Hijacked\Thrashed & throttled

schimersschimers
edited March 2005 in Spyware & Virus Removal
On 02/11/05 at 6:11 pm I picked up something nasty which left me with windows explorer only. No Internet Explorer; OE; functioning desktop icons; run line; norton antivirus {although I see it running in task manager}; and most important of all - no calendar in system restore. AVG found a few items - only to have them return. Microsoft tech support was useless.

Yesterday I installed Firefox and every program at the Hijack this site. So now I am at least limping along with one leg. Here is a copy of my Hijack this file:

Logfile of HijackThis v1.99.1
Scan saved at 5:42:50 PM, on 2/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ofps.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Data\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.boschimers.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/adobefall03hp
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: icservice - ONTRACK Data International, Inc. - C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Network Security Service (%AF夶À¨) - Unknown owner - C:\WINDOWS\mswc.exe (file missing)

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited February 2005
    Download about:Buster and unzip it to your Desktop. Doubleclick on AboutBuster.exe to run it and then click on Update > Check for Update. If there is an update available, click on 'Download Update and wait while it downloads. Once downloaded, click on Exit.

    When you have done this, boot into Safe Mode (restart your PC and tap F8 as it restarts) and make sure that you can view hidden files and folders.

    Close all open windows and run Hijack This again. Check the below entries and click on Fix Checked.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ecrio.dll/sp.html#28129
    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

    O15 - Trusted Zone: *.05p.com
    O15 - Trusted Zone: *.awmdabest.com
    O15 - Trusted Zone: *.clickspring.net
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.mt-download.com
    O15 - Trusted Zone: *.musicmatch.com
    O15 - Trusted Zone: *.my-internet.info
    O15 - Trusted Zone: *.scoobidoo.com
    O15 - Trusted Zone: *.searchmiracle.com
    O15 - Trusted Zone: *.static.topconverting.com
    O15 - Trusted Zone: *.05p.com (HKLM)
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O15 - Trusted Zone: *.clickspring.net (HKLM)
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted Zone: *.mt-download.com (HKLM)
    O15 - Trusted Zone: *.musicmatch.com (HKLM)
    O15 - Trusted Zone: *.my-internet.info (HKLM)
    O15 - Trusted Zone: *.scoobidoo.com (HKLM)
    O15 - Trusted Zone: *.searchmiracle.com (HKLM)
    O15 - Trusted Zone: *.static.topconverting.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: 206.161.124.130 (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)

    O23 - Service: Network Security Service (�%AF夶À¨) - Unknown owner - C:\WINDOWS\mswc.exe (file missing)

    Close Hijack This and run about:Buster again, click the 'Start' button and then click the 'OK' button. Let it scan (the scan can take some time to complete, so be patient.). Once the first scan has completed, it will ask you if you wish for about:Buster to scan once more. Click Yes and let it scan a second time. Once the second scan has finished, copy and paste the report to Notepad and save it on your drive.

    To copy and paste the report to a log file, select (highlight) all of the text produced by the scan with your mouse, right-click and select 'Copy'.

    Next, launch Notepad (click Start > Run > type notepad.exe and press enter). When the file is open, rightclick and select Paste. Click on File > Save As and save it in C:\ as Log.txt. Copy the log and post it back in this thread when you have rebooted.

    While still in Safe Mode, run a search and make sure that all of the below files in bold have been deleted (if not delete them):

    Reboot, reset your Home Page and run a Housecall scan. It will get rid of any remaining files. Post a new Hijack This log (and your About Buster log).
  • schimersschimers
    edited February 2005
    Thank you for your quick attention Crunchie! However, I had a few problems:

    1) after running Hijack in safe mode quite a few of the entries you had marked did not show up. (but I did "fix checked" to the ones that were;

    2) My Internet Explorer is still hijacked (or corrupted) and will not open any URL (although I can see it trying). I have to use Firefox. Consequently, Housecall will not install Netscape plugins in my Mizolla plugins directory - so I can't use Housecall (nor a number of other internet based scanners)





    scanned at: 11:21:04 AM on: 2/27/2005


    -- Scan 1
    About:Buster Version 4.0
    Reference List : 19

    No ADS found on system
    Removed 2 Random Key Entries
    Attempted Clean Of Temp folder.
    Pages Reset... Done!

