Pop-Up Hell!! Done everything I can do and still having problems

Unknown
edited March 2005 in Spyware & Virus Removal
I have been experiencing popups for over 2 weeks now and have done everything I can think of. I have run dozens of spyware and adware programs to locate and delete the problems including the two offered here SpyBot S&D and AdAware. I am still getting pop-ups and occasionaly requests to load FlashTalk which I have X'd out of every time. The pop-ups even occur when my computer is not connected to the internet and get worse when I am on. It is interfering with my computer severly. I have clicke out of over a dozen pop-ups just typing this message. Here is my latest Hijack This log. Can someone identify what I need to get rid of to fix the problem and go back to a normal computing experience? :) Thank you for your time and help.

Logfile of HijackThis v1.99.1
Scan saved at 12:24:14 AM, on 3/25/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\luihkl\cocenjm.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\WINNT\System32\uitkvqxx\uhwrfx.exe
C:\Program Files\Canon\MultiPASS\mpservic.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MultiPASS\monitr32.exe
C:\Program Files\Canon\MultiPASS\MPTBox.exe
C:\WINNT\System32\RUNDLL32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\System32\imantf.exe
C:\WINNT\System32\FxRedir.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\mpyusq\gogwd.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINNT\System32\iepverquery.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINNT\System32\mpyusq\gogwd.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\System32\cbbxmvkg\jghs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\Documents and Settings\Robert\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://targetclicks.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaciSoft] C:\WINNT\System32\pacis.exe
O4 - HKLM\..\Run: [73nX33Q] imantf.exe
O4 - HKLM\..\Run: [yhlghy] C:\WINNT\System32\ivor\yhlghy.exe
O4 - HKLM\..\Run: [vdscqxxj] C:\WINNT\System32\hccvh\vdscqxxj.exe
O4 - HKLM\..\Run: [tcdftpi] C:\WINNT\System32\txxh\tcdftpi.exe
O4 - HKLM\..\Run: [vxisiech] C:\WINNT\System32\mowvb\vxisiech.exe
O4 - HKLM\..\Run: [sxjkx] C:\WINNT\System32\rctii\sxjkx.exe
O4 - HKLM\..\Run: [gogwd] C:\WINNT\System32\mpyusq\gogwd.exe
O4 - HKLM\..\Run: [jghs] C:\WINNT\System32\cbbxmvkg\jghs.exe
O4 - HKLM\..\Run: [etbrun] C:\winnt\system32\eliteuhe32.exe
O4 - HKLM\..\Run: [xjtqb] C:\WINNT\System32\grrnn\xjtqb.exe
O4 - HKLM\..\Run: [omdh] C:\WINNT\System32\oekka\omdh.exe
O4 - HKLM\..\Run: [rmlwwog] C:\WINNT\System32\abajnl\rmlwwog.exe
O4 - HKLM\..\Run: [uhwrfx] C:\WINNT\System32\uitkvqxx\uhwrfx.exe
O4 - HKLM\..\Run: [cocenjm] C:\WINNT\System32\luihkl\cocenjm.exe
O4 - HKLM\..\Run: [Media Access] C:\WINNT\System32\MediaAccK.exe
O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe
O4 - HKCU\..\Run: [M047RTcqh] iepverquery.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A6542C2-96D8-42EC-86FA-5B9F68925A1A}: NameServer = 69.50.188.180,195.225.176.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
O17 - HKLM\System\CS2\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: cocenjmluihkl - Unknown owner - C:\WINNT\System32\luihkl\cocenjm.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: gogwdmpyusq - Unknown owner - C:\WINNT\System32\mpyusq\gogwd.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jghscbbxmvkg - Unknown owner - C:\WINNT\System32\cbbxmvkg\jghs.exe
O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: omdhoekka - Unknown owner - C:\WINNT\System32\oekka\omdh.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: uhwrfxuitkvqxx - Unknown owner - C:\WINNT\System32\uitkvqxx\uhwrfx.exe
O23 - Service: vdscqxxjhccvh - Unknown owner - C:\WINNT\System32\hccvh\vdscqxxj.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: vxisiechmowvb - Unknown owner - C:\WINNT\System32\mowvb\vxisiech.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    Please download CWShredder but don't run it yet.
    http://cwshredder.net/bin/CWSInstall.exe


