Options
How would I remove the programs "Home Search Assistant" "Search Extender", etc.
Hello all,
I would appreciate any help anyone could give me with regards to some problems I am having with some programs I cannot remove from my computer. The programs I am concerned with are entitled "Home Search Assistant" "Search Extender" and "Shopping Wizard." I have run the newest updates of both Ad Aware and Spybot Search and Destroy, and I am still dealing with these programs. I have run Hijack This and have a log of what was found, which I will post:
Logfile of HijackThis v1.99.1
Scan saved at 5:25:32 PM, on 4/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\ffsqh\clbi.exe
C:\WINDOWS\System32\gcxn\kuuixodp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
C:\WINDOWS\system32\ntoz.exe
c:\windows\system32\gqeqeq.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Ares Lite Edition\Ares.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\sysnj.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\WINDOWS\System32\rasadhlp.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {1B2C2435-BA99-7868-719D-43F24E09EE2C} - C:\WINDOWS\system32\ieza32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [lmwgpr] C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O4 - HKLM\..\Run: [lekcv] C:\WINDOWS\System32\blpgx\lekcv.exe
O4 - HKLM\..\Run: [iosyfub] C:\WINDOWS\System32\rofc\iosyfub.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [vehmijr] C:\WINDOWS\System32\sitrlx\vehmijr.exe
O4 - HKLM\..\Run: [hbudme] C:\WINDOWS\System32\yniuly\hbudme.exe
O4 - HKLM\..\Run: [udvifbkh] C:\WINDOWS\System32\pfha\udvifbkh.exe
O4 - HKLM\..\Run: [vawdbss] C:\WINDOWS\System32\fceeky\vawdbss.exe
O4 - HKLM\..\Run: [rgaoqnh] C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\MIKECO~1\LOCALS~1\Temp\skhnp.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [qfvq] C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O4 - HKLM\..\Run: [hqxrlor] C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O4 - HKLM\..\Run: [bvcu] C:\WINDOWS\System32\skbmgou\bvcu.exe
O4 - HKLM\..\Run: [oomp] C:\WINDOWS\System32\vrqpni\oomp.exe
O4 - HKLM\..\Run: [jedccbrc] C:\WINDOWS\System32\vflq\jedccbrc.exe
O4 - HKLM\..\Run: [ndbieq] C:\WINDOWS\System32\wqamw\ndbieq.exe
O4 - HKLM\..\Run: [nofqmq] C:\WINDOWS\System32\axgt\nofqmq.exe
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [qwibmse] C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [glkxkdi] C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [ntoz.exe] C:\WINDOWS\system32\ntoz.exe
O4 - HKLM\..\Run: [rysiqmg] c:\windows\system32\gqeqeq.exe
O4 - HKLM\..\RunOnce: [ipwa32.exe] C:\WINDOWS\system32\ipwa32.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [sysnj.exe] C:\WINDOWS\sysnj.exe
O4 - HKCU\..\Run: [rasadhlp] C:\WINDOWS\System32\rasadhlp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [AIM] C:\Program Files\AOL Instant Messenger\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SmartEnforcer.lnk = C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AOL Instant Messenger\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: clbiffsqh - Unknown owner - C:\WINDOWS\System32\ffsqh\clbi.exe
O23 - Service: hqxrlorvxrsfmux - Unknown owner - C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kuuixodpgcxn - Unknown owner - C:\WINDOWS\System32\gcxn\kuuixodp.exe
O23 - Service: lekcvblpgx - Unknown owner - C:\WINDOWS\System32\blpgx\lekcv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lmwgprhwfylyfl - Unknown owner - C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O23 - Service: nofqmqaxgt - Unknown owner - C:\WINDOWS\System32\axgt\nofqmq.exe
O23 - Service: oompvrqpni - Unknown owner - C:\WINDOWS\System32\vrqpni\oomp.exe
O23 - Service: qfvqkpjjunvt - Unknown owner - C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O23 - Service: rgaoqnhabaujbt - Unknown owner - C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: udvifbkhpfha - Unknown owner - C:\WINDOWS\System32\pfha\udvifbkh.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
I do not know how these came to be on my computer, but I would appreciate any help anyone can give me as to how I can get them off of it.