    -- Scan 2
    About:Buster Version 4.0
    Reference List : 19

    No ADS found on system
    Attempted Clean Of Temp folder.
    Pages Reset... Done!
  • schimersschimers
    edited February 2005
    I tried everything twice and here are my latest logs. Still can't run housecall even after going to the european site (which also had some Mozilla upload features).


    Logfile of HijackThis v1.99.1
    Scan saved at 1:41:31 PM, on 2/27/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ofps.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\Data\Downloads\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/adobefall03hp
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
    O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.static.topconverting.com
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted Zone: *.static.topconverting.com (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: icservice - ONTRACK Data International, Inc. - C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: Network Security Service (%AF夶À¨) - Unknown owner - C:\WINDOWS\mswc.exe (file missing)



    -- Scan 1
    About:Buster Version 4.0
    Reference List : 23

    No ADS found on system
    Removed 3 Random Key Entries
    Attempted Clean Of Temp folder.
    Pages Reset... Done!

    -- Scan 2
    About:Buster Version 4.0
    Reference List : 23

    No ADS found on system
    Attempted Clean Of Temp folder.
    Pages Reset... Done!




    Scanned at: 11:51:00 AM on: 2/27/2005


    -- Scan 1
    About:Buster Version 4.0
    Reference List : 23

    No ADS found on system
    Removed 5 Random Key Entries
    Attempted Clean Of Temp folder.
    Pages Reset... Done!

    -- Scan 2
    About:Buster Version 4.0
    Reference List : 23

    No ADS found on system
    Attempted Clean Of Temp folder.
    Pages Reset... Done!
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited February 2005
    Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.static.topconverting.com
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted Zone: *.static.topconverting.com (HKLM)

    O23 - Service: Network Security Service (�%AF夶À¨) - Unknown owner - C:\WINDOWS\mswc.exe (file missing)

    Try this scan at Panda and see how that goes.

    The scan here does not require an active X install, but uses java instead.
    http://fr.trendmicro-europe.com/consumer/products/housecall_launch.php

    Go here http://www.billsway.com/vbspage/ and download, unzip and run the Registry Search Tool. Type frame.crazywinnings then static.topconverting in the dialog box. Let it run and after a few minutes, a prompt will appear. Click OK to write the results to Notepad and post them here.
  • schimersschimers
    edited February 2005
    Crunchie: Unfortunately, I have "fixed" the above 015 and 023's a number of times including running HijackThis in safe mode.

    Panda does not work nor does trendmicro (it states I may not have given permission although at the bottom of the error message it does state other reasons it may not run)

    RegSrch.vb will also not run and states:

    ActiveX component can't create object: "Scripting.FileSystemObject"
    Source: Microsoft VBScript runtime error



    other things I have done:

    1) ran CWS shredder which gave the following log:

    **** Run Keys ****

    RUN: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    RUN: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    RUN: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    RUN: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    RUN: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    RUN: [AlcxMonitor] ALCXMNTR.EXE
    RUN: [PS2] C:\WINDOWS\system32\ps2.exe
    RUN: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    RUN: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    RUN: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
    RUN: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
    RUN: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    RUN: [NVIEW] rundll32.exe nview.dll,nViewLoadHook


    **** Browser Helper Objects ****

    BHO: [CNavExtBho Class] C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll


    **** IE Toolbars ****

    TOOLBAR: [&Radio] C:\WINDOWS\System32\msdxm.ocx
    TOOLBAR: [&Radio] C:\WINDOWS\System32\msdxm.ocx
    TOOLBAR: [HP View] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    TOOLBAR: [Norton AntiVirus] C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll


    **** IE Extensions ****



    **** Hosts File Entries ****

    HOSTS: 127.0.0.1 localhost
    HOSTS: 127.0.0.1 localhost


    **** IE Settings ****

    IEBypass: 127.0.0.1;localhost
    Default Page: http://www.google.com
    Default Search: http://www.google.com
    Local Page: C:\WINDOWS\System32\blank.htm
    Search Page: http://www.google.com


