[colinclark]

I've followed all instructions in the very helpful "You Must Read This Before Posting A Hijackthis Log". Still my desktop shows the black "Warning You're in Danger ....".

As requested this is my Hijackthis log.. followed by the Ewido log. Your help is much appreciated. thanks!

Logfile of HijackThis v1.99.1
Scan saved at 21:44:54, on 21/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AOL 8.0a\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\itkzg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocsv.dll/blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {42DE119E-AE63-2908-88E0-D7B611D264A1} - C:\WINDOWS\system32\ipvt.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Class - {F23079EB-2ED9-850D-E431-CC41AF3F3F4C} - C:\WINDOWS\system32\ipzb32.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [systx.exe] C:\WINDOWS\system32\systx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Oasis] regsvr32 /s "c:\Program Files\Oasis\oasis.dll"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0a\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121975289578
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\wingr.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

*********************************************************

EWIDO LOG

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 22:16:36, 20/07/2005
+ Report-Checksum: E7E04547

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{430B869B-EB6E-CBD3-5E4D-6D279372AA20} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{4FFB405E-2D99-7374-B6D3-F0CD9DC8744E} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{792A038A-9C16-9885-5B25-CE939788172A} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{8169E4D3-2914-C956-AAFE-F49D78C929A8} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{82315E43-11FA-6C58-5A20-2880E5C9C491} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{913EAD11-DA6B-5C8F-D264-E3D4FC8BA5DD} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{97E37285-B9D3-035E-821F-3EBE4F849C3D} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A94D3AA0-A235-876E-2DCD-617E08BD8301} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{B4F697AE-7E58-DC0D-D012-24F83EAB9F25} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{C7D795AC-547B-FA4B-091B-30C3C67B7D07} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{DFC94122-75A0-85E3-3738-430A8B983C39} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Update\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW -> Spyware.CoolWebSearch : Cleaned with backup
C:\WINDOWS\aoitr.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\apicg.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiov32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apiru32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\appew.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\atlcu32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\atlib.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\atlpq.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\avrack.ini:fjktlk -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\avrack.ini:upclum -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\bfblq.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\bxesj.txt:gbsrme -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\bxesj.txt:vkcaxf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\bxesj.txt:wnfpwx -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\bxesj.txt:zfjlur -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\control.ini:mqhbxx -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crcu32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\cren.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\crfe32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\cucil.txt:ppjjrp -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\cucil.txt:yegtoq -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\czfox.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\d3gf32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\d3kl.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\desktop.ini:kosews -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\desktop.ini:namrox -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\desktop.ini:qrwuxy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\desktop.ini:rtnbsc -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\dfovq.txt:frzgra -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\dfovq.txt:xxqnym -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\dinsq.txt:zmjybp -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\djhyw.txt:mfbpaf -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\html.exe -> TrojanDownloader.Delf.ks : Cleaned with backup
C:\WINDOWS\gvwru.txt:xxqnym -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipfa32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ipik32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\ipjy32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\ipqi.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\itkzg.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\javahn.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\javavu32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\jglko.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\kfxpp.txt:auocui -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\khnll.txt:pyjtso -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\kxeuc.txt:qrpsok -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\mfcbw.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\msdfmap.ini:zibglp -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msyq.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\nfovq.txt:qbwfus -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\n_btxeww.txt:ckfohe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\n_btxeww.txt:loortj -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\n_btxeww.txt:mcfbze -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\n_fmobho.txt:buezmg -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\n_fmobho.txt:bwrsfg -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\n_yzjgxc.txt:hkxiqm -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\ODBC.INI:lrhpju -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ODBC.INI:rjwkfo -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ODBC.INI:zjnttf -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:kzosae -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:wpmwhx -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\ODBCINST.INI:xxqnym -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:dhhqwx -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:nvzmai -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:ralkrn -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\OEWABLog.txt:upurll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\orgri.txt:jkppiz -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\orun32.ini:knvzng -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\qrwux.txt:phylal -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\qrwux.txt:tkgnrs -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\qzlqx.txt:tfptrp -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\rfzyr.txt:kzssdd -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\RtlRack.ini:gssqnk -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\RtlRack.ini:sdbkjy -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:aspkvi -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\SchedLgU.Txt:viqhax -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\sdkrz.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\setuplog.txt:khunwy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\slrpn.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\smscfg.ini:dinsqb -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\smscfg.ini:fkguzv -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\smscfg.ini:mhqcju -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\smscfg.ini:xjonnn -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\syspi.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\abirvalg32.dll -> TrojanProxy.Small.cn : Cleaned with backup
