[luis10]

I am posting a HijackThis log file after trying the whole automated sequence advertised. My computer is extremely slow, adding unwanted favourite websites and pested with popups.

Can anyone help me by checking my Hijackthis log file and providing directions on what do to next?

I am increasingly frustrated with the automated spyware removers that don't seem to work. Help highly appreciated!

Thank you!

**************************************************************


Logfile of HijackThis v1.99.1
Scan saved at 2:20:24 PM, on 9/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\ntnt32.exe
C:\Windows\System32\alg.exe
C:\Windows\System32\ati2evxx.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\anti_spyware\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\PROGRA~1\ANTI_S~1\TREND_~1\PcCtlCom.exe
C:\Windows\System32\svchost.exe
C:\PROGRA~1\ANTI_S~1\TREND_~1\Tmntsrv.exe
C:\PROGRA~1\ANTI_S~1\TREND_~1\tmproxy.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\MsgSys.EXE
C:\Program Files\WIBUKEY\Server\WkSvW32.exe
C:\Windows\System32\CCM\CcmExec.exe
C:\PROGRA~1\ANTI_S~1\TREND_~1\TmPfw.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
C:\Windows\System32\Atiptaxx.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\anti_spyware\trend_micro\pccguide.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Windows\netbh32.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Windows\System32\wuauclt.exe
C:\PROGRA~1\ANTI_S~1\TREND_~1\TSC.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\anti_spyware\security suite\ewidoguard.exe
C:\Program Files\anti_spyware\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Windows\zovmt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\Windows\zovmt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\Windows\zovmt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Windows\zovmt.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\Windows\zovmt.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\Windows\zovmt.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\Windows\zovmt.dll/sp.html#83556
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=?????? ??????????
F2 - REG:system.ini: UserInit=C:\Windows\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {388C2E34-686F-EB26-27A8-3DED78707177} - C:\Windows\sysji.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\ANTI_S~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Class - {E738B04A-1963-CC45-FEB7-57FDF80D6F8D} - C:\Windows\system32\mfccy32.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Windows\System32\msdxm.ocx
O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NAVNet] "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1A.tmp" /m
O4 - HKLM\..\Run: [ipfb32.exe] C:\Windows\system32\ipfb32.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [cpqek] C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
O4 - HKLM\..\Run: [atlta.exe] C:\Windows\system32\atlta.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [nethf32.exe] C:\Windows\nethf32.exe
O4 - HKLM\..\Run: [iphk32.exe] C:\Windows\system32\iphk32.exe
O4 - HKLM\..\Run: [javasw.exe] C:\Windows\javasw.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\anti_spyware\trend_micro\pccguide.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\anti_spyware\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [ntim.exe] C:\Windows\system32\ntim.exe
O4 - HKLM\..\Run: [netbh32.exe] C:\Windows\netbh32.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Windows\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = office.ctbto.org
O17 - HKLM\Software\..\Telephony: DomainName = office.ctbto.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = office.ctbto.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = office.ctbto.org
O20 - Winlogon Notify: NavLogon - C:\Windows\System32\NavLogon.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\Windows\ntnt32.exe" /s (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\Windows\System32\ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\anti_spyware\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\anti_spyware\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\ANTI_S~1\TREND_~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\ANTI_S~1\TREND_~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\ANTI_S~1\TREND_~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\ANTI_S~1\TREND_~1\tmproxy.exe
O23 - Service: WIBU-KEY Server (WkSvW32) - WIBU-SYSTEMS AG - C:\Program Files\WIBUKEY\Server\WkSvW32.exe