    **** IE Context Menu (Right click) ****



    **** Layered Service Providers ****

    LSP: MSAFD Tcpip [TCP/IP]
    LSP: MSAFD Tcpip [UDP/IP]
    LSP: RSVP UDP Service Provider
    LSP: RSVP TCP Service Provider
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{278E7C3B-C9EA-4F82-8792-8E528533EB0F}] SEQPACKET 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{278E7C3B-C9EA-4F82-8792-8E528533EB0F}] DATAGRAM 4
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D3DDC5A-519A-41F9-83BA-561F8451A556}] SEQPACKET 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D3DDC5A-519A-41F9-83BA-561F8451A556}] DATAGRAM 3
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F70979D1-1020-4FE3-B96D-1316A8A5DCE0}] SEQPACKET 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{F70979D1-1020-4FE3-B96D-1316A8A5DCE0}] DATAGRAM 0
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BBE5F2B8-3FC1-48B5-9293-069A8A747AB1}] SEQPACKET 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BBE5F2B8-3FC1-48B5-9293-069A8A747AB1}] DATAGRAM 1
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{44D47DEC-603D-473D-94BB-77D6E6140236}] SEQPACKET 2
    LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{44D47DEC-603D-473D-94BB-77D6E6140236}] DATAGRAM 2


    **** Blocked Control Panel Items ****

    BLOCKED: [ncpa.cpl] No
    BLOCKED: [odbccp32.cpl] No


    **** Downloaded Program Files ****

    DirectAnimation Java Classes [file://C:\WINDOWS\Java\classes\dajava.cab]
    Microsoft XML Parser for Java [file://C:\WINDOWS\Java\classes\xmldso.cab]


    **** Windows Services ****

    [Alerter] %SystemRoot%\System32\svchost.exe -k LocalService
    [ALG] %SystemRoot%\System32\alg.exe
    [AppMgmt] %SystemRoot%\system32\svchost.exe -k netsvcs
    [aspnet_state] %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
    [AudioSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Avg7Alrt] C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    [Avg7UpdSvc] C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    [BITS] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Browser] %SystemRoot%\System32\svchost.exe -k netsvcs
    [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    [ccPwdSvc] "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"
    [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    [CiSvc] %SystemRoot%\system32\cisvc.exe
    [ClipSrv] %SystemRoot%\system32\clipsrv.exe
    [COMSysApp] C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    [CryptSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [Dhcp] %SystemRoot%\System32\svchost.exe -k netsvcs
    [dmadmin] %SystemRoot%\System32\dmadmin.exe /com
    [dmserver] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Dnscache] %SystemRoot%\System32\svchost.exe -k NetworkService
    [ERSvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Eventlog] %SystemRoot%\system32\services.exe
    [EventSystem] C:\WINDOWS\System32\svchost.exe -k netsvcs
    [FastUserSwitchingCompatibility] %SystemRoot%\System32\svchost.exe -k netsvcs
    [helpsvc] %SystemRoot%\System32\svchost.exe -k netsvcs
    [HidServ] %SystemRoot%\System32\svchost.exe -k netsvcs
    [icservice] "C:\Program Files\Ontrack\Internet Cleanup\icserv.exe"
    [ImapiService] C:\WINDOWS\System32\imapi.exe
    [iPodService] C:\Program Files\iPod\bin\iPodService.exe
    [lanmanserver] %SystemRoot%\System32\svchost.exe -k netsvcs
    [lanmanworkstation] %SystemRoot%\System32\svchost.exe -k netsvcs
