A Log for Review

Unknown
edited May 2005 in Spyware & Virus Removal
Hello,

I keep getting this Bullseye network thing on my computer and cannot get rid of it. I have run Ad Aware and Spybot. I can see the folder in my programs folder, but it will not go away.

Thanks!

Logfile of HijackThis v1.98.2
Scan saved at 6:04:28 PM, on 5/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\sony\giga pocket\shwserv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\giga pocket\RM_SV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\program files\support.com\client\bin\tgcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\sony\usbsircs\usbsircs.exe
C:\Program Files\Sony\giga pocket\ReserveModule.exe
C:\Program Files\sony\giga pocket\gps.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\Origin\SofType42\SofType.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jen\Application Data\Mozilla\Profiles\default\7iclokf5.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VAIOSurvey] c:\program files\sony\vaio survey\surveysa.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Remocon Driver.lnk = ?
O4 - Global Startup: Timer Recording Manager.lnk = C:\Program Files\Sony\giga pocket\ReserveModule.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.1.5.21/superbingo/superbingo-ob-assets.cab
O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/download/bargain_buddy/cab/installer_MARKETING14.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.com/save/makeover.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

Comments

  • SpywareShooterSpywareShooter 127.0.0.1
    edited May 2005
    Please upgrade to HijackThis version 1.99.1 and post a new log.
  • jennypenny
    edited May 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 2:09:03 PM, on 5/20/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2

    (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\program files\support.com\client\bin\tgcmd.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Common Files\Symantec

    Shared\ccApp.exe
    C:\Program Files\Lexmark X1100

    Series\lxbkbmgr.exe
    C:\Program Files\Lexmark X1100

    Series\lxbkbmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Viewpoint\Viewpoint

    Manager\ViewMgr.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\sony\usbsircs\usbsircs.exe
    C:\Program Files\Sony\giga

    pocket\ReserveModule.exe
    C:\Program Files\sony\giga pocket\gps.exe
    C:\Program Files\Common Files\Symantec

    Shared\ccEvtMgr.exe
    C:\Program Files\sony\giga pocket\shwserv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet

    Security\NISUM.EXE
    C:\Program Files\Outlook Express\msimn.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Music\SSSvr.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Video\GPVSvr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Norton Internet

    Security\ccPxySvc.exe
    C:\Program Files\Common Files\Symantec

    Shared\Security Center\SymWSC.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\UPnPFramework.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Sony\giga pocket\RM_SV.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Origin\SofType42\SofType.exe
    C:\Program Files\SmartFTP\SmartFTP.exe
    C:\Program Files\BullsEye

    Network\bin\bargains.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet

    Explorer\Main,Default_Page_URL =

    http://www.sony.com/vaiopeople
    R1 - HKCU\Software\Microsoft\Internet Connection

    Wizard,ShellNext = http://www.sony.com/vaiopeople
    N3 - Netscape 7:

    user_pref("browser.search.defaultengine",

    "engine://C%3A%5CProgram%20Files%5CNetscape%5CNet

    scape%5Csearchplugins%5CSBWeb_01.src");

    (C:\Documents and Settings\Jen\Application

    Data\Mozilla\Profiles\default\7iclokf5.slt\prefs.

    js)
    O2 - BHO: AcroIEHlprObj Class -

    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

    C:\Program Files\Adobe\Acrobat

    6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) -

    {53707962-6F74-2D53-2644-206D7942484F} -

    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper -

    {BDF3E430-B101-42AD-A544-FADC6B084872} -

    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: ADP UrlCatcher Class -

    {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -

    C:\WINDOWS\system32\msbe.dll
    O3 - Toolbar: Norton AntiVirus -

    {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -

    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

    C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px]

    C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program

    files\support.com\client\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI

    Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [IgfxTray]

    C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds]

    C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program

    Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program

    Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [VAIO Recovery]

    C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series]

    "C:\Program Files\Lexmark X1100

    Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [WinPatrol]

    "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

    C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program

    Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [VAIOSurvey] c:\program

    files\sony\vaio survey\surveysa.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program

    Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program

    Files\VBouncer\BundleOuter.EXE
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program

    Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup

    "C:\Program

    Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - HKCU\..\Run: [AIM] C:\Program

    Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Symantec NetDriver Monitor]

    C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk =

    C:\Program Files\Common

    Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: America Online 8.0 Tray

    Icon.lnk = C:\Program Files\America Online

    8.0\aoltray.exe
    O4 - Global Startup: Billminder.lnk = C:\Program

    Files\Quicken\billmind.exe
    O4 - Global Startup: Microsoft Office.lnk =

    C:\Program Files\Microsoft

    Office\Office10\OSA.EXE
    O4 - Global Startup: Remocon Driver.lnk = ?
    O4 - Global Startup: Timer Recording Manager.lnk

    = C:\Program Files\Sony\giga

    pocket\ReserveModule.exe
    O8 - Extra context menu item: E&xport to

    Microsoft Excel -

    res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/300

    0
    O9 - Extra button: (no name) -

    {120E090D-9136-4b78-8258-F0B44B4BD2AC} -

    C:\WINDOWS\System32\ms.exe
    O9 - Extra 'Tools' menuitem: MaxSpeed -

    {120E090D-9136-4b78-8258-F0B44B4BD2AC} -

    C:\WINDOWS\System32\ms.exe
    O9 - Extra button: AIM -

    {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

    C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF:

    START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: Fortune Bingo by pogo -

    http://game1.pogo.com/applet-6.1.5.21/superbingo/

    superbingo-ob-assets.cab
    O16 - DPF: Yahoo! Bingo -

    http://download.games.yahoo.com/games/clients/y/x

    t0_x.cab
    O16 - DPF: Yahoo! Dominoes -

    http://download.games.yahoo.com/games/clients/y/d

    ot8_x.cab
    O16 - DPF: Yahoo! Pool 2 -

    http://download.games.yahoo.com/games/clients/y/p

    ote_x.cab
    O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650}

    -

    http://download.bargain-buddy.net/download/bargai

    n_buddy/cab/installer_MARKETING14.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

    (Windows Genuine Advantage Validation Tool) -

    http://go.microsoft.com/fwlink/?linkid=36467&clci

    d=0x409
    O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E}

    (AimSp32 Class) -

    http://makeover.ivillage.com/save/makeover.cab
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA}

    (TGOnlineCtrl Class) -

    http://zone.msn.com/bingame/pacz/default/pandaonl

    ine.cab
    O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658}

    (Installer Class) -

    http://www.ysbweb.com/ist/softwares/v4.0/ysb_regu

    lar.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B}

    (QDiagAOLCCUpdateObj Class) -

    http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592}

    (ZoneIntro Class) -

    http://zone.msn.com/binFramework/v10/ZIntro.cab34

    246.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41}

    (TikGames Online Control) -

    http://zone.msn.com/bingame/shpo/default/shapo.ca

    b
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A}

    (SCEWebLauncherCtl Object) -

    http://zone.msn.com/bingame/hsol/default/SCEWebLa

    uncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

    (PopCapLoader Object) -

    http://download.games.yahoo.com/games/web_games/p

    opcap/insaniquarium/popcaploader_v6.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822}

    - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978}

    (IWinAmpActiveX Class) -

    http://cdn.digitalcity.com/_media/dalaillama/ampx

    .cab
    O20 - Winlogon Notify: igfxcui -

    C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr)

    - Symantec Corporation - C:\Program Files\Common

    Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation

    Service (ccPwdSvc) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec

    Shared\ccPwdSvc.exe
    O23 - Service: Symantec Proxy Service (ccPxySvc)

    - Symantec Corporation - C:\Program Files\Norton

    Internet Security\ccPxySvc.exe
    O23 - Service: Giga Pocket Hardware Detector -

    Sony Corporation - C:\Program Files\sony\giga

    pocket\shwserv.exe
    O23 - Service: iPod Service (iPodService) - Apple

    Computer, Inc. - C:\Program

    Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark

    International, Inc. -

    C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service -

    Unknown owner - C:\Program Files\Common

    Files\Macromedia Shared\Service\Macromedia

    Licensing.exe
    O23 - Service: Norton AntiVirus Auto Protect

    Service (navapsvc) - Symantec Corporation -

    C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Internet Security Accounts

    Manager (NISUM) - Symantec Corporation -

    C:\Program Files\Norton Internet

    Security\NISUM.EXE
    O23 - Service: NVIDIA Driver Helper Service

    (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Symantec Network Drivers Service

