[Solved] HijackThis log

Comments

• justup2002

  May 2006 edited May 2006

  I don't what to sound pushy or anything by replying to my own post but i was reading the forum ediquitte sticky and and it said that if it has been more then three days with no reply that it may have sliped past them and that i should post again saying it has been more then three days so here it is.
  
  Once again thanks in advance for any help

  0
• justup2002

  May 2006 edited May 2006

  Hate to keep doing this but it has been another three days i really need your help if you could please assist me it would be greatly appreciated

  0
• Trogan London, UK

  May 2006 edited May 2006

  Hi justup2002, welcome to Short-Media!
  
  Im sorry for the delay and I appreciate your patience. If you still require help, please post a new HJT log.

  0
• justup2002

  May 2006 edited May 2006

  thank you for you reply here is my new HJT log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 1:04:27 PM, on 5/13/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5346.0005)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\folding\FAH504-Console.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\dvd43\dvd43_tray.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\vsndmi13.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Windows Media Connect 2\WMCCFG.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
  C:\folding\FahCore_82.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 64.190.180.186:8080
  R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
  O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
  O4 - HKLM\..\Run: [sndmi13] C:\WINDOWS\vsndmi13.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link AirPlus USB.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{560A2F18-C077-4D2E-8FD0-951171543427}: NameServer = 192.168.0.1
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O20 - Winlogon Notify: windows - C:\WINDOWS\
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: FAH@C:+Documents and Settings+Hartmann+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Hartmann\Desktop\FAH504-Console.exe (file missing)
  O23 - Service: [email]FAH@C:+folding+FAH504-Console.exe[/email] - Stanford University - C:\folding\FAH504-Console.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

  0
• Trogan London, UK

  May 2006 edited May 2006

  Thanks! Can you do the following please:
  
  Before we begin, we need to disable Windows Defender as it may interfere with the fix:
  
  1) Open Windows Defender.
  2) Click on Tools > General Settings.
  3) Scroll Down and Uncheck Turn on real-time Protection (recommended).
  4) After you uncheck these, click on the Save button and close Windows Defender.
  5) Right click on the Windows Defender icon on the taskbar and select Shutdown Windows Defender.
  
  You can enable Windows Defender once we have finished
  ================================================================
  
  Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
  
  R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
  
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
  
  O20 - Winlogon Notify: windows - C:\WINDOWS\
  
  - Close ALL open windows (especially Internet Explorer!)
  Click Fix Checked
  
  ================================================================
  
  Update your Java.
  Older versions have vulnerabilities that malware can use to infect your system.
  Please follow these steps to remove older version Java components.

  • Close any programmes you may have running, ESPECIALLY your web browser
  • Click Start > Control Panel.
  • Click Add/Remove Programs.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove all versions of Java.
  • Reboot your computer once all Java components are removed.

  Then download the latest version of Java Runtime Environment, and install it to your computer.
  
  ================================================================
  
  Please post a new HJT log.
  

  • Please go to Jotti's malware scan
  • Copy and paste the following file path into the "File to upload & scan" box on the top of the page:
  • C:\WINDOWS\vsndmi13.exe
  • Click on the submit button
  • Please post the results in your next reply.

  0
• justup2002

  May 2006 edited May 2006

  i followed all your instructions ansd ran the scan on the file you requested and nothing was found here is my new HJT log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:33:15 PM, on 5/13/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5346.0005)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\folding\FAH504-Console.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\dvd43\dvd43_tray.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\vsndmi13.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Windows Media Connect 2\WMCCFG.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
  C:\folding\FahCore_82.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 64.190.180.186:8080
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
  O4 - HKLM\..\Run: [sndmi13] C:\WINDOWS\vsndmi13.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link AirPlus USB.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{560A2F18-C077-4D2E-8FD0-951171543427}: NameServer = 192.168.0.1
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: FAH@C:+Documents and Settings+Hartmann+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Hartmann\Desktop\FAH504-Console.exe (file missing)
  O23 - Service: [email]FAH@C:+folding+FAH504-Console.exe[/email] - Stanford University - C:\folding\FAH504-Console.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

  0
• Trogan London, UK

  May 2006 edited May 2006

  Thanks!
  
