CWS Spyware found

Unknown
edited June 2005 in Spyware & Virus Removal
My system is infected with Coolwebsearch spyware.

I have run both ad-Aware and spybot.

I am getting a lot of messages from Symantic AV saying virus found and identifies it as a trojan horse.

Any help you can provide would be greatly appreciated.

Hijackthis log file:

Logfile of HijackThis v1.99.1
Scan saved at 9:46:10 AM, on 6/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\GEARSEC.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VECTORVEST\Binn\sqlservr.exe
C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\System32\vmnat.exe
C:\Program Files\ORL\VNC\WinVNC.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlagent.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\USBToolbox\Res.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\mfcvp32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE
C:\My_Software\HiJackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mkpft.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://milo.crystaldecisions.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {FBF394D3-B372-7E71-4611-A6EE5AF256CE} - C:\WINDOWS\system32\ieom32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ResModify] C:\Program Files\USBToolbox\Res.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mfcvp32.exe] C:\WINDOWS\mfcvp32.exe
O4 - HKLM\..\Run: [d3ie32.exe] C:\WINDOWS\system32\d3ie32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - Global Startup: BlackBerry Desktop Redirector.lnk = C:\Program Files\Research In Motion\BlackBerry\Redirector.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://horizon.businessobjects.com
O15 - Trusted Zone: http://ordercapture.businessobjects.com
O15 - Trusted Zone: http://horizon.crystaldecisions.com
O15 - Trusted Zone: http://infocenter.crystaldecisions.com
O15 - Trusted Zone: http://milo.crystaldecisions.com
O15 - Trusted Zone: http://mymilo.crystaldecisions.com
O15 - Trusted Zone: http://ordercapture.crystaldecisions.com
O15 - Trusted Zone: http://team.crystaldecisions.com
O15 - Trusted Zone: http://*.horizon
O16 - DPF: {07D60FC6-7B9A-438C-8FC2-8E66051872AE} (Pivotal eRelationship Active Access (Version 3.0.2) - Resources (rdares.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDARES.CAB
O16 - DPF: {28E4BE08-1C25-4CE4-A9AA-3495A9D08C8E} (Pivotal eRelationship - Shortcut Handler (rshortcut.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RSHORTCUT.CAB
O16 - DPF: {460324E8-CFB4-4357-85EF-CE3EBFE23A62} (Crystal ActiveX Report Viewer Control 11.0) - http://infocenter.crystaldecisions.com/crystalreportviewers11/ActiveXControls/ActiveXViewer.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://members.vectorvest.com/sr2upgrade/download/setup.exe
O16 - DPF: {4F5A43C9-3C93-43B5-8C15-6092FECBF86C} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Platform Access (rdaclnt.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDACLNT.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04a58d2407e5de568815/netzip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117800960596
O16 - DPF: {695FA8ED-7910-4E06-A837-E0D06E498C60} (Pivotal eRelationship Active Access (Version 3.0.2) - Smart Portal (rdaprtl.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDAPRTL.CAB
O16 - DPF: {7C84CA79-B7DC-42D1-92AE-2A5D75D7D1A8} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Instantiator (rdaobjcreate.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaObjCreate.cab
O16 - DPF: {9B57C630-AA6E-440D-8D44-D34542E5531A} (SendMail Class) - http://www112.placeware.com/etc/static/SCLrapidweb/2004-07-30-23-09-14/MailObjects.cab
O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - http://infocenter.crystaldecisions.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab
O16 - DPF: {A4BD9732-328D-11D4-BB89-00A0C9843488} (Pivotal Rn1SendX RXSession Class) - http://horizon.crystaldecisions.com/ePower/cab/RN1SENDX.CAB
O16 - DPF: {AE4F48D0-6A0A-11D3-9FB0-005004A79108} (Pivotal eRelationship Active Access - Plug-in Result Return Collection (dfoutils.dll)) - http://horizon.crystaldecisions.com/ePower/cab/DFOUTILS.CAB
O16 - DPF: {DCC6C3C0-5940-4741-B7AE-FFB564FD5FE1} (Pivotal eRelationship Active Access (Version 3.0.2) - Portal Control Proxy (rdaui.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaUI.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://landolakesinc.webex.com/client/v_mywebex/webex/ieatgpc.cab
O16 - DPF: {EE6DD3BD-B5E5-4A05-9FF2-9DB265522F0D} (ZaboCheckAndRunControl Class) - http://vanbob01.crystald.net/wiasp/distribution/ZaboIEen.cab
O16 - DPF: {FE3C679D-41C6-4A35-AEF6-402E3558AA7E} (Pivotal eRelationship Active Access (Version 3.0.2) - Shared Object Library Interface (rdashare.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDASHARE.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
O17 - HKLM\Software\..\Telephony: DomainName = intl.businessobjects.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A13E3E5-65E9-4BBF-B6E6-6565278D0664}: Domain = crystald.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{670F3A59-7F14-48DB-A60A-336D128F48D8}: Domain = crystald.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll (file missing)
O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
O23 - Service: Groove Audit Service (GrooveAuditService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveAuditService.exe
O23 - Service: Groove Installer Service (GrooveInstallerService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveInstallerService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: PatchLink Install - Unknown owner - C:\WINDOWS\PatchLink\Deploy Wizard\PLInstSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: RoamAdmn - symantec - C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\System32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\ORL\VNC\WinVNC.exe" -service (file missing)