    (SNDSrvc) - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Sony TV Tuner Controller - Sony

    Corporation - C:\Program Files\Sony\giga

    pocket\halsv.exe
    O23 - Service: Sony TV Tuner Manager - Sony

    Corporation - C:\Program Files\Sony\giga

    pocket\RM_SV.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony

    Corporation -

    C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec

    Corporation - C:\Program Files\Common

    Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: VAIO Media Music Server

    (VAIOMediaPlatform-MusicServer-AppServer) -

    Unknown owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Music\SSSvr.exe"

    /Service=VAIOMediaPlatform-MusicServer-AppServer

    /DisplayName="VAIO Media Music Server (file

    missing)
    O23 - Service: VAIO Media Music Server (HTTP)

    (VAIOMediaPlatform-MusicServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-MusicServer-HTTP

    /RegRoot="Software\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="Applications\MusicServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Music Server (UPnP)

    (VAIOMediaPlatform-MusicServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Photo Server

    (VAIOMediaPlatform-PhotoServer-AppServer) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Photo\appsrv\PhotoAppSrv.exe
    O23 - Service: VAIO Media Photo Server (HTTP)

    (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-PhotoServer-HTTP

    /RegRoot="SOFTWARE\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="\Applications\PhotoServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Photo Server (UPnP)

    (VAIOMediaPlatform-PhotoServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Video Server

    (VAIOMediaPlatform-VideoServer-AppServer) -

    Unknown owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Video\GPVSvr.exe"

    /Service=VAIOMediaPlatform-VideoServer-AppServer

    /DisplayName="VAIO Media Video Server (file

    missing)
    O23 - Service: VAIO Media Video Server (HTTP)

    (VAIOMediaPlatform-VideoServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-VideoServer-HTTP

    /RegRoot="SOFTWARE\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="\Applications\VideoServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Video Server (UPnP)

    (VAIOMediaPlatform-VideoServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: WAN Miniport (ATW) Service

    (WANMiniportService) - America Online, Inc. -

    C:\WINDOWS\wanmpsvc.exe
    O23 - Service: ZESOFT - Unknown owner -

    C:\WINDOWS\zeta.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited May 2005
    Please install 1.99.1 again. Sometimes a bug happens that causes random line breaks in the log. A simple reinstallation should fix it.
  • jennypenny
    edited May 2005
    Do the breaks really matter? :confused:
  • SpywareShooterSpywareShooter 127.0.0.1
    edited May 2005
    They make it much harder to analyze. Its mainly just to help get you help sooner, we can check the logs quicker if we don't have to fix 30 line breaks.
  • jennypenny
    edited May 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 1:34:49 PM, on 5/21/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2

    (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec

    Shared\ccEvtMgr.exe
    C:\Program Files\sony\giga pocket\shwserv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet

    Security\NISUM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Music\SSSvr.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Video\GPVSvr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Norton Internet

    Security\ccPxySvc.exe
    C:\Program Files\Common Files\Symantec

    Shared\Security Center\SymWSC.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\VAIO Media Integrated

    Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\giga pocket\RM_SV.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\program files\support.com\client\bin\tgcmd.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Common Files\Symantec

    Shared\ccApp.exe
    C:\Program Files\Lexmark X1100

    Series\lxbkbmgr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Lexmark X1100

    Series\lxbkbmon.exe
    C:\Program Files\Viewpoint\Viewpoint

    Manager\ViewMgr.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\sony\usbsircs\usbsircs.exe
    C:\Program Files\Sony\giga

    pocket\ReserveModule.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\sony\giga pocket\gps.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\BullsEye

    Network\bin\bargains.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet

    Explorer\Main,Default_Page_URL =

    http://www.sony.com/vaiopeople
    R1 - HKCU\Software\Microsoft\Internet Connection

    Wizard,ShellNext = http://www.sony.com/vaiopeople
    N3 - Netscape 7:

    user_pref("browser.search.defaultengine",

    "engine://C%3A%5CProgram%20Files%5CNetscape%5CNet

    scape%5Csearchplugins%5CSBWeb_01.src");

