Type' box
  
• From the drop-down menu, click on 'Disabled'
  
• Click the 'Apply' tab, then click 'OK'

The service is now stopped and disabled.


B. We will now delete the service:

1. Open HJT

2. Click on Config>>Misc Tools>>Delete an NT Service

3. Copy/Paste NetSvc in the space provided and click OK

4. The program will ask you to REBOOT --- Accept

5. REBOOT into SAFE MODE

6. Using Windows Explorer, locate and DELETE the following file (if it still is present):

C:\Program Files\Intel<===Folder

7. REBOOT back into Normal Mode

8. Finally, run HijackThis, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

[NoPopups]

Hi. I've gotten some local help and have spent the better part of the day desperately trying to nuke this bloody thing. I am still getting notifications of VirtuMonde infection from ewido, then I get dozens of IE popups. I've installed and run the MS Antispywhare beta, run the Symantec FxVundo and FxVMonde tools (twice), and still no joy.

Below is my most recent HiJackthis log. I had put some things in the ignore list and wanted to move them back, just in case one of those items turns out to be more significant than I thought, but I can't figure out how to move items from the ignore list back to the log. If you can tell me how to do that I'd appreciate it.

Also, there are 4 user accounts on this machine. How do I make sure all 4 of them are clean?

Logfile of HijackThis v1.99.1
Scan saved at 5:31:41 PM, on 9/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [rrkmgrc] C:\WINDOWS\System32\fbnohj.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322
O20 - Winlogon Notify: imgtask - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: newswSvc - Unknown owner - C:\PROGRA~1\SCOPEW~1\NEWSWA~1\newswSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Trevuren]

Run HJT>>MiscTools

Press Ignore list button under Configuration.

Press Delete All

Then,

Finally, run HijackThis and with all windows closed except for HJT, click SCAN, produce a LOG and POST it in this thread for review.

Regards,

Trevuren

[NoPopups]

Thanks. That "delete all" made me nervous so I didn't dare try it before. Here's tne new log.

Logfile of HijackThis v1.99.1
Scan saved at 7:05:08 PM, on 9/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Creative\ShareDLL\Mediadet.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapp...://my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [rrkmgrc] C:\WINDOWS\System32\fbnohj.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://quicken.ehos...s/custappx3.cab
O16 - DPF: {22BFAD0D-3C27-4C08-8ECB-2BF8271371B5} (Aspen VCS Client Launcher) - http://206.253.210.4...all/startup.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst_current.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterf...ds/Uploader.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://photo.walmart...oad/XUpload.ocx
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: imgtask - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: newswSvc - Unknown owner - C:\PROGRA~1\SCOPEW~1\NEWSWA~1\newswSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Trevuren]

And we go after it again. Delete your current VundoFix, there have been some changes made today. New procedure to follow.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

1. Download VundoFix.exe to your desktop.

• Create a folder on your desktop and name it VundoFix.
• Double-click VundoFix.exe to extract the files to this folder.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• Please type the following file path (make sure to enter it exactly as below!):
  
  
  • C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
  
  
• Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
• The fix will run then HijackThis will open.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:
  
  O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
  O20 - Winlogon Notify: imgtask - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
  
  
• After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
• Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
• Once your machine reboots please continue with the instructions below.

2. Download and install CleanUp!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).

Set the program up as follows:

• Click "Options..."
• Move the arrow down to "Custom CleanUp!"
• Put a check next to the following (Make sure nothing else is checked!):
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
• Click OK
• Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

3. Then, please run this online virus scan: ActiveScan

4. Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.

Regards,

Trevuren

[NoPopups]

Not going well. My explorer (desktop shell) doesn't want to stay up in safe mode. I ran vundofix.bat in a cmd shell. I was not prompted for anything and the script ran straight through to hijackthis -

You must have an internet connection Active to download
strings from systernals. If one is active than
Press any key to continue . . .
File Downloader - Version 1.01 (build 7.4)
Downloads a file from a HTTP or a FTP server.
Copyright © 2004, Noel Danjou <[email protected]>.