  I need to see some more info on C:\WINDOWS\vsndmi13.exe.
  
  Start by going to C:\WINDOWS\vsndmi13.exe << If you do not see vsndmi13.exe listed, you may need to view hidden files and folders.
  
  Right click on the file and go to Properties.
  Then go to the Version tab to see what company name it's from:
  
  Please let me know what is found

  0
• justup2002

  May 2006 edited May 2006

  i found the file and went to properties and clicked company name but it was blank

  0
• Trogan London, UK

  May 2006 edited May 2006

  In that case, can you delete the file please.
  
  EDIT: Please post a new HJT log, before deleting.

  0
• justup2002

  May 2006 edited May 2006

  ok here is my new HJT log but when i try to delete the file it says access denied:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 12:17:40 PM, on 5/14/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5346.0005)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\folding\FAH504-Console.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\dvd43\dvd43_tray.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\vsndmi13.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Windows Media Connect 2\WMCCFG.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
  C:\Program Files\AIM\aim.exe
  C:\folding\FahCore_78.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 64.190.180.186:8080
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
  O4 - HKLM\..\Run: [sndmi13] C:\WINDOWS\vsndmi13.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link AirPlus USB.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{560A2F18-C077-4D2E-8FD0-951171543427}: NameServer = 192.168.0.1
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: FAH@C:+Documents and Settings+Hartmann+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Hartmann\Desktop\FAH504-Console.exe (file missing)
  O23 - Service: [email]FAH@C:+folding+FAH504-Console.exe[/email] - Stanford University - C:\folding\FAH504-Console.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

  0
• Trogan London, UK

  May 2006 edited May 2006

  Thanks for posting the log.
  
  Download Ewido Anti-Malware
  

  • Install Ewido
  • When installing the program, under "Additonal Options" uncheck:
    • Install background guard
    • Install scan via context menu
  • Once installed, open Ewido
  • You will need to update Ewido to the latest definition files
    • On the left hand side of the main screen click update.
    • Then click on the Start Update button.
  • The update will start and a progress bar will show the updates being installed.
    • If you are having problems with the updater, you can manually update Ewido » Ewido manual updates.
  • After it has finished, close Ewido.

  
  You may want to print these instructions, as the internet will not be available from now on.
  
  Please reboot your computer in SafeMode by doing the following:

  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.

  
  Once in Safe Mode, do the following:
  
  
  Open HijackThis
  - Click the Do a system scan only button
  - Check the following entries (below)
  
  O4 - HKLM\..\Run: [sndmi13] C:\WINDOWS\vsndmi13.exe
  
  - Close ALL open windows (especially Internet Explorer!)
  Click Fix Checked
  
  
  Find and Delete the following:
  
  C:\WINDOWS\vsndmi13.exe << this file
  
  
  Please open Ewido.

  • Click on scanner
  • Click Complete System Scan. (Please don't use the computer while Ewido is scanning)
  • NOTE: During some scans with Ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If Ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop

  Close Ewido
  
  Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

  0
• justup2002

  May 2006 edited May 2006

  i deleted the file but when i try to run ewido it stops reponding in the middle of the scan and it won't complete

  0
• Trogan London, UK

  May 2006 edited May 2006

  We'll come back to Ewido later.
  
  Can you run this online scan please:
  
  Panda ActiveScan
  
  - Once you are on the Panda site, click the Scan your PC button
  - A new window will open...click the Check Now button
  - Enter your Country
  - Enter your State/Province
  - Enter your e-mail address and click send
  - Select either Home User or Company
  - Click the big Scan Now button
  - If it wants to install an ActiveX component allow it
  - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  - When download is complete, click on Local Disks to start the scan
  - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  
  Post the contents of the Panda scan report, along with a new HijackThis Log
  
  Also, I need to see a different type of log from Hijackthis
  

  • Run Hijackthis.
  • Click on "Open the Misc Tools section".
  • Next click on "Open uninstall manager".
  • Press the button 'save list'. It will open a Notepad file.
  • Place the content of that file here in your in your next post.

