Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Need help w/ Dr. Watson Posmortem Debugger

Started by ogre0969 , Mar 10 2005 02:11 PM

Please log in to reply

#1
ogre0969

Posted 10 March 2005 - 02:11 PM

Member

Member
10 posts

I am having the same problems as a lot of other people it seems. I have already gone through all the steps on the "You Must Read This Before Posting A Hijackthis Log. Any help is greatly appreciated. Here is my log:
____________________________________________________________________

Logfile of HijackThis v1.99.0
Scan saved at 11:59:28 AM, on 3/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\system32\d?dplay.exe
C:\Documents and Settings\Robert\Application Data\othb.exe
C:\Downloads\Nerd Network\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://db105.com:81/...n/index.cgi?c=0
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ovupj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {B79CC35D-10FE-026C-855E-6F9CB7D9C3B9} - C:\WINDOWS\crzu32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [iexpilorer.exe] C:\WINDOWS\System32\iexpilorer.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ierh.exe] C:\WINDOWS\system32\ierh.exe
O4 - HKLM\..\Run: [nthg32.exe] C:\WINDOWS\system32\nthg32.exe
O4 - HKLM\..\Run: [Win32 Explorer] C:\WINDOWS\System32\explorer32.exe
O4 - HKLM\..\Run: [NSjogf.exe] C:\documents and settings\robert\local settings\temp\NSjogf.exe
O4 - HKLM\..\Run: [CSxM.exe] C:\documents and settings\robert\local settings\temp\CSxM.exe
O4 - HKLM\..\Run: [SX5SLC4.exe] C:\documents and settings\robert\local settings\temp\SX5SLC4.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [LTM2] C:\WINDOWS\litmus\SVSHOST.exe
O4 - HKCU\..\Run: [Win32 Explorer] C:\WINDOWS\System32\explorer32.exe
O4 - HKCU\..\Run: [Jieobcfx] C:\WINDOWS\system32\d?dplay.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Robert\Application Data\othb.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {F42B7D85-B194-4311-B92F-18F5C6C9D2B3} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O15 - Trusted Zone: *.db105.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.db105.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.211.105.20
O15 - Trusted IP range: (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100704994216
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Compaq Advisor - NeoPlanet - C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WUSB54GSVC - Unknown - C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe" "WUSB54G.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\ntdtcsetup.log:lhted.exe (file missing)

#2
Hemal

Posted 10 March 2005 - 03:01 PM

Founding Fart

Technician
1,470 posts

Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants. Afterwards, Please Post a fresh Hijack This log.

#3
ogre0969

Posted 10 March 2005 - 03:21 PM

Member

Topic Starter
Member
10 posts

I ran CW Shredder, rebooted and re ran to make sure. Here is the new log:
____________________________________________________________________
Logfile of HijackThis v1.99.0
Scan saved at 1:14:52 PM, on 3/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\d?dplay.exe
C:\Documents and Settings\Robert\Application Data\othb.exe
C:\Downloads\Utilities\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://db105.com:81/...n/index.cgi?c=0
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {B79CC35D-10FE-026C-855E-6F9CB7D9C3B9} - C:\WINDOWS\crzu32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [iexpilorer.exe] C:\WINDOWS\System32\iexpilorer.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ierh.exe] C:\WINDOWS\system32\ierh.exe
O4 - HKLM\..\Run: [nthg32.exe] C:\WINDOWS\system32\nthg32.exe
O4 - HKLM\..\Run: [Win32 Explorer] C:\WINDOWS\System32\explorer32.exe
O4 - HKLM\..\Run: [NSjogf.exe] C:\documents and settings\robert\local settings\temp\NSjogf.exe
O4 - HKLM\..\Run: [CSxM.exe] C:\documents and settings\robert\local settings\temp\CSxM.exe
O4 - HKLM\..\Run: [SX5SLC4.exe] C:\documents and settings\robert\local settings\temp\SX5SLC4.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [LTM2] C:\WINDOWS\litmus\SVSHOST.exe
O4 - HKCU\..\Run: [Win32 Explorer] C:\WINDOWS\System32\explorer32.exe
O4 - HKCU\..\Run: [Jieobcfx] C:\WINDOWS\system32\d?dplay.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Robert\Application Data\othb.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {F42B7D85-B194-4311-B92F-18F5C6C9D2B3} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O15 - Trusted Zone: *.db105.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.db105.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 81.211.105.20
O15 - Trusted IP range: (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100704994216
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Compaq Advisor - NeoPlanet - C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WUSB54GSVC - Unknown - C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe" "WUSB54G.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\ntdtcsetup.log:lhted.exe (file missing)

#4
ogre0969

Posted 11 March 2005 - 09:37 AM

Member

Topic Starter
Member
10 posts

Bumping. Thanks in advance for any help I recieve.

