problem with adware, please help (HighjackThis log)

[theartknife]

Hi I’m hoping you can help me as I’ve tried everything I can think of myself. A couple of days ago a host of pop-ups started appearing and my internet browser started randomly re-directing itself to crummy websites. I’ve scanned for spyware and adware, but there is always at least one file that cannot be deleted and the problem never goes away. I have also been getting error messages about “run DLL as an APP” I’m assuming this is linked as the files that cannot be deleted are invariably DLL files.
I browsed a few topics of people that have had similar problems, but could do with some more specific advice as i'm what might be called an everyday PC user.

Anyway, please help me if you can, below is a HijackThis log

Thanks

Logfile of HijackThis v1.99.1
Scan saved at 15:57:32, on 21/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Network\ipnetwork.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wmplayer.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] C:\Program Files\wmplayer\wmplayer.exe /auto
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames.exe
O4 - HKLM\..\RunServices: [] p2pnetworking.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000228.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O4 - Global Startup: wmplayer.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\lvj2091oe.dll
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

Hi,

Please download Look2Me-Destroyer.exe (http://www.atribune.org/content/view/28/) to your desktop.

Close all windows before continuing.
Double-click Look2Me-Destroyer.exe to run it.
Put a check next to Run this program as a task.
You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
Once it's done scanning, click the Remove L2M button.
You will receive a Done Scanning message, click OK.
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
Your computer will then shutdown.
turn your computer back on.
Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.


If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

[theartknife]

Hey, thanks so much for your reply, i really appreciate the help.

right so far so good, i'd done as you said and the error message i was getting on startup has gone, so that's a step in the right direction.
below is the Look2Me-Destroyer.txt document and a new HiJackThis log

thanks again
************************************************

Look2Me-Destroyer V1.0.11

Scanning for infected files.....
Scan started at 3/21/2006 11:53:11 PM

Infected! C:\WINDOWS\system32\k8800ilme8qa0.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069035.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069037.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069078.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069086.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069104.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069112.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069125.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069169.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069423.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069424.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069434.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069443.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069459.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069468.dll
Infected! C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069469.dll
Infected! C:\WINDOWS\system32\en66l1js1.dll
Infected! C:\WINDOWS\system32\gui32.dll
Infected! C:\WINDOWS\system32\ir0ol5d31.dll
Infected! C:\WINDOWS\system32\k8800ilme8qa0.dll
Infected! C:\WINDOWS\system32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\k8800ilme8qa0.dll
C:\WINDOWS\system32\k8800ilme8qa0.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069035.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069035.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069037.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP275\A0069037.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069078.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069078.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069086.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP276\A0069086.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069104.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069104.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069112.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069112.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069125.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069125.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069169.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069169.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069423.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069423.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069424.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069424.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069434.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069434.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069443.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069443.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069459.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069459.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069468.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069468.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069469.dll
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0069469.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\en66l1js1.dll
C:\WINDOWS\system32\en66l1js1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\gui32.dll
C:\WINDOWS\system32\gui32.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\ir0ol5d31.dll
C:\WINDOWS\system32\ir0ol5d31.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\k8800ilme8qa0.dll
C:\WINDOWS\system32\k8800ilme8qa0.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunServices

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{8362D848-18D3-48E0-98A4-73759F9D7E3C}"
HKCR\Clsid\{8362D848-18D3-48E0-98A4-73759F9D7E3C}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A2CAB27C-31F7-4B87-9A20-F0321E54481F}"
HKCR\Clsid\{A2CAB27C-31F7-4B87-9A20-F0321E54481F}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BCC70DF8-7F76-4284-AC64-9D461671859E}"
HKCR\Clsid\{BCC70DF8-7F76-4284-AC64-9D461671859E}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


****************************************************

Logfile of HijackThis v1.99.1
Scan saved at 00:02:55, on 22/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Network\ipnetwork.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wmplayer.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] C:\Program Files\wmplayer\wmplayer.exe /auto
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames.exe
O4 - HKLM\..\RunServices: [] p2pnetworking.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000228.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O4 - Global Startup: wmplayer.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

OK log is looking better. I think we might be able to take care of the rest without using any more tools, but we'll see. You might want to print these instructions as you will not have access to the internet for part of this fix. First make sure you can view all hidden files and folders explained below:


Click "Start".
Click "My Computer".
Select the "Tools" menu and click "Folder Options".
Select the "View" tab.
Under the "Hidden files and folders" heading, select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Click "Yes" to confirm.
Uncheck the "Hide file extensions for known file types".
Click "OK".

Next run Hijack This again and put a check (tick) next to the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd8.exe
O4 - HKLM\..\Run: [gimmygames] C:\windows\gimmygames.exe
O4 - HKLM\..\RunServices: [] p2pnetworking.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000228.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe

Close all other browsers/windows and click Fix Checked. Close Hijack This.