Thanks again!
Mike
I would appreciate any help anyone could give me with regards to some problems I am having with some programs I cannot remove from my computer. The programs I am concerned with are entitled "Home Search Assistant" "Search Extender" and "Shopping Wizard." I have run the newest updates of both Ad Aware and Spybot Search and Destroy, and I am still dealing with these programs. I have run Hijack This and have a log of what was found, which I will post:
Logfile of HijackThis v1.99.1
Scan saved at 5:25:32 PM, on 4/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\ffsqh\clbi.exe
C:\WINDOWS\System32\gcxn\kuuixodp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
C:\WINDOWS\system32\ntoz.exe
c:\windows\system32\gqeqeq.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Ares Lite Edition\Ares.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\sysnj.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\WINDOWS\System32\rasadhlp.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {1B2C2435-BA99-7868-719D-43F24E09EE2C} - C:\WINDOWS\system32\ieza32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [lmwgpr] C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O4 - HKLM\..\Run: [lekcv] C:\WINDOWS\System32\blpgx\lekcv.exe
O4 - HKLM\..\Run: [iosyfub] C:\WINDOWS\System32\rofc\iosyfub.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [vehmijr] C:\WINDOWS\System32\sitrlx\vehmijr.exe
O4 - HKLM\..\Run: [hbudme] C:\WINDOWS\System32\yniuly\hbudme.exe
O4 - HKLM\..\Run: [udvifbkh] C:\WINDOWS\System32\pfha\udvifbkh.exe
O4 - HKLM\..\Run: [vawdbss] C:\WINDOWS\System32\fceeky\vawdbss.exe
O4 - HKLM\..\Run: [rgaoqnh] C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\MIKECO~1\LOCALS~1\Temp\skhnp.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [qfvq] C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O4 - HKLM\..\Run: [hqxrlor] C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O4 - HKLM\..\Run: [bvcu] C:\WINDOWS\System32\skbmgou\bvcu.exe
O4 - HKLM\..\Run: [oomp] C:\WINDOWS\System32\vrqpni\oomp.exe
O4 - HKLM\..\Run: [jedccbrc] C:\WINDOWS\System32\vflq\jedccbrc.exe
O4 - HKLM\..\Run: [ndbieq] C:\WINDOWS\System32\wqamw\ndbieq.exe
O4 - HKLM\..\Run: [nofqmq] C:\WINDOWS\System32\axgt\nofqmq.exe
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [qwibmse] C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [glkxkdi] C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [ntoz.exe] C:\WINDOWS\system32\ntoz.exe
O4 - HKLM\..\Run: [rysiqmg] c:\windows\system32\gqeqeq.exe
O4 - HKLM\..\RunOnce: [ipwa32.exe] C:\WINDOWS\system32\ipwa32.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [sysnj.exe] C:\WINDOWS\sysnj.exe
O4 - HKCU\..\Run: [rasadhlp] C:\WINDOWS\System32\rasadhlp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [AIM] C:\Program Files\AOL Instant Messenger\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SmartEnforcer.lnk = C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AOL Instant Messenger\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: clbiffsqh - Unknown owner - C:\WINDOWS\System32\ffsqh\clbi.exe
O23 - Service: hqxrlorvxrsfmux - Unknown owner - C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kuuixodpgcxn - Unknown owner - C:\WINDOWS\System32\gcxn\kuuixodp.exe
O23 - Service: lekcvblpgx - Unknown owner - C:\WINDOWS\System32\blpgx\lekcv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lmwgprhwfylyfl - Unknown owner - C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O23 - Service: nofqmqaxgt - Unknown owner - C:\WINDOWS\System32\axgt\nofqmq.exe
O23 - Service: oompvrqpni - Unknown owner - C:\WINDOWS\System32\vrqpni\oomp.exe
O23 - Service: qfvqkpjjunvt - Unknown owner - C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O23 - Service: rgaoqnhabaujbt - Unknown owner - C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: udvifbkhpfha - Unknown owner - C:\WINDOWS\System32\pfha\udvifbkh.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
I do not know how these came to be on my computer, but I would appreciate any help anyone can give me as to how I can get them off of it.