    Download Ad-aware SE from: http://www.majorgeeks.com/download506.html

    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://targetclicks.net/srch.php?qq=%s
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [PaciSoft] C:\WINNT\System32\pacis.exe
    O4 - HKLM\..\Run: [73nX33Q] imantf.exe
    O4 - HKLM\..\Run: [yhlghy] C:\WINNT\System32\ivor\yhlghy.exe
    O4 - HKLM\..\Run: [vdscqxxj] C:\WINNT\System32\hccvh\vdscqxxj.exe
    O4 - HKLM\..\Run: [tcdftpi] C:\WINNT\System32\txxh\tcdftpi.exe
    O4 - HKLM\..\Run: [vxisiech] C:\WINNT\System32\mowvb\vxisiech.exe
    O4 - HKLM\..\Run: [sxjkx] C:\WINNT\System32\rctii\sxjkx.exe
    O4 - HKLM\..\Run: [gogwd] C:\WINNT\System32\mpyusq\gogwd.exe
    O4 - HKLM\..\Run: [jghs] C:\WINNT\System32\cbbxmvkg\jghs.exe
    O4 - HKLM\..\Run: [etbrun] C:\winnt\system32\eliteuhe32.exe
    O4 - HKLM\..\Run: [xjtqb] C:\WINNT\System32\grrnn\xjtqb.exe
    O4 - HKLM\..\Run: [omdh] C:\WINNT\System32\oekka\omdh.exe
    O4 - HKLM\..\Run: [rmlwwog] C:\WINNT\System32\abajnl\rmlwwog.exe
    O4 - HKLM\..\Run: [uhwrfx] C:\WINNT\System32\uitkvqxx\uhwrfx.exe
    O4 - HKLM\..\Run: [cocenjm] C:\WINNT\System32\luihkl\cocenjm.exe
    O4 - HKLM\..\Run: [Media Access] C:\WINNT\System32\MediaAccK.exe
    O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe
    O4 - HKCU\..\Run: [M047RTcqh] iepverquery.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8A6542C2-96D8-42EC-86FA-5B9F68925A1A}: NameServer = 69.50.188.180,195.225.176.37
    O17 - HKLM\System\CS1\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
    O17 - HKLM\System\CS2\Services\Tcpip\..\{319AB958-7479-4729-9E01-70963876BE9E}: NameServer = 69.50.188.180,195.225.176.37
    O23 - Service: cocenjmluihkl - Unknown owner - C:\WINNT\System32\luihkl\cocenjm.exe
    O23 - Service: gogwdmpyusq - Unknown owner - C:\WINNT\System32\mpyusq\gogwd.exe
    O23 - Service: jghscbbxmvkg - Unknown owner - C:\WINNT\System32\cbbxmvkg\jghs.exe
    O23 - Service: omdhoekka - Unknown owner - C:\WINNT\System32\oekka\omdh.exe
    O23 - Service: uhwrfxuitkvqxx - Unknown owner - C:\WINNT\System32\uitkvqxx\uhwrfx.exe
    O23 - Service: vdscqxxjhccvh - Unknown owner - C:\WINNT\System32\hccvh\vdscqxxj.exe
    O23 - Service: vxisiechmowvb - Unknown owner - C:\WINNT\System32\mowvb\vxisiech.exe


    Reboot your computer into Safe Mode


    Now run CWShredder, making sure to click "Fix".


    Then delete these files or directories (Do not be concerned if they do not exist)

    C:\WINNT\System32\pacis.exe
    C:\WINNT\System32\imantf.exe
    C:\WINNT\System32\ivor <-- this folder
    C:\WINNT\System32\hccvh <-- this folder
    C:\WINNT\System32\txxh <-- this folder
    C:\WINNT\System32\mowvb <-- this folder
    C:\WINNT\System32\rctii <-- this folder
    C:\WINNT\System32\mpyusq <-- this folder
    C:\WINNT\System32\cbbxmvkg <-- this folder
    C:\winnt\system32\eliteuhe32.exe
    C:\WINNT\System32\grrnn <-- this folder
    C:\WINNT\System32\oekka <-- this folder
    C:\WINNT\System32\abajnl <-- this folder
    C:\WINNT\System32\uitkvqxx <-- this folder
    C:\WINNT\System32\luihkl <-- this folder
    C:\WINNT\System32\MediaAccK.exe
    C:\WINNT\System32\iepverquery.exe
    C:\WINNT\System32\wuam.exe



    Run a full scan with Adaware.

