HSA, Shopping Wizard, and Antivirus-Gold problems - michellgomez

michellgomez

Hello,

I need some help. I have read a lot of your instructionals to try to help myself before asking for help, but I must bow down to the "gods" of spyware removal and ask for help.

HSA and Shopping Wizard are on my computer. Also, my desktop has been taken over my an advertisement for Antivirus-Gold. Oh, and I have Norton on my computer.

I have downloaded and run CWSshredder, Ad-aware, Spybot Search and Destroy. I have downloaded all their updates. I have run them several times, restarted, run several times again, even "yanked the plug from the wall," and started all over again. CWSshredder now doesn't show any problems but Spybot shows a CWS infection but cannot fix it.

I have saved all of my important files to disks incase of a total system meltdown or need to restore to factory default (wish I were laughing at that).

I know you guys are really busy, but any help will be greatly appreciated.

Here is my HKT file.

Logfile of HijackThis v1.99.1
Scan saved at 12:33:23 PM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\crhf32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX03.531\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\FIXCOM~1\SPYBOT~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Class - {7CDA428B-E678-4696-262A-B07C9ECE7D9C} - C:\WINDOWS\atlan32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\WINDOWS\system32\msfw.exe
O4 - HKLM\..\RunOnce: [netys32.exe] C:\WINDOWS\netys32.exe
O4 - HKLM\..\RunOnce: [atltx32.exe] C:\WINDOWS\atltx32.exe
O4 - HKLM\..\RunOnce: [ipmw32.exe] C:\WINDOWS\ipmw32.exe
O4 - HKLM\..\RunOnce: [apipg32.exe] C:\WINDOWS\system32\apipg32.exe
O4 - HKLM\..\RunOnce: [ntdd.exe] C:\WINDOWS\system32\ntdd.exe
O4 - HKLM\..\RunOnce: [ieue.exe] C:\WINDOWS\ieue.exe
O4 - HKLM\..\RunOnce: [mfcsa.exe] C:\WINDOWS\mfcsa.exe
O4 - HKLM\..\RunOnce: [iefp.exe] C:\WINDOWS\system32\iefp.exe
O4 - HKLM\..\RunOnce: [iezi32.exe] C:\WINDOWS\iezi32.exe
O4 - HKLM\..\RunOnce: [atlsx32.exe] C:\WINDOWS\system32\atlsx32.exe
O4 - HKLM\..\RunOnce: [syshj32.exe] C:\WINDOWS\system32\syshj32.exe
O4 - HKLM\..\RunOnce: [atlln.exe] C:\WINDOWS\atlln.exe
O4 - HKLM\..\RunOnce: [msqh32.exe] C:\WINDOWS\msqh32.exe
O4 - HKLM\..\RunOnce: [ntpw.exe] C:\WINDOWS\ntpw.exe
O4 - HKLM\..\RunOnce: [sdkxc.exe] C:\WINDOWS\sdkxc.exe