Server: www.sysinternals.com
Port: 80
Protocol: HTTP

Strings.zip: .... 15116 bytes
Done.
Killing Processes.
Searching for infected dll's
Please be patient this may take some time.
Deleting Infected dll's
The system cannot find the file xfind.txt.
The system cannot find the file xfind.txt.
File not found - C:\windows\dnsurl.dll
Could Not Find c:\windows\dnsurl.dll
Fixing Registry
Opening Hijack This

[Trevuren]

1. Download a free trial version of SpySweeper

2. Update the definitions.

3. REBOOT into Safe Mode

4. Run SpySweeper

5. Save the log

6. Reboot back into Normal Mode

7. Post the SpySweeper log into your thread

Regards,

Trevuren

[NoPopups]

********
9:56 PM: |··· Start of Session, Saturday, September 03, 2005 ···|
9:56 PM: Spy Sweeper started
9:56 PM: Sweep initiated using definitions version 526
9:56 PM: Starting Memory Sweep
9:57 PM: Memory Sweep Complete, Elapsed Time: 00:01:14
9:57 PM: Starting Registry Sweep
9:57 PM: Found Adware: drsnsrch.com hijack
9:57 PM: HKU\WRSS_Profile_S-1-5-21-4064130714-2571614713-779020932-1014\software\microsoft\search assistant\ || defaultsearchurl (ID = 128205)
9:57 PM: Found Adware: websearch toolbar
9:57 PM: HKLM\system\currentcontrolset\enum\root\legacy_wintoolssvc\ (7 subtraces) (ID = 146518)
9:57 PM: Registry Sweep Complete, Elapsed Time:00:00:22
9:57 PM: Starting Cookie Sweep
9:57 PM: Found Spy Cookie: websponsors cookie
9:57 PM: [email protected][1].txt (ID = 3665)
9:57 PM: Found Spy Cookie: about cookie
9:57 PM: ed@about[1].txt (ID = 2037)
9:57 PM: Found Spy Cookie: ad-rotator cookie
9:57 PM: ed@ad-rotator[1].txt (ID = 2051)
9:57 PM: Found Spy Cookie: go.com cookie
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: Found Spy Cookie: adknowledge cookie
9:57 PM: ed@adknowledge[1].txt (ID = 2072)
9:57 PM: Found Spy Cookie: adlegend cookie
9:57 PM: ed@adlegend[1].txt (ID = 2074)
9:57 PM: Found Spy Cookie: precisead cookie
9:57 PM: [email protected][1].txt (ID = 3182)
9:57 PM: Found Spy Cookie: ads.businessweek cookie
9:57 PM: [email protected][1].txt (ID = 2113)
9:57 PM: Found Spy Cookie: ask cookie
9:57 PM: ed@ask[2].txt (ID = 2245)
9:57 PM: Found Spy Cookie: belnk cookie
9:57 PM: [email protected][2].txt (ID = 2293)
9:57 PM: Found Spy Cookie: atwola cookie
9:57 PM: ed@atwola[2].txt (ID = 2255)
9:57 PM: Found Spy Cookie: azjmp cookie
9:57 PM: ed@azjmp[2].txt (ID = 2270)
9:57 PM: Found Spy Cookie: banner cookie
9:57 PM: ed@banner[1].txt (ID = 2276)
9:57 PM: ed@belnk[1].txt (ID = 2292)
9:57 PM: Found Spy Cookie: bizrate cookie
9:57 PM: ed@bizrate[1].txt (ID = 2308)
9:57 PM: Found Spy Cookie: enhance cookie
9:57 PM: [email protected][1].txt (ID = 2614)
9:57 PM: Found Spy Cookie: gostats cookie
9:57 PM: [email protected][1].txt (ID = 2748)
9:57 PM: Found Spy Cookie: 360i cookie
9:57 PM: [email protected][1].txt (ID = 1962)
9:57 PM: Found Spy Cookie: wtlive.com cookie
9:57 PM: [email protected][2].txt (ID = 3700)
9:57 PM: Found Spy Cookie: dealtime cookie
9:57 PM: ed@dealtime[1].txt (ID = 2505)
9:57 PM: Found Spy Cookie: did-it cookie
9:57 PM: ed@did-it[2].txt (ID = 2523)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: [email protected][1].txt (ID = 2293)
9:57 PM: Found Spy Cookie: megago cookie
9:57 PM: [email protected][2].txt (ID = 2983)
9:57 PM: Found Spy Cookie: expage cookie
9:57 PM: ed@expage[2].txt (ID = 2637)
9:57 PM: [email protected][1].txt (ID = 2038)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: [email protected][1].txt (ID = 2038)
9:57 PM: [email protected][1].txt (ID = 2038)
9:57 PM: ed@gostats[2].txt (ID = 2747)
9:57 PM: ed@go[1].txt (ID = 2728)
9:57 PM: Found Spy Cookie: howstuffworks cookie
9:57 PM: ed@howstuffworks[2].txt (ID = 2805)
9:57 PM: Found Spy Cookie: screensavers.com cookie
9:57 PM: [email protected][2].txt (ID = 3298)