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    You have an HSA infection. The filenames on this type of infection can change each time you reboot your computer or use Internet Explorer. With that in mind, some of these filenames may be different. But the pattern is the same and you may be able to determine the correct files to remove. The sooner you perform this fix, the higher it's chances for success.

    Much of this fix has to be performed in Safe Mode where you won't be able to access the Internet.
    Please print out these instructions.


    Step 1
    Download CWShredder but don't run it yet.


    Step 2
    Download AboutBuster
    Unzip it to your desktop but don't run it yet.


    Step 3
    Download Ad-aware SE 1.06
    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Step 5
    Make sure that you can VIEW ALL HIDDEN FILES.


    Step 6
    Reboot your computer into SAFE MODE


    Step 7
    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mkpft.dll/sp.html#37049
    O2 - BHO: Class - {FBF394D3-B372-7E71-4611-A6EE5AF256CE} - C:\WINDOWS\system32\ieom32.dll
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {FBF394D3-B372-7E71-4611-A6EE5AF256CE} - C:\WINDOWS\system32\ieom32.dll
    O4 - HKLM\..\Run: [mfcvp32.exe] C:\WINDOWS\mfcvp32.exe
    O4 - HKLM\..\Run: [d3ie32.exe] C:\WINDOWS\system32\d3ie32.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04a58d2...ip/RdxIE601.cab




    Step 8
    Now run CWShredder, making sure to click "Fix".


    Step 9
    Then delete these files or directories (Do not be concerned if they do not exist)

    C:\WINDOWS\system32\ieom32.dll
    C:\WINDOWS\system32\d3ie32.exe
    C:\WINDOWS\mkpft.dll
    C:\WINDOWS\mfcvp32.exe


    Step 10
    Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.


    Step 11
    Run a full scan with Adaware.