O4 - HKLM\..\RunOnce: [ntzt.exe] C:\WINDOWS\system32\ntzt.exe
O4 - HKLM\..\RunOnce: [sdknv32.exe] C:\WINDOWS\system32\sdknv32.exe
O4 - HKLM\..\RunOnce: [mfcsp32.exe] C:\WINDOWS\mfcsp32.exe
O4 - HKLM\..\RunOnce: [appnb.exe] C:\WINDOWS\appnb.exe
O4 - HKLM\..\RunOnce: [d3sv32.exe] C:\WINDOWS\system32\d3sv32.exe
O4 - HKLM\..\RunOnce: [syssj.exe] C:\WINDOWS\syssj.exe
O4 - HKLM\..\RunOnce: [netvs32.exe] C:\WINDOWS\netvs32.exe
O4 - HKLM\..\RunOnce: [sdkxp32.exe] C:\WINDOWS\system32\sdkxp32.exe
O4 - HKLM\..\RunOnce: [winaz32.exe] C:\WINDOWS\system32\winaz32.exe
O4 - HKLM\..\RunOnce: [apivx32.exe] C:\WINDOWS\apivx32.exe
O4 - HKLM\..\RunOnce: [ieeb32.exe] C:\WINDOWS\system32\ieeb32.exe
O4 - HKLM\..\RunOnce: [ntjd32.exe] C:\WINDOWS\ntjd32.exe
O4 - HKLM\..\RunOnce: [syspu.exe] C:\WINDOWS\syspu.exe
O4 - HKLM\..\RunOnce: [ietu32.exe] C:\WINDOWS\system32\ietu32.exe
O4 - HKLM\..\RunOnce: [winoq.exe] C:\WINDOWS\system32\winoq.exe
O4 - HKLM\..\RunOnce: [sdkbf32.exe] C:\WINDOWS\system32\sdkbf32.exe
O4 - HKLM\..\RunOnce: [mfchz.exe] C:\WINDOWS\system32\mfchz.exe
O4 - HKLM\..\RunOnce: [crbl.exe] C:\WINDOWS\crbl.exe
O4 - HKLM\..\RunOnce: [winuh.exe] C:\WINDOWS\system32\winuh.exe
O4 - HKLM\..\RunOnce: [javaij.exe] C:\WINDOWS\javaij.exe
O4 - HKLM\..\RunOnce: [mfcne32.exe] C:\WINDOWS\system32\mfcne32.exe
O4 - HKLM\..\RunOnce: [ipsi32.exe] C:\WINDOWS\ipsi32.exe
O4 - HKLM\..\RunOnce: [apikm.exe] C:\WINDOWS\apikm.exe
O4 - HKLM\..\RunOnce: [netyp32.exe] C:\WINDOWS\netyp32.exe
O4 - HKLM\..\RunOnce: [crip32.exe] C:\WINDOWS\crip32.exe
O4 - HKLM\..\RunOnce: [addte.exe] C:\WINDOWS\system32\addte.exe
O4 - HKLM\..\RunOnce: [mswq32.exe] C:\WINDOWS\system32\mswq32.exe
O4 - HKLM\..\RunOnce: [ntck32.exe] C:\WINDOWS\system32\ntck32.exe
O4 - HKLM\..\RunOnce: [mspa.exe] C:\WINDOWS\system32\mspa.exe
O4 - HKLM\..\RunOnce: [appbx32.exe] C:\WINDOWS\system32\appbx32.exe
O4 - HKLM\..\RunOnce: [sdkie.exe] C:\WINDOWS\sdkie.exe
O4 - HKLM\..\RunOnce: [sysdc32.exe] C:\WINDOWS\system32\sysdc32.exe
O4 - HKLM\..\RunOnce: [msbv.exe] C:\WINDOWS\system32\msbv.exe
O4 - HKLM\..\RunOnce: [mszt.exe] C:\WINDOWS\system32\mszt.exe
O4 - HKLM\..\RunOnce: [sdkpj.exe] C:\WINDOWS\sdkpj.exe
O4 - HKLM\..\RunOnce: [d3dj.exe] C:\WINDOWS\system32\d3dj.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [addht32.exe] C:\WINDOWS\system32\addht32.exe
