another trojan_spy detected!!! advice needed

Unknown

last night , my com got infected with this virus called trojan-spy and my wallpaper turns blue. i think this is a same problem as many of them who have posted their logfiles. this is a copy of my logfile and i hope that someone will be kind enough to help me get my com back! thks.



Logfile of HijackThis v1.99.1
Scan saved at 12:09:32 AM, on 5/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ViRobotXP\vrmonsvc.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\System32\msole32.exe
E:\WINDOWS\System32\shnlog.exe
E:\WINDOWS\popuper.exe
E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
E:\WINDOWS\System32\intmonp.exe
E:\Program Files\ViRobotXP\vrmonnt.exe
E:\WINDOWS\System32\intmon.exe
E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
E:\PROGRA~1\Save\Save.exe
E:\Program Files\Common Files\CMEII\CMESys.exe
E:\WINDOWS\System32\rundll32.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Yahoo!\Messenger\ypager.exe
E:\Program Files\Date Manager\DateManager.exe
E:\Program Files\Common Files\GMT\GMT.exe
E:\Program Files\PrecisionTime\PrecisionTime.exe
E:\Program Files\WebSecureAlert\WebSecureAlert.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
E:\Program Files\Internet Explorer\iexplore.exe
E:\Documents and Settings\User\Local Settings\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.quicknavigate.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qfind.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qfind.net/search.php?qq=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://qfind.net/bar/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qfind.net/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qfind.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.quicknavigate.com/search.php?qq=%1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.qfind.net/search.php?qq=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.qfind.net/search.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.quicknavigate.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.quicknavigate.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.qfind.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.starhub.net.sg:8080
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - E:\WINDOWS\System32\hpA940.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DashBar Toolbar - {CC90CDA0-74A0-45b4-80EF-D89CA8C249B8} - E:\Program Files\DashBar\DashBar17.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Vrmon] E:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrSchedule] E:\Program Files\ViRobotXP\Vrres.exe
O4 - HKLM\..\Run: [Omnipage] E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [WhenUSave] E:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [CMESys] "E:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 E:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Control handler] E:\WINDOWS\System32\ykgmy0toii5thd.exe
O4 - HKLM\..\Run: [startup] E:\WINDOWS\System32\winlogon32.exe
O4 - HKLM\..\Run: [MSN Messenger] E:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Date Manager.lnk = E:\Program Files\Date Manager\DateManager.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = E:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: GStartup.lnk = E:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PrecisionTime.lnk = E:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: WebSecureAlert.lnk = E:\Program Files\WebSecureAlert\WebSecureAlert.exe
O8 - Extra context menu item: &RSDN Search - res://E:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL/GoVM.dll.htm
O9 - Extra button: Microsoft AntiSpyware helper - {0FCF7363-2A76-4806-805F-B5E3AFB2A89D} - E:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {0FCF7363-2A76-4806-805F-B5E3AFB2A89D} - E:\WINDOWS\System32\wldr.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yqmczfdw.exe
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://max-stats.com/partner/jpg+chm//x.chm::/open.exe
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://search-search.net/ws2.chm::/w.exe
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://activex.microsoft.com/controls/dashboard/msddsc.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.globalhauri.com/Eng/online_up/vrupdate.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O17 - HKLM\System\CS1\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - E:\WINDOWS\msopt.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - E:\WINDOWS\System32\vbsys2.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - E:\Program Files\ViRobotXP\vrmonsvc.exe

HJThis

Hello,cjj_oo & Welcome

First have a look here please

http://www.short-media.com/forum/showthread.php?t=14915

you may also want to have a look here before cleaning

how to remove the new.net infection.

Try these steps 1 by 1 until it is gone.
http://www.newdotnet.com/removal.html

HGD

cjj_oo

I tried to follow the steps that were written by buck_eye sam and i try to delete some of the common files like: C:\\Windows\sites.ini , C:\\Windows\popuper.exe ,C:\\Windows\System32\intmonp.exe , C:\\Windows\System32\msmsgs.exe ,C:\\Windows\System32\ole32vbs.exe,
C:\\Windows\System32\msole.exe, C:\\Windows\System32\Log files, C:\\Windows\System32\Search maid and this is the log files that i obtained:


I am not sure how to run the Hijackthis and which are the ones that i have to check or uncheck so i hope someone can help me with this . thank you in advance