  0
• justup2002

  May 2006 edited May 2006

  when i open panda scan i only get as far as where i should click local disks and when i do it says nothing but at the bottom of the window it ssays error on page but here are the two HJT logs you requested:
  
  the first one:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:20:14 PM, on 5/14/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5346.0005)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\folding\FAH504-Console.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\dvd43\dvd43_tray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Windows Media Connect 2\WMCCFG.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\svchost.exe
  C:\folding\FahCore_78.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\AIM\aim.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 64.190.180.186:8080
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link AirPlus USB.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{560A2F18-C077-4D2E-8FD0-951171543427}: NameServer = 192.168.0.1
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: FAH@C:+Documents and Settings+Hartmann+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Hartmann\Desktop\FAH504-Console.exe (file missing)
  O23 - Service: [email]FAH@C:+folding+FAH504-Console.exe[/email] - Stanford University - C:\folding\FAH504-Console.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  
  
  And the other one:
  
  1Click DVD Copy 4.2.9.2
  Ad-Aware SE Personal
  Adobe Bridge 1.0
  Adobe Common File Installer
  Adobe Download Manager 2.0 (Remove Only)
  Adobe Help Center 1.0
  Adobe InDesign CS2 Trial
  Adobe Photoshop CS2
  Adobe Reader 7.0.7
  Adobe Stock Photos 1.0
  AOL Coach Version 1.0(Build:20040229.1 en)
  AOL Instant Messenger
  AOL Uninstaller (Choose which Products to Remove)
  AOLIcon
  ArcSoft Software Suite
  BitComet 0.60
  Creative MediaSource
  Dell Driver Reset Tool
  Dell Media Experience
  Dell Photo Printer 720
  Dell Photo Printer 720 Logger
  Dell Picture Studio v3.0
  Dell Support 5.0.0 (630)
  D-Link AirPlus USB
  DVD43 v3.7.0
  EPSON Copy Utility
  EPSON Photo Print
  EPSON Scanner Reference Guide
  EPSON Smart Panel
  EPSON TWAIN 5
  ewido anti-malware
  HighMAT Extension to Microsoft Windows XP CD Writing Wizard
  Hijackthis 1.99.1
  HijackThis 1.99.1
  Hotfix for Windows XP (KB915865)
  Intel(R) 537EP V9x DF PCI Modem
  Intel(R) Extreme Graphics 2 Driver
  Intel(R) PRO Network Adapters and Drivers
  Intel(R) PROSet for Wired Connections
  Internet Explorer 7 Beta 2
  Internet Explorer Default Page
  IrfanView (remove only)
  J2SE Runtime Environment 5.0 Update 6
  Jasc Paint Shop Photo Album
  Jasc Paint Shop Photo Album 5
  Jasc Paint Shop Pro 8 Dell Edition
  Jasc Paint Shop Pro Studio, Dell Editon
  Jasc Paint Shop Pro Studio.01 , Dell Edition 1.0.1.1 Patch
  Kaspersky Anti-Virus Personal
  Kaspersky On-line Scanner
  Macromedia Dreamweaver 8
  Macromedia Extension Manager
  Macromedia Fireworks 8
  Macromedia Flash 8
  Macromedia Flash 8 Video Encoder
  Macromedia Flash Player 8
  Macromedia Flash Player 8
  Macromedia Flash Player 8 Plugin
  Macromedia Shockwave Player
  Mega Pixel Camera (8105 SXGA)
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1
  Microsoft .NET Framework 1.1 Hotfix (KB886903)
  Microsoft .NET Framework 2.0
  Microsoft DirectX Transform optional components
  Microsoft Office Professional Edition 2003