O4 - HKLM\..\RunOnce: [netcz32.exe] C:\WINDOWS\system32\netcz32.exe
O4 - HKLM\..\RunOnce: [appso.exe] C:\WINDOWS\appso.exe
O4 - HKLM\..\RunOnce: [winvq.exe] C:\WINDOWS\winvq.exe
O4 - HKLM\..\RunOnce: [sysfo.exe] C:\WINDOWS\system32\sysfo.exe
O4 - HKLM\..\RunOnce: [javaee32.exe] C:\WINDOWS\system32\javaee32.exe
O4 - HKLM\..\RunOnce: [apiut.exe] C:\WINDOWS\apiut.exe
O4 - HKLM\..\RunOnce: [mfcxd.exe] C:\WINDOWS\system32\mfcxd.exe
O4 - HKLM\..\RunOnce: [ntbh32.exe] C:\WINDOWS\system32\ntbh32.exe
O4 - HKLM\..\RunOnce: [apilh.exe] C:\WINDOWS\system32\apilh.exe
O4 - HKLM\..\RunOnce: [netrw32.exe] C:\WINDOWS\system32\netrw32.exe
O4 - HKLM\..\RunOnce: [apift32.exe] C:\WINDOWS\apift32.exe
O4 - HKLM\..\RunOnce: [netfj32.exe] C:\WINDOWS\netfj32.exe
O4 - HKLM\..\RunOnce: [sdkkn32.exe] C:\WINDOWS\system32\sdkkn32.exe
O4 - HKLM\..\RunOnce: [addkn.exe] C:\WINDOWS\addkn.exe
O4 - HKLM\..\RunOnce: [netii32.exe] C:\WINDOWS\netii32.exe
O4 - HKLM\..\RunOnce: [ipqq32.exe] C:\WINDOWS\ipqq32.exe
O4 - HKLM\..\RunOnce: [d3ar32.exe] C:\WINDOWS\system32\d3ar32.exe
O4 - HKLM\..\RunOnce: [mfcaz.exe] C:\WINDOWS\mfcaz.exe
O4 - HKLM\..\RunOnce: [added.exe] C:\WINDOWS\system32\added.exe
O4 - HKLM\..\RunOnce: [ntyo.exe] C:\WINDOWS\system32\ntyo.exe
O4 - HKLM\..\RunOnce: [netnd.exe] C:\WINDOWS\netnd.exe
O4 - HKLM\..\RunOnce: [addyw32.exe] C:\WINDOWS\addyw32.exe
O4 - HKLM\..\RunOnce: [appji.exe] C:\WINDOWS\system32\appji.exe
O4 - HKLM\..\RunOnce: [netnm.exe] C:\WINDOWS\system32\netnm.exe
O4 - HKLM\..\RunOnce: [appaw.exe] C:\WINDOWS\appaw.exe
O4 - HKLM\..\RunOnce: [winbw.exe] C:\WINDOWS\winbw.exe
O4 - HKLM\..\RunOnce: [netql32.exe] C:\WINDOWS\netql32.exe
O4 - HKLM\..\RunOnce: [javapt32.exe] C:\WINDOWS\javapt32.exe
O4 - HKLM\..\RunOnce: [ntke.exe] C:\WINDOWS\ntke.exe
O4 - HKLM\..\RunOnce: [appju32.exe] C:\WINDOWS\appju32.exe
O4 - HKLM\..\RunOnce: [iezb32.exe] C:\WINDOWS\system32\iezb32.exe
O4 - HKLM\..\RunOnce: [syshr.exe] C:\WINDOWS\system32\syshr.exe
O4 - HKLM\..\RunOnce: [ieis.exe] C:\WINDOWS\ieis.exe
O4 - HKLM\..\RunOnce: [atlxh.exe] C:\WINDOWS\system32\atlxh.exe
O4 - HKLM\..\RunOnce: [winmw32.exe] C:\WINDOWS\system32\winmw32.exe
O4 - HKLM\..\RunOnce: [appgh.exe] C:\WINDOWS\system32\appgh.exe
O4 - HKLM\..\RunOnce: [netkl32.exe] C:\WINDOWS\netkl32.exe
O4 - HKLM\..\RunOnce: [atltm.exe] C:\WINDOWS\atltm.exe
O4 - HKLM\..\RunOnce: [mfczi32.exe] C:\WINDOWS\mfczi32.exe