Logfile of HijackThis v1.99.1
Scan saved at 11:29:51 PM, on 5/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ViRobotXP\vrmonsvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Messenger\msmsgs.exe
E:\WINDOWS\System32\shnlog.exe
E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
E:\Program Files\ViRobotXP\vrmonnt.exe
E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
E:\WINDOWS\System32\intmon.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\Program Files\Yahoo!\Messenger\ypager.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
E:\Program Files\Internet Explorer\iexplore.exe
E:\Documents and Settings\User\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.quicknavigate.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.quicknavigate.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.quicknavigate.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.starhub.net.sg:8080
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - E:\WINDOWS\System32\hp67E1.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Vrmon] E:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrSchedule] E:\Program Files\ViRobotXP\Vrres.exe
O4 - HKLM\..\Run: [Omnipage] E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Control handler] E:\WINDOWS\System32\ykgmy0toii5thd.exe
O4 - HKLM\..\Run: [startup] E:\WINDOWS\System32\winlogon32.exe
O4 - HKLM\..\Run: [MSN Messenger] E:\WINDOWS\System32\msmsgs.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = E:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yqmczfdw.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://max-stats.com/partner/jpg+chm//x.chm::/open.exe
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://search-search.net/ws2.chm::/w.exe
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://activex.microsoft.com/controls/dashboard/msddsc.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.globalhauri.com/Eng/online_up/vrupdate.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O17 - HKLM\System\CS1\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - E:\WINDOWS\msopt.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - E:\WINDOWS\System32\vbsys2.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - E:\Program Files\ViRobotXP\vrmonsvc.exe

Buckeye_Sam

Make sure that you can VIEW ALL HIDDEN FILES.

Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.quicknavigate.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.quicknavigate.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.quicknavigate.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.quicknavigate.com/
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - E:\WINDOWS\System32\hp67E1.tmp
O4 - HKLM\..\Run: [Control handler] E:\WINDOWS\System32\ykgmy0toii5thd.exe
O4 - HKLM\..\Run: [startup] E:\WINDOWS\System32\winlogon32.exe
O4 - HKLM\..\Run: [MSN Messenger] E:\WINDOWS\System32\msmsgs.exe
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\yqmczfdw.exe
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://max-stats.com/partner/jpg+chm//x.chm::/open.exe
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exe
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://search-search.net/ws2.chm::/w.exe
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - E:\WINDOWS\msopt.dll (file missing)
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - E:\WINDOWS\System32\vbsys2.dll


Reboot your computer into SAFE MODE

Then delete these files or directories (Do not be concerned if they do not exist):

E:\WINDOWS\System32\vbsys2.dll
E:\WINDOWS\System32\winlogon32.exe
E:\WINDOWS\System32\msmsgs.exe
E:\WINDOWS\System32\ykgmy0toii5thd.exe
E:\WINDOWS\System32\hp67E1.tmp
E:\WINDOWS\System32\shnlog.exe
E:\WINDOWS\System32\intmon.exe
C:\Program Files\Internet Explorer\yqmczfdw.exe
c:\ied_s7.cab
c:\x.cab


Reboot your computer to go back to normal mode.


Please run at least two of these online scans.
Make sure they are set to clean automatically:

Panda Virus Scan

Bit Defender

TrendMicro Housecall

There will be files that these scans will not remove. Please include that information in your next post.


Reboot and post a new hijackthis log and the info from your virus scans.

cjj_oo

first of all , thank you for your attention on this case

i have fixed the files and run a panda virus scan and this is the latest log file that i obtained.

:\Program Files\ViRobotXP\vrmonsvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
E:\Program Files\ViRobotXP\vrmonnt.exe
E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
E:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Documents and Settings\User\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.starhub.net.sg:8080
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Vrmon] E:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrSchedule] E:\Program Files\ViRobotXP\Vrres.exe
O4 - HKLM\..\Run: [Omnipage] E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = E:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://search-search.net/ws2.chm::/w.exe
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://activex.microsoft.com/controls/dashboard/msddsc.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.globalhauri.com/Eng/online_up/vrupdate.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O17 - HKLM\System\CS1\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - E:\Program Files\ViRobotXP\vrmonsvc.exe

after this , i run the panda virus scan and this is the report that i obtained:

