Options

Spyware need help plz

Unknown
edited July 2005 in Spyware & Virus Removal
Hi, guys I have a spyware my desktop changed and my pc getting more slower by the time. I did everything I soppused to do. This is my hijackthis log file.


Logfile of HijackThis v1.99.1
Scan saved at 9:28:05 PM, on 6/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ALGHAD~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ALGHAD~1\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: (no name) - {EB2B2F71-1FFB-4BAA-989E-2FE39CF50CB3} - (no file)
O2 - BHO: (no name) - {FCF10A24-565B-A08E-94E6-9988C80E87E4} - C:\WINDOWS\System32\pq6qJyWn.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AD Black List - D:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Highlight - D:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - D:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Search - D:\Program Files\Avant Browser\Search.htm
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Filter: text/html - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
O18 - Filter: text/plain - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Comments

  • Shadow2018Shadow2018 Northwest Missouri
    edited June 2005
    Make sure all hidden files are viewable,

    Open my computer>click tools>click folder options>
    click view tab>check show hidden files>uncheck hide file extensions>
    click apply>click OK>exit

    Close all open windows and place a checkmark next to these entries and have Hijack This fix them by clicking Fix Checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ALGHAD~1\LOCALS~1\Temp\se.dll/spage.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ALGHAD~1\LOCALS~1\Temp\se.dll/spage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {EB2B2F71-1FFB-4BAA-989E-2FE39CF50CB3} - (no file)
    O2 - BHO: (no name) - {FCF10A24-565B-A08E-94E6-9988C80E87E4} - C:\WINDOWS\System32\pq6qJyWn.dll


    Delete all files in your temp folder.

    Delete these files/directories if they exist:
    C:\WINDOWS\System32\pq6qJyWn.dll


    Post a new log when finished.
  • mtn_knight
    edited June 2005
    Shadow2018; thanks for ur help this is my last file tell me if there is anything I need to do. and by the way my pc still very slow samething.



    Logfile of HijackThis v1.99.1
    Scan saved at 10:30:53 PM, on 6/26/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe
    C:\WINDOWS\System32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O18 - Filter: text/html - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
    O18 - Filter: text/plain - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe
  • Shadow2018Shadow2018 Northwest Missouri
    edited June 2005
    Did you follow the instructions from my last post on making all hidden files viewable?
  • mtn_knight
    edited June 2005
    i'm sorry for been late. Yes, I did, but nothing changed. and I have this warning on my desktop:


    WARNING!
    YOU'RE IN DANGER!



    ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK. WHEN YOU VISIT SITES, SEND EMAILS... ALL YOUR ACTIONS ARE LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS. YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

    Every site you or somebody or even something, like spyware, opened in your browser, with all images, and all downloaded and maybe later removed movies or mp3 songs - ARE STILL THERE and could broke your life!


    SECURE YOURSELF RIGHT NOW!
    REMOVE ALL SPYWARE FROM YOUR PC!

    Removal instructions


    at the End there is a removel link when I klick on it. I get to this website

    http://www.antivirus-gold.com/?wm=10067&swm=0


    and this is my lost HighJackThis file:



    Logfile of HijackThis v1.99.1
    Scan saved at 7:07:11 PM, on 6/28/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    D:\Program Files\Avant Browser\avant.exe
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O8 - Extra context menu item: ÃÖÝ Åáì ÞÇÆãÉ ÇáÅÚáÇä ÇáÓæÏÇÁ - D:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: ÅãäÚ ßáø ÇáÕæÑ ÇáÊí Ýí äÝÓ ÇáÎÇÏã - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: ÅÝÊÍ ßáø ÇáæÕáÇÊ Ýí åÐå ÇáÕÝÍÉ - D:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: ÇáÖæÁ - D:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: ÈÍË - D:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O18 - Filter: text/html - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
    O18 - Filter: text/plain - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe
  • Shadow2018Shadow2018 Northwest Missouri
    edited June 2005
    Run two of these online scans:

    http://housecall.trendmicro.com/

    http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

    http://www.bitdefender.com/scan8/ie.html

    In your next post let me know what could not be removed.
  • Shadow2018Shadow2018 Northwest Missouri
    edited June 2005
    After running the online scans close all open windows.

    Run Hijack This again and place a checkmark next to these entries:

    O4 - HKCU\..\Run: [updatelavasoft] C:\WINDOWS\System32\updatelavasoft.exe
    O18 - Filter: text/html - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)
    O18 - Filter: text/plain - {80C1CE37-0BEB-4D45-B1BF-A2C03C97983B} - (no file)


    Then reboot into safe mode and delete the following file:

    C:\WINDOWS\System32\updatelavasoft.exe


    Reboot and post a new log. Be sure you can view all hidden files before posting the log.