O4 - HKLM\..\RunOnce: [ieth.exe] C:\WINDOWS\ieth.exe
O4 - HKLM\..\RunOnce: [netnl.exe] C:\WINDOWS\netnl.exe
O4 - HKLM\..\RunOnce: [atlca.exe] C:\WINDOWS\atlca.exe
O4 - HKLM\..\RunOnce: [ient32.exe] C:\WINDOWS\system32\ient32.exe
O4 - HKLM\..\RunOnce: [wingm.exe] C:\WINDOWS\wingm.exe
O4 - HKLM\..\RunOnce: [mfcci.exe] C:\WINDOWS\mfcci.exe
O4 - HKLM\..\RunOnce: [ntvj32.exe] C:\WINDOWS\ntvj32.exe
O4 - HKLM\..\RunOnce: [crlq.exe] C:\WINDOWS\crlq.exe
O4 - HKLM\..\RunOnce: [syspu32.exe] C:\WINDOWS\syspu32.exe
O4 - HKLM\..\RunOnce: [msyv.exe] C:\WINDOWS\msyv.exe
O4 - HKLM\..\RunOnce: [mser32.exe] C:\WINDOWS\mser32.exe
O4 - HKLM\..\RunOnce: [msto32.exe] C:\WINDOWS\system32\msto32.exe
O4 - HKLM\..\RunOnce: [ipxl32.exe] C:\WINDOWS\ipxl32.exe
O4 - HKLM\..\RunOnce: [mssw32.exe] C:\WINDOWS\system32\mssw32.exe
O4 - HKLM\..\RunOnce: [winxb.exe] C:\WINDOWS\system32\winxb.exe
O4 - HKLM\..\RunOnce: [sysgb32.exe] C:\WINDOWS\system32\sysgb32.exe
O4 - HKLM\..\RunOnce: [sdkaa.exe] C:\WINDOWS\system32\sdkaa.exe
O4 - HKLM\..\RunOnce: [addul.exe] C:\WINDOWS\system32\addul.exe
O4 - HKLM\..\RunOnce: [iejs.exe] C:\WINDOWS\iejs.exe
O4 - HKLM\..\RunOnce: [sdkul32.exe] C:\WINDOWS\sdkul32.exe
O4 - HKLM\..\RunOnce: [crfe32.exe] C:\WINDOWS\system32\crfe32.exe
O4 - HKLM\..\RunOnce: [apikb32.exe] C:\WINDOWS\system32\apikb32.exe
O4 - HKLM\..\RunOnce: [crnm.exe] C:\WINDOWS\system32\crnm.exe
O4 - HKLM\..\RunOnce: [ntry.exe] C:\WINDOWS\ntry.exe
O4 - HKLM\..\RunOnce: [iego32.exe] C:\WINDOWS\system32\iego32.exe
O4 - HKLM\..\RunOnce: [addxv.exe] C:\WINDOWS\system32\addxv.exe
O4 - HKLM\..\RunOnce: [apibz32.exe] C:\WINDOWS\apibz32.exe
O4 - HKLM\..\RunOnce: [atlka.exe] C:\WINDOWS\system32\atlka.exe
O4 - HKLM\..\RunOnce: [atlqw32.exe] C:\WINDOWS\atlqw32.exe
O4 - HKLM\..\RunOnce: [atlet32.exe] C:\WINDOWS\system32\atlet32.exe
O4 - HKLM\..\RunOnce: [msjp32.exe] C:\WINDOWS\system32\msjp32.exe
O4 - HKLM\..\RunOnce: [mfceb32.exe] C:\WINDOWS\system32\mfceb32.exe
O4 - HKLM\..\RunOnce: [addwi32.exe] C:\WINDOWS\addwi32.exe
O4 - HKLM\..\RunOnce: [msmp.exe] C:\WINDOWS\system32\msmp.exe
O4 - HKLM\..\RunOnce: [ntlf32.exe] C:\WINDOWS\system32\ntlf32.exe
O4 - HKLM\..\RunOnce: [mfcku32.exe] C:\WINDOWS\mfcku32.exe
O4 - HKLM\..\RunOnce: [syspe32.exe] C:\WINDOWS\system32\syspe32.exe
O4 - HKLM\..\RunOnce: [atlid32.exe] C:\WINDOWS\atlid32.exe