Spyware:Spyware/New.net No disinfected C:\Program Files\NewDotNet\newdotnet5_48.dll
Spyware:Spyware/New.net No disinfected C:\Program Files\NewDotNet\uninstall5_48.exe
Adware:Adware/SuperSpider No disinfected C:\RECYCLED\Q678340.exe
Adware:Adware/Gator No disinfected E:\Documents and Settings\rontan\Local Settings\Temp\fsg_tmp\GTR9.tmp
Adware:Adware/Gator No disinfected E:\Documents and Settings\rontan\Local Settings\Temp\fsg_tmp\GTR9.tmp[GTR9.tme]
Adware:Adware/EliteBar No disinfected E:\Documents and Settings\rontan\Local Settings\Temporary Internet Files\Content.IE5\POCR5XKL\js[1].htm
Adware:Adware/PurityScan No disinfected E:\Documents and Settings\User\Desktop\backups\backup-20050516-180606-227.inf
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Desktop\Quarantine files!!!!\intmon.xxx
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Desktop\Quarantine files!!!!\msole32.xxx
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Desktop\Quarantine files!!!!\popuper.xxx
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Desktop\Quarantine files!!!!\shnlog.xxx
Adware:Adware/PurityScan No disinfected E:\Documents and Settings\User\Desktop\Quarantine files!!!!\vbsys2.ddd
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Anti Spam.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Black Jack Online.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Home Loan.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Network Security.url
Adware:Adware/SuperSpider No disinfected E:\Documents and Settings\User\Favorites\Online Dating.url
Adware:Adware/CWS No disinfected E:\Documents and Settings\User\Favorites\Online Gambling\Online Gambling.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Online Gambling.url
Adware:Adware/CWS No disinfected E:\Documents and Settings\User\Favorites\Online Pharmacy\Lortab.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Online Pharmacy.url
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\Favorites\Spyware Removal.url
Virus:Exploit/Codebase.gen No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\8XIVGXUR\ne2[1].chm[index.html]
Virus:Trj/Downloader.XE No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\8XIVGXUR\ne2[1].chm[loader.exe]
Adware:Adware/SuperSpider No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\HR3JH5OE\chm10[1].chm
Adware:Adware/SuperSpider No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\HR3JH5OE\chm10[1].chm[ieloader.exe]
Virus:VBS/Psyme.C No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\HR3JH5OE\chm10[1].chm[launch10.html]
Adware:Adware/WUpd No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\KFGH816X\iframe[1].htm
Adware:Adware/MSSearch No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\QHNOTC7M\631[1].chm[file.exe]
Adware:Adware/WUpd No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\S1EZ4HMB\index[2].htm
Virus:Trj/Downloader.AMS No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\WX6FG5AB\x[1].chm[open.exe]
Virus:Exploit/CodeBaseExec No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\WX6FG5AB\x[1].chm[x.htm]
Adware:Adware/PurityScan No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\YR4RMHS9\777[1].cab
Adware:Adware/PurityScan No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\YR4RMHS9\777[1].cab[vbsys2.dll]
Adware:Adware/PurityScan No disinfected E:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\YR4RMHS9\777[1].cab[start.INF]
Adware:Adware/Popuper No disinfected E:\Documents and Settings\User\My Documents\Your Scanner.url
Adware:Adware/Gator No disinfected E:\Program Files\Common Files\htpcjnbj\hnelnpfltl\cfpbddtaf.exe
Adware:Adware/Gator No disinfected E:\Program Files\Common Files\htpcjnbj\jnblpcrh\ppppdcnn.exe
Adware:Adware/Gator No disinfected E:\Program Files\WebSecureAlert\WebSecureAlert.exe
Adware:Adware/Gator No disinfected E:\Program Files\WebSecureAlert\WSAHelper.dll what should i do next? should i delete the infected files? please advise thx!

Buckeye_Sam

Please fix these lines with Hijackthis:

O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://search-search.net/ws2.chm::/w.exe


Delete these files/folders:

C:\Program Files\NewDotNet
E:\Documents and Settings\User\Favorites\Anti Spam.url
E:\Documents and Settings\User\Favorites\Black Jack Online.url
E:\Documents and Settings\User\Favorites\Home Loan.url
E:\Documents and Settings\User\Favorites\Network Security.url
E:\Documents and Settings\User\Favorites\Online Dating.url
E:\Documents and Settings\User\Favorites\Online Gambling\Online Gambling.url
E:\Documents and Settings\User\Favorites\Online Gambling.url
E:\Documents and Settings\User\Favorites\Online Pharmacy\Lortab.url
E:\Documents and Settings\User\Favorites\Online Pharmacy.url
E:\Documents and Settings\User\Favorites\Spyware Removal.url
E:\Documents and Settings\User\My Documents\Your Scanner.url
E:\Program Files\Common Files\htpcjnbj
E:\Program Files\Common Files\htpcjnbj
E:\Program Files\WebSecureAlert


Delete temp files

Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

Empty the Recycle Bin.