Next restart the PC in safe mode. Do this by rebooting and then begin repeatedly tapping the F8 key. Keep tapping the F8 key until the advanced boot options menu appears. Scroll with the arrow keys to the top choice which is safe mode. Press enter.

Once in safe mode use Windows Explorer to navigate to the following folders. In all cases when I ask you to delete a file or folder do not be alarmed if they don't exist:

Go to this folder:

C:\Program Files\Common Files\

Find and delete the following file and/or folders:

mc-110-12-0000228.exe<---This file.
VCClient<---This folder.

Navigate to this folder:

C:\windows\

Delete these files:

winsysupd8.exe
gimmygames.exe

Using the Windows Search feature please search for the following file (be sure to include hidden files in your search):

p2pnetworking.exe

Delete all instances of that file that you find.

Next reboot the PC in normal mode and post another Hijack This log.

[theartknife]

great, my system is allready running much more smoothly and no more pop-ups. I carried out your instructions, the HiJackThis log is below.
Just a couple of other things, when i rebooted my after doing everything you advised, freeprodtb downloaded a .exe file onto my desktop and my AVG anti virus software caught a couple of warnings of infected objects as follows..
C:\Windows\system32\dr.exe
C:\Windows\system32\xxx.exe

not sure if this is relevant, but thought i would mention it.

thanks again.

******************************
Logfile of HijackThis v1.99.1
Scan saved at 02:16:29, on 22/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Network\ipnetwork.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wmplayer.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XBTB04715 - {A8B0BDED-64A5-495b-97DA-42C0301E229B} - C:\PROGRA~1\TOOLBA~1\TOOLBA~1.DLL
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Toolbar888\ToolBar888.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] p2pnetworking.exe
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [wmplayer] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O4 - Global Startup: wmplayer.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

Well we might need to bring out some more muscle. Please download Ewido Anti-Malware from my signature below. Install the program and set it up according to the instructions below:

You will need to update ewido to the latest definition files.

On the left hand side of the main screen click update
Click on Start

The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.

Once the updates are installed do the following:


If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.

Reboot into Safe Mode, you can do this by restarting your computer, then contiunally tapping F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. Then, run ewido.

Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!

Click on scanner
Click on Settings
Under "How to scan" all boxes should be selected
Under "Possibly unwanted software" all boxes should be selected
Under "What to scan" select scan every file
Click OK
Click on Complete system scan
Let the program scan the machine

If ewido finds anything, it will pop up a notification. Please check the box that says Perform action with all infections

Once the scan has completed, there will be a button located on the bottom of the screen named Save report.


Click Save report
Save the report to your desktop
Exit ewido

Reboot the PC into normal mode and post the Ewido log and a fresh Hijack This log.

[theartknife]

ok, done and done. This time i got a DOS interface window and a new error message on startup as follows.

C:Docume~1\xx\setup.exe
C:\WINDOWS\SYSTEM32\AUTOEXE.NT. The system file is not suitable for running MS-DOS and Microsoft Windows applications. Choose 'Close to terminate the application.

again, not sure if this is relevant, but thought it might be worth mentioning.

and so the reports...

*****************************************************
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 10:06:56, 22/03/2006
+ Report-Checksum: BCAB2A7B

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
HKU\S-1-5-21-1957994488-1708537768-1343024091-1003\Software\DNS -> Adware.Shorty : Cleaned with backup
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\wmplayer.exe -> Dropper.VB.me : Cleaned with backup
:mozilla.16:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.17:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.19:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.22:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.24:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.26:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.27:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.43:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.45:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.46:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.47:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.48:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.49:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.50:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.51:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.52:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.53:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned with backup
:mozilla.54:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.55:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.56:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.57:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.58:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.62:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.63:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
:mozilla.67:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.68:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.69:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.70:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.71:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.72:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.73:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.74:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.75:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.76:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.77:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.78:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.79:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.80:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.81:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.82:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.83:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.84:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.85:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
:mozilla.101:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.107:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.108:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.115:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
:mozilla.119:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.120:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.121:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.122:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.138:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned with backup
:mozilla.139:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Adviva : Cleaned with backup
:mozilla.141:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup
:mozilla.142:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup
:mozilla.143:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup
:mozilla.144:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Starware : Cleaned with backup
:mozilla.145:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.146:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.147:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.153:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.169:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup
:mozilla.170:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.171:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.174:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.175:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.184:C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\xx\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-3781ef88-4e8ca1fb.class -> Trojan.ClassLoader.Dummy.d : Cleaned with backup
C:\Documents and Settings\xx\exe.exe -> Dropper.VB.me : Cleaned with backup
C:\Documents and Settings\xx\im.exe -> Not-A-Virus.PSWTool.Win32.Messen.103 : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\!update.exe -> Downloader.PurityScan.bx : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\Cookies\xx@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\Cookies\xx@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\temp.fr520F -> Adware.Look2Me : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\temp.fr9DDD -> Adware.Look2Me : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temp\VVSNInst.exe -> Adware.SaveNow : Cleaned with backup
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\05MJS9AR\drdata[1].avi -> Dropper.Agent.aac : Cleaned with backup
C:\Documents and Settings\xx\pwha.exe -> Not-A-Virus.PSWTool.Win32.PassView.162 : Cleaned with backup
C:\Program Files\Common Files\InetGet\mc-110-12-0000140.exe -> Dropper.Agent.aac : Cleaned with backup
C:\Program Files\Common Files\services.exe -> Adware.Maxifiles : Cleaned with backup
C:\Program Files\Common Files\Windows\services32.exe -> Adware.Maxifiles : Cleaned with backup
C:\Program Files\Toolbar888\ToolBar888.dll -> Adware.Softomate : Cleaned with backup
C:\WINDOWS\system32\Ѕуmantec\winlogon.exe -> Downloader.PurityScan.bx : Cleaned with backup