O4 - HKLM\..\RunOnce: [mfcbo32.exe] C:\WINDOWS\system32\mfcbo32.exe
O4 - HKLM\..\RunOnce: [sysgl32.exe] C:\WINDOWS\system32\sysgl32.exe
O4 - HKLM\..\RunOnce: [apibe.exe] C:\WINDOWS\system32\apibe.exe
O4 - HKLM\..\RunOnce: [appfi.exe] C:\WINDOWS\appfi.exe
O4 - HKLM\..\RunOnce: [ipux32.exe] C:\WINDOWS\system32\ipux32.exe
O4 - HKLM\..\RunOnce: [crkf.exe] C:\WINDOWS\system32\crkf.exe
O4 - HKLM\..\RunOnce: [sysoj32.exe] C:\WINDOWS\sysoj32.exe
O4 - HKLM\..\RunOnce: [d3yr.exe] C:\WINDOWS\system32\d3yr.exe
O4 - HKLM\..\RunOnce: [mseg32.exe] C:\WINDOWS\mseg32.exe
O4 - HKLM\..\RunOnce: [d3sd32.exe] C:\WINDOWS\system32\d3sd32.exe
O4 - HKLM\..\RunOnce: [addcb.exe] C:\WINDOWS\system32\addcb.exe
O4 - HKLM\..\RunOnce: [apivc.exe] C:\WINDOWS\system32\apivc.exe
O4 - HKLM\..\RunOnce: [sysmc32.exe] C:\WINDOWS\system32\sysmc32.exe
O4 - HKLM\..\RunOnce: [netar.exe] C:\WINDOWS\system32\netar.exe
O4 - HKLM\..\RunOnce: [ntzg32.exe] C:\WINDOWS\ntzg32.exe
O4 - HKLM\..\RunOnce: [appta32.exe] C:\WINDOWS\appta32.exe
O4 - HKLM\..\RunOnce: [apixe.exe] C:\WINDOWS\system32\apixe.exe
O4 - HKLM\..\RunOnce: [atlye32.exe] C:\WINDOWS\atlye32.exe
O4 - HKLM\..\RunOnce: [atlnb32.exe] C:\WINDOWS\system32\atlnb32.exe
O4 - HKLM\..\RunOnce: [msrx32.exe] C:\WINDOWS\msrx32.exe
O4 - HKLM\..\RunOnce: [mfcnj32.exe] C:\WINDOWS\system32\mfcnj32.exe
O4 - HKLM\..\RunOnce: [netzn.exe] C:\WINDOWS\netzn.exe
O4 - HKLM\..\RunOnce: [apiao32.exe] C:\WINDOWS\system32\apiao32.exe
O4 - HKLM\..\RunOnce: [apipl.exe] C:\WINDOWS\apipl.exe
O4 - HKLM\..\RunOnce: [winab32.exe] C:\WINDOWS\system32\winab32.exe
O4 - HKLM\..\RunOnce: [netdn32.exe] C:\WINDOWS\netdn32.exe
O4 - HKLM\..\RunOnce: [sdkhr.exe] C:\WINDOWS\sdkhr.exe
O4 - HKLM\..\RunOnce: [ntqs32.exe] C:\WINDOWS\ntqs32.exe
O4 - HKLM\..\RunOnce: [ipxo32.exe] C:\WINDOWS\ipxo32.exe
O4 - HKLM\..\RunOnce: [appbt32.exe] C:\WINDOWS\appbt32.exe
O4 - HKLM\..\RunOnce: [ntee32.exe] C:\WINDOWS\system32\ntee32.exe
O4 - HKLM\..\RunOnce: [crjj.exe] C:\WINDOWS\system32\crjj.exe
O4 - HKLM\..\RunOnce: [javakj32.exe] C:\WINDOWS\system32\javakj32.exe
O4 - HKLM\..\RunOnce: [sdkyg32.exe] C:\WINDOWS\system32\sdkyg32.exe
O4 - HKLM\..\RunOnce: [atldc32.exe] C:\WINDOWS\system32\atldc32.exe
O4 - HKLM\..\RunOnce: [javago32.exe] C:\WINDOWS\javago32.exe
O4 - HKLM\..\RunOnce: [msls.exe] C:\WINDOWS\msls.exe
O4 - HKLM\..\RunOnce: [crms32.exe] C:\WINDOWS\system32\crms32.exe