    [LmHosts] %SystemRoot%\System32\svchost.exe -k LocalService
    [Messenger] %SystemRoot%\System32\svchost.exe -k netsvcs
    [mnmsrvc] C:\WINDOWS\System32\mnmsrvc.exe
    [MSDTC] C:\WINDOWS\System32\msdtc.exe
    [MSIServer] C:\WINDOWS\System32\msiexec.exe /V
    [navapsvc] "C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"
    [NetDDE] %SystemRoot%\system32\netdde.exe
    [NetDDEdsdm] %SystemRoot%\system32\netdde.exe
    [Netlogon] %SystemRoot%\System32\lsass.exe
    [Netman] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Nla] %SystemRoot%\System32\svchost.exe -k netsvcs
    [NProtectService] C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    [NtLmSsp] %SystemRoot%\System32\lsass.exe
    [NtmsSvc] %SystemRoot%\system32\svchost.exe -k netsvcs
    [NVSvc] %SystemRoot%\System32\nvsvc32.exe
    [OmniForm Printer] C:\WINDOWS\System32\ofps.exe
    [PlugPlay] %SystemRoot%\system32\services.exe
    [PolicyAgent] %SystemRoot%\System32\lsass.exe
    [ProtectedStorage] %SystemRoot%\system32\lsass.exe
    [RasAuto] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RasMan] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RDSessMgr] C:\WINDOWS\system32\sessmgr.exe
    [RemoteAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
    [RpcLocator] %SystemRoot%\System32\locator.exe
    [RpcSs] %SystemRoot%\system32\svchost -k rpcss
    [RSVP] %SystemRoot%\System32\rsvp.exe
    [SamSs] %SystemRoot%\system32\lsass.exe
    [SAVScan] C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    [SBService] C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    [SCardDrv] %SystemRoot%\System32\SCardSvr.exe
    [SCardSvr] %SystemRoot%\System32\SCardSvr.exe
    [Schedule] %SystemRoot%\System32\svchost.exe -k netsvcs
    [seclogon] %SystemRoot%\System32\svchost.exe -k netsvcs
    [SENS] %SystemRoot%\system32\svchost.exe -k netsvcs
    [SharedAccess] %SystemRoot%\System32\svchost.exe -k netsvcs
    [ShellHWDetection] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Speed Disk service] C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    [Spooler] %SystemRoot%\system32\spoolsv.exe
    [srservice] %SystemRoot%\System32\svchost.exe -k netsvcs
    [SSDPSRV] %SystemRoot%\System32\svchost.exe -k LocalService
    [stisvc] %SystemRoot%\System32\svchost.exe -k imgsvc
    [SwPrv] C:\WINDOWS\System32\dllhost.exe /Processid:{DBC49D1F-CE2A-4F95-823A-14394866C90F}
    [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    [SymWSC] C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    [SysmonLog] %SystemRoot%\system32\smlogsvc.exe
    [TapiSrv] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TermService] %SystemRoot%\System32\svchost.exe -k netsvcs
    [Themes] %SystemRoot%\System32\svchost.exe -k netsvcs
    [TrkWks] %SystemRoot%\system32\svchost.exe -k netsvcs
    [UMWdf] C:\WINDOWS\System32\wdfmgr.exe
    [uploadmgr] %SystemRoot%\System32\svchost.exe -k netsvcs
    [upnphost] %SystemRoot%\System32\svchost.exe -k LocalService
    [UPS] %SystemRoot%\System32\ups.exe
    [VSS] %SystemRoot%\System32\vssvc.exe
    [W32Time] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WebClient] %SystemRoot%\System32\svchost.exe -k LocalService
    [winmgmt] %systemroot%\system32\svchost.exe -k netsvcs
    [WmdmPmSN] %SystemRoot%\System32\svchost.exe -k netsvcs
    [WmiApSrv] C:\WINDOWS\System32\wbem\wmiapsrv.exe
    [wuauserv] %systemroot%\system32\svchost.exe -k netsvcs
    [WZCSVC] %SystemRoot%\System32\svchost.exe -k netsvcs