    Reboot your computer to go back to normal mode and post a new hijackthis log and the log from About Buster.
  • kpg
    edited June 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 4:41:00 PM, on 6/16/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Citrix\ICA Client\ssonsvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\msdtc.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\System32\carpserv.exe
    C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\GEARSEC.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\USBToolbox\Res.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\netrw32.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
    C:\Program Files\Dell\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$VECTORVEST\Binn\sqlservr.exe
    C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\System32\vmnat.exe
    C:\Program Files\ORL\VNC\WinVNC.exe
    C:\WINDOWS\System32\vmnetdhcp.exe
    C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlagent.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\My_Software\HiJackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://milo.crystaldecisions.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ResModify] C:\Program Files\USBToolbox\Res.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [netrw32.exe] C:\WINDOWS\system32\netrw32.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
    O4 - Global Startup: BlackBerry Desktop Redirector.lnk = C:\Program Files\Research In Motion\BlackBerry\Redirector.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: http://horizon.businessobjects.com
    O15 - Trusted Zone: http://ordercapture.businessobjects.com
    O15 - Trusted Zone: http://horizon.crystaldecisions.com
    O15 - Trusted Zone: http://infocenter.crystaldecisions.com
    O15 - Trusted Zone: http://milo.crystaldecisions.com
    O15 - Trusted Zone: http://mymilo.crystaldecisions.com
    O15 - Trusted Zone: http://ordercapture.crystaldecisions.com
    O15 - Trusted Zone: http://team.crystaldecisions.com
    O15 - Trusted Zone: http://*.horizon
    O16 - DPF: {07D60FC6-7B9A-438C-8FC2-8E66051872AE} (Pivotal eRelationship Active Access (Version 3.0.2) - Resources (rdares.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDARES.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {28E4BE08-1C25-4CE4-A9AA-3495A9D08C8E} (Pivotal eRelationship - Shortcut Handler (rshortcut.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RSHORTCUT.CAB
    O16 - DPF: {460324E8-CFB4-4357-85EF-CE3EBFE23A62} (Crystal ActiveX Report Viewer Control 11.0) - http://infocenter.crystaldecisions.com/crystalreportviewers11/ActiveXControls/ActiveXViewer.cab
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://members.vectorvest.com/sr2upgrade/download/setup.exe
    O16 - DPF: {4F5A43C9-3C93-43B5-8C15-6092FECBF86C} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Platform Access (rdaclnt.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDACLNT.CAB
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117800960596
    O16 - DPF: {695FA8ED-7910-4E06-A837-E0D06E498C60} (Pivotal eRelationship Active Access (Version 3.0.2) - Smart Portal (rdaprtl.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDAPRTL.CAB
    O16 - DPF: {7C84CA79-B7DC-42D1-92AE-2A5D75D7D1A8} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Instantiator (rdaobjcreate.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaObjCreate.cab
    O16 - DPF: {9B57C630-AA6E-440D-8D44-D34542E5531A} (SendMail Class) - http://www112.placeware.com/etc/static/SCLrapidweb/2004-07-30-23-09-14/MailObjects.cab
    O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - http://infocenter.crystaldecisions.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab
    O16 - DPF: {A4BD9732-328D-11D4-BB89-00A0C9843488} (Pivotal Rn1SendX RXSession Class) - http://horizon.crystaldecisions.com/ePower/cab/RN1SENDX.CAB
    O16 - DPF: {AE4F48D0-6A0A-11D3-9FB0-005004A79108} (Pivotal eRelationship Active Access - Plug-in Result Return Collection (dfoutils.dll)) - http://horizon.crystaldecisions.com/ePower/cab/DFOUTILS.CAB
    O16 - DPF: {DCC6C3C0-5940-4741-B7AE-FFB564FD5FE1} (Pivotal eRelationship Active Access (Version 3.0.2) - Portal Control Proxy (rdaui.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaUI.cab
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://landolakesinc.webex.com/client/v_mywebex/webex/ieatgpc.cab
    O16 - DPF: {EE6DD3BD-B5E5-4A05-9FF2-9DB265522F0D} (ZaboCheckAndRunControl Class) - http://vanbob01.crystald.net/wiasp/distribution/ZaboIEen.cab
    O16 - DPF: {FE3C679D-41C6-4A35-AEF6-402E3558AA7E} (Pivotal eRelationship Active Access (Version 3.0.2) - Shared Object Library Interface (rdashare.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDASHARE.CAB
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
    O17 - HKLM\Software\..\Telephony: DomainName = intl.businessobjects.com
    O17 - HKLM\System\CCS\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5A13E3E5-65E9-4BBF-B6E6-6565278D0664}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\..\{670F3A59-7F14-48DB-A60A-336D128F48D8}: Domain = crystald.net
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
    O17 - HKLM\System\CS1\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll (file missing)
    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
    O23 - Service: Groove Audit Service (GrooveAuditService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveAuditService.exe
    O23 - Service: Groove Installer Service (GrooveInstallerService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveInstallerService.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: PatchLink Install - Unknown owner - C:\WINDOWS\PatchLink\Deploy Wizard\PLInstSvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: RoamAdmn - symantec - C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\System32\vmnat.exe
    O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\ORL\VNC\WinVNC.exe" -service (file missing)