  Microsoft Plus! Digital Media Edition Installer
  Microsoft Plus! Photo Story 2 LE
  Modem Event Monitor
  Modem Helper
  Modem On Hold
  Musicmatch® Jukebox
  My Way Search Assistant
  NAVY FIELD
  Network Play System (Patching)
  NewTek LightWave 3D [8]
  Norton AntiSpam
  Panda ActiveScan
  Photo Click
  PowerDVD 5.5
  QuickBooks Simple Start Special Edition
  QuickTime
  RealPlayer Basic
  RegistryFix v5.5
  Security Update for Step By Step Interactive Training (KB898458)
  Security Update for Windows Media Player (KB911564)
  Security Update for Windows Media Player 10 (KB911565)
  Security Update for Windows XP (KB883939)
  Security Update for Windows XP (KB890046)
  Security Update for Windows XP (KB893756)
  Security Update for Windows XP (KB896358)
  Security Update for Windows XP (KB896422)
  Security Update for Windows XP (KB896423)
  Security Update for Windows XP (KB896424)
  Security Update for Windows XP (KB896428)
  Security Update for Windows XP (KB896688)
  Security Update for Windows XP (KB899587)
  Security Update for Windows XP (KB899588)
  Security Update for Windows XP (KB899591)
  Security Update for Windows XP (KB900725)
  Security Update for Windows XP (KB901017)
  Security Update for Windows XP (KB901190)
  Security Update for Windows XP (KB901214)
  Security Update for Windows XP (KB902400)
  Security Update for Windows XP (KB903235)
  Security Update for Windows XP (KB904706)
  Security Update for Windows XP (KB905414)
  Security Update for Windows XP (KB905749)
  Security Update for Windows XP (KB905915)
  Security Update for Windows XP (KB908519)
  Security Update for Windows XP (KB908531)
  Security Update for Windows XP (KB911562)
  Security Update for Windows XP (KB911567)
  Security Update for Windows XP (KB911927)
  Security Update for Windows XP (KB912812)
  Security Update for Windows XP (KB912919)
  Security Update for Windows XP (KB913446)
  Security Update for Windows XP (KB913580)
  SHOUTcast Source DSP 1.9.0 (remove only)
  Sonic DLA
  Sonic MyDVD LE
  Sonic RecordNow Audio
  Sonic RecordNow Copy
  Sonic RecordNow Data
  Sonic Update Manager
  Sound Blaster Live! 24-bit
  Spybot - Search & Destroy 1.4
  SpywareBlaster v3.5.1
  The Movies(TM)
  The Sims Makin' Magic
  TI Connect 1.6
  Turbo Lister
  Update for Windows XP (KB894391)
  Update for Windows XP (KB896727)
  Update for Windows XP (KB898461)
  Update for Windows XP (KB900485)
  Update for Windows XP (KB904942)
  Update for Windows XP (KB910437)
  Uplink
  Viewpoint Media Player
  Windows Defender
  Windows Defender Signatures
  Windows Installer 3.1 (KB893803)
  Windows Media Connect
  Windows Media Format Runtime
  Windows Media Player 10
  Windows Media Player 10
  Windows XP Hotfix - KB867282
  Windows XP Hotfix - KB873333
  Windows XP Hotfix - KB885836
  Windows XP Hotfix - KB886185
  Windows XP Hotfix - KB887742
  Windows XP Hotfix - KB888302
  Windows XP Hotfix - KB890859
  Windows XP Hotfix - KB890923
  Windows XP Hotfix - KB893066
  Windows XP Hotfix - KB893086
  WinRAR archiver
  WordPerfect Office 12
  Yahoo! Anti-Spy
  Yahoo! Install Manager
  Yahoo! Toolbar 6.0 Beta with My Web
  ZoneAlarm

  0
• Trogan London, UK

  May 2006 edited May 2006

  Click Start > Run and type in appwiz.cpl and hit enter. From the list uninstall:
  
  My Way Search Assistant
  
  
  Apart from that, your HJT log is clean. How is the computer?