    (C:\Documents and Settings\Jen\Application

    Data\Mozilla\Profiles\default\7iclokf5.slt\prefs.

    js)
    O2 - BHO: AcroIEHlprObj Class -

    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

    C:\Program Files\Adobe\Acrobat

    6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) -

    {53707962-6F74-2D53-2644-206D7942484F} -

    C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper -

    {BDF3E430-B101-42AD-A544-FADC6B084872} -

    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: ADP UrlCatcher Class -

    {F4E04583-354E-4076-BE7D-ED6A80FD66DA} -

    C:\WINDOWS\system32\msbe.dll
    O3 - Toolbar: Norton AntiVirus -

    {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -

    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

    C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px]

    C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program

    files\support.com\client\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI

    Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [IgfxTray]

    C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds]

    C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program

    Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program

    Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [VAIO Recovery]

    C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series]

    "C:\Program Files\Lexmark X1100

    Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [WinPatrol]

    "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

    C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program

    Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [VAIOSurvey] c:\program

    files\sony\vaio survey\surveysa.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program

    Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program

    Files\VBouncer\BundleOuter.EXE
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program

    Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup

    "C:\Program

    Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - HKCU\..\Run: [AIM] C:\Program

    Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Symantec NetDriver Monitor]

    C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk =

    C:\Program Files\Common

    Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: America Online 8.0 Tray

    Icon.lnk = C:\Program Files\America Online

    8.0\aoltray.exe
    O4 - Global Startup: Billminder.lnk = C:\Program

    Files\Quicken\billmind.exe
    O4 - Global Startup: Microsoft Office.lnk =

    C:\Program Files\Microsoft

    Office\Office10\OSA.EXE
    O4 - Global Startup: Remocon Driver.lnk = ?
    O4 - Global Startup: Timer Recording Manager.lnk

    = C:\Program Files\Sony\giga

    pocket\ReserveModule.exe
    O8 - Extra context menu item: E&xport to

    Microsoft Excel -

    res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/300

    0
    O9 - Extra button: (no name) -

    {120E090D-9136-4b78-8258-F0B44B4BD2AC} -

    C:\WINDOWS\System32\ms.exe
    O9 - Extra 'Tools' menuitem: MaxSpeed -

    {120E090D-9136-4b78-8258-F0B44B4BD2AC} -

    C:\WINDOWS\System32\ms.exe
    O9 - Extra button: AIM -

    {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

    C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger -

    {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF:

    START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: Fortune Bingo by pogo -

    http://game1.pogo.com/applet-6.1.5.21/superbingo/

    superbingo-ob-assets.cab
    O16 - DPF: Yahoo! Bingo -

    http://download.games.yahoo.com/games/clients/y/x

    t0_x.cab
    O16 - DPF: Yahoo! Dominoes -

    http://download.games.yahoo.com/games/clients/y/d

    ot8_x.cab
    O16 - DPF: Yahoo! Pool 2 -

    http://download.games.yahoo.com/games/clients/y/p

    ote_x.cab
    O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650}

    -

    http://download.bargain-buddy.net/download/bargai

    n_buddy/cab/installer_MARKETING14.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

    (Windows Genuine Advantage Validation Tool) -

    http://go.microsoft.com/fwlink/?linkid=36467&clci

    d=0x409
    O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E}

    (AimSp32 Class) -

    http://makeover.ivillage.com/save/makeover.cab
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA}

    (TGOnlineCtrl Class) -

    http://zone.msn.com/bingame/pacz/default/pandaonl

    ine.cab
    O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658}

    (Installer Class) -

    http://www.ysbweb.com/ist/softwares/v4.0/ysb_regu

    lar.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B}

    (QDiagAOLCCUpdateObj Class) -

    http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592}

    (ZoneIntro Class) -

    http://zone.msn.com/binFramework/v10/ZIntro.cab34

    246.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41}

    (TikGames Online Control) -

    http://zone.msn.com/bingame/shpo/default/shapo.ca

    b
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A}

    (SCEWebLauncherCtl Object) -

    http://zone.msn.com/bingame/hsol/default/SCEWebLa

    uncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

    (PopCapLoader Object) -

    http://download.games.yahoo.com/games/web_games/p

    opcap/insaniquarium/popcaploader_v6.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822}

    - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978}

    (IWinAmpActiveX Class) -

    http://cdn.digitalcity.com/_media/dalaillama/ampx

    .cab
    O20 - Winlogon Notify: igfxcui -

    C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr)

    - Symantec Corporation - C:\Program Files\Common

    Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation

    Service (ccPwdSvc) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec

    Shared\ccPwdSvc.exe
    O23 - Service: Symantec Proxy Service (ccPxySvc)

    - Symantec Corporation - C:\Program Files\Norton

    Internet Security\ccPxySvc.exe
    O23 - Service: Giga Pocket Hardware Detector -

    Sony Corporation - C:\Program Files\sony\giga

    pocket\shwserv.exe
    O23 - Service: iPod Service (iPodService) - Apple

    Computer, Inc. - C:\Program

    Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark

    International, Inc. -

    C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service -

    Unknown owner - C:\Program Files\Common

    Files\Macromedia Shared\Service\Macromedia

    Licensing.exe
    O23 - Service: Norton AntiVirus Auto Protect

    Service (navapsvc) - Symantec Corporation -

    C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Internet Security Accounts

    Manager (NISUM) - Symantec Corporation -

    C:\Program Files\Norton Internet

    Security\NISUM.EXE
    O23 - Service: NVIDIA Driver Helper Service

    (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Symantec Network Drivers Service

    (SNDSrvc) - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Sony TV Tuner Controller - Sony

    Corporation - C:\Program Files\Sony\giga

    pocket\halsv.exe
    O23 - Service: Sony TV Tuner Manager - Sony

    Corporation - C:\Program Files\Sony\giga

    pocket\RM_SV.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony

    Corporation -

    C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec

    Corporation - C:\Program Files\Common

    Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: VAIO Media Music Server

    (VAIOMediaPlatform-MusicServer-AppServer) -

    Unknown owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Music\SSSvr.exe"

    /Service=VAIOMediaPlatform-MusicServer-AppServer

    /DisplayName="VAIO Media Music Server (file

    missing)
    O23 - Service: VAIO Media Music Server (HTTP)

    (VAIOMediaPlatform-MusicServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-MusicServer-HTTP

    /RegRoot="Software\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="Applications\MusicServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Music Server (UPnP)

    (VAIOMediaPlatform-MusicServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Photo Server

    (VAIOMediaPlatform-PhotoServer-AppServer) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Photo\appsrv\PhotoAppSrv.exe
    O23 - Service: VAIO Media Photo Server (HTTP)

    (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-PhotoServer-HTTP

    /RegRoot="SOFTWARE\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="\Applications\PhotoServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Photo Server (UPnP)

    (VAIOMediaPlatform-PhotoServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Video Server

    (VAIOMediaPlatform-VideoServer-AppServer) -

    Unknown owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Video\GPVSvr.exe"

    /Service=VAIOMediaPlatform-VideoServer-AppServer

    /DisplayName="VAIO Media Video Server (file

    missing)
    O23 - Service: VAIO Media Video Server (HTTP)

    (VAIOMediaPlatform-VideoServer-HTTP) - Unknown

    owner - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\SV_Httpd.exe"

    /Service=VAIOMediaPlatform-VideoServer-HTTP

    /RegRoot="SOFTWARE\Sony Corporation\VAIO Media

    Platform\2.0"

    /RegExt="\Applications\VideoServer\HTTP (file

    missing)
    O23 - Service: VAIO Media Video Server (UPnP)

    (VAIOMediaPlatform-VideoServer-UPnP) - Sony

    Corporation - C:\Program Files\Sony\VAIO Media

    Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: WAN Miniport (ATW) Service

    (WANMiniportService) - America Online, Inc. -

    C:\WINDOWS\wanmpsvc.exe
    O23 - Service: ZESOFT - Unknown owner -

    C:\WINDOWS\zeta.exe
  • jennypenny
    edited May 2005
    It did it again ...
  • jennypenny
    edited May 2005
    If someone could review this, I'd greatly appreciate it. :)
  • jennypenny
    edited May 2005
    If someone could review this, I'd greatly appreciate it.
  • jennypenny
    edited May 2005
    Can someone please help me?
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    When you run Hijackthis and get a log it should open up in notepad. Make sure that the spacing is correct in notepad before you post it here.

