Help with virus

Comments

• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Please go to Jotti's and have this file scanned. Post the results back here.
  
  hqax.hta
  
  It is in your 'all users' folder.
  
  Go to your Control Panel and locate the Sun Java icon and double click on it. Locate the 'cache' and delete the contents.
  That should remove those problems.

  0
• ourkid

  November 2005 edited November 2005

  Hi, thanks for your reply
  
  I have submitted the file to Jotti's and had it scanned
  
  File: hqax.hta
  Status: OK
  MD5 1038f182dd9ce2cc52ae016bf4605b51
  Packers detected: -
  
  
  AntiVir Found nothing
  ArcaVir Found nothing
  Avast Found nothing
  AVG Antivirus Found nothing
  BitDefender Found nothing
  ClamAV Found nothing
  Dr.Web Found nothing
  F-Prot Antivirus Found nothing
  Fortinet Found nothing
  Kaspersky Anti-Virus Found nothing
  NOD32 Found nothing
  Norman Virus Control Found nothing
  UNA Found nothing
  VBA32 Found nothing
  
  
  When clicking on the Sun Java icon within my Control Panel i am told 'The system cannot find the file specified'. Does this mean I do not have Java installed and need to install it?
  
  Thanks

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  According to your previous post, it is installed.
  
  C:\Documents and Settings\Dom\Application Data\Sun\Java\Deployment\cache
  
  Check in your add/remove programs to see if it's there.

  0
• ourkid

  November 2005 edited November 2005

  I have cleared the Java Cache and my Virus scan now comes back clean
  
  However I am still unable to remove the flashing advert for Spyware from my desktop. I cannot remove it as it is not vivible within the desktop settings
  
  Any ideas would be appreciated

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Please download the trial version of Ewido Security Suite here:
  http://www.ewido.net/en/download/
  Install it, and update the definitions to the newest files. Do NOT run a scan yet.
  Next, please reboot your computer in Safe Mode by doing the following:
  1) Restart your computer
  2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3) Instead of Windows loading as normal, a menu should appear
  4) Select the first option, to run Windows in Safe Mode.
  
  For additional help in booting into Safe Mode, see the following site:
  http://www.pchell.com/support/safemode.shtml
  
  Once in Safe Mode, please run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.
  
  Save the logfile from the scan. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

  0
• ourkid

  November 2005 edited November 2005

  Hi
  
  I have followed the steps as above however the flashing advert was still on my desktop
  
  However I have managed to remove it by selecting Desktop / Customise Desktop / Web and then removing the entry in the Web Pages list..sorry if this was an obvious place to look!
  
  So I now appear to have resolved that issue, however I would appreciate it if you could take a look at the Ewido security logs and the new Hijack this log to see if any other issues are apparent
  

  ---

  ewido security suite - Scan report

  ---

  
  + Created on: 17:25:56, 10/11/2005
  + Report-Checksum: 170A16E
  
  + Scan result:
  
  C:\WINDOWS\system32:itaa.dll -> TrojanDownloader.Small.azk : Ignored
  C:\Documents and Settings\Dom\Cookies\dom@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@ehg-magicalia.hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@ehg-rodale.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@servedby.advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
  C:\Documents and Settings\Dom\Local Settings\Temp\AF.tmp -> TrojanDownloader.WinShow.ay : Cleaned with backup
  C:\Documents and Settings\Dom\Local Settings\Temp\b.exe -> Not-A-Virus.Hoax.Renos.n : Cleaned with backup
  C:\Documents and Settings\Dom\Local Settings\Temp\c.exe -> Dialer.Generic : Cleaned with backup
  C:\Documents and Settings\Dom\Local Settings\Temp\p.exe -> Spyware.Raze : Cleaned with backup
  C:\Documents and Settings\Dom\Local Settings\Temp\t.exe -> Not-A-Virus.Hoax.Renos.n : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@112.2o7[2].txt[/email] -> Spyware.Cookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@122.2o7[1].txt[/email] -> Spyware.Cookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@ad.yieldmanager[2].txt[/email] -> Spyware.Cookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@adopt.euroclick[2].txt[/email] -> Spyware.Cookie.Euroclick : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@adopt.specificclick[1].txt[/email] -> Spyware.Cookie.Specificclick : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@adorigin[2].txt[/email] -> Spyware.Cookie.Adorigin : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@bigpond.122.2o7[1].txt[/email] -> Spyware.Cookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@burstnet[1].txt[/email] -> Spyware.Cookie.Burstnet : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@com[2].txt[/email] -> Spyware.Cookie.Com : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfk4kic5alo.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfk4kod5gdq.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfk4updzmgo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkiaocpmgo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkiohcpkfp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkiuoc5seq.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkoahc5iap.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkokhdpkfp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkokmd5iko.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkoohc5kfo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkowldpobp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkycidpslq.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfkycoc5cap.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfl4kjcjclp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfl4qkczkcp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfliglcpabo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfliohajcbo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wflockcjofp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfloencjwfo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfloggajwlo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wflosiajolo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wflyqicpmhq.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfmiald5kep.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfmisnc5olo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfmykncjkko.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wfmysoc5iap.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wgkiqhd5wep.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wgkyalczwao.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjk4okcjchp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjl4glczkco.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlickd5ihp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlisgdzmbo.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjloejcpmap.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlosgczmkp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlosoazwao.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlyapdzcho.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlysjczshp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjlyugdjgbp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjmield5mfo.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjmyslajocp.stats.esomniture[2].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@e-2dj6wjmyuhcpsfp.stats.esomniture[1].txt[/email] -> Spyware.Cookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@image.masterstats[1].txt[/email] -> Spyware.Cookie.Masterstats : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@paypopup[2].txt[/email] -> Spyware.Cookie.Paypopup : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@rotator.adjuggler[1].txt[/email] -> Spyware.Cookie.Adjuggler : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@serving-sys[1].txt[/email] -> Spyware.Cookie.Serving-sys : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temp\Cookies\team [email]gaz@ad.yieldmanager[2].txt[/email] -> Spyware.Cookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temp\Cookies\team [email]gaz@adopt.euroclick[2].txt[/email] -> Spyware.Cookie.Euroclick : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temp\Cookies\team [email]gaz@burstnet[2].txt[/email] -> Spyware.Cookie.Burstnet : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temp\Cookies\team [email]gaz@com[2].txt[/email] -> Spyware.Cookie.Com : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temp\t.exe -> Not-A-Virus.Hoax.Renos.n : Cleaned with backup
  C:\WINDOWS\Q329170.log:kpobqm -> TrojanDownloader.Agent.bq : Cleaned with backup
  C:\WINDOWS\Rhododendron.bmp:ysnrce -> Spyware.SearchPage : Cleaned with backup
  C:\WINDOWS\_vol.img:cxsfgf -> TrojanDownloader.Agent.bc : Cleaned with backup
  