    AboutBuster 5.0 reference file 28
    Scan started on [6/16/2005] at [4:17:37 PM]
    Removed Stream! C:\WINDOWS\bhwrv.dat:vknngy
    Removed Stream! C:\WINDOWS\_default.pif:bdrdyc
    Removed Stream! C:\WINDOWS\_default.pif:bhwbon
    Removed Stream! C:\WINDOWS\_default.pif:bkiobs
    Removed Stream! C:\WINDOWS\_default.pif:bmxxgr
    Removed Stream! C:\WINDOWS\_default.pif:bulhxi
    Removed Stream! C:\WINDOWS\_default.pif:bvoxjr
    Removed Stream! C:\WINDOWS\_default.pif:ejyxdc
    Removed Stream! C:\WINDOWS\_default.pif:exrpxd
    Removed Stream! C:\WINDOWS\_default.pif:feseyq
    Removed Stream! C:\WINDOWS\_default.pif:fpckis
    Removed Stream! C:\WINDOWS\_default.pif:gfenjo
    Removed Stream! C:\WINDOWS\_default.pif:gjvfif
    Removed Stream! C:\WINDOWS\_default.pif:igdwud
    Removed Stream! C:\WINDOWS\_default.pif:ilfslp
    Removed Stream! C:\WINDOWS\_default.pif:iltvtz
    Removed Stream! C:\WINDOWS\_default.pif:imgrr
    Removed File! : C:\Windows\cweyh.dat
    Removed File! : C:\Windows\evxts.dat
    Removed File! : C:\Windows\iovux.dat
    Removed File! : C:\Windows\irctm.dat
    Removed File! : C:\Windows\jyjvh.dat
    Removed File! : C:\Windows\mjzkr.dat
    Removed File! : C:\Windows\njnxs.dat
    Removed File! : C:\Windows\npfdt.dat
    Removed File! : C:\Windows\omluz.dat
    Removed File! : C:\Windows\ovbvb.dat
    Removed File! : C:\Windows\quxkz.dat
    Removed File! : C:\Windows\tpnij.dat
    Removed File! : C:\Windows\voyjt.dat
    Removed File! : C:\Windows\wygmv.dat
    Removed File! : C:\Windows\ysieg.dat
    Removed File! : C:\Windows\zmtzf.dat
    Removed File! : C:\Windows\System32\acxex.dat
    Removed File! : C:\Windows\System32\cdxsu.dat
    Removed File! : C:\Windows\System32\duqkf.dat
    Removed File! : C:\Windows\System32\jakww.dat
    Removed File! : C:\Windows\System32\nopjl.dat
    Removed File! : C:\Windows\System32\pymmp.dat
    Removed File! : C:\Windows\System32\tetxq.dat
    Removed File! : C:\Windows\System32\uaskw.dat
    Removed File! : C:\Windows\System32\vygbe.dat
    Scan was COMPLETED SUCCESSFULLY at 4:18:16 PM



    First, thank you very much for help.

    Second, I noticed after re-booting and goining in the browser the NETRW32.exe process was running and in task manager I could see it was taking up 98% of the CPU.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    Fix these lines with Hijackthis.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O4 - HKLM\..\Run: [netrw32.exe] C:\WINDOWS\system32\netrw32.exe


    And delete this file.

    C:\WINDOWS\system32\netrw32.exe



    Reboot and post a new hijackthis log.
  • kpg
    edited June 2005
    Deleted the lines and removed netrw32.exe

    Here is the HJT log.

    I think we are done....