Thanks again!
Mike
0
Comments
Please follow these steps to remove the HSA from your computer.
Step 1
Download cwsserviceremove.zip and extract it to your desktop:
http://lineofire.geekstogo.com/cwsserviceremove.zip
Step 2
Download this tool called AboutBuster http://www.downloads.subratam.org/AboutBuster.zip
Unzip it to your desktop but don't run it yet.
Step 3
Download Adaware SE Personal from http://www.lavasoft.de/english/default.shtml. Install and open Adaware and click on *Check for Updates Now* and then *Connect*. It will find a new reference-file. Click *ok* and let it download and install the updates by clicking on *Finish* .This will return you to the main screen. Exit Adaware.
Step 4
Print out these instructions so you have them handy as most of the steps need to be done in safe mode and you may not be able to go online.
Step 5
Make sure your PC is configured to show hidden files.
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
Step 6
Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called Remote Procedure Call (RPC) Helper. When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.
Step 7
Reboot to Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. To get back to normal mode just restart the computer as you normally would.
Step 8
Scan with Hijack This and put checks next to all the following, then click "Fix Checked"
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\scdco.dll/sp.html#12047
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {1B2C2435-BA99-7868-719D-43F24E09EE2C} - C:\WINDOWS\system32\ieza32.dll
O4 - HKLM\..\Run: [ntoz.exe] C:\WINDOWS\system32\ntoz.exe
O4 - HKLM\..\RunOnce: [ipwa32.exe] C:\WINDOWS\system32\ipwa32.exe
O4 - HKLM\..\RunOnce: [sysnj.exe] C:\WINDOWS\sysnj.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
and delete the following files if present(do not be concerned if some do not exist).
C:\WINDOWS\system32\ntya.exe
C:\WINDOWS\system32\ipwa32.exe
C:\WINDOWS\system32\ntoz.exe
C:\WINDOWS\system32\scdco.dll
C:\WINDOWS\system32\ieza32.dll
C:\WINDOWS\sysnj.exe
Step 9
Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.
Step 10
Scan with Adaware and let it remove any bad files found.
Step 11
Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
Step 12
Find the cwsserviceremove.reg that you downloaded in Step one. Double click on the cwsserviceemove.reg Answer ‘Yes’ when asked to have its contents added to the Registry.
Step 13
Reboot to normal mode, scan again with Hijack This and post a new log here.
Step 14
Finally, do an online scan at one of the following sites. Let it remove any infected files found.
http://housecall.antivirus.com
or
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Post a fresh HijackThis log and the AboutBuster report back here please.
As for the additional logs, I am posting them now:
Hijack this:
Logfile of HijackThis v1.99.1
Scan saved at 1:10:04 AM, on 4/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\ffsqh\clbi.exe
C:\WINDOWS\System32\gcxn\kuuixodp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ntvi32.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDLL32.EXE
C:\WINDOWS\system32\wineg.exe
C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\picsvr\picsvr.exe
C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
C:\WINDOWS\System32\rasadhlp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
c:\windows\system32\mkggec.exe
C:\Program Files\Ares Lite Edition\Ares.exe
C:\Program Files\AOL Instant Messenger\aim.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\CashBack\bin\cashback.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\WINDOWS\system32\exdl1.exe
C:\WINDOWS\system32\exdl3.exe