    Once you have posted a new hijackthis log in this thread I will help you sort it out.
  • jennypenny
    edited May 2005
    Buckeye_Sam wrote:
    When you run Hijackthis and get a log it should open up in notepad. Make sure that the spacing is correct in notepad before you post it here.

    That is what I did. I just checked it and the spacing is fine in notepad.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    I don't understand why you can't copy and paste it here. :scratch:

    If it won't work for you just attach it as a text file and I'll post it for you.
  • jennypenny
    edited May 2005
    Buckeye_Sam wrote:
    I don't understand why you can't copy and paste it here. :scratch:

    If it won't work for you just attach it as a text file and I'll post it for you.

    Same log as above...

    Logfile of HijackThis v1.99.1
    Scan saved at 1:34:49 PM, on 5/21/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\sony\giga pocket\shwserv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Norton Internet Security\ccPxySvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\giga pocket\RM_SV.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\program files\support.com\client\bin\tgcmd.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\sony\usbsircs\usbsircs.exe
    C:\Program Files\Sony\giga pocket\ReserveModule.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\sony\giga pocket\gps.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\BullsEye Network\bin\bargains.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jen\Application Data\Mozilla\Profiles\default\7iclokf5.slt\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [VAIOSurvey] c:\program files\sony\vaio survey\surveysa.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Remocon Driver.lnk = ?
    O4 - Global Startup: Timer Recording Manager.lnk = C:\Program Files\Sony\giga pocket\ReserveModule.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.1.5.21/superbingo/superbingo-ob-assets.cab
    O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
    O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
    O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/download/bargain_buddy/cab/installer_MARKETING14.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.com/save/makeover.cab
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
    O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
    O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\sony\giga pocket\shwserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\giga pocket\halsv.exe
    O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\giga pocket\RM_SV.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
    O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)
    O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
    O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)
    O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
    O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
    O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Perfect! :thumbsup:

    Please remove these entries from Add/Remove Programs in the Control Panel(if present):

    Virtual Bouncer
    Wild Tangent
    Viewpoint Manager
    Viewpoint Media Player


    Please make sure that you can VIEW ALL HIDDEN FILES.

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
    O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
    O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
    O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
    O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/d...MARKETING14.cab
    O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares...ysb_regular.cab
    O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe


    Reboot your computer into SAFE MODE

    Then delete these files or directories (Do not be concerned if they do not exist):

    C:\WINDOWS\zeta.exe
    C:\WINDOWS\System32\ms.exe
    C:\WINDOWS\system32\msbe.dll
    C:\Program Files\VBouncer
    C:\Program Files\WildTangent
    C:\Program Files\Viewpoint


    Reboot your computer to go back to normal mode.