O4 - HKLM\..\RunOnce: [atlvz.exe] C:\WINDOWS\atlvz.exe
O4 - HKLM\..\RunOnce: [ntko32.exe] C:\WINDOWS\system32\ntko32.exe
O4 - HKLM\..\RunOnce: [d3jv.exe] C:\WINDOWS\system32\d3jv.exe
O4 - HKLM\..\RunOnce: [winfz32.exe] C:\WINDOWS\winfz32.exe
O4 - HKLM\..\RunOnce: [msoa.exe] C:\WINDOWS\msoa.exe
O4 - HKLM\..\RunOnce: [iecw32.exe] C:\WINDOWS\iecw32.exe
O4 - HKLM\..\RunOnce: [msqt32.exe] C:\WINDOWS\system32\msqt32.exe
O4 - HKLM\..\RunOnce: [ntvq32.exe] C:\WINDOWS\system32\ntvq32.exe
O4 - HKLM\..\RunOnce: [ieqb32.exe] C:\WINDOWS\system32\ieqb32.exe
O4 - HKLM\..\RunOnce: [addvg.exe] C:\WINDOWS\addvg.exe
O4 - HKLM\..\RunOnce: [wineo32.exe] C:\WINDOWS\system32\wineo32.exe
O4 - HKLM\..\RunOnce: [javaxf.exe] C:\WINDOWS\system32\javaxf.exe
O4 - HKLM\..\RunOnce: [addsq.exe] C:\WINDOWS\system32\addsq.exe
O4 - HKLM\..\RunOnce: [syshx.exe] C:\WINDOWS\system32\syshx.exe
O4 - HKLM\..\RunOnce: [javasq32.exe] C:\WINDOWS\javasq32.exe
O4 - HKLM\..\RunOnce: [crdj.exe] C:\WINDOWS\system32\crdj.exe
O4 - HKLM\..\RunOnce: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\RunOnce: [atlro32.exe] C:\WINDOWS\system32\atlro32.exe
O4 - HKLM\..\RunOnce: [ipqw.exe] C:\WINDOWS\system32\ipqw.exe
O4 - HKLM\..\RunOnce: [crms.exe] C:\WINDOWS\system32\crms.exe
O4 - HKLM\..\RunOnce: [ieet32.exe] C:\WINDOWS\system32\ieet32.exe
O4 - HKLM\..\RunOnce: [appua.exe] C:\WINDOWS\system32\appua.exe
O4 - HKLM\..\RunOnce: [netye32.exe] C:\WINDOWS\system32\netye32.exe
O4 - HKLM\..\RunOnce: [atlif.exe] C:\WINDOWS\system32\atlif.exe
O4 - HKLM\..\RunOnce: [mfcob32.exe] C:\WINDOWS\system32\mfcob32.exe
O4 - HKLM\..\RunOnce: [mfccy32.exe] C:\WINDOWS\system32\mfccy32.exe
O4 - HKLM\..\RunOnce: [netce.exe] C:\WINDOWS\netce.exe
O4 - HKLM\..\RunOnce: [atlrt.exe] C:\WINDOWS\atlrt.exe
O4 - HKLM\..\RunOnce: [iebm32.exe] C:\WINDOWS\iebm32.exe
O4 - HKLM\..\RunOnce: [winvf.exe] C:\WINDOWS\system32\winvf.exe
O4 - HKLM\..\RunOnce: [mfcrb.exe] C:\WINDOWS\system32\mfcrb.exe
O4 - HKLM\..\RunOnce: [ipjc32.exe] C:\WINDOWS\system32\ipjc32.exe
O4 - HKLM\..\RunOnce: [craj.exe] C:\WINDOWS\system32\craj.exe
O4 - HKLM\..\RunOnce: [sysdn32.exe] C:\WINDOWS\sysdn32.exe
O4 - HKLM\..\RunOnce: [msno.exe] C:\WINDOWS\system32\msno.exe
O4 - HKLM\..\RunOnce: [mstk32.exe] C:\WINDOWS\mstk32.exe
O4 - HKLM\..\RunOnce: [mshh32.exe] C:\WINDOWS\system32\mshh32.exe