  
  ::Report End
  
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 17:39:50, on 10/11/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\ATKKBService.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\Program Files\ewido\security suite\ewidoguard.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\wbem\wmiprvse.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\a2\a2guard.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Logitech\SetPoint\KEM.exe
  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\HiJack This\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O4 - HKLM\..\Run: [Anvshell] anvshell.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [LiveNote] livenote.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [Bug Manager] C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: hqax.hta
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
  O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
  O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup145.cab
  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  Many thanks

  0
• Crunchie Mandurah. Western Australia. Member

  November 2005 edited November 2005

  Please read these instructions carefully and print them out! Be sure to follow ALL instructions!
  
  Download smitRem.zip and save the file to your desktop.
  Right click on the file and extract it to it's own folder on the desktop.
  
  Place a shortcut to Panda ActiveScan on your desktop.
  
  If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
  Ad-Aware SE Setup
  Don't run it yet!
  
  Next, please reboot your computer in SafeMode by doing the following:

  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.

  
  Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
  Wait for the tool to complete and disk cleanup to finish.
  
  The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
  
  
  Open Ad-aware and do a full scan. Remove all it finds.
  
  
  Run Ewido:

  • Click on scanner
  • Click Complete System Scan and the scan will begin.
  • During the scan it will prompt you to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop

  Close Ewido
  
  Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.
  
  Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!
  Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
  Let us know if any problems persist.
  
  ================
  
  Hope that helps.

  0
• ourkid

  January 2006 edited January 2006

  Apologies for the delay in responding however I have been away from home for a while
  
  I have followed the instructions and here are the results/logs
  
  Logfile of HijackThis v1.99.1
  Scan saved at 03:22:48, on 06/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\ATKKBService.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\wbem\wmiprvse.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\a2\a2guard.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Logitech\SetPoint\KEM.exe
  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
  C:\Program Files\HiJack This\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O4 - HKLM\..\Run: [Anvshell] anvshell.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [LiveNote] livenote.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [Bug Manager] C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: hqax.hta
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
  O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup145.cab
  O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  Panda Active Scan
  
  
  Incident Status Location
  
  Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Dom\Desktop\smitRem\smitRem\Process.exe
  Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Dom\Desktop\smitRem.exe[Process.exe]
  Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@xmts[1].txt[/email]
  
  

  ---

  ewido security suite - Scan report

  ---

  
  + Created on: 02:42:53, 06/01/2006
  + Report-Checksum: A5E6AC27
  
  + Scan result:
  
  C:\Documents and Settings\Dom\Cookies\dom@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Dom\Cookies\dom@adopt.euroclick[1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@ad.yieldmanager[1].txt[/email] -> Spyware.Cookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@adopt.specificclick[2].txt[/email] -> Spyware.Cookie.Specificclick : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@com[2].txt[/email] -> Spyware.Cookie.Com : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Cookies\team [email]gaz@ehg-baa.hitbox[1].txt[/email] -> Spyware.Cookie.Hitbox : Cleaned with backup
  C:\Documents and Settings\Team Gaz\Local Settings\Temporary Internet Files\Content.IE5\3N5BUNZ7\mm[2].js -> Spyware.Chitika : Cleaned with backup
  C:\WINDOWS\system32:itaa.dll -> TrojanDownloader.Small.azk : Cleaned with backup
  