    Please follow these instructions to run Adware.
    • Download, install, update, configure, and run Ad-Aware SE Personal 1.05.
      1. Download Ad-Aware SE Personal 1.05:
      2. Install Ad-Aware SE Personal 1.05:
        • Double-click on aawsepersonal.exe to install the program.
        • Follow the default settings for installation.
        • After the program has finished installing uncheck the "Perform a full system scan now", "Update definition file now", and "Open the help file now" boxes.
      3. Update Ad-Aware SE Personal 1.05:
        • Double-click the Ad-Aware SE Personal icon on your desktop.
        • Click "Check for updates now" then click "Connect".
        • It will check for any updates. If any are found click "OK" to download and install the updates. Once it has finished click "Finish".
      4. Configure Ad-Aware SE Personal 1.05:
        • Click on the Gear button at the top of the window.
        • Click "General" on the left hand side to display the General Settings box.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Automatically save logfile"
            • "Automatically quarantine objects prior to removal"
            • "Safe Mode (always request confirmation)"
            • "Prompt to update outdated definitions" - change to 7 days from the default 14.
        • Click "Scanning" on the left hand side to display the Scan Settings box.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Scan within archives"
            • "Select drives & folders to scan" - select your hard drive(s).
            • "Scan active processes"
            • "Scan registry"
            • "Deep-scan registry"
            • "Scan my IE favorites for banned URLs"
            • "Scan my Hosts file"
        • Click "Advanced" on the left hand side to display the Advanced Settings box.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Move deleted files to Recycle Bin"
            • "Include additional object information"
            • "Include negligible objects information"
            • "Include environment information"
        • Click "Defaults" on the left hand side to display the Default Settings box.
          • Make sure these items have your preferred settings in them.:
            • "Default homepage"
            • "Default searchpage"
        • Click "Tweak" on the left hand side to display the Tweak Settings box.
          • Click the + (plus) sign next to the Log Files section. This will expand the section.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Include basic Ad-Aware settings in log file"
            • "Include additional Ad-Aware settings in log file"
            • "Include reference summary in log file"
            • "Include alternate data stream details in log file"
          • Click the + (plus) sign next to the Scanning Engine section. This will expand the section.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Unload recognized processes & modules during scan"
            • "Scan registry for all users instead of current user only"
            • "Obtain command line of scanned processes"
          • Click the + (plus) sign next to the Cleaning Engine section. This will expand the section.
          • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark:
            • "Always try to unload modules before deletion"
            • "During removal, unload Explorer and IE if necessary"
            • "Let Windows remove files in use at next reboot"
            • "Delete quarantined objects after restoring"
        • Once you are done with these settings, click "Proceed" to save them.
        • This will take you back to the main screen.
      5. Run Ad-Aware SE Personal 1.05:
        • Click the "Start" button.
        • Uncheck the "Search for negligible risk entries" entry.
        • Choose the "Use custom scanning options" scan mode.
        • Click the "Next" button.
        • Ad-Aware will begin to scan for malware residing on your computer.
        • Allow the scan to finish.
        • Right-click on any entry in the list and click "Select All" to select the whole list.
        • Click "Next" and choose "OK" at the prompt to quarantine and remove the objects.

    Reboot and post a new hijackthis log and we'll see what's left.
  • jennypenny
    edited May 2005
    Here is the new log:

    Logfile of HijackThis v1.99.1
    Scan saved at 4:36:39 PM, on 5/27/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\program files\support.com\client\bin\tgcmd.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\sony\usbsircs\usbsircs.exe
    C:\Program Files\Sony\giga pocket\ReserveModule.exe
    C:\Program Files\sony\giga pocket\gps.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\sony\giga pocket\shwserv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security\NISUM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\Program Files\Norton Internet Security\ccPxySvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Sony\giga pocket\RM_SV.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Origin\SofType42\SofType.exe
    C:\Program Files\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Jen\Application Data\Mozilla\Profiles\default\7iclokf5.slt\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\bin\tgcmd.exe" /server
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [VAIOSurvey] c:\program files\sony\vaio survey\surveysa.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
    O4 - Global Startup: Billminder.lnk = C:\Program Files\Quicken\billmind.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Remocon Driver.lnk = ?
    O4 - Global Startup: Timer Recording Manager.lnk = C:\Program Files\Sony\giga pocket\ReserveModule.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
    O16 - DPF: Fortune Bingo by pogo - http://game1.pogo.com/applet-6.1.5.21/superbingo/superbingo-ob-assets.cab
    O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/games/clients/y/xt0_x.cab
    O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.com/save/makeover.cab
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
    O23 - Service: Giga Pocket Hardware Detector - Sony Corporation - C:\Program Files\sony\giga pocket\shwserv.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\giga pocket\halsv.exe
    O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\giga pocket\RM_SV.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: VAIO Media Music Server (VAIOMediaPlatform-MusicServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe" /Service=VAIOMediaPlatform-MusicServer-AppServer /DisplayName="VAIO Media Music Server (file missing)
    O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-MusicServer-HTTP /RegRoot="Software\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\MusicServer\HTTP (file missing)
    O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Photo Server (VAIOMediaPlatform-PhotoServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
    O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-PhotoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\PhotoServer\HTTP (file missing)
    O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
    O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
    O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Your log looks clean. Are you still having problems?
This discussion has been closed.