  0
• justup2002

  May 2006 edited May 2006

  i tried to unistall myway but i get this:
  

  0
• Trogan London, UK

  May 2006 edited May 2006

  Delete the file "desrcas.dll" and try again.
  
  If that doesn't work, try in Safe Mode.

  0
• justup2002

  May 2006 edited May 2006

  i went there but desrcas.dll doesnt exist in fact the whole mywaysa folder is empty except for other empty folders

  0
• Trogan London, UK

  May 2006 edited May 2006

  Try this:
  

  • Run Hijackthis.
  • Click on "Open the Misc Tools section".
  • Next click on "Open uninstall manager".
  • Find My Way Search Assistant.
  • Click on Delete this entry

  Next, delete the MyWaySA folder.
  
  Let me know how it goes.

  0
• justup2002

  May 2006 edited May 2006

  ok i deleted the folder and the uninstall entry

  0
• Trogan London, UK

  May 2006 edited May 2006

  How is the computer running?

  0
• justup2002

  May 2006 edited May 2006

  it seems to be running a lot better excluding the problems i was having trying to fix other problems

  0
• Trogan London, UK

  May 2006 edited May 2006

  OK Cool!
  
  What other problems are you still having?

  0
• justup2002

  May 2006 edited May 2006

  alright thanks for you help

  0
• Trogan London, UK

  May 2006 edited May 2006

  Just before we finish, can you try running Ewido once more please? You can run it in Normal mode if you want; just don't use the computer while it is scanning.

  0
• justup2002

  May 2006 edited May 2006

  i successfully completed an ewido scan here is the log if you want:
  

  ---

  ewido anti-malware - Scan report

  ---

  
  + Created on: 3:18:37 PM, 5/15/2006
  + Report-Checksum: 7AA80735
  
  + Scan result:
  