O4 - HKLM\..\RunOnce: [ipmd32.exe] C:\WINDOWS\system32\ipmd32.exe
O4 - HKLM\..\RunOnce: [mshp32.exe] C:\WINDOWS\system32\mshp32.exe
O4 - HKLM\..\RunOnce: [winmt.exe] C:\WINDOWS\winmt.exe
O4 - HKLM\..\RunOnce: [javaaw.exe] C:\WINDOWS\system32\javaaw.exe
O4 - HKLM\..\RunOnce: [netea.exe] C:\WINDOWS\netea.exe
O4 - HKLM\..\RunOnce: [d3tx32.exe] C:\WINDOWS\d3tx32.exe
O4 - HKLM\..\RunOnce: [sysje.exe] C:\WINDOWS\sysje.exe
O4 - HKLM\..\RunOnce: [mfcni32.exe] C:\WINDOWS\mfcni32.exe
O4 - HKLM\..\RunOnce: [addxj.exe] C:\WINDOWS\addxj.exe
O4 - HKLM\..\RunOnce: [appdg32.exe] C:\WINDOWS\appdg32.exe
O4 - HKLM\..\RunOnce: [addrv32.exe] C:\WINDOWS\system32\addrv32.exe
O4 - HKLM\..\RunOnce: [d3wz32.exe] C:\WINDOWS\d3wz32.exe
O4 - HKLM\..\RunOnce: [apprl32.exe] C:\WINDOWS\system32\apprl32.exe
O4 - HKLM\..\RunOnce: [apiep32.exe] C:\WINDOWS\apiep32.exe
O4 - HKLM\..\RunOnce: [sysjl.exe] C:\WINDOWS\system32\sysjl.exe
O4 - HKLM\..\RunOnce: [d3ex.exe] C:\WINDOWS\d3ex.exe
O4 - HKLM\..\RunOnce: [appum32.exe] C:\WINDOWS\system32\appum32.exe
O4 - HKLM\..\RunOnce: [winxo.exe] C:\WINDOWS\winxo.exe
O4 - HKLM\..\RunOnce: [crih32.exe] C:\WINDOWS\crih32.exe
O4 - HKLM\..\RunOnce: [d3ba.exe] C:\WINDOWS\system32\d3ba.exe
O4 - HKLM\..\RunOnce: [winxe.exe] C:\WINDOWS\system32\winxe.exe
O4 - HKLM\..\RunOnce: [mfcqx32.exe] C:\WINDOWS\system32\mfcqx32.exe
O4 - HKLM\..\RunOnce: [ntgm.exe] C:\WINDOWS\system32\ntgm.exe
O4 - HKLM\..\RunOnce: [d3ki32.exe] C:\WINDOWS\d3ki32.exe
O4 - HKLM\..\RunOnce: [sdktr.exe] C:\WINDOWS\system32\sdktr.exe
O4 - HKLM\..\RunOnce: [javazf32.exe] C:\WINDOWS\javazf32.exe
O4 - HKLM\..\RunOnce: [sdkoc32.exe] C:\WINDOWS\system32\sdkoc32.exe
O4 - HKLM\..\RunOnce: [mfcsg32.exe] C:\WINDOWS\system32\mfcsg32.exe
O4 - HKLM\..\RunOnce: [javans32.exe] C:\WINDOWS\system32\javans32.exe
O4 - HKLM\..\RunOnce: [mssw.exe] C:\WINDOWS\mssw.exe
O4 - HKLM\..\RunOnce: [d3bx32.exe] C:\WINDOWS\system32\d3bx32.exe
O4 - HKLM\..\RunOnce: [crpu32.exe] C:\WINDOWS\crpu32.exe
O4 - HKLM\..\RunOnce: [mspz.exe] C:\WINDOWS\system32\mspz.exe
O4 - HKLM\..\RunOnce: [javaeo.exe] C:\WINDOWS\system32\javaeo.exe
O4 - HKLM\..\RunOnce: [netph32.exe] C:\WINDOWS\netph32.exe
O4 - HKLM\..\RunOnce: [ipis32.exe] C:\WINDOWS\ipis32.exe
O4 - HKLM\..\RunOnce: [appnp32.exe] C:\WINDOWS\system32\appnp32.exe
O4 - HKLM\..\RunOnce: [ntia.exe] C:\WINDOWS\ntia.exe