C:\DOCUME~1\MIKECO~1\LOCALS~1\Temp\bs523.tmpbsx32\bbi2.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\Documents and Settings\Mike Corart\package_NNSTP5.exe
C:\WINDOWS\exdl.exe
C:\WINDOWS\exdl.exe
C:\WINDOWS\exdl.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {7C1B0897-335B-8C51-83E4-E850E4EF3490} - C:\WINDOWS\crxx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [lmwgpr] C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O4 - HKLM\..\Run: [lekcv] C:\WINDOWS\System32\blpgx\lekcv.exe
O4 - HKLM\..\Run: [iosyfub] C:\WINDOWS\System32\rofc\iosyfub.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [vehmijr] C:\WINDOWS\System32\sitrlx\vehmijr.exe
O4 - HKLM\..\Run: [hbudme] C:\WINDOWS\System32\yniuly\hbudme.exe
O4 - HKLM\..\Run: [udvifbkh] C:\WINDOWS\System32\pfha\udvifbkh.exe
O4 - HKLM\..\Run: [vawdbss] C:\WINDOWS\System32\fceeky\vawdbss.exe
O4 - HKLM\..\Run: [rgaoqnh] C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\MIKECO~1\LOCALS~1\Temp\skhnp.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [qfvq] C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O4 - HKLM\..\Run: [hqxrlor] C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O4 - HKLM\..\Run: [bvcu] C:\WINDOWS\System32\skbmgou\bvcu.exe
O4 - HKLM\..\Run: [oomp] C:\WINDOWS\System32\vrqpni\oomp.exe
O4 - HKLM\..\Run: [jedccbrc] C:\WINDOWS\System32\vflq\jedccbrc.exe
O4 - HKLM\..\Run: [ndbieq] C:\WINDOWS\System32\wqamw\ndbieq.exe
O4 - HKLM\..\Run: [nofqmq] C:\WINDOWS\System32\axgt\nofqmq.exe
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [qwibmse] C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [glkxkdi] C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [wineg.exe] C:\WINDOWS\system32\wineg.exe
O4 - HKLM\..\Run: [xheshwx] c:\windows\system32\mkggec.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\RunOnce: [ntvi32.exe] C:\WINDOWS\ntvi32.exe
O4 - HKCU\..\Run: [rasadhlp] C:\WINDOWS\System32\rasadhlp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [AIM] C:\Program Files\AOL Instant Messenger\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SmartEnforcer.lnk = C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AOL Instant Messenger\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: clbiffsqh - Unknown owner - C:\WINDOWS\System32\ffsqh\clbi.exe
O23 - Service: hqxrlorvxrsfmux - Unknown owner - C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kuuixodpgcxn - Unknown owner - C:\WINDOWS\System32\gcxn\kuuixodp.exe
O23 - Service: lekcvblpgx - Unknown owner - C:\WINDOWS\System32\blpgx\lekcv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: lmwgprhwfylyfl - Unknown owner - C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O23 - Service: nofqmqaxgt - Unknown owner - C:\WINDOWS\System32\axgt\nofqmq.exe
O23 - Service: oompvrqpni - Unknown owner - C:\WINDOWS\System32\vrqpni\oomp.exe
O23 - Service: qfvqkpjjunvt - Unknown owner - C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O23 - Service: rgaoqnhabaujbt - Unknown owner - C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: udvifbkhpfha - Unknown owner - C:\WINDOWS\System32\pfha\udvifbkh.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe
AboutBuster:
Scanned at: 12:26:35 AM on: 4/27/2005
-- Scan 1
About:Buster Version 4.0
Reference List : 19
No ADS found on system
Removed 4 Random Key Entries
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!
-- Scan 2
About:Buster Version 4.0
Reference List : 19
No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!
Thank you for your time. I appreciate your efforts and await further instructions.
Mike
http://cwshredder.net/bin/CWSInstall.exe
Download Ad-aware SE 1.05 from: http://www.majorgeeks.com/download506.html
Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.