  C:\Documents and Settings\Hartmann\Cookies\hartmann@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@com[2].txt -> TrackingCookie.Com : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@e-2dj6wfloqodzmeq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@e-2dj6wgkoqkajwfo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@e-2dj6wjkykhdpsbo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@e-2dj6wjnyamczeap.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
  C:\Documents and Settings\Hartmann\Cookies\hartmann@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@ad1.clickhype[1].txt -> TrackingCookie.Clickhype : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@com[1].txt -> TrackingCookie.Com : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@data4.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wfk4emajcbq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wfkieidjclq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wflowhd5idp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wfmigicjefo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wgkiajcjmao.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wgkosnajmbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wgmygpcpcap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@e-2dj6wjliqmazmap.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@entrepreneur.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@news.com[1].txt -> TrackingCookie.Com : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Cookies\hartmann@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Rar$EX00.406\RegistryFix.v5.5.Incl.Keymaker-EMBRACE\keygen.exe -> Heuristic.Win32.Morphine-Crypted : Cleaned with backup
  C:\Documents and Settings\Hartmann\Local Settings\Temp\Rar$EX01.593\RegistryFix.v5.5.Incl.Keymaker-EMBRACE\keygen.exe -> Heuristic.Win32.Morphine-Crypted : Cleaned with backup
  C:\Program Files\Microsoft AntiSpyware\Quarantine\EC98A914-61BE-4D69-84C3-4A937C\1DE2F52C-C2A6-41CE-9CF2-4BF8CD -> Not-A-Virus.NetTool.Win32.ICQMonitor.11 : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq12.tmp -> TrackingCookie.Casalemedia : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq13.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq14.tmp -> TrackingCookie.Hotlog : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq180.tmp -> TrackingCookie.Advertising : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq181.tmp -> TrackingCookie.Bluestreak : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq182.tmp -> TrackingCookie.Clickbank : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq188.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18B.tmp -> TrackingCookie.Advertising : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18C.tmp -> TrackingCookie.Spylog : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18D.tmp -> TrackingCookie.Onestat : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq18E.tmp -> TrackingCookie.Adserver : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq26F.tmp -> TrackingCookie.Bfast : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq270.tmp -> TrackingCookie.Doubleclick : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq271.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7A.tmp -> TrackingCookie.2o7 : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7C.tmp -> TrackingCookie.Advertising : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7D.tmp -> TrackingCookie.Falkag : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7E.tmp -> TrackingCookie.Atdmt : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7F.tmp -> TrackingCookie.Bfast : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq81.tmp -> TrackingCookie.Burstnet : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq82.tmp -> TrackingCookie.Casalemedia : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq83.tmp -> TrackingCookie.Centrport : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq84.tmp -> TrackingCookie.Bridgetrack : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq86.tmp -> TrackingCookie.Com : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq87.tmp -> TrackingCookie.Coremetrics : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq88.tmp -> TrackingCookie.Doubleclick : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq89.tmp -> TrackingCookie.Ru4 : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8A.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8B.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8D.tmp -> TrackingCookie.Fastclick : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq8F.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq90.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq91.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq93.tmp -> TrackingCookie.Mediaplex : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq94.tmp -> TrackingCookie.Questionmarket : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq96.tmp -> TrackingCookie.Revenue : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq97.tmp -> TrackingCookie.Serving-sys : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq98.tmp -> TrackingCookie.Tradedoubler : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq99.tmp -> TrackingCookie.Trafficmp : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9A.tmp -> TrackingCookie.Tribalfusion : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9B.tmp -> TrackingCookie.Valueclick : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9C.tmp -> TrackingCookie.Webtrendslive : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9D.tmp -> TrackingCookie.Adserver : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq9E.tmp -> TrackingCookie.Zedo : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqC8.tmp -> TrackingCookie.247realmedia : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCA.tmp -> TrackingCookie.Adtech : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCB.tmp -> TrackingCookie.Bluestreak : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCC.tmp -> TrackingCookie.Serving-sys : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCD.tmp -> TrackingCookie.Burstnet : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqCE.tmp -> TrackingCookie.Bridgetrack : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD0.tmp -> TrackingCookie.Pro-market : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD2.tmp -> TrackingCookie.Ru4 : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD4.tmp -> TrackingCookie.Falkag : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD5.tmp -> TrackingCookie.Fastclick : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD6.tmp -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD8.tmp -> TrackingCookie.Hitslink : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqD9.tmp -> TrackingCookie.Hotlog : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDA.tmp -> TrackingCookie.Linksynergy : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDC.tmp -> TrackingCookie.Mediaplex : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqDF.tmp -> TrackingCookie.Questionmarket : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE0.tmp -> TrackingCookie.Revenue : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE1.tmp -> TrackingCookie.Spylog : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE2.tmp -> TrackingCookie.Statcounter : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE3.tmp -> TrackingCookie.Tradedoubler : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE4.tmp -> TrackingCookie.Trafficmp : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE6.tmp -> TrackingCookie.Tribalfusion : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE8.tmp -> TrackingCookie.Webtrendslive : Cleaned with backup
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppqE9.tmp -> TrackingCookie.Zedo : Cleaned with backup
  C:\WINDOWS\system32\ddayw.dll -> Adware.Virtumonde : Cleaned with backup
  
  
  ::Report End

  0
• Trogan London, UK

  May 2006 edited May 2006

  Thanks!
  
  Can you post one more HJT log and tell me how the computer is please.