C:\WINDOWS\system32\addgl32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\alxjh.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\apill.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\apism32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\appvr.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\atltw32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\bjkce.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\crgw32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\crqz32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\crrc.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\d3uu32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\exmvg.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\hccsc.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\ieog.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\javaur.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\javavv32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\javaxw32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\javayz.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\mfcgs.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\mfcxt.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\mshtma.exe -> Heuristic.Win32.AVKiller : Cleaned with backup
C:\WINDOWS\system32\msjl32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\mspz32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\msvv.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\netxx32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\ntaf32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\ntpr.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\pudnm.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\sdkta32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\sdkug32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\soihk.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\sysdr.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\winah32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\winee32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\system32\wingy32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\xcoln.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\yzplx.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\system32\__delete_on_reboot__ipvt.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\system32\__delete_on_reboot__ipzb32.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\systl.dll -> TrojanDownloader.Agent.bc : Cleaned with backup
C:\WINDOWS\syszc32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\tggxp.txt:dmbkbb -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\uninstIU.exe -> Trojan.Agent.ff : Error during cleaning
C:\WINDOWS\vb.ini:qzlqxw -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\vb.ini:ynwaoa -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\vbaddin.ini:hmwwjd -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\vbaddin.ini:vdorzz -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\vbaddin.ini:zhvuza -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\whyvn.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\wincr32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winny.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winwe32.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winxs.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\winyg.exe -> TrojanDownloader.Agent.bq : Cleaned with backup
C:\WINDOWS\winyl.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ykwck.dll -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\yrfxd.txt:lkubss -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ysrjr.txt:igymjk -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:afbbug -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:afehak -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:ajjyjj -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:aobijv -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:bbtdsz -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:bmnbih -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:bqkspe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:brphbp -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:bvhiyz -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:cfpcjd -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:corrrg -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:cwvjan -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:dblpjd -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:dinsqb -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:drcuhk -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:duyuqo -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:eblzsq -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:ecpzyt -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:egjctt -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:erlghz -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:fyimoi -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:gbdaem -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:gconhm -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:gdbqxs -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:gjdtdo -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:gryxph -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:hfamnr -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:hqkudh -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:hsjjzg -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:hzbwwa -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:iacnpa -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:igbcyl -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:ihszbh -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:iizzgk -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:irepfx -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:isoazi -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:isrnhj -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:jeivio -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:jhdocj -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:jluvfe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:jnylxw -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:khunwy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:kugpod -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:kvkdgl -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:lattyf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:ldgacf -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:licyjg -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:liqlvo -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:lklfxy -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:lllxcn -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:llrlpg -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:lqajqt -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:lqbtnp -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:lrilrv -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:mlgjmk -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:mpdjpb -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:mziysc -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:oatfvf -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:omdxsh -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:omqmfz -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:oxpihq -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:pdzhby -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:pehglh -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:pghtyw -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:pmexrh -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:psegzi -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:pzgylk -> Spyware.Ipyn : Cleaned with backup
C:\WINDOWS\_default.pif:qihmmh -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:qnixea -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:qrwuxy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:qrzhfy -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\_default.pif:rcmifj -> Spyware.SearchPage : Cleaned with backup
C:\WINDOWS\_default.pif:rejgrc -> Spyware.Ipyn : Cleaned with backup