    **** Custom IE Search Items ****

    SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
    SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm


    **** Complete IE Options ****

    IEOPT: [NoUpdateCheck]
    IEOPT: [NoJITSetup]
    IEOPT: [Disable Script Debugger] yes
    IEOPT: [Show_ChannelBand] No
    IEOPT: [Anchor Underline] yes
    IEOPT: [Cache_Update_Frequency] Once_Per_Session
    IEOPT: [Display Inline Images] yes
    IEOPT: [Do404Search]
    IEOPT: [Local Page] C:\WINDOWS\System32\blank.htm
    IEOPT: [Save_Session_History_On_Exit] no
    IEOPT: [Show_FullURL] no
    IEOPT: [Show_StatusBar] yes
    IEOPT: [Show_ToolBar] yes
    IEOPT: [Show_URLinStatusBar] yes
    IEOPT: [Show_URLToolBar] yes
    IEOPT: [Start Page] http://www.google.com
    IEOPT: [Use_DlgBox_Colors] yes
    IEOPT: [Search Page] http://www.google.com
    IEOPT: [Window_Placement] ,
    IEOPT: [Use Custom Search URL]
    IEOPT: [FullScreen] no
    IEOPT: [Expand Alt Text] no
    IEOPT: [Move System Caret] no
    IEOPT: [NscSingleExpand]
    IEOPT: [Error Dlg Displayed On Every Error] no
    IEOPT: [NoWebJITSetup]
    IEOPT: [Page_Transitions]
    IEOPT: [FavIntelliMenus] yes
    IEOPT: [Enable Browser Extensions] no
    IEOPT: [UseThemes]
    IEOPT: [Force Offscreen Composition]
    IEOPT: [NotifyDownloadComplete] no
    IEOPT: [AllowWindowReuse]
    IEOPT: [Friendly http errors] yes
    IEOPT: [ShowGoButton] yes
    IEOPT: [SmoothScroll]
    IEOPT: [Enable AutoImageResize] yes
    IEOPT: [Enable_MyPics_Hoverbar] yes
    IEOPT: [Play_Animations] yes
    IEOPT: [Play_Background_Sounds] yes
    IEOPT: [Display Inline Videos] yes
    IEOPT: [Show image placeholders]
    IEOPT: [Print_Background] no
    IEOPT: [Use FormSuggest] yes
    IEOPT: [AddToFavoritesExpanded]
    IEOPT: [Use Search Asst] no
    IEOPT: [FavChevron] NO
    IEOPT: [Save Directory] C:\Documents and Settings\Owner\My Documents\
    IEOPT: [ShowedCheckBrowser] Yes
    IEOPT: [Check_Associations] Yes
    IEOPT: [Default_Page_URL] http://www.google.com
    IEOPT: [Default_Search_URL] http://www.google.com
    IEOPT: [Search Page] http://www.google.com
    IEOPT: [Enable_Disk_Cache] yes
    IEOPT: [Cache_Percent_of_Disk]
    IEOPT: [Delete_Temp_Files_On_Exit] yes
    IEOPT: [Local Page] %SystemRoot%\system32\blank.htm
    IEOPT: [Anchor_Visitation_Horizon]
    IEOPT: [Use_Async_DNS] yes
    IEOPT: [Placeholder_Width]
    IEOPT: [Placeholder_Height]
    IEOPT: [Start Page] http://www.google.com
    IEOPT: [CompanyName] Microsoft Corporation
    IEOPT: [Custom_Key] MICROSO
    IEOPT: [Wizard_Version] 6.00.2800.1017
    IEOPT: [FullScreen] no
    IEOPT: [Use Search Asst] no
    IEOPT: [Check_Associations] yes



    2) I ran adsspy which gave the following log:

    C:\WINDOWS\desktop.ini : ggxhy (99600 bytes)
    C:\WINDOWS\IsUninst.exe : riazu (98926 bytes)
    C:\WINDOWS\orun32.isu : jodov (29256 bytes)
  • schimersschimers
    edited February 2005
    While I Googled "crazywinnings" a search program called Xoftspy 410 came up. It told me that I have another BHO called Net Pal and a high threat called OrbitExplorer and it also didn't like Wild Tangent.

    "OrbitExplorer SOFTWARE\Classes\WTVis.WTVisSender"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "SOFTWARE\Classes\WTVis.WTVisSender.1"/>
    <REGKEY NAME = "OrbitExplorer SOFTWARE\Classes\WTVis.WTVisSender.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "typelib\{11066f62-0388-458c-b7e7-47e824894f20}"/>
    <REGKEY NAME = "OrbitExplorer typelib\{11066f62-0388-458c-b7e7-47e824894f20}"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "typelib\{7946205b-fef7-494f-a64b-3e992a780866}"/>
    <REGKEY NAME = "OrbitExplorer typelib\{7946205b-fef7-494f-a64b-3e992a780866}"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "typelib\{b162d478-ef46-4475-b1fe-216bdedb7fad}"/>
    <REGKEY NAME = "OrbitExplorer typelib\{b162d478-ef46-4475-b1fe-216bdedb7fad}"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "typelib\{b7e20302-c22c-4af2-9d75-c3eb6eee9dd8}"/>
    <REGKEY NAME = "OrbitExplorer typelib\{b7e20302-c22c-4af2-9d75-c3eb6eee9dd8}"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}"/>
    <REGKEY NAME = "OrbitExplorer typelib\{fa13aa2e-ca9b-11d2-9780-00104b242ea3}"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "wdmhhost.wthoster"/>
    <REGKEY NAME = "OrbitExplorer wdmhhost.wthoster"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "WDMHHost.WTHoster.1"/>
    <REGKEY NAME = "OrbitExplorer WDMHHost.WTHoster.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "WT.WTMultiplayer"/>
    <REGKEY NAME = "OrbitExplorer WT.WTMultiplayer"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "WT.WTMultiplayer.1"/>
    <REGKEY NAME = "OrbitExplorer WT.WTMultiplayer.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "WT3D.WT"/>
    <REGKEY NAME = "OrbitExplorer WT3D.WT"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "WT3D.WT.1"/>
    <REGKEY NAME = "OrbitExplorer WT3D.WT.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "Wtdmmpv.WTDMMPVersion"/>
    <REGKEY NAME = "OrbitExplorer Wtdmmpv.WTDMMPVersion"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "Wtdmmpv.WTDMMPVersion.1"/>
    <REGKEY NAME = "OrbitExplorer Wtdmmpv.WTDMMPVersion.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "wtvis.wtvisreceiver"/>
    <REGKEY NAME = "OrbitExplorer wtvis.wtvisreceiver"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "wtvis.wtvisreceiver.1"/>
    <REGKEY NAME = "OrbitExplorer wtvis.wtvisreceiver.1"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "wtvis.wtvissender"/>
    <REGKEY NAME = "OrbitExplorer wtvis.wtvissender"/>
    </SW>
    <SW NAME = "OrbitExplorer">
    <REGKEYFOUND NAME = "wtvis.wtvissender.1"/>
    <REGKEY NAME = "OrbitExplorer wtvis.wtvissender.1
  • schimersschimers
    edited February 2005
    I found frame crazywinnings and static.topconverting in my registry at Hkey users\HKEY_USERS\S-1-5-21-688697832-414328176-144519411-1003\software\microsoft\windows\zonemaps\domains