::Report End

****************************************************

Logfile of HijackThis v1.99.1
Scan saved at 10:16:35, on 22/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\p2pnetworking.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XBTB04715 - {A8B0BDED-64A5-495b-97DA-42C0301E229B} - C:\PROGRA~1\TOOLBA~1\TOOLBA~1.DLL (file missing)
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Toolbar888\ToolBar888.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] p2pnetworking.exe
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [wmplayer] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

Please run a Panda Active Scan from my signature below. Allow the scan to delete whatever it finds. It will generate a log at the end. Please post the log here along with a fresh Hijack This log.

[theartknife]

ok, that's done. reports as follows

and thanks again for sticking with me.

************************************
Incident Status Location

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\xx\Application Data\Mozilla\Firefox\Profiles\wgkpom19.default\cookies.txt[]
Adware:adware/dyfuca Not disinfected C:\Documents and Settings\xx\Local Settings\Temp\cfout.txt
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\KLQNKDEV\freeprodtb[1].exe
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\X00VW47Y\drdata[1].avi
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\XY54DSN4\dnscatcher[1].avi
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\XY54DSN4\launcher[1].exe
Adware:Adware/Maxifiles Not disinfected C:\Program Files\DNS\cwebpage.dll
Adware:Adware/Maxifiles Not disinfected C:\Program Files\InetGet2\direct.exe
Adware:Adware/Maxifiles Not disinfected C:\Program Files\InetGet2\gimmysmileysB.exe
Adware:adware/dollarrevenue Not disinfected C:\WINDOWS\keyboard21.dat
Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\system32\mc-110-12-0000140.exe
Virus:W32/IRCbot.VE.worm Disinfected C:\WINDOWS\system32\p2pnetworking.exe
****************************************************

Logfile of HijackThis v1.99.1
Scan saved at 00:37:19, on 23/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XBTB04715 - {A8B0BDED-64A5-495b-97DA-42C0301E229B} - C:\PROGRA~1\TOOLBA~1\TOOLBA~1.DLL (file missing)
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Toolbar888\ToolBar888.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] p2pnetworking.exe
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [wmplayer] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

No problem. I'll stick with you 'til the end. We'll get rid of it. This one is being a little contrary. Never seen it do this before. Anyway with that said this time run a Kaspersky online scan from my signature below. Allow the scan to delete whatever it finds. Post the log from Kaspersky as well as another fresh Hijack This log.

[theartknife]

thnaks, that's good to hear. I'm not sure that the the Kaspersky online scan actually deleted anything. It didn't seem to offer any option to do so, maybe i missed something.
anyway, reports as follows.

**************************************************
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, March 23, 2006 9:36:02 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 23/03/2006
Kaspersky Anti-Virus database records: 172444
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 90582
Number of viruses found: 6
Number of infected objects: 20
Number of suspicious objects: 0
Duration of the scan process: 00:48:38

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\X00VW47Y\drdata[1].avi Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\X00VW47Y\i[1].exe Infected: Trojan-Downloader.Win32.VB.zd skipped
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\XY54DSN4\launcher[1].exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.p skipped
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\XY54DSN4\launcher[1].exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP261\A0067783.exe Infected: Trojan-Downloader.Win32.Adload.t skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP277\A0070544.exe Infected: Trojan-Downloader.Win32.VB.zd skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070571.exe Infected: Trojan-Downloader.Win32.VB.zd skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070572.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.p skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070572.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070573.exe Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070577.exe Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070589.exe Infected: Trojan-Dropper.Win32.VB.me skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070590.exe Infected: Trojan-Dropper.Win32.VB.me skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070593.exe Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070620.exe Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070621.exe Infected: Trojan-Dropper.Win32.Agent.aac skipped
C:\System Volume Information\_restore{DDE10987-CEAA-42C7-AACC-EAD98E87FB8E}\RP278\A0070635.exe Infected: Backdoor.Win32.IRCBot.qc skipped
C:\WINDOWS\system32\mc-110-12-0000140.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.p skipped
C:\WINDOWS\system32\mc-110-12-0000140.exe NSIS: infected - 1 skipped
C:\WINDOWS\system32\setup.exe.tmp Infected: Trojan-Downloader.Win32.VB.zd skipped

Scan process completed.