  
  ::Report End
  
  
  
  
  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: 06/01/2006
  The current time is: 0:59:28.51
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  Install.dat
  
  
  ~~~ Favorites ~~~
  
  cars
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  desktop.html
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 768 'explorer.exe'
  Killing PID 768 'explorer.exe'
  
  Starting registry repairs
  
  Deleting files
  
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!
  
  
  I no longer have any problems with the flashing advert on my desktop however could you please advise if you see any issues with any of the logs

  0
• Creature

  January 2006 edited January 2006

  [Forget about it here. I'll start a new thread. Sorry for the inconvenience. I shouldn't have posted it here. Sorry ourkid.

  0
• Crunchie Mandurah. Western Australia. Member

  January 2006 edited January 2006

  Not sure about this one; hqax.hta so can you get it uploaded for a scan if you don't know what it is and then let me know thew results.
  
  http://virusscan.jotti.org/

  0
• ourkid

  January 2006 edited January 2006

  To be honest I have no idea what that file is. I have upload it as requested and the results came back as below.
  
  
  
  File: hqax.hta
  Status: OK
  MD5 1038f182dd9ce2cc52ae016bf4605b51
  Packers detected: -
  Scanner results
  AntiVir Found nothing
  ArcaVir Found nothing
  Avast Found nothing
  AVG Antivirus Found nothing
  BitDefender Found nothing
  ClamAV Found nothing
  Dr.Web Found nothing
  F-Prot Antivirus Found nothing
  Fortinet Found nothing
  Kaspersky Anti-Virus Found nothing
  NOD32 Found nothing
  Norman Virus Control Found nothing
  UNA Found nothing
  VBA32 Found nothing

  0
• Crunchie Mandurah. Western Australia. Member

  January 2006 edited January 2006

  Can you locate it and then right click on it and go to it's Properties and gather all the info available and post it back here please. Things like no manufacturer etc will make it suspect.

  0
• ourkid

  January 2006 edited January 2006

  I have located the file which is at C:\Documents and Settings\All Users\Start Menu\Programs\Startup
  
  When viewing properties i am told:
  
  Type of File: HTML Application
  Opens with Microsoft (R) HTML Application host
  Size 138kb
  
  There is no information at all under the 'General' tab for Title,Subject,Source, Author etc

  0
• Crunchie Mandurah. Western Australia. Member

  January 2006 edited January 2006

  As you know nothing about the file and there is no info on it, I think it would be prudent to remove it . Just right click on the file and select delete.
  Please reboot your PC when done and post a new hijackthis log.

  0
• ourkid

  January 2006 edited January 2006

  I have deleted the file and here is the new Hijack This log
  
  Logfile of HijackThis v1.99.1
  Scan saved at 23:10:11, on 15/01/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Sygate\SPF\smc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\ATKKBService.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\Program Files\ewido\security suite\ewidoctrl.exe
  C:\WINDOWS\system32\nvsvc32.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
  C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GSv2.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\wbem\wmiprvse.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\RUNDLL32.EXE
  C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\a2\a2guard.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Logitech\SetPoint\KEM.exe
  C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\HiJack This\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O4 - HKLM\..\Run: [Anvshell] anvshell.exe
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [LiveNote] livenote.exe
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
  O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [Bug Manager] C:\Program Files\Fitbug Limited\Bug Manager\BugManager.exe
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
  O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup145.cab
  O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  O23 - Service: WUSB54GSv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54GSv2.exe (file missing)

  0
• Crunchie Mandurah. Western Australia. Member

  January 2006 edited January 2006

  Congratulations! Your log looks clean - good work!
  
  ===============
  
  Now that your PC is clean you need to follow these easy steps to keeping it this way:
  
  Secure your Internet Explorer by going here and following the instructions there.
  
  Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.
  
  Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.
  
  Install and keep updated, Ewido anti-malware, Ad-Aware SE and Spybot S&D.
  Run them both on a regular basis, following the manufacturer's recommendations.
  
  Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.
  
  Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.
  
  
  Clear your Temp folders.
  Clear out your Temporary internet files and other temp files.
  Go to Start > Settings > Control Panel >Internet Options.
  Under the General tab click the Delete temporary internet files,
  delete all Offline content as well. Clear out Cookies.
  
  Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.
  
  Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)
  
  C:\Documents and Settings\username\Local Settings\Temp\
  
  In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.
  
  Empty the Recycle Bin.
  
  For XP users.
  After something like this it is a good idea to Flush the Restore Points and start fresh.
  To flush the XP system Restore Points.
  
  Go to Start>Run and type msconfig. Press enter.
  
  When msconfig opens, click the Launch System Restore Button.
  On the next page, click the System Restore Settings link on the left.
  
  Check the box labelled 'Turn off System restore'.
  
  Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.
  
  Note that all previous restore points will be lost.
  
  ===============
  
  If you have any more problems, post back.
  
  -
  
  Happy surfing,
  
  crunchie.

  0