    does this help?
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited February 2005
    Your last post helps, but the rest is French to me :). Do the following to get rid of the 015 entries;

    First, Disconnect from the Internet!!

    (Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)
    ____
    Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
    Save in: Desktop
    File Name: fixme.reg
    Save as Type: All files
    Click: Save

    REGEDIT4

    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

    [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]

    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]

    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]

    Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.

    Note that since the Domains are deleted SpywareBlaster protection must be re-enabled. Spybot's Immunize feature must be used again, also have to re-install IE-SpyAd if installed.

    Go to Start>Run and type regedit.

    Press enter.

    Navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Network Security Service

    If Network Security Service exists , right click on it and choose delete from the menu.

    Now navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Network Security Service

    If LEGACY_Network Security Service exists then right click on it and choose delete from the menu.

    If you have trouble deleting a key. Then click once on the key name to highlight it and click on the Permission menu option under Security or Edit. Then Uncheck "Allow inheritible permissions" and press copy. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.
  • schimersschimers
    edited March 2005
    There were no Network Security Services. But I still have the 015's (although less of them);

    Logfile of HijackThis v1.99.1
    Scan saved at 6:41:46 PM, on 3/1/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ofps.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Data\Downloads\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/adobefall03hp
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: 64.91.255.87 www.dcsresearch.com
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.static.topconverting.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: icservice - ONTRACK Data International, Inc. - C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited March 2005
    It is probable that Spybot's Tea-Timer is preventing the fix of those 015's. Please do the same again, but this time disable the Tea-Timer. That fix has never failed to work before, so I suspect it is Spybot :).
  • schimersschimers
    edited March 2005
    Hi Crunchie:

    I stopped tea-timer in task manager; ran fixme.reg; aand then ran Hijack this again but those darn stubborn 015's just won't take the hint to leave!:

    Logfile of HijackThis v1.99.1
    Scan saved at 8:50:34 PM, on 3/3/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ofps.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\hp\drivers\keyboard\PS2.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Data\Downloads\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/adobefall03hp
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: 64.91.255.87 www.dcsresearch.com
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [PS2] C:\hp\drivers\keyboard\PS2.EXE
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.static.topconverting.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: icservice - ONTRACK Data International, Inc. - C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited March 2005
    Download the zip file and unzip fixme.reg. Close all browser windows. Double click to run it and when asked if you want to merge with your registry, answer yes.
  • schimersschimers
    edited March 2005
    Crunchie;

    It appears that you have led me to sucess! I thank you greatly for your help which was beyond the call of duty.

    Bo Schimers


    Logfile of HijackThis v1.99.1
    Scan saved at 8:33:06 PM, on 3/5/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    C:\WINDOWS\ALCXMNTR.EXE
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ofps.exe
    C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\Data\Downloads\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/go/adobefall03hp
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
    O1 - Hosts: 64.91.255.87 www.dcsresearch.com
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    O4 - HKLM\..\Run: [QD FastAndSafe] C:\Program Files\Norton SystemWorks\Norton CleanSweep\QDCSFS.exe /scheduler
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: icservice - ONTRACK Data International, Inc. - C:\Program Files\Ontrack\Internet Cleanup\icserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited March 2005
    Looking good :D. You are welcome.
Sign In or Register to comment.