::Report End

[Advertisements]

1. Make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://www.xtra.co.n...1916458,00.html

2. Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

3. While in safemode open Hijackthis and click scan. Then tick and fix the following in Hijackthis with all windows closed except Hijackthis.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\itkzg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocsv.dll/blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {42DE119E-AE63-2908-88E0-D7B611D264A1} - C:\WINDOWS\system32\ipvt.dll (file missing)
O2 - BHO: Class - {F23079EB-2ED9-850D-E431-CC41AF3F3F4C} - C:\WINDOWS\system32\ipzb32.dll (file missing)
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [systx.exe] C:\WINDOWS\system32\systx.exe

4. Delete the files. (if present)

C:\WINDOWS\system32\svcnt.exe
C:\WINDOWS\system32\systx.exe

5. Reboot and Download about:buster by RubbeRDuckY Here.

Save the file somewhere you will remember like to the Desktop.

Please run about:buster by RubbeRDuckY:

• Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
• Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
• Click "OK" at the prompt with instructions.
• Click "Update" and then "Check For Update" to begin the update process.
• If any updates exist please download them by clicking "Download Update" then click the X to close that window.
• Boot into safemode again
• Open About:buster again
• Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
• Click Yes to allow it to shutdown explorer.exe.
• It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
• When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.

6. Reboot back into normal mode and download http://osc.geekstogo...rviceremove.reg run it it will ask to merge into the registery say yes.

7. Download and run http://cwshredder.ne.../CWShredder.exe click fix.

8. Then post the about:buster log and a new Hijackthis log here in a reply.

[therock247uk]

1. Make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://www.xtra.co.n...1916458,00.html

2. Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

3. While in safemode open Hijackthis and click scan. Then tick and fix the following in Hijackthis with all windows closed except Hijackthis.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\itkzg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdocsv.dll/blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\dubxe.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {42DE119E-AE63-2908-88E0-D7B611D264A1} - C:\WINDOWS\system32\ipvt.dll (file missing)
O2 - BHO: Class - {F23079EB-2ED9-850D-E431-CC41AF3F3F4C} - C:\WINDOWS\system32\ipzb32.dll (file missing)
O4 - HKLM\..\Run: [Fast Start] C:\WINDOWS\system32\svcnt.exe home
O4 - HKLM\..\Run: [systx.exe] C:\WINDOWS\system32\systx.exe

4. Delete the files. (if present)

C:\WINDOWS\system32\svcnt.exe
C:\WINDOWS\system32\systx.exe

5. Reboot and Download about:buster by RubbeRDuckY Here.

Save the file somewhere you will remember like to the Desktop.

Please run about:buster by RubbeRDuckY:

• Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
• Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
• Click "OK" at the prompt with instructions.
• Click "Update" and then "Check For Update" to begin the update process.
• If any updates exist please download them by clicking "Download Update" then click the X to close that window.
• Boot into safemode again
• Open About:buster again
• Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
• Click Yes to allow it to shutdown explorer.exe.
• It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
• When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.

6. Reboot back into normal mode and download http://osc.geekstogo...rviceremove.reg run it it will ask to merge into the registery say yes.

7. Download and run http://cwshredder.ne.../CWShredder.exe click fix.

8. Then post the about:buster log and a new Hijackthis log here in a reply.

[colinclark]

Many thanks for your help. Brilliant! This seems to have fixed the problem. I can now remove the "Warning...." webpage from my desktop. (It was listed as "Security Inf v3").

Here's the end-point Hijackthis and about:Buster logs.

Am I OK to upgrade now to XP SP2?

Thanks again for your kind help.


Logfile of HijackThis v1.99.1
Scan saved at 21:51:02, on 22/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AOL 8.0a\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Oasis] regsvr32 /s "c:\Program Files\Oasis\oasis.dll"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0a\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121975289578
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\wingr.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Scanned at: 21:37:27 on: 22/07/2005


-- Scan 1 ---------------------------
About:Buster Version 4.0
Reference List : 31

No ADS found on system
Removed 2 Random Key Entries
Removed! : C:\WINDOWS\aqwgz.dat
Removed! : C:\WINDOWS\bgtqd.dat
Removed! : C:\WINDOWS\ddexc.dat
Removed! : C:\WINDOWS\dnhkj.dat
Removed! : C:\WINDOWS\eehsb.dat
Removed! : C:\WINDOWS\fesou.dat
Removed! : C:\WINDOWS\fhtso.dat
Removed! : C:\WINDOWS\fleeh.dat
Removed! : C:\WINDOWS\gbijc.dat
Removed! : C:\WINDOWS\glyyp.dat
Removed! : C:\WINDOWS\guvsb.dat
Removed! : C:\WINDOWS\hcvla.dat
Removed! : C:\WINDOWS\higen.dat
Removed! : C:\WINDOWS\iewpy.dat
Removed! : C:\WINDOWS\iigtb.dat
Removed! : C:\WINDOWS\lqzsi.dat
Removed! : C:\WINDOWS\mtbqn.dat
Removed! : C:\WINDOWS\nrgpp.dat
Removed! : C:\WINDOWS\omdxs.dat
Removed! : C:\WINDOWS\oxqzu.dat
Removed! : C:\WINDOWS\qbdjg.dat
Removed! : C:\WINDOWS\qcipy.dat
Removed! : C:\WINDOWS\qiwpy.dat
Removed! : C:\WINDOWS\sjaxm.dat
Removed! : C:\WINDOWS\tanvr.dat
Removed! : C:\WINDOWS\tttlk.dat
Removed! : C:\WINDOWS\vdjwa.dat
Removed! : C:\WINDOWS\zdnjn.dat
Removed! : C:\WINDOWS\zrzlv.dat
Removed! : C:\WINDOWS\System32\cfqmf.dat
Removed! : C:\WINDOWS\System32\cqibz.dat
Removed! : C:\WINDOWS\System32\dqwsp.dat
Removed! : C:\WINDOWS\System32\ehlsq.dat
Removed! : C:\WINDOWS\System32\emwnw.dat
Removed! : C:\WINDOWS\System32\fxevf.dat
Removed! : C:\WINDOWS\System32\gimqf.dat
Removed! : C:\WINDOWS\System32\iacnp.dat
Removed! : C:\WINDOWS\System32\kqmsh.dat
Removed! : C:\WINDOWS\System32\kxfow.dat
Removed! : C:\WINDOWS\System32\nkhif.dat
Removed! : C:\WINDOWS\System32\oysoh.dat
Removed! : C:\WINDOWS\System32\pjcuo.dat
Removed! : C:\WINDOWS\System32\pskvc.dat
Removed! : C:\WINDOWS\System32\rrwve.dat
Removed! : C:\WINDOWS\System32\takug.dat
Removed! : C:\WINDOWS\System32\tutan.dat
Removed! : C:\WINDOWS\System32\unusm.dat
Removed! : C:\WINDOWS\System32\vhpjp.dat
Removed! : C:\WINDOWS\System32\ztycw.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 4.0
Reference List : 31