    Reboot your computer to go back to normal mode.


    Please run these two online scans.
    Make sure they are set to clean automatically:

    http://www.bitdefender.com/scan/licence.php

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    If there are files that can not be removed by the scans please include that information in your next post.



    Reboot and post a new hijackthis log.
  • robgmart
    edited March 2005
    Did all the steps as stated and here is the requested information

    No Virus's found by BitDefender


    Panda Active Scan found and did not repair the following

    Incident Status Location

    Possible Virus. No disinfected C:\Documents and Settings\All Users\Documents\install.exe
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temp\-1.exe
    Adware:Adware/Envolo No disinfected C:\Documents and Settings\Eric\Local Settings\Temp\AutoUpdate0\setup.inf
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temp\II79.tmp
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\5ACK24DV\AproposClientInstaller[1].exe
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\WDMRW9YR\AproposClientInstaller[1].exe
    Adware:Adware/WUpd No disinfected C:\Program Files\Media Access\MediaAccess.exe
    Adware:Adware/StartPage.DD No disinfected C:\RECYCLER\S-1-5-21-861567501-682003330-725345543-1004\Dc2.exe
    Spyware:Spyware/BargainBuddy No disinfected C:\RECYCLER\S-1-5-21-861567501-682003330-725345543-1004\Dc3.exe
    Adware:Adware/ISearch No disinfected C:\WINNT\system32\Cache\HLInstaller.exe
    Adware:Adware/ISearch No disinfected C:\WINNT\system32\Cache\MTE1NjE6ODoxMg.exe
    Adware:Adware/nCase No disinfected C:\WINNT\system32\Cache\pop.exe
    Adware:Adware/Startpage.VH No disinfected C:\WINNT\system32\chkntfsfat.exe
    Adware:Adware/StartPage.DD No disinfected C:\WINNT\system32\elitemkw32.exe
    Adware:Adware/ISearch No disinfected C:\WINNT\system32\HyperLinker.exe
    Spyware:Spyware/BargainBuddy No disinfected C:\WINNT\system32\ntio35.exe
    Adware:Adware/Apropos No disinfected C:\WINNT\system32\oakache.exe
    Adware:Adware/WUpd No disinfected C:\WINNT\system32\pop2.exe
    Adware:Adware/nCase No disinfected C:\WINNT\system32\saie1108.exe
    Here is the current HiJack This log

    Logfile of HijackThis v1.99.1
    Scan saved at 4:04:56 AM, on 3/26/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Canon\MultiPASS\monitr32.exe
    C:\Program Files\Canon\MultiPASS\MPTBox.exe
    C:\WINNT\System32\RUNDLL32.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINNT\System32\oakache.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\WINNT\System32\FxRedir.EXE
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    C:\Program Files\Canon\MultiPASS\mpservic.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\MSN\MSNCoreFiles\msn6.exe
    C:\Documents and Settings\Robert\Desktop\HijackThis.exe

    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINNT\Downloaded Program Files\ycomp5_3_16_0.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINNT\Downloaded Program Files\ycomp5_3_16_0.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
    O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [73nX33Q] oakache.exe
    O4 - HKLM\..\Run: [gogwd] C:\WINNT\System32\mpyusq\gogwd.exe
    O4 - HKLM\..\Run: [jghs] C:\WINNT\System32\cbbxmvkg\jghs.exe
    O4 - HKLM\..\Run: [etbrun] C:\winnt\system32\eliteuhe32.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
    O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    O23 - Service: gogwdmpyusq - Unknown owner - C:\WINNT\System32\mpyusq\gogwd.exe (file missing)
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: jghscbbxmvkg - Unknown owner - C:\WINNT\System32\cbbxmvkg\jghs.exe (file missing)
    O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

    Still having Pop-Ups so am ready for the next step in cleaning this mess up. Thank you for helping. It is definitely a learning experience.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    Please download and install CCleaner, but don't run it yet.
    http://www.ccleaner.com/ccdownload.php



    Please disable Spybot's Teatimer before proceeding with this fix.



    Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [73nX33Q] oakache.exe
    O4 - HKLM\..\Run: [gogwd] C:\WINNT\System32\mpyusq\gogwd.exe
    O4 - HKLM\..\Run: [jghs] C:\WINNT\System32\cbbxmvkg\jghs.exe
    O4 - HKLM\..\Run: [etbrun] C:\winnt\system32\eliteuhe32.exe
    O23 - Service: gogwdmpyusq - Unknown owner - C:\WINNT\System32\mpyusq\gogwd.exe (file missing)
    O23 - Service: jghscbbxmvkg - Unknown owner - C:\WINNT\System32\cbbxmvkg\jghs.exe (file missing)



    Reboot your computer into Safe Mode

    Then delete these files or directories (Do not be concerned if they do not exist):

    C:\WINNT\System32\mpyusq <-- this folder
    C:\WINNT\System32\cbbxmvkg <-- this folder
    C:\winnt\system32\eliteuhe32.exe
    C:\WINNT\System32\oakache.exe
    C:\WINNT\system32\Cache\HLInstaller.exe
    C:\WINNT\system32\Cache\MTE1NjE6ODoxMg.exe
    C:\WINNT\system32\Cache\pop.exe
    C:\WINNT\system32\chkntfsfat.exe
    C:\WINNT\system32\elitemkw32.exe
    C:\WINNT\system32\HyperLinker.exe
    C:\WINNT\system32\ntio35.exe
    C:\WINNT\system32\pop2.exe
    C:\WINNT\system32\saie1108.exe
    AUNPS2.DLL
    C:\Program Files\Media Access <-- this folder



    Run CCleaner now.


    Reboot your computer to go back to normal mode.


    Run this virus scan and let me know if there is anything it can't remove.
    http://www.pandasoftware.com/activescan/com/activescan_principal.htm


    Reboot and post a new hijackthis log.
  • robgmart
    edited March 2005
    Buckeye_Sam,

    I just have to say thank you. Things are getting better. Not quite so many pop-ups lately. They are reducing fast.

    Here is the information you were asking about

    My Latest Panda ActiveScan Report

    Incident Status Location

    Spyware:Spyware/BetterInet No disinfected Windows Registry
    Adware:Adware/BookedSpace No disinfected C:\WINNT\bsx32
    Adware:Adware/Apropos No disinfected Windows Registry
    Adware:Adware/IPInsight No disinfected C:\WINNT\farmmext.ini
    Adware:Adware/EliteBar No disinfected C:\WINNT\EliteToolBar
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temp\-1.exe
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temp\II79.tmp
    Adware:Adware/Apropos No disinfected C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\5ACK24DV\AproposClientInstaller[1].exe
    And my lates HiJackThis Report

    Logfile of HijackThis v1.99.1
    Scan saved at 1:52:35 AM, on 3/27/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    C:\Program Files\Canon\MultiPASS\mpservic.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINNT\system32\ZoneLabs\vsmon.exe
    C:\WINNT\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Canon\MultiPASS\monitr32.exe
    C:\Program Files\Canon\MultiPASS\MPTBox.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINNT\System32\FxRedir.EXE
    C:\Program Files\MSN\MSNCoreFiles\msn6.exe
    C:\WINNT\system32\sol.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Robert\Desktop\HijackThis.exe

    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINNT\Downloaded Program Files\ycomp5_3_16_0.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINNT\Downloaded Program Files\ycomp5_3_16_0.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [MP_STATUS_MONITOR] "C:\Program Files\Canon\MultiPASS\monitr32.exe" I
    O4 - HKLM\..\Run: [MPTBox] "C:\Program Files\Canon\MultiPASS\MPTBox.exe"
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
    O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MPService - Canon Information Systems - C:\Program Files\Canon\MultiPASS\mpservic.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

    Hopefully this helps. I have to recommend you guys to anyone who has computer problems. This has been incredible how fast and accurately you have noted the problems and been able to fix them. Thank you again.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited March 2005
    Your log looks clean!

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
  • robgmart
    edited March 2005
    THANK YOU!! THANK YOU!! THANK YOU!! So nice to surf again without spending half my time clicking out of popups. Should be fully protected now but if I have problems again I will be sure to come back here. Again. Thank You!!
This discussion has been closed.