9:57 PM: Found Spy Cookie: kmpads cookie
9:57 PM: ed@kmpads[2].txt (ID = 2909)
9:57 PM: [email protected][1].txt (ID = 2038)
9:57 PM: Found Spy Cookie: mywebsearch cookie
9:57 PM: ed@mywebsearch[1].txt (ID = 3051)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: Found Spy Cookie: pub cookie
9:57 PM: ed@pub[1].txt (ID = 3205)
9:57 PM: Found Spy Cookie: realmedia cookie
9:57 PM: ed@realmedia[2].txt (ID = 3235)
9:57 PM: Found Spy Cookie: reunion cookie
9:57 PM: ed@reunion[2].txt (ID = 3255)
9:57 PM: Found Spy Cookie: rightmedia cookie
9:57 PM: ed@rightmedia[1].txt (ID = 3259)
9:57 PM: [email protected][2].txt (ID = 2038)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: Found Spy Cookie: servlet cookie
9:57 PM: ed@servlet[1].txt (ID = 3345)
9:57 PM: [email protected][2].txt (ID = 2038)
9:57 PM: Found Spy Cookie: stamps.com cookie
9:57 PM: ed@stamps[2].txt (ID = 3437)
9:57 PM: [email protected][2].txt (ID = 2506)
9:57 PM: Found Spy Cookie: reliablestats cookie
9:57 PM: [email protected][1].txt (ID = 3254)
9:57 PM: Found Spy Cookie: clicktracks cookie
9:57 PM: [email protected][1].txt (ID = 2407)
9:57 PM: Found Spy Cookie: tickle cookie
9:57 PM: ed@tickle[2].txt (ID = 3529)
9:57 PM: Found Spy Cookie: toplist cookie
9:57 PM: ed@toplist[2].txt (ID = 3557)
9:57 PM: [email protected][1].txt (ID = 2038)
9:57 PM: [email protected][2].txt (ID = 2729)
9:57 PM: Found Spy Cookie: com.com cookie
9:57 PM: [email protected][1].txt (ID = 2446)
9:57 PM: [email protected][1].txt (ID = 2729)
9:57 PM: Found Spy Cookie: mytemplatestorage cookie
9:57 PM: [email protected][2].txt (ID = 3050)
9:57 PM: [email protected][2].txt (ID = 3298)
9:57 PM: [email protected][1].txt (ID = 3438)
9:57 PM: Found Spy Cookie: web-stat cookie
9:57 PM: [email protected][2].txt (ID = 3649)
9:57 PM: Found Spy Cookie: seeq cookie
9:57 PM: [email protected][1].txt (ID = 3332)
9:57 PM: Found Spy Cookie: zedo cookie
9:57 PM: ed@zedo[2].txt (ID = 3762)
9:58 PM: Found Spy Cookie: 3 cookie
9:58 PM: ellen@3[2].txt (ID = 1959)
9:58 PM: Found Spy Cookie: 412 cookie
9:58 PM: ellen@412[1].txt (ID = 1969)
9:58 PM: Found Spy Cookie: 447 cookie
9:58 PM: ellen@447[2].txt (ID = 1973)
9:58 PM: Found Spy Cookie: 64.62.232 cookie
9:58 PM: [email protected][1].txt (ID = 1987)
9:58 PM: [email protected][2].txt (ID = 1987)
9:58 PM: [email protected][4].txt (ID = 1987)
9:58 PM: Found Spy Cookie: 91338698 cookie
9:58 PM: ellen@91338698[1].txt (ID = 2025)
9:58 PM: [email protected][2].txt (ID = 3665)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: ellen@about[1].txt (ID = 2037)
9:58 PM: ellen@about[3].txt (ID = 2037)
9:58 PM: ellen@ad-rotator[1].txt (ID = 2051)
9:58 PM: Found Spy Cookie: adecn cookie
9:58 PM: ellen@adecn[1].txt (ID = 2063)
9:58 PM: ellen@adknowledge[2].txt (ID = 2072)
9:58 PM: Found Spy Cookie: hbmediapro cookie
9:58 PM: [email protected][1].txt (ID = 2768)
9:58 PM: [email protected][2].txt (ID = 3182)
9:58 PM: Found Spy Cookie: affiliate cookie
9:58 PM: ellen@affiliate[1].txt (ID = 2199)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: ellen@ask[1].txt (ID = 2245)
9:58 PM: [email protected][2].txt (ID = 2293)
9:58 PM: ellen@atwola[2].txt (ID = 2255)
9:58 PM: ellen@azjmp[1].txt (ID = 2270)
9:58 PM: Found Spy Cookie: a cookie
9:58 PM: ellen@a[1].txt (ID = 2027)
9:58 PM: Found Spy Cookie: bannerspace cookie
9:58 PM: ellen@bannerspace[1].txt (ID = 2284)
9:58 PM: ellen@banner[1].txt (ID = 2276)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: ellen@belnk[2].txt (ID = 2292)
9:58 PM: ellen@bizrate[1].txt (ID = 2308)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 3530)
9:58 PM: Found Spy Cookie: coolsavings cookie
9:58 PM: ellen@coolsavings[1].txt (ID = 2465)
9:58 PM: [email protected][2].txt (ID = 1962)
9:58 PM: Found Spy Cookie: customer cookie
