I have followed the steps laid out in the to go section of this forum. My Mozilla browser keeps crashing. I get an error saying " Virus Trojan Horse Startpage .16.M"
I ran spybot, adaware, Panda Active Scan and Hijackthis. Panda Active scan tells me there are 66spywares and 6 viruses. AVG is not able to remove the virus.
PLease help.... i have posted the results of active scan and hijack this..Thanks a lot....
Active SCan log
Incident Status Location
Adware:Adware/CWS.Aboutblank No disinfected C:\WINDOWS\system32\lplgmd.dll
Adware:adware/purityscan No disinfected C:\Documents and Settings\Mani Krishna\Local Settings\Temp\!update.exe
Adware:adware/cws.aboutblank No disinfected C:\WINDOWS\TEMP\sp.html
Adware:adware/popuper No disinfected C:\Documents and Settings\Mani Krishna\Favorites\Online Gambling.URL
Adware:adware/topspyware No disinfected C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\wmplayer.exe.tmp
Adware:adware/delfinmedia No disinfected C:\keys.ini
Spyware:spyware/bridge No disinfected C:\WINDOWS\thin.exe
Adware:adware/memorywatcher No disinfected C:\PROGRAM FILES\MemoryWatcher
Adware:adware/sidesearch No disinfected C:\Documents and Settings\Mani Krishna\Application Data\Lycos
Adware:adware/blazefind No disinfected Windows Registry
Adware:Adware/CWS.Aboutblank No disinfected C:\WINDOWS\SYSTEM32\lplgmd.dll
Adware:Adware/PurityScan No disinfected C:\WINDOWS\SYSTEM32\l?gonui.exe
Virus:Bck/Agent.E Disinfected C:\WINDOWS\SYSTEM32\ctlh.dll
Adware:Adware/CWS.Aboutblank No disinfected C:\WINDOWS\TEMP\sp.html
Virus:Trj/Downloader.CMZ Disinfected C:\WINDOWS\thin.exe
Adware:Adware/CWS.Aboutblank No disinfected C:\WINDOWS\notepad.exe.tmp
Adware:Adware/CWS.Aboutblank No disinfected C:\Program Files\Windows Media Player\wmplayer.exe.tmp
Spyware:Spyware/BetterInet No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[data2.dat]
Adware:Adware/KeenValue No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[updmgr.exe]
Adware:Adware/KeenValue No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[simgr.exe]
Adware:Adware/KeenValue No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[rvupdmgr.exe]
Adware:Adware/SaveNow No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[saveuninst.exe]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[dpi.exe]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[init.dll]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[pcsvc.dll]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[pcsvc.exe]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[pcsvcAccess.ocx]
Adware:Adware/KeenValue No disinfected C:\Program Files\PestPatrol\Quarantine\20040522171933711.zip[IncFindBHO150.dll]
Adware:Adware/eZula No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[ezstub.exe]
Adware:Adware/eZula No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[seng.dll]
Adware:Adware/eZula No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[chcon.dll]
Adware:Adware/eZula No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[seng.to_be_deleted_x]
Adware:Adware/eZula No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[chcon.to_be_deleted_x]
Adware:Adware/ClockSync No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[sync.exe]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[CSIE.DLL]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[Loader.exe]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[CSIEINST.DLL]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[CSSSINST.DLL]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[CSBIINST.DLL]
Adware:Adware/Apropos No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[AutoUpdate.exe]
Adware:Adware/Apropos No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[auto_update_uninstall.exe]
Adware:Adware/Apropos No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[auto_update_uninstall.log]
Adware:Adware/Apropos No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[AutoUpdate.to_be_deleted]
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[ClrSchP072.exe]
Virus:Trj/Siboco.A Disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[msmc.exe]
Adware:Adware/Apropos No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[AutoUpdate.to_be_deleted_x]
Adware:Adware/PurityScan No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[purityscan.exe]
Adware:Adware/SaveNow No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[saveuninst.exe]
Adware:Adware/IEDriver No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[SearchBar.htm]
Adware:Adware/IEDriver No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[Searchx.htm]
Adware:Adware/MemoryWatcher No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[TrayIcon.ocx]
Adware:Adware/MemoryWatcher No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[MemoryWatcher.exe]
Adware:Adware/MemoryWatcher No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[NgiNUdB0.exe]
Adware:Adware/MemoryWatcher No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[NtzJ63G.exe]
Adware:Adware/MemoryWatcher No disinfected C:\Program Files\PestPatrol\Quarantine\20040521184511688.zip[Dfmc1bU0.exe]
Virus:Eicar.Mod No disinfected C:\Program Files\PestPatrol\Help.chm[HowCanITestDetection.html]
Virus:Exploit/CodeBase.A Disinfected C:\install.htm
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4\maya4\PLUGINS\B3D\COMMON\BDEINSTA\FILES\NSSETUP1.EXE[BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4\maya4\PLUGINS\B3D\COMMON\BDEINSTA\BDEInsNS.jar[BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDEDATA2.CAB][BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[bdeinsexe.cab][BDEInstall.exe]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDEInsNS.jar][BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDEINSTA.CAB][bdedata2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[NSSETUP1.EXE][BDEData2.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDELOAD.CAB]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[BDELOAD.CAB][bdeload.dll]
Adware:Adware/BrilliantDigitalNo disinfected C:\Documents and Settings\All Users\Desktop\vijay's stuff\newmarzo\maya4.rar[bdeviewer.cab][BDEViewer.exe]
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Mani Krishna\Local Settings\Temp\!update.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Mani Krishna\Desktop\New Folder\backups\backup-20041117-132659-394.dll
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Mani Krishna\Application Data\bddr.exe
Virus:Trj/Downloader.CMZ Disinfected C:\System Volume Information\_restore{312B22CA-F99D-4F59-93DD-B0526A6DE6FD}\RP789\A0277158.exe
Adware:Adware/PurityScan No disinfected C:\install_george.exe.tcf
Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 5:05:51 PM, on 10/02/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM+\AIM+.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Mani Krishna\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MANIKR~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\MANIKR~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7005B67F-636C-49B8-8957-6E3CA0DDB552} - C:\WINDOWS\system32\lplgmd.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_2_3_0.dll
O3 - Toolbar: AdwareFilter - {1028F737-81E7-452B-A860-E50CAD90A08C} - C:\Program Files\AdwareFilterToolBar\AdwareFilter.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX500 (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE /P33 "EPSON Stylus Photo RX500 (Copy 1)" /O6 "USB002" /M "Stylus Photo RX500"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\RunOnce: [Panda_cleaner_122510] C:\WINDOWS\system32\ActiveScan\pavdr.exe 122510
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: AOL Instant Messenger - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)
O16 - DPF: Yahoo! Chess - http://download.game...nts/y/ct1_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} (F5 Networks CacheCleaner) - https://firepass.man...achecleaner.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O18 - Filter: text/html - {55A13E75-545E-4BE7-9A98-BF69EBD23C6B} - C:\WINDOWS\system32\lplgmd.dll
O18 - Filter: text/plain - {55A13E75-545E-4BE7-9A98-BF69EBD23C6B} - C:\WINDOWS\system32\lplgmd.dll
O23 - Service: AVG6 Service (AvgServ) - GRISOFT s.r.o - C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\System32\PackethSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Thanks a lot