Robert

#5
ogre0969

Posted 11 March 2005 - 11:37 AM

Member

Topic Starter
Member
10 posts

I was reading through some other posts and ran Adaware again and it picked up 650 additional objects. I also Ran AboutBuster and CW-Shredder again. I am still getting the Debugger error. But I can access my computer through explorer.
I greatly appreciat any help anyone can give. Thanks! in advance.

Here is my aboutbuster log:

-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 25

Removed Data Streams:
C:\WINDOWS\bootstat.dat:eykru
C:\WINDOWS\btljm.dat:kdtkl
C:\WINDOWS\Compaq Amber.BMP:gqlvg
C:\WINDOWS\compaq.reg:cwuek
C:\WINDOWS\d3dx.dat:xkvmi
C:\WINDOWS\DBDILLMM.ini:ltcez
C:\WINDOWS\etixk.dat:gcufq
C:\WINDOWS\gtrai.dat:xdghj
C:\WINDOWS\iiagy.dat:kctpe
C:\WINDOWS\IsUninst.exe:kudxp
C:\WINDOWS\jumxo.dat:cnijp
C:\WINDOWS\lohhx.dat:nnbly
C:\WINDOWS\max820.tsf:amvvf
C:\WINDOWS\MKDEWE.TRN:wawgi
C:\WINDOWS\MKDEWE.TRN:wawgi
C:\WINDOWS\msoffice.ini:mwhtl
C:\WINDOWS\ODBC.INI:nxjct
C:\WINDOWS\omoun.dat:chgvt
C:\WINDOWS\orun32.ini:gkctk
C:\WINDOWS\orun32.ini:gkctk
C:\WINDOWS\Prairie Wind.bmp:pgjgr
C:\WINDOWS\Prairie Wind.bmp:pgjgr
C:\WINDOWS\qlpvb.dat:xzfdk
C:\WINDOWS\rhuqe.dat:cnnrx
C:\WINDOWS\River Sumida.bmp:iuscq
C:\WINDOWS\RPTSMITH.INI:noqbu
C:\WINDOWS\RS_RUN.INI:fpjpw
C:\WINDOWS\RS_SQLIF.INI:ewoah
C:\WINDOWS\ryprd.dat:sxqdm
C:\WINDOWS\setdebug.exe:dztwi
C:\WINDOWS\sntsh.dat:svnuf
C:\WINDOWS\vmmreg32.dll:jokot
C:\WINDOWS\wmnzl.dat:wjwke
C:\WINDOWS\WMSysPr9.prx:bbfhq
C:\WINDOWS\WMSysPrx.prx:manze
C:\WINDOWS\yikip.dat:qvltl
C:\WINDOWS\ykrfc.dat:itmeq
C:\WINDOWS\ztjjo.dat:adqer
C:\WINDOWS\_default.pif:dfmch