    Again, thanks so much for your help.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:56:51 PM, on 6/17/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Citrix\ICA Client\ssonsvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\carpserv.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\USBToolbox\Res.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\WINDOWS\System32\msdtc.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\GEARSEC.EXE
    C:\Program Files\Dell\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$VECTORVEST\Binn\sqlservr.exe
    C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\RegSrvc.exe
    C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\System32\vmnat.exe
    C:\Program Files\ORL\VNC\WinVNC.exe
    C:\WINDOWS\System32\vmnetdhcp.exe
    C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlagent.exe
    C:\My_Software\HiJackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://milo.crystaldecisions.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ResModify] C:\Program Files\USBToolbox\Res.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
    O4 - Global Startup: BlackBerry Desktop Redirector.lnk = C:\Program Files\Research In Motion\BlackBerry\Redirector.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: http://horizon.businessobjects.com
    O15 - Trusted Zone: http://ordercapture.businessobjects.com
    O15 - Trusted Zone: http://horizon.crystaldecisions.com
    O15 - Trusted Zone: http://infocenter.crystaldecisions.com
    O15 - Trusted Zone: http://milo.crystaldecisions.com
    O15 - Trusted Zone: http://mymilo.crystaldecisions.com
    O15 - Trusted Zone: http://ordercapture.crystaldecisions.com
    O15 - Trusted Zone: http://team.crystaldecisions.com
    O15 - Trusted Zone: http://*.horizon
    O16 - DPF: {07D60FC6-7B9A-438C-8FC2-8E66051872AE} (Pivotal eRelationship Active Access (Version 3.0.2) - Resources (rdares.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDARES.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {28E4BE08-1C25-4CE4-A9AA-3495A9D08C8E} (Pivotal eRelationship - Shortcut Handler (rshortcut.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RSHORTCUT.CAB
    O16 - DPF: {460324E8-CFB4-4357-85EF-CE3EBFE23A62} (Crystal ActiveX Report Viewer Control 11.0) - http://infocenter.crystaldecisions.com/crystalreportviewers11/ActiveXControls/ActiveXViewer.cab
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://members.vectorvest.com/sr2upgrade/download/setup.exe
    O16 - DPF: {4F5A43C9-3C93-43B5-8C15-6092FECBF86C} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Platform Access (rdaclnt.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDACLNT.CAB
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117800960596
    O16 - DPF: {695FA8ED-7910-4E06-A837-E0D06E498C60} (Pivotal eRelationship Active Access (Version 3.0.2) - Smart Portal (rdaprtl.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDAPRTL.CAB
    O16 - DPF: {7C84CA79-B7DC-42D1-92AE-2A5D75D7D1A8} (Pivotal ePower Lifecycle Engine (Version 3.0.2) - Instantiator (rdaobjcreate.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaObjCreate.cab
    O16 - DPF: {9B57C630-AA6E-440D-8D44-D34542E5531A} (SendMail Class) - http://www112.placeware.com/etc/static/SCLrapidweb/2004-07-30-23-09-14/MailObjects.cab
    O16 - DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} (Crystal ActiveX Report Viewer Control 10.0) - http://infocenter.crystaldecisions.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab
    O16 - DPF: {A4BD9732-328D-11D4-BB89-00A0C9843488} (Pivotal Rn1SendX RXSession Class) - http://horizon.crystaldecisions.com/ePower/cab/RN1SENDX.CAB
    O16 - DPF: {AE4F48D0-6A0A-11D3-9FB0-005004A79108} (Pivotal eRelationship Active Access - Plug-in Result Return Collection (dfoutils.dll)) - http://horizon.crystaldecisions.com/ePower/cab/DFOUTILS.CAB
    O16 - DPF: {DCC6C3C0-5940-4741-B7AE-FFB564FD5FE1} (Pivotal eRelationship Active Access (Version 3.0.2) - Portal Control Proxy (rdaui.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RdaUI.cab
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://landolakesinc.webex.com/client/v_mywebex/webex/ieatgpc.cab
    O16 - DPF: {EE6DD3BD-B5E5-4A05-9FF2-9DB265522F0D} (ZaboCheckAndRunControl Class) - http://vanbob01.crystald.net/wiasp/distribution/ZaboIEen.cab
    O16 - DPF: {FE3C679D-41C6-4A35-AEF6-402E3558AA7E} (Pivotal eRelationship Active Access (Version 3.0.2) - Shared Object Library Interface (rdashare.dll)) - http://horizon.crystaldecisions.com/ePower/cab/RDASHARE.CAB
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
    O17 - HKLM\Software\..\Telephony: DomainName = intl.businessobjects.com
    O17 - HKLM\System\CCS\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5A13E3E5-65E9-4BBF-B6E6-6565278D0664}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\..\{670F3A59-7F14-48DB-A60A-336D128F48D8}: Domain = crystald.net
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intl.businessobjects.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
    O17 - HKLM\System\CS1\Services\Tcpip\..\{23019BFC-BAD0-4FE9-A57E-629BCF6D134A}: Domain = crystald.net
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = crystald.net,crystaldecisions.com,usa.businessobjects.com
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll (file missing)
    O20 - Winlogon Notify: Sebring - C:\WINDOWS\System32\LgNotify.dll (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSEC.EXE
    O23 - Service: Groove Audit Service (GrooveAuditService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveAuditService.exe
    O23 - Service: Groove Installer Service (GrooveInstallerService) - Groove Networks, Inc. - C:\Program Files\Groove Networks\Groove\Bin\GrooveInstallerService.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: PatchLink Install - Unknown owner - C:\WINDOWS\PatchLink\Deploy Wizard\PLInstSvc.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
    O23 - Service: RoamAdmn - symantec - C:\PROGRA~1\Symantec\TOOLS\ROAMADMN.EXE
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\System32\vmnat.exe
    O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\ORL\VNC\WinVNC.exe" -service (file missing)
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited June 2005
    I would recommend uninstalling Spyware Begone. It is a rogue/suspect program and there are many better alternatives.

    http://www.spywarewarrior.com/rogue_anti-spyware.htm



    Aside from that, your log is clean.

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
This discussion has been closed.