Reboot and post a new hijackthis log. Are you having any problems now?

cjj_oo

tks for the prompt reply! i appreciate that ...

anyway, i have have what you have told me and this is how the log file looks like:

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\ViRobotXP\vrmonsvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
E:\Program Files\ViRobotXP\vrmonnt.exe
E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_SICN03.EXE
E:\PROGRA~1\ICQ\ICQ.exe
E:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
E:\Documents and Settings\User\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.starhub.net.sg:8080
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Smapp] E:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Vrmon] E:\Program Files\ViRobotXP\vrmonnt.exe Main
O4 - HKLM\..\Run: [VrSchedule] E:\Program Files\ViRobotXP\Vrres.exe
O4 - HKLM\..\Run: [Omnipage] E:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] E:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] E:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = E:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - E:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: {62CEC9E0-3811-4C36-A94E-4F7565DCD23F} (DDSC Class) - http://activex.microsoft.com/controls/dashboard/msddsc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {D9701E87-A34D-11D4-BE29-000102598CE4} (VrUpdate Control) - http://download.globalhauri.com/Eng/online_up/vrupdate.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O17 - HKLM\System\CS1\Services\Tcpip\..\{357C3510-7ED5-4D7B-8266-5158EA8579C2}: NameServer = 203.116.1.78 203.116.1.94
O23 - Service: C-DillaCdaC11BA - Macrovision - E:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p1\webserver\bin\win32\matlabserver.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ViRobot Expert Monitoring (vrmonsvc) - HAURI - E:\Program Files\ViRobotXP\vrmonsvc.exe



one more thing, i am unable to change my wallpaper under the display properties( when i do a right click) so is there a way to solve this problem?

Buckeye_Sam

Try this....

Download the following reg file to your desktop by right clicking on the link, and selecting save as.

http://www.bleepingcomputer.com/files/reg/smitfraud.reg

Once it has downloaded, double-click on the smitfraud.reg file on your desktop and when it asks if you would like to merge the data, click on the Yes button.

Reboot your computer and you should now be able to change your desktop settings back to how you would like it. If your desktop still looks strange, go into your display properties and click on the Themes tab. Change the theme to Windows XP and you will now be using the default Windows XP settings. Then change them as you see fit.


Your log is clean.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
   
   You can find instructions on how to enable and reenable system restore here:
   
   Managing Windows Millenium System Restore
   
   or
   
   Windows XP System Restore Guide
   
   Renable system restore with instructions from tutorial above
   
   
2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
   1. From within Internet Explorer click on the Tools menu and then click on Options.
   2. Click once on the Security tab
   3. Click once on the Internet icon so it becomes highlighted.
   4. Click once on the Custom Level button.
      1. Change the Download signed ActiveX controls to Prompt
         
      2. Change the Download unsigned ActiveX controls to Disable
         
      3. Change the Initialize and script ActiveX controls not marked as safe to Disable
         
      4. Change the Installation of desktop items to Prompt
         
      5. Change the Launching programs and files in an IFRAME to Prompt
         
      6. Change the Navigate sub-frames across different domains to Prompt
         
      7. When all these settings have been made, click on the OK button.
         
      8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
   5. Next press the Apply button and then the OK to exit the Internet Properties page.
   
   
3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
   
   See this link for a listing of some online & their stand-alone antivirus programs:
   
   Virus, Spyware, and Malware Protection and Removal Resources
   
   
4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
   
   For a tutorial on Firewalls and a listing of some available ones see the link below:
   
   Understanding and Using Firewalls
   
   
6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
   
   A tutorial on installing & using this product can be found here:
   
   Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
   
   
8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
   
   A tutorial on installing & using this product can be found here:
   
   Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
   
   
9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
   
   A tutorial on installing & using this product can be found here:
   
   Using SpywareBlaster to protect your computer from Spyware and Malware
   
   
10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

cjj_oo

i follow your instructions and i am able to get my wallpaper back! hopefully, after installing the firewall, my com will not be prone to virus attack again. Thanks for the attention you have beeen giving these few days.