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

[therock247uk]

1. Make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://www.xtra.co.n...1916458,00.html

2. Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.

3. While in safemode open Hijackthis and click scan. Then tick and fix the following in Hijackthis with all windows closed except Hijackthis.

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (file missing)
O4 - HKCU\..\Run: [Oasis] regsvr32 /s "c:\Program Files\Oasis\oasis.dll"

4. Delete the folders. (if present)

c:\Program Files\Oasis

5. Reboot and post a new Hijackthis log here in a reply.

[colinclark]

Thanks for your continued help. Followed your instructions then rebooted and produced this log.

Logfile of HijackThis v1.99.1
Scan saved at 11:18:01, on 23/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\AOL 8.0a\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0a\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121975289578
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\wingr.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[therock247uk]

Go to start, run type "services.msc" with out the quotes find the service.

Remote Procedure Call (RPC) Helper

Right click and stop it, make the start up type to disabled. When you have done that go into Hijackthis > open the misc tools section > delete an NT service and delete 11Fßä#·ºÄÖ`I. Then post a new Hijackthis log here in a reply.

[colinclark]

The service was already stopped - so I just Disabled it.

I cut/pasted the name into Highjackthis but it failed to delete it. Error = "Service 11Fßä#·ºÄÖ`I was not found in the Registry. Make sure you entered the short name of the service., vbExclamation". The service is still in the HJT Scan log when I re-enable it.

[therock247uk]

Ok keep it disabled then post a new Hijackthis log here in a reply.

[colinclark]

Sorry - Ignore my previous post. I tried again using Snagit to capture the crazy text from Services. Hijackthis now found it and deleted it OK. Rebooted then Scan - log below. Thanks for sticking with it!

Logfile of HijackThis v1.99.1
Scan saved at 14:41:41, on 23/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\AOL 8.0a\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0a\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121975289578
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[therock247uk]

Your log is clean

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

I also suggest that you delete any files from "temp", "tmp" folders. In Internet Explorer, click on "Tools" => "Internet Options" => "Delete Files" and select the box that says "Delete All Offline Content" and click on "OK" twice. Also, empty the recycle bin by right clicking on it and selecting "Empty Recycle Bin". These steps should be done on a regular basis.

Credit to PGPhantom for canned speech.

[colinclark]

Top guy. Thanks for all your help. I'll follow your advice! It's my daughter's boyfriend's laptop. God knows where he's been!

Just as I read your post Avast throws up another Trojan - Win32:Trojano-1584 [Trj].

Don't know where they're coming from - my only browser session is looking at Geekstogo and MSN Messenger is currently closed.

[therock247uk]

Post a new Hijackthis log here in a reply.

[colinclark]

Here you go. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 19:05:27, on 23/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Wireless 11Mbps Network\XPFix.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\AOL 8.0a\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0a\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121975289578
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

[therock247uk]

Still looks clean here still haiving problems?

[colinclark]

No more alerts. Must have been a delayed one?! Everything seems fine. Just updated to SP2 and ran some more scans. All clean.

Great work. Many thanks for your help.