Removed 4 Random Key Entries
Removed! : C:\WINDOWS\acfaf.dat
Removed! : C:\WINDOWS\aeroi.dat
Removed! : C:\WINDOWS\alhoh.dat
Removed! : C:\WINDOWS\bbjrn.dat
Removed! : C:\WINDOWS\bfrho.dat
Removed! : C:\WINDOWS\brlgm.dat
Removed! : C:\WINDOWS\btljm.dat
Removed! : C:\WINDOWS\butno.dat
Removed! : C:\WINDOWS\cwefv.dat
Removed! : C:\WINDOWS\dlipu.dat
Removed! : C:\WINDOWS\dnkua.dat
Removed! : C:\WINDOWS\duxsh.dat
Removed! : C:\WINDOWS\eolzt.dat
Removed! : C:\WINDOWS\eqiif.dat
Removed! : C:\WINDOWS\etixk.dat
Removed! : C:\WINDOWS\fajxb.dat
Removed! : C:\WINDOWS\feego.dat
Removed! : C:\WINDOWS\fmepx.dat
Removed! : C:\WINDOWS\fmggm.dat
Removed! : C:\WINDOWS\foesw.dat
Removed! : C:\WINDOWS\fsqbq.dat
Removed! : C:\WINDOWS\gcbxm.dat
Removed! : C:\WINDOWS\gdeaa.dat
Removed! : C:\WINDOWS\ggggn.dat
Removed! : C:\WINDOWS\gkosx.dat
Removed! : C:\WINDOWS\gtrai.dat
Removed! : C:\WINDOWS\hbeba.dat
Removed! : C:\WINDOWS\hhnte.dat
Removed! : C:\WINDOWS\hrdqp.dat
Removed! : C:\WINDOWS\htysx.dat
Removed! : C:\WINDOWS\hvkyy.dat
Removed! : C:\WINDOWS\ieuuo.dat
Removed! : C:\WINDOWS\iiagy.dat
Removed! : C:\WINDOWS\jbqpn.dat
Removed! : C:\WINDOWS\jumxo.dat
Removed! : C:\WINDOWS\kpnqs.dat
Removed! : C:\WINDOWS\krdvp.dat
Removed! : C:\WINDOWS\kylgz.dat
Removed! : C:\WINDOWS\lhoqz.dat
Removed! : C:\WINDOWS\lohhx.dat
Removed! : C:\WINDOWS\luvus.dat
Removed! : C:\WINDOWS\lxjlv.dat
Removed! : C:\WINDOWS\mnaie.dat
Removed! : C:\WINDOWS\msgur.dat
Removed! : C:\WINDOWS\mxqma.dat
Removed! : C:\WINDOWS\nacdz.dat
Removed! : C:\WINDOWS\nftxs.dll
Removed! : C:\WINDOWS\oktmz.dat
Removed! : C:\WINDOWS\omoun.dat
Removed! : C:\WINDOWS\ozteq.dat
Removed! : C:\WINDOWS\pipsj.dat
Removed! : C:\WINDOWS\qdflj.dat
Removed! : C:\WINDOWS\qlpvb.dat
Removed! : C:\WINDOWS\qphgt.dat
Removed! : C:\WINDOWS\rfomu.dat
Removed! : C:\WINDOWS\rhuqe.dat
Removed! : C:\WINDOWS\ryprd.dat
Removed! : C:\WINDOWS\sdkzh.exe
Removed! : C:\WINDOWS\sgqoe.dat
Removed! : C:\WINDOWS\shhlb.dat
Removed! : C:\WINDOWS\skmcx.dat
Removed! : C:\WINDOWS\sntsh.dat
Removed! : C:\WINDOWS\sskrk.dat
Removed! : C:\WINDOWS\szzvc.dat
Removed! : C:\WINDOWS\tbojr.dat
Removed! : C:\WINDOWS\umjlm.dat
Removed! : C:\WINDOWS\usudc.dat
Removed! : C:\WINDOWS\vcrii.dat
Removed! : C:\WINDOWS\vozzr.dat
Removed! : C:\WINDOWS\vrulr.dat
Removed! : C:\WINDOWS\wfkmb.dat
Removed! : C:\WINDOWS\wmnzl.dat
Removed! : C:\WINDOWS\wqwoo.dat
Removed! : C:\WINDOWS\wuocb.dat
Removed! : C:\WINDOWS\wzgjw.dat
Removed! : C:\WINDOWS\xhupm.dat
Removed! : C:\WINDOWS\xmjbt.dat
Removed! : C:\WINDOWS\xnwwy.dat
Removed! : C:\WINDOWS\xyifr.dat
Removed! : C:\WINDOWS\xyudc.dat
Removed! : C:\WINDOWS\yikip.dat
Removed! : C:\WINDOWS\ykrfc.dat
Removed! : C:\WINDOWS\ynjye.dat
Removed! : C:\WINDOWS\ztjjo.dat
Removed! : C:\WINDOWS\zuupu.dat
Removed! : C:\WINDOWS\zvntu.dat
Removed! : C:\WINDOWS\system32\affak.dat
Removed! : C:\WINDOWS\system32\axfge.dat
Removed! : C:\WINDOWS\system32\bfiso.dat
Removed! : C:\WINDOWS\system32\bpkvb.dat
Removed! : C:\WINDOWS\system32\bqkku.dat
Removed! : C:\WINDOWS\system32\brtyk.dat
Removed! : C:\WINDOWS\system32\btppi.dat
Removed! : C:\WINDOWS\system32\cstgo.dat
Removed! : C:\WINDOWS\system32\ctmqu.dat
Removed! : C:\WINDOWS\system32\dcldi.dat
Removed! : C:\WINDOWS\system32\dkgfb.dat
Removed! : C:\WINDOWS\system32\dnibn.dat
Removed! : C:\WINDOWS\system32\ebzjl.dat
Removed! : C:\WINDOWS\system32\ejcld.dat
Removed! : C:\WINDOWS\system32\ewbbw.dat
Removed! : C:\WINDOWS\system32\fhmxz.dat
Removed! : C:\WINDOWS\system32\fpaql.dat
Removed! : C:\WINDOWS\system32\fsxce.dat
Removed! : C:\WINDOWS\system32\gxhqj.dat
Removed! : C:\WINDOWS\system32\hwdal.dat
Removed! : C:\WINDOWS\system32\hxacm.dat
Removed! : C:\WINDOWS\system32\hyfpw.dat
Removed! : C:\WINDOWS\system32\ijbct.dat
Removed! : C:\WINDOWS\system32\jaaud.dat
Removed! : C:\WINDOWS\system32\jawig.dat
Removed! : C:\WINDOWS\system32\jktik.dat
Removed! : C:\WINDOWS\system32\jmpli.dat
Removed! : C:\WINDOWS\system32\jovwm.dat
Removed! : C:\WINDOWS\system32\jtshv.dat
Removed! : C:\WINDOWS\system32\jvgwz.dat
Removed! : C:\WINDOWS\system32\kaias.dat
Removed! : C:\WINDOWS\system32\kzvcq.dat
Removed! : C:\WINDOWS\system32\lgxbx.dat
Removed! : C:\WINDOWS\system32\lvyjo.dat
Removed! : C:\WINDOWS\system32\mfcgz32.exe
Removed! : C:\WINDOWS\system32\mhvgj.dat
Removed! : C:\WINDOWS\system32\miaeo.dat
Removed! : C:\WINDOWS\system32\mseky.dat
Removed! : C:\WINDOWS\system32\msgc32.exe
Removed! : C:\WINDOWS\system32\nkkie.dat
Removed! : C:\WINDOWS\system32\nvbsv.dat
Removed! : C:\WINDOWS\system32\nzyyc.dat
Removed! : C:\WINDOWS\system32\offzk.dat
Removed! : C:\WINDOWS\system32\ojdat.dat
Removed! : C:\WINDOWS\system32\ommsh.dat
Removed! : C:\WINDOWS\system32\oqinm.dat
Removed! : C:\WINDOWS\system32\oqiqc.dat
Removed! : C:\WINDOWS\system32\oycai.dat
Removed! : C:\WINDOWS\system32\pajxq.dat
Removed! : C:\WINDOWS\system32\pcfdm.dat
Removed! : C:\WINDOWS\system32\pjwsp.dat
Removed! : C:\WINDOWS\system32\pnova.dat
Removed! : C:\WINDOWS\system32\pqknw.dat
Removed! : C:\WINDOWS\system32\pqrmg.dat
Removed! : C:\WINDOWS\system32\qfrej.dat
Removed! : C:\WINDOWS\system32\qqsue.dat
Removed! : C:\WINDOWS\system32\quuij.dat
Removed! : C:\WINDOWS\system32\qxmvn.dat
Removed! : C:\WINDOWS\system32\qyfbu.dat
Removed! : C:\WINDOWS\system32\riyuv.dat
Removed! : C:\WINDOWS\system32\rtqsm.dat
Removed! : C:\WINDOWS\system32\sdkef32.exe
Removed! : C:\WINDOWS\system32\shhti.dat
Removed! : C:\WINDOWS\system32\sqvnx.dat
Removed! : C:\WINDOWS\system32\stoby.dat
Removed! : C:\WINDOWS\system32\udmng.dat
Removed! : C:\WINDOWS\system32\ugxxp.dat
Removed! : C:\WINDOWS\system32\uoyty.dat
Removed! : C:\WINDOWS\system32\utiln.dat
Removed! : C:\WINDOWS\system32\uwtsy.dat
Removed! : C:\WINDOWS\system32\vedze.dat
Removed! : C:\WINDOWS\system32\vgyph.dat
Removed! : C:\WINDOWS\system32\vioyt.dat
Removed! : C:\WINDOWS\system32\vwatq.dat
Removed! : C:\WINDOWS\system32\wbkxs.dat
Removed! : C:\WINDOWS\system32\wcmdi.dat
Removed! : C:\WINDOWS\system32\wfeom.dat
Removed! : C:\WINDOWS\system32\xbqip.dat
Removed! : C:\WINDOWS\system32\xjprt.dat
Removed! : C:\WINDOWS\system32\xrnso.dat
Removed! : C:\WINDOWS\system32\xylpa.dat
Removed! : C:\WINDOWS\system32\yeotg.dat
Removed! : C:\WINDOWS\system32\ygfdf.dat
Removed! : C:\WINDOWS\system32\ygzgo.dat
Removed! : C:\WINDOWS\system32\yizyq.dat
Removed! : C:\WINDOWS\system32\ymyqq.dat
Removed! : C:\WINDOWS\system32\yueoo.dat
Removed! : C:\WINDOWS\system32\zjdfk.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 25