9:58 PM: ellen@customer[1].txt (ID = 2481)
9:58 PM: ellen@customer[2].txt (ID = 2481)
9:58 PM: ellen@did-it[1].txt (ID = 2523)
9:58 PM: Found Spy Cookie: directtrack cookie
9:58 PM: ellen@directtrack[2].txt (ID = 2527)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2293)
9:58 PM: [email protected][2].txt (ID = 2038)
9:58 PM: Found Spy Cookie: rn11 cookie
9:58 PM: [email protected][2].txt (ID = 3262)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: [email protected][2].txt (ID = 2038)
9:58 PM: ellen@expage[2].txt (ID = 2637)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: Found Spy Cookie: gamespy cookie
9:58 PM: ellen@gamespy[1].txt (ID = 2719)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: Found Spy Cookie: go2net.com cookie
9:58 PM: ellen@go2net[1].txt (ID = 2730)
9:58 PM: ellen@gostats[2].txt (ID = 2747)
9:58 PM: ellen@go[2].txt (ID = 2728)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: ellen@howstuffworks[1].txt (ID = 2805)
9:58 PM: [email protected][1].txt (ID = 3298)
9:58 PM: Found Spy Cookie: ic-live cookie
9:58 PM: ellen@ic-live[1].txt (ID = 2821)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][2].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: Found Spy Cookie: ugo cookie
9:58 PM: [email protected][1].txt (ID = 3609)
9:58 PM: Found Spy Cookie: metareward.com cookie
9:58 PM: ellen@metareward[1].txt (ID = 2990)
9:58 PM: ellen@mywebsearch[1].txt (ID = 3051)
9:58 PM: [email protected][2].txt (ID = 2038)
9:58 PM: Found Spy Cookie: pricegrabber cookie
9:58 PM: ellen@pricegrabber[2].txt (ID = 3185)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2528)
9:58 PM: ellen@realmedia[1].txt (ID = 3235)
9:58 PM: ellen@rightmedia[1].txt (ID = 3259)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: Found Spy Cookie: domainsponsor cookie
9:58 PM: [email protected][1].txt (ID = 2534)
9:58 PM: [email protected][1].txt (ID = 3649)
9:58 PM: ellen@servlet[2].txt (ID = 3345)
9:58 PM: [email protected][2].txt (ID = 2506)
9:58 PM: [email protected][1].txt (ID = 2407)
9:58 PM: [email protected][2].txt (ID = 3254)
9:58 PM: [email protected][1].txt (ID = 2806)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2446)
9:58 PM: Found Spy Cookie: tracking cookie
9:58 PM: ellen@tracking[1].txt (ID = 3571)
9:58 PM: [email protected][1].txt (ID = 2806)
9:58 PM: [email protected][2].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][1].txt (ID = 2446)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: Found Spy Cookie: happyhippo cookie
9:58 PM: [email protected][1].txt (ID = 2761)
9:58 PM: [email protected][2].txt (ID = 2806)
9:58 PM: [email protected][2].txt (ID = 3298)
9:58 PM: [email protected][2].txt (ID = 3332)
9:58 PM: Found Spy Cookie: videodome cookie
9:58 PM: [email protected][2].txt (ID = 3639)
9:58 PM: [email protected][1].txt (ID = 2446)
9:58 PM: [email protected][2].txt (ID = 3649)
9:58 PM: [email protected][1].txt (ID = 3332)
9:58 PM: Found Spy Cookie: xiti cookie
9:58 PM: ellen@xiti[1].txt (ID = 3717)
9:58 PM: [email protected][2].txt (ID = 3665)
9:58 PM: julia@about[2].txt (ID = 2037)
9:58 PM: julia@adknowledge[1].txt (ID = 2072)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: julia@ask[1].txt (ID = 2245)
9:58 PM: [email protected][1].txt (ID = 2293)
9:58 PM: julia@atwola[1].txt (ID = 2255)
9:58 PM: julia@belnk[1].txt (ID = 2292)
9:58 PM: julia@directtrack[1].txt (ID = 2527)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][2].txt (ID = 2293)
9:58 PM: julia@go2net[1].txt (ID = 2730)
9:58 PM: julia@go[2].txt (ID = 2728)
9:58 PM: [email protected][1].txt (ID = 3298)
9:58 PM: Found Spy Cookie: infospace cookie
9:58 PM: julia@infospace[1].txt (ID = 2865)
9:58 PM: julia@mywebsearch[2].txt (ID = 3051)
9:58 PM: Found Spy Cookie: offeroptimizer cookie