    Open my computer>click tools>click folder options>
    click view tab>check show hidden files>uncheck hide file extensions>click apply>click OK>exit
  • mtn_knight
    edited June 2005
    Hi Shadow. I really appreciate your help. I did everything you asked me to do. and these are the results for the scans that I did.


    this is for Panda Anti Virus Scan:

    Incident Status Location

    Virus:Trj/Downloader.DGU Disinfected Operating system
    Adware:Adware/MyWay No disinfected C:\Program Files\MyWay
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alghadear\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/SearchAid No disinfected C:\WINDOWS\System32\msupdate.cmd
    Adware:Adware/ExactSearch No disinfected Windows Registry
    Adware:Adware/Startpage.ME No disinfected C:\m00.exe
    Adware:Adware/SuperSpider No disinfected C:\q.exe
    Adware:Adware/CWS.Aboutblank No disinfected Windows Registry
    Adware:Adware/Virmaid No disinfected C:\WINDOWS\System32\perfcii.ini
    Adware:Adware/Antivirus-gold No disinfected C:\WINDOWS\screen.html
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alghadear\Favorites\Online Gambling\Online Gambling.url
    Virus:Trj/Downloader.DGU Disinfected C:\Documents and Settings\Alghadear\Local Settings\Temp\zwviltwl.exe
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\8HA3GHI3\d[1].htm
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\8HURC1E3\d[1].php[d[1]]
    Spyware:Spyware/XXXToolbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\8HURC1E3\prompt[1].htm
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\CTAF0XE3\d[1].php[d[1]]
    Virus:Exploit/Mhtredir.gen Disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\CTAF0XE3\index[1].htm
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\OPQF8PEF\d[1].php[d[1]]
    Virus:Exploit/Mhtredir.gen Disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\ORWTS5KD\index[2].htm
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\OXI7KDQ3\d[1].php[d[1]]
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\P7Z71XOA\d[1].php[d[1]]
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\SNLJAUF1\d[1].php[d[1]]
    Spyware:Spyware/XXXToolbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\SNLJAUF1\prompt[1].php[prompt[1]]
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\ZZ1NZPWS\d[1].php[d[1]]
    Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Alghadear\Local Settings\Temporary Internet Files\Content.IE5\ZZ1NZPWS\d[2].php[d[2]]
    Adware:Adware/Startpage.ME No disinfected C:\m00.exe
    Adware:Adware/MyWay No disinfected C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL
    Adware:Adware/SuperSpider No disinfected C:\q.exe
    Possible Virus. No disinfected C:\WINDOWS\Downloaded Installations\{66824AEA-4A0F-4A13-8716-B170603E6D38}\MindSoft Utilities XP 8.1 English.msi[unk_0089][io.exe]
    Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\hosts
    Adware:Adware/Antivirus-gold No disinfected C:\WINDOWS\screen.html
    Possible Virus. No disinfected C:\WINDOWS\system32\baksm.dat
    Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts
    Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts.20050618-064145.backup
    Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts.20050619-234038.backup
    Virus:Trj/Agent.RQ Disinfected C:\WINDOWS\system32\fxiegwfr.exe
    Virus:Trj/Downloader.DGU Disinfected C:\WINDOWS\system32\msdcom32.dll
    Adware:Adware/SearchAid No disinfected C:\WINDOWS\system32\msupdate.cmd
    Adware:Adware/Virmaid No disinfected C:\WINDOWS\system32\perfcii.ini
    Possible Virus. No disinfected D:\Program Files\MindSoft\MindSoft Utilities XP 8.1\io.exe


    ________________________________________________________________________


    and this is the result of BitDefender Anti Virus:



    BitDefender Online Scanner - Real Time Virus Report
    Generated at: Thu, Jun 30, 2005 - 20:04:50

    Scan Info
    Scanned Files 85385
    Infected Files 92

    Virus Detected
    Trojan.Downloader.Agent.AP 1
    Backdoor.Small.DC 79
    Dropped:BAT.AutoDelete.A 1
    JS.Trojan.Downloader.IstBar.A 9
    Win32.Worm.Mytob.1.Gen 2


    ________________________________________________________________________


    as you told me after the scan I did everything even the view hiding file which was viewed> and this is my last Highjack This File.