*******************************************************

Logfile of HijackThis v1.99.1
Scan saved at 09:43:00, on 23/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XBTB04715 - {A8B0BDED-64A5-495b-97DA-42C0301E229B} - C:\PROGRA~1\TOOLBA~1\TOOLBA~1.DLL (file missing)
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Toolbar888\ToolBar888.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [wmplayer] p2pnetworking.exe
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [wmplayer] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

Sorry this is taking so long. This one wants to hold on and not let go. First of all I need you to open the Windows Search feature and look for the following file (be sure to search hidden files and folders as well):

p2pnetworking.exe

Please post back and let me know where this file resides on your system (the full path to the file i.e C:\Windows\system32\xxxx.exe), every instance of it as well, especially if other instances have a different path. We're probably going to have to use a tool to kill some entries that are loading, but we'll get there. Post back with your response.

[theartknife]

ok, as you say this one wants to hold on, but we can beat it. I have done the scan, the one and only entry is as follows

C:Windows\prefetch\P2PNETWORKING.EXE-2D7BE74F.pf

.

[skywalker45]

OK. Glad you found the little rascal. Please download Pocket Killbox from here. (http://www.short-media.com/download.php?dc=69) Place the program on your desktop. Don't do anything with it yet. Also download Ad-Aware and Spybot from my signature below. Update the programs but don't run them yet. If you already have these installed just be sure you update them. You might want to print these instructions as you will not have access to the internet during this fix.

Next run Hijack This again and put a check (tick) next to the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O2 - BHO: XBTB04715 - {A8B0BDED-64A5-495b-97DA-42C0301E229B} - C:\PROGRA~1\TOOLBA~1\TOOLBA~1.DLL (file missing)

O3 - Toolbar: Toolbar888 - {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} - C:\Program Files\Toolbar888\ToolBar888.dll (file missing)

O4 - HKLM\..\Run: [wmplayer] p2pnetworking.exe
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\RunServices: [wmplayer] p2pnetworking.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe

Close all open browsers/windows and click Fix Checked. Close Hijack This.

Restart the PC in safe mode as has been explained above.

Once in safe mode open Pocket Killbox by double clicking it.

Put a check (tick) by "Standard File Kill".
In the "Full path to delete" box, copy and paste each of the following lines one at a time:

C:\Program Files\Toolbar888
C:\Program Files\Network
C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe
C:\Windows\prefetch\p2pnetworking.exe-2D7BE74F.pf

Click on the button that has the red circle with the X in the middle after you enter each file. The program will ask for confirmation to delete the file. Click Yes. Continue until you have done each file one at a time. Killbox may tell you that a file doesn't exist. If it does, just continue to the next.

Next while still using Killbox go to tools---->delete temp files.
In the window that pops up, put a check by ALL the options there except these three:

XP Prefetch
Recent
History

Now click the Delete Selected Temp Files button.
Exit Killbox.

Finally go to Start---->Control Panel---->Internet Options. On the "general" tab under "temporary internet files" click "delete files". Put a check by "delete offline content" and click OK. Click on the "Programs" tab then click the "Reset Web Settings" button. Click "Apply" then click OK.

Empty the recycle bin.

While in safe mode use Windows Explorer to search for and delete the following (note that they may not exist. Also make certain to look for hidden files and folders):

C:\Program Files\Toolbar888<----This folder.
C:\Program Files\Network<----This folder.
C:\Program Files\Common Files\Windows\mc-110-12-0000140.exe<----This file.
C:\Windows\prefetch\p2pnetworking.exe-2D7BE74F.pf<----This file.

Next run a full scan with Ad-Aware and Spybot in safe mode. Allow the programs to delete whatever they find.

Finally after all this reboot into normal mode and post a fresh Hijack This log.
:)

[theartknife]

okay, done and done (just as it's beginning to get light)
HJT report as follows

thanks

*********************************

Logfile of HijackThis v1.99.1
Scan saved at 05:51:24, on 24/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\xx\Desktop\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[skywalker45]

Whew! Congratulations. The log looks clean. Are you having any more problems? Please let me know.

[theartknife]

everything seems to be working fine. Thanks so much for all your help, i really appreciate it.

[skywalker45]

No problem, you're welcome. I'll close this thread now. If you need it re-opened just PM me or one of the other moderators and we'll open it for you.