9:58 PM: julia@offeroptimizer[1].txt (ID = 3087)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: [email protected][2].txt (ID = 2528)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 2038)
9:58 PM: [email protected][2].txt (ID = 3254)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: [email protected][1].txt (ID = 3298)
9:58 PM: claire@adknowledge[1].txt (ID = 2072)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: claire@ask[1].txt (ID = 2245)
9:58 PM: claire@atwola[2].txt (ID = 2255)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: claire@go[1].txt (ID = 2728)
9:58 PM: claire@mywebsearch[2].txt (ID = 3051)
9:58 PM: claire@offeroptimizer[1].txt (ID = 3087)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: [email protected][2].txt (ID = 2729)
9:58 PM: Found Spy Cookie: freestats.net cookie
9:58 PM: [email protected][2].txt (ID = 2705)
9:58 PM: [email protected][2].txt (ID = 3254)
9:58 PM: [email protected][1].txt (ID = 2729)
9:58 PM: Cookie Sweep Complete, Elapsed Time: 00:00:19
9:58 PM: Starting File Sweep
9:58 PM: nzqlihv.wzg (ID = 84909)
9:58 PM: temp.fr6798 (ID = 84909)
9:59 PM: Found Adware: abetterinternet
9:59 PM: wupdt.exe (ID = 95137)
9:59 PM: Found Adware: 180search assistant/zango
9:59 PM: salmau.dat (ID = 93788)
10:00 PM: Warning: Failed to open file "c:\documents and settings\ed\my documents\turbotax\2004 ebert e tax return.zip". Access is denied
10:00 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\ultimate seventies_ 1972\16 i can see clearly now (the rain i.m4a". System Error. Code: 5.
Access is denied
10:00 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\silver screen classics - vol. 10\10-07 tchaikovsky_ francesca da rimi.m4a". System Error. Code: 5.
Access is denied
10:00 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\thumbs.db". System Error. Code: 5.
Access is denied
10:00 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\dinner party\04 liszt_ lieberstraum no.3 in a fla.m4a". System Error. Code: 5.
Access is denied
10:01 PM: Found Adware: spyblocs
10:01 PM: icont.exe (ID = 76558)
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\bob seger & the silver bullet band\the fire inside\05 always in my heart.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\celine dion\let's talk about love\09 miles to go (before i sleep).m4a". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\real rock\1-09 at the hop.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\sounds of the seventies_ 1974\01 can't get enough.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\sounds of the seventies_ 1974\08 rock the boat.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\rachmaninov - piano concertos 2 & 4\01 piano concerto no. 2 in c minor i.m4a". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\dixie chicks\home\08 i believe in love.m4a". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\dave koz\lucky man\02 you make smile.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\dave koz\off the beaten path\11 under the spell of the moon.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\dave koz\saxophonic\01 honey-dipped.mp3". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\classic disney vol. 1_ 60 years of musi\19 the work song.m4a". System Error. Code: 5.
Access is denied