  0
• justup2002

  May 2006 edited May 2006

  computer seems good here is the HJT log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:04:35 PM, on 5/15/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.5346.0005)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Windows Defender\MsMpEng.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\LEXBCES.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\LEXPPS.EXE
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\CTsvcCDA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\folding\FAH504-Console.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\dvd43\dvd43_tray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Windows Media Connect 2\WMCCFG.exe
  C:\WINDOWS\system32\MsPMSPSv.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\AIRPLUS\D-Link AirPlus DWL-120+ Wireless USB Adapter\AIRPLUS.EXE
  C:\folding\FahCore_7a.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 64.190.180.186:8080
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
  O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
  O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
  O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
  O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
  O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: D-Link AirPlus USB.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{560A2F18-C077-4D2E-8FD0-951171543427}: NameServer = 192.168.0.1
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: FAH@C:+Documents and Settings+Hartmann+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Hartmann\Desktop\FAH504-Console.exe (file missing)
  O23 - Service: [email]FAH@C:+folding+FAH504-Console.exe[/email] - Stanford University - C:\folding\FAH504-Console.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Kaspersky Anti-Virus Service (kavsvc) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

  0
• Trogan London, UK

  May 2006 edited May 2006

  Great! Your HJT log is clean aswell.
  
  I'm going to mark this resolved. If you need help again, just start a new thread.
  
  
  Here are some measures you can take to stay more secure online:
  
  Secure your Internet Explorer by going here and following the instructions there.
  
  Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.
  
  Use a firewall to help prevent your PC(s) from being usurped by undesireables. If you don't have a Firewall, then choose one from the list here
  
  Install an Anti-Virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often. If you don't have an Anti-Virus program, choose one from the list here
  
  Install and keep updated, Ad-Aware SE and Spybot Search & Destroy.
  Run them both on a regular basis, following the manufacturer's recommendations.
  
  Install and keep updated, SpywareBlaster and SpywareGuard
  
  Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.
  
  Clear your Temp folders.
  Go to Start > Control Panel > Internet Options.
  Under the General tab click the Delete Files... button; check the Delete all offline content box and press OK. Next, click the Delete Cookies... button and press OK
  
  Go to "Start" -> "Run" and type in the box: "cleanmgr" press OK. Select the drive where your Operating System is installed (Default is C:) and press OK. Let Disk Cleanup scan your system for files to remove (it takes a few minutes!). On the next screen make sure these 3 options are checked and then press "OK" to remove:
  

  • Temporary Files
  • Temporary Internet Files
  • Recycle Bin

  Also, go to Start > Find/Search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.
  
  Empty/delete the entire contents from the following folders:
  
  C:\Windows\temp
  C:\temp <-- if you have one.
  Note: Empty contents but don't delete the folder(s) itself.
  
  Clear out temp files from the following location. Change "username" to whatever you have on your computer.
  
  C:\Documents and Settings\username\Local Settings\Temp\
  
  In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.
  
  Empty the Recycle Bin!
  
  Hide system files
  It is very important that system files and folders are hidden again, so that they DO NOT get deleted by mistake. To hide system files and folders, do the following for your operating system...
  
  Windows XP
  * Click Start.
  * Open My Computer.
  * Select the Tools menu and click Folder Options.
  * Select the View Tab.
  * Under the Hidden files and folders heading, uncheck Do not show hidden files and folders
  * Check the Hide protected operating system files (recommended) option.
  * Click Yes to confirm.
  * Click OK.
  
  
  For XP users.
  After something like this it is a good idea to Flush the Restore Points and start fresh.
  To flush the XP system Restore Points.
  
  Go to Start | Run | type msconfig | Press Enter.
  
  When msconfig opens, click the Launch System Restore Button.
  On the next page, click the System Restore Settings link on the left.
  
  Check the box labelled 'Turn off System restore'.
  
  Reboot! Go back in and Turn System Restore Back on. A new Restore Point will be created automatically.
  
  Note that all previous restore points will be lost.
  
  ===============
  
  If you have any more problems, post back.
  
  
  Please consider joining the Folding@Home Project
  Join our Folding@Home team! Alzheimer's, Parkinson's, cancer... we're trying to cure them with our computers! You've at least read a little about it in the greeting I sent you when you signed up for the site. We're always really pleased to greet new members to the team, and it's a quick way to become an appreciated member of the community.
  MORE INFO: READ THIS

  0