    Logfile of HijackThis v1.99.1
    Scan saved at 8:59:59 PM, on 6/30/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    C:\WINDOWS\System32\devldr32.exe
    D:\Program Files\Avant Browser\avant.exe
    C:\WINDOWS\notepad.exe
    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O8 - Extra context menu item: ÃÖÝ Åáì ÞÇÆãÉ ÇáÅÚáÇä ÇáÓæÏÇÁ - D:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: ÅãäÚ ßáø ÇáÕæÑ ÇáÊí Ýí äÝÓ ÇáÎÇÏã - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: ÅÝÊÍ ßáø ÇáæÕáÇÊ Ýí åÐå ÇáÕÝÍÉ - D:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: ÇáÖæÁ - D:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: ÈÍË - D:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll (file missing)
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

    ________________________________________________________________________

    by the way some of the scan says about Ad Aware SE. files are:
    {{password protected}} wich means couldn't be scaned!!!

    so should I unisttal it ???


    I really don't know how to thank you for your valuebale time.

    I'll wait for ur answer and I'll do what you are going to tell me and if it doesn't work, I will reformat my pc. I'm really getting tired of all this.

    Thanks alot
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    You may want to print these instructions for your reference.

    Reboot into safe mode and delete these files or directories:

    C:\Program Files\MyWay
    C:\WINDOWS\System32\msupdate.cmd
    C:\m00.exe
    C:\q.exe
    C:\WINDOWS\System32\perfcii.ini
    C:\WINDOWS\screen.html
    C:\WINDOWS\system32\baksm.dat

    While in safe mode run Ad-Aware se and spybot again.

    Reboot into normal and download these programs:

    ewido security suite-http://www.ewido.net/en/download/

    CWShredder-http://majorgeeks.com/CWShredder_Last_Merijn_Version_d4086.html

    Cleanup-http://www.stevengould.org/software/cleanup/download.html

    Save the folders to your desktop. Unzip them and show all files. Run CWShredder by clicking Fix.

    Now run cleanup. Run cleanup by clicking cleanup.

    Run the setup file for ewido. When setup is complete open ewido and update the program. Then run a full scan with ewido.

    Run panda activescan again and post that log with a new Hijack This log.
  • mtn_knight
    edited July 2005
    Shadow2018: hi, I did everythings exactly as you told me. and this is the Panda scan result:





    Incident Status Location

    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alghadear\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/ExactSearch No disinfected Windows Registry
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Alghadear\Favorites\Online Gambling\Online Gambling.url
    Possible Virus. No disinfected C:\WINDOWS\Downloaded Installations\{66824AEA-4A0F-4A13-8716-B170603E6D38}\MindSoft Utilities XP 8.1 English.msi[unk_0089][io.exe]
    Possible Virus. No disinfected D:\Program Files\MindSoft\MindSoft Utilities XP 8.1\io.exe
    ________________________________________________________________________



    and this is my last HighJack This file:

    Logfile of HijackThis v1.99.1
    Scan saved at 2:43:45 AM, on 7/3/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    D:\Program Files\ewido\security suite\ewidoctrl.exe
    D:\Program Files\ewido\security suite\ewidoguard.exe
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll (file missing)
    O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe


    anything else I need to do please let me know!!

    Thank you very much
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    Download cleanup4.0 and save it to your desktop. Run the setup file and then run cleanup by clicking cleanup. This will clean out your temp files and cookies.

    Then download CWShredder . Unzip the folder and show all files. Open CWShredder and run it by clicking Fix.

    Then if these still exist delete these files/directories:

    Possible Virus. No disinfected D:\Program Files\MindSoft\MindSoft Utilities XP 8.1\io.exe
    Possible Virus. No disinfected C:\WINDOWS\Downloaded
    If the gambling files are not used then delete them as well:
    C:\Documents and Settings\Alghadear\Favorites\Online Gambling\Online Gambling.url

    Then download regcleaner . Save the setup file to your desktop and then run the setup file. Open regcleaner>click tools>registry cleaner>auto registry cleaner. Select all entries and click remove selected.