10:01 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\britney spears\oops!...i did it again\07 lucky.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\b.b. king\the best of b.b. king\03 how blue can you get.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\kfog live from the archives 9\02 long way down.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\celtic voices_ women of song\14 the goodnight song.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\sounds of the seventies_ 1975\13 you are so beautiful.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\flim & the bb's\this is a recording\06 according to anthony.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\b.b. king & eric clapton\riding with the king\01 riding with the king.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\john denver\an evening with john denver\19 poem's, prayers and promises.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\joni mitchell\clouds\09 the fiddle and the drum.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\kenny g\six of hearts\04 the wedding song.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\mandy moore\coverage\09 breaking us in two.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\a time to remember - 1974\18 pinball.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\stormy weather\06 good morning heartache.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\the full monty\01 the zodiac.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\sheryl crow\the globe sessions\08 the difficult kind.m4a". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\the manhattan transfer\tonin'\09 along comes mary.mp3". System Error. Code: 5.
Access is denied
10:02 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\the who\who's next\01 baba o'riley.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\dave koz\the dance\02 i'm waiting for you.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\craig chaquico\acoustic planet\02 winterflame.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\rimsky-korsakov_ scheherazade - capricco\04 scheherazade (symphonic suite) op.m4a". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\100 masterpieces of classical music\3-09 verdi_ rigoletto, preludio.m4a". System Error. Code: 5.
Access is denied
10:03 PM: Found Adware: apropos
10:03 PM: verti1.exe (ID = 50181)
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\kfog live from the archives 5\15 have a little faith in me.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\bob dylan\blood on the tracks\04 idiot wind.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\cat stevens\tea for the tillerman\07 longer boats.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\risqué rhythm\17 rocket 69.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\bad company\10 from 6\ready for love.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\alanis morissette\jagged little pill\07 you learn.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\aretha franklin\a rose is still a rose\06 in the morning.mp3". System Error. Code: 5.
Access is denied
10:03 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\city of birmingham symphony, walter well\beethoven_ the complete symphonies\3-06 symphony no. 7, ii. allegretto.mp3". System Error. Code: 5.
Access is denied
10:04 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\compilations\kfog live from the archives 7\02 mrs. potter's lullaby.mp3". System Error. Code: 5.
Access is denied
10:04 PM: Warning: Failed to read file "c:\documents and settings\all users\documents\my music\music\frankie valli & the four seasons\20 greatest hits\15 sherry - walk like a man - big gi.mp3". System Error. Code: 5.
Access is denied
10:04 PM: Found Trojan Horse: trojan-backdoor-haxdoor
10:04 PM: etherxxxxa00476 (ID = 79895)
10:04 PM: File Sweep Complete, Elapsed Time: 00:06:26
10:04 PM: Full Sweep has completed. Elapsed time 00:08:31
10:04 PM: Traces Found: 217
********
9:55 PM: |··· Start of Session, Saturday, September 03, 2005 ···|
9:55 PM: Spy Sweeper started
9:56 PM: Program Version 4.0.4 (Build 430) Using Spyware Definitions 526
9:56 PM: |··· End of Session, Saturday, September 03, 2005 ···|