Make sure that you can view all hidden files. Instructions on how to do this can be found here:
How to see hidden files in Windows
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ewfjr.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {7C1B0897-335B-8C51-83E4-E850E4EF3490} - C:\WINDOWS\crxx.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [lmwgpr] C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O4 - HKLM\..\Run: [lekcv] C:\WINDOWS\System32\blpgx\lekcv.exe
O4 - HKLM\..\Run: [iosyfub] C:\WINDOWS\System32\rofc\iosyfub.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [vehmijr] C:\WINDOWS\System32\sitrlx\vehmijr.exe
O4 - HKLM\..\Run: [hbudme] C:\WINDOWS\System32\yniuly\hbudme.exe
O4 - HKLM\..\Run: [udvifbkh] C:\WINDOWS\System32\pfha\udvifbkh.exe
O4 - HKLM\..\Run: [vawdbss] C:\WINDOWS\System32\fceeky\vawdbss.exe
O4 - HKLM\..\Run: [rgaoqnh] C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\MIKECO~1\LOCALS~1\Temp\skhnp.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\System32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [qfvq] C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O4 - HKLM\..\Run: [hqxrlor] C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O4 - HKLM\..\Run: [bvcu] C:\WINDOWS\System32\skbmgou\bvcu.exe
O4 - HKLM\..\Run: [oomp] C:\WINDOWS\System32\vrqpni\oomp.exe
O4 - HKLM\..\Run: [jedccbrc] C:\WINDOWS\System32\vflq\jedccbrc.exe
O4 - HKLM\..\Run: [ndbieq] C:\WINDOWS\System32\wqamw\ndbieq.exe
O4 - HKLM\..\Run: [nofqmq] C:\WINDOWS\System32\axgt\nofqmq.exe
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [qwibmse] C:\WINDOWS\System32\yvtmmrdd\qwibmse.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [glkxkdi] C:\WINDOWS\System32\yhsjaf\glkxkdi.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [wineg.exe] C:\WINDOWS\system32\wineg.exe
O4 - HKLM\..\Run: [xheshwx] c:\windows\system32\mkggec.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\RunOnce: [ntvi32.exe] C:\WINDOWS\ntvi32.exe
O4 - HKCU\..\Run: [rasadhlp] C:\WINDOWS\System32\rasadhlp.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: clbiffsqh - Unknown owner - C:\WINDOWS\System32\ffsqh\clbi.exe
O23 - Service: hqxrlorvxrsfmux - Unknown owner - C:\WINDOWS\System32\vxrsfmux\hqxrlor.exe
O23 - Service: kuuixodpgcxn - Unknown owner - C:\WINDOWS\System32\gcxn\kuuixodp.exe
O23 - Service: lekcvblpgx - Unknown owner - C:\WINDOWS\System32\blpgx\lekcv.exe
O23 - Service: lmwgprhwfylyfl - Unknown owner - C:\WINDOWS\System32\hwfylyfl\lmwgpr.exe
O23 - Service: nofqmqaxgt - Unknown owner - C:\WINDOWS\System32\axgt\nofqmq.exe
O23 - Service: oompvrqpni - Unknown owner - C:\WINDOWS\System32\vrqpni\oomp.exe
O23 - Service: qfvqkpjjunvt - Unknown owner - C:\WINDOWS\System32\kpjjunvt\qfvq.exe
O23 - Service: rgaoqnhabaujbt - Unknown owner - C:\WINDOWS\System32\abaujbt\rgaoqnh.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: udvifbkhpfha - Unknown owner - C:\WINDOWS\System32\pfha\udvifbkh.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe
Reboot your computer into Safe Mode
Now run CWShredder, making sure to click "Fix".
Then delete these files or directories (Do not be concerned if they do not exist)
C:\WINDOWS\ewfjr.dll
C:\WINDOWS\Nail.exe
C:\WINDOWS\crxx.dll
C:\WINDOWS\system32\nvms.dll
C:\WINDOWS\system32\mscb.dll
C:\WINDOWS\system32\msbe.dll
C:\WINDOWS\System32\pacis.exe
C:\WINDOWS\System32\hwfylyfl <-- this folder
C:\WINDOWS\System32\blpgx <-- this folder
C:\WINDOWS\System32\rofc <-- this folder
C:\WINDOWS\cfgmgr51.dll
C:\WINDOWS\System32\sitrlx <-- this folder
C:\WINDOWS\System32\yniuly <-- this folder
C:\WINDOWS\System32\pfha <-- this folder
C:\WINDOWS\System32\fceeky <-- this folder
C:\WINDOWS\System32\abaujbt <-- this folder
C:\WINDOWS\System32\nsvsvc <-- this folder
C:\WINDOWS\System32\picsvr <-- this folder
C:\WINDOWS\System32\kpjjunvt <-- this folder
C:\WINDOWS\System32\vxrsfmux <-- this folder
C:\WINDOWS\System32\skbmgou <-- this folder
C:\WINDOWS\System32\vrqpni <-- this folder
C:\WINDOWS\System32\vflq <-- this folder
C:\WINDOWS\System32\wqamw <-- this folder
C:\WINDOWS\System32\axgt <-- this folder
C:\WINDOWS\System32\ffsqh <-- this folder
C:\WINDOWS\System32\yvtmmrdd <-- this folder
C:\WINDOWS\System32\gcxn <-- this folder
C:\WINDOWS\System32\yhsjaf <-- this folder
C:\WINDOWS\system32\wineg.exe
c:\windows\system32\mkggec.exe
C:\Program Files\BullsEye Network <-- this folder
C:\Program Files\NaviSearch <-- this folder
C:\Program Files\CashBack <-- this folder
C:\WINDOWS\ntvi32.exe
C:\WINDOWS\System32\rasadhlp.exe
C:\WINDOWS\system32\ntya.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\zeta.exe
Delete temp files
Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.
Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.
Empty the Recycle Bin.
Run a full scan with Adaware.
Reboot your computer to go back to normal mode and post a new log.
Logfile of HijackThis v1.99.1
Scan saved at 11:12:37 PM, on 4/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\mskk32.exe
C:\WINDOWS\winwb.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\GSMedia3.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
c:\windows\system32\lhlnbt.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Ares Lite Edition\Ares.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {065A3DF4-4253-B880-16A3-75DA427DD453} - C:\WINDOWS\winwb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [ycnpoi] c:\windows\system32\lhlnbt.exe
O4 - HKLM\..\Run: [GMedia2] C:\WINDOWS\system32\GSMedia3.exe
O4 - HKLM\..\Run: [winwb.exe] C:\WINDOWS\winwb.exe
O4 - HKLM\..\RunOnce: [mskk32.exe] C:\WINDOWS\mskk32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares Lite Edition\Ares.exe" -h
O4 - HKCU\..\Run: [AIM] C:\Program Files\AOL Instant Messenger\aim.exe -cnetwait.odl
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: SmartEnforcer.lnk = C:\Program Files\Perfigo\SmartEnforcer\SmartEnforcer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AOL Instant Messenger\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM Inc. - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
Thank you for your efforts. I appreciate them.
Please download CWShredder but don't run it yet.
http://cwshredder.net/bin/CWSInstall.exe
Download Ad-aware SE 1.05 from: http://www.majorgeeks.com/download506.html
Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.
Make sure that you can view all hidden files. Instructions on how to do this can be found here:
How to see hidden files in Windows
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nvyhe.dll/sp.html#12047
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {065A3DF4-4253-B880-16A3-75DA427DD453} - C:\WINDOWS\winwb.dll
O4 - HKLM\..\Run: [clbi] C:\WINDOWS\System32\ffsqh\clbi.exe
O4 - HKLM\..\Run: [kuuixodp] C:\WINDOWS\System32\gcxn\kuuixodp.exe
O4 - HKLM\..\Run: [ycnpoi] c:\windows\system32\lhlnbt.exe
O4 - HKLM\..\Run: [GMedia2] C:\WINDOWS\system32\GSMedia3.exe
O4 - HKLM\..\Run: [winwb.exe] C:\WINDOWS\winwb.exe
O4 - HKLM\..\RunOnce: [mskk32.exe] C:\WINDOWS\mskk32.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntya.exe (file missing)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Reboot your computer into Safe Mode
Now run CWShredder, making sure to click "Fix".
Then delete these files or directories (Do not be concerned if they do not exist)
C:\WINDOWS\svcproc.exe
C:\WINDOWS\mskk32.exe
C:\WINDOWS\winwb.exe
C:\WINDOWS\winwb.dll
C:\WINDOWS\system32\ntya.exe
C:\WINDOWS\system32\GSMedia3.exe
c:\windows\system32\lhlnbt.exe
C:\WINDOWS\system32\nvyhe.dll
C:\WINDOWS\System32\gcxn <-- this folder
C:\WINDOWS\System32\ffsqh <-- this folder
Run a full scan with Adaware.
Reboot your computer to go back to normal mode and post a new log.