Removed Data Streams:
C:\WINDOWS\bootstat.dat:eykru
C:\WINDOWS\btljm.dat:kdtkl
C:\WINDOWS\Compaq Amber.BMP:gqlvg
C:\WINDOWS\compaq.reg:cwuek
C:\WINDOWS\d3dx.dat:xkvmi
C:\WINDOWS\DBDILLMM.ini:ltcez
C:\WINDOWS\etixk.dat:gcufq
C:\WINDOWS\gtrai.dat:xdghj
C:\WINDOWS\iiagy.dat:kctpe
C:\WINDOWS\IsUninst.exe:kudxp
C:\WINDOWS\jumxo.dat:cnijp
C:\WINDOWS\lohhx.dat:nnbly
C:\WINDOWS\max820.tsf:amvvf
C:\WINDOWS\MKDEWE.TRN:wawgi
C:\WINDOWS\MKDEWE.TRN:wawgi
C:\WINDOWS\msoffice.ini:mwhtl
C:\WINDOWS\ODBC.INI:nxjct
C:\WINDOWS\omoun.dat:chgvt
C:\WINDOWS\orun32.ini:gkctk
C:\WINDOWS\orun32.ini:gkctk
C:\WINDOWS\Prairie Wind.bmp:pgjgr
C:\WINDOWS\Prairie Wind.bmp:pgjgr
C:\WINDOWS\qlpvb.dat:xzfdk
C:\WINDOWS\rhuqe.dat:cnnrx
C:\WINDOWS\River Sumida.bmp:iuscq
C:\WINDOWS\RPTSMITH.INI:noqbu
C:\WINDOWS\RS_RUN.INI:fpjpw
C:\WINDOWS\RS_SQLIF.INI:ewoah
C:\WINDOWS\ryprd.dat:sxqdm
C:\WINDOWS\setdebug.exe:dztwi
C:\WINDOWS\sntsh.dat:svnuf
C:\WINDOWS\vmmreg32.dll:jokot
C:\WINDOWS\wmnzl.dat:wjwke
C:\WINDOWS\WMSysPr9.prx:bbfhq
C:\WINDOWS\WMSysPrx.prx:manze
C:\WINDOWS\yikip.dat:qvltl
C:\WINDOWS\ykrfc.dat:itmeq
C:\WINDOWS\ztjjo.dat:adqer
C:\WINDOWS\_default.pif:dfmch