[Trevuren]

DSRFix by Atribune et al for all OS.

Please print out or copy this page to Notepad . Make sure to work through the steps in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fix.

• Download DSRFIX from HERE onto your Desktop.
  • Unzip and EXTRACT the files to your Desktop.
  • The program creates and names the new folder to house the files.
  • DO NOT RUN IT YET
• Download Cleanup from Here (Alternate site if the above is not working Go Here)
  • A window will open and choose SAVE, then DESKTOP as the destination.
  • On your Desktop, click on Cleanup40.exe icon.
  • Then, click RUN and place a checkmark beside "I Agree"
  • Then click NEXT followed by START and OK.
  • A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
  • Click OK
  • DO NOT RUN IT YET
• CLOSE INTERNET EXPLORER, if it is open
  
  
  
• Open the folder dsrfix
  • Double click on the dsrfix batch file( the one with the little gear in it )
  • Once dsrfix has completed it will close on its own
• Run Cleanup
  • Click on the "Cleanup" button and let it run.
  • Once its done, close the program.
• REBOOT your system.
  
  
  
• Please restart HJT and post back a fresh HJT log for review.

[NoPopups]

here ya go....

Logfile of HijackThis v1.99.1
Scan saved at 11:13:22 PM, on 9/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Ed\Desktop\AntiSpyware\VundoFix\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapp...://my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [rrkmgrc] C:\WINDOWS\System32\fbnohj.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://quicken.ehos...s/custappx3.cab
O16 - DPF: {22BFAD0D-3C27-4C08-8ECB-2BF8271371B5} (Aspen VCS Client Launcher) - http://206.253.210.4...all/startup.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst_current.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterf...ds/Uploader.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart...ploadClient.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://photo.walmart...oad/XUpload.ocx
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?322
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://costco.intern...x/PCAXSetup.cab?
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: imgtask - C:\WINDOWS\$NtUninstallKB899591$\imgtask.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: newswSvc - Unknown owner - C:\PROGRA~1\SCOPEW~1\NEWSWA~1\newswSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Trevuren]

Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

• Please download ewido security suite it is a trial version of the program.
  
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will prompt you to update click the OK button
  • The program will now go to the main screen
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed do the following:
  • REBOOT into Safe Mode
  • Run EWIDO
  • Click on scanner
  • Click on Start Scan
  • Let the program scan the machine
  • While the scan is in progress you will be prompted to clean files, click OK
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop
• Reboot your machine and post back a new HJT log and the ewido .txt log file you saved by using Add Reply

Regards,

Trevuren