    Run activescan again and post the results of activescan and a new Hijack this log.
  • mtn_knight
    edited July 2005
    thanks Shadow; this is my last Panda scan result:



    Incident Status Location

    Adware:Adware/ExactSearch No disinfected Windows Registry


    and this is my last HighJack this file:


    Logfile of HijackThis v1.99.1
    Scan saved at 12:20:46 AM, on 7/4/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\ewido\security suite\ewidoctrl.exe
    D:\Program Files\ewido\security suite\ewidoguard.exe
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    C:\WINDOWS\System32\RunDll32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\devldr32.exe
    D:\Program Files\Avant Browser\avant.exe
    C:\WINDOWS\notepad.exe
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O8 - Extra context menu item: ÃÖÝ Åáì ÞÇÆãÉ ÇáÅÚáÇä ÇáÓæÏÇÁ - D:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: ÅãäÚ ßáø ÇáÕæÑ ÇáÊí Ýí äÝÓ ÇáÎÇÏã - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: ÅÝÊÍ ßáø ÇáæÕáÇÊ Ýí åÐå ÇáÕÝÍÉ - D:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: ÇáÖæÁ - D:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: ÈÍË - D:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll (file missing)
    O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

    ________________________________________________________________________

    Shadow: you remember that I told you I have that warning on my desktop! now its gone but I lost my desktop picture. now I have only white desktop and when I move the mouse courser from the teskbar to the desktop it changes from white to gray. I still have the icons but I can not access my desktop even when I do right mouse click, I see the propertie option, but it says "not available". even if I go to control panel> Display there is no option for the desktop.

    please, how can I restore my desktop back and get rid of the lag thing :scratch:

    you have no idea how helpful you've been to me :thumbsup:
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    Try this to restore your desktop:

    In order to restore your desktop settings download the following reg file(thanks to Grinler at Bleeping computer) to your desktop by right clicking on the link, and selecting save as.

    http://www.bleepingcomputer.com/files/reg/smitfraud.reg

    Once it has downloaded, double-click on the smitfraud.reg file on your desktop and when it asks if you would like to merge the data, click on the Yes button.

    Reboot your computer and you should now be able to change your desktop settings back to how you would like it. If your desktop still looks strange, go into your display properties and click on the Themes tab. Change the theme to Windows XP and you will now be using the default Windows XP settings. Then change them as you see fit.


    Let me know if it works.
  • mtn_knight
    edited July 2005
    Shadow2018; thanks alot for your help. I really apriciate it. Thanks alot. Everything back to normal now. Just one thing, which is that I have a screan saver prog. (water Illusion v2.01) which was activated before this happened, but now it says that Trial Version and I should either buy a Key licen or Enter one. But really it doesn't matter to me at all after all what you have done. I mean it is ok even if doesn't work, because I lost the Product Key for the screan saver prog. Anyway this is my last HijackThis File and you tell me if there is anything else I must do:


    Logfile of HijackThis v1.99.1
    Scan saved at 3:51:48 PM, on 7/8/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\RunDll32.exe
    D:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\WINDOWS\Explorer.EXE
    D:\Program Files\ewido\security suite\ewidoctrl.exe
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\Program Files\Digital Design Ltd\Installers\MCCINST.EXE
    C:\WINDOWS\system32\devldr32.exe
    D:\Program Files\ewido\security suite\ewidoguard.exe
    D:\Program Files\Executive Software\Diskeeper\DfrgNTFS.exe
    D:\Program Files\Avant Browser\avant.exe
    C:\Documents and Settings\Alghadear\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
    O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Add to AD Black List - D:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: Block All Images from the Same Server - D:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Highlight - D:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: Open All Links in This Page... - D:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
    O8 - Extra context menu item: Search - D:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120477866529
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O20 - Winlogon Notify: FolderGuard - D:\Program Files\Folder Guard XP\FGuard32.dll
    O21 - SSODL: DCOM Server - {2c1cd3d7-86ac-4068-93bc-a02304bb8c34} - C:\WINDOWS\System32\msdcom32.dll (file missing)
    O23 - Service: Diskeeper - Executive Software International, Inc. - D:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
    O23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: Metric Conversion Calculator Installer - Unknown owner - C:\Program Files\Digital Design Ltd\Metric Conversion Calculator\MCCINST.EXE" /update (file missing)
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

    Shadow2018: thanks again and again. :celebrate
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    Run regcleaner. The screen that first comes up is a list of registry entries. Look for ExactSearch and once found please delete it. If you find other entries for old programs that are no longer instaled on your system delete those as well. Let me know in your next post if you were able to remove this entry.
  • mtn_knight
    edited July 2005
    Shadow2018: Thanks alot, but there is no such entry as ExactSearch,and there is one or two entries for Netscape which I don't have and didn't use at all. should I remove them? thanks again shadow
  • Shadow2018Shadow2018 Northwest Missouri
    edited July 2005
    Yes. Remove any entries found for programs that you do not currently use.
Sign In or Register to comment.