Attempted Clean Of Temp folder.
Pages Reset... Done!
____________________________________________________________________

and new hijack this log:

Logfile of HijackThis v1.99.0
Scan saved at 9:34:34 AM, on 3/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe
C:\Program Files\WUSB54G Wireless-G Adapter\WUSB54G.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\VERITAS Software\Update Manager\sgtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\nthg32.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\system32\d?dplay.exe
C:\Documents and Settings\Robert\Application Data\othb.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Downloads\Utilities\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://db105.com:81/...n/index.cgi?c=0
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xhenc.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://db105.com:81/...n/index.cgi?c=0
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://db105.com:81/...n/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {B9A894DA-536D-899F-404E-D315F02B92FF} - C:\WINDOWS\system32\atlsg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [EnigmaPopupStop] C:\Program Files\SpyHunter\PopupBlocker\EnigmaPopupStop.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ierh.exe] C:\WINDOWS\system32\ierh.exe
O4 - HKLM\..\Run: [nthg32.exe] C:\WINDOWS\system32\nthg32.exe
O4 - HKLM\..\Run: [NSjogf.exe] C:\documents and settings\robert\local settings\temp\NSjogf.exe
O4 - HKLM\..\Run: [CSxM.exe] C:\documents and settings\robert\local settings\temp\CSxM.exe
O4 - HKLM\..\Run: [SX5SLC4.exe] C:\documents and settings\robert\local settings\temp\SX5SLC4.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [LTM2] C:\WINDOWS\litmus\SVSHOST.exe
O4 - HKCU\..\Run: [Jieobcfx] C:\WINDOWS\system32\d?dplay.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Robert\Application Data\othb.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htm
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Advisor - {F42B7D85-B194-4311-B92F-18F5C6C9D2B3} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O15 - Trusted IP range: 81.211.105.20
O15 - Trusted IP range: (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-bet...all/xscan60.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1100704994216
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Compaq Advisor - NeoPlanet - C:\Program Files\Compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WUSB54GSVC - Unknown - C:\Program Files\WUSB54G Wireless-G Adapter\WLService.exe" "WUSB54G.exe (file missing)
O23 - Service: Network Security Service - Unknown - C:\WINDOWS\ntdtcsetup.log:lhted.exe (file missing)