O4 - HKLM\..\RunOnce: [apimm.exe] C:\WINDOWS\system32\apimm.exe
O4 - HKLM\..\RunOnce: [javabc32.exe] C:\WINDOWS\system32\javabc32.exe
O4 - HKLM\..\RunOnce: [iesj.exe] C:\WINDOWS\system32\iesj.exe
O4 - HKLM\..\RunOnce: [appwn32.exe] C:\WINDOWS\system32\appwn32.exe
O4 - HKLM\..\RunOnce: [winlk32.exe] C:\WINDOWS\system32\winlk32.exe
O4 - HKLM\..\RunOnce: [syszh32.exe] C:\WINDOWS\syszh32.exe
O4 - HKLM\..\RunOnce: [mfcjf.exe] C:\WINDOWS\system32\mfcjf.exe
O4 - HKLM\..\RunOnce: [ntcg.exe] C:\WINDOWS\system32\ntcg.exe
O4 - HKLM\..\RunOnce: [apptg32.exe] C:\WINDOWS\system32\apptg32.exe
O4 - HKLM\..\RunOnce: [sdkiv.exe] C:\WINDOWS\system32\sdkiv.exe
O4 - HKLM\..\RunOnce: [crhl32.exe] C:\WINDOWS\crhl32.exe
O4 - HKLM\..\RunOnce: [apiae32.exe] C:\WINDOWS\system32\apiae32.exe
O4 - HKLM\..\RunOnce: [netam.exe] C:\WINDOWS\system32\netam.exe
O4 - HKLM\..\RunOnce: [mfcjm.exe] C:\WINDOWS\mfcjm.exe
O4 - HKLM\..\RunOnce: [javayb32.exe] C:\WINDOWS\system32\javayb32.exe
O4 - HKLM\..\RunOnce: [msor32.exe] C:\WINDOWS\system32\msor32.exe
O4 - HKLM\..\RunOnce: [crju.exe] C:\WINDOWS\crju.exe
O4 - HKLM\..\RunOnce: [netik32.exe] C:\WINDOWS\netik32.exe
O4 - HKLM\..\RunOnce: [appga32.exe] C:\WINDOWS\system32\appga32.exe
O4 - HKLM\..\RunOnce: [atlgi.exe] C:\WINDOWS\atlgi.exe
O4 - HKLM\..\RunOnce: [sdkkr32.exe] C:\WINDOWS\sdkkr32.exe
O4 - HKLM\..\RunOnce: [javakh.exe] C:\WINDOWS\javakh.exe
O4 - HKLM\..\RunOnce: [sdksh.exe] C:\WINDOWS\sdksh.exe
O4 - HKLM\..\RunOnce: [ieix32.exe] C:\WINDOWS\ieix32.exe
O4 - HKLM\..\RunOnce: [appye32.exe] C:\WINDOWS\appye32.exe
O4 - HKLM\..\RunOnce: [winbi.exe] C:\WINDOWS\winbi.exe
O4 - HKLM\..\RunOnce: [javaax32.exe] C:\WINDOWS\javaax32.exe
O4 - HKLM\..\RunOnce: [netqn.exe] C:\WINDOWS\system32\netqn.exe
O4 - HKLM\..\RunOnce: [addpd32.exe] C:\WINDOWS\system32\addpd32.exe
O4 - HKLM\..\RunOnce: [msos32.exe] C:\WINDOWS\msos32.exe
O4 - HKLM\..\RunOnce: [iena32.exe] C:\WINDOWS\iena32.exe
O4 - HKLM\..\RunOnce: [atlxb32.exe] C:\WINDOWS\atlxb32.exe
O4 - HKLM\..\RunOnce: [crxb.exe] C:\WINDOWS\system32\crxb.exe
O4 - HKLM\..\RunOnce: [syskt32.exe] C:\WINDOWS\syskt32.exe
O4 - HKLM\..\RunOnce: [crai.exe] C:\WINDOWS\system32\crai.exe
O4 - HKLM\..\RunOnce: [apihy32.exe] C:\WINDOWS\system32\apihy32.exe
O4 - HKLM\..\RunOnce: [addxf32.exe] C:\WINDOWS\addxf32.exe
O4 - HKLM\..\RunOnce: [sysbp.exe] C:\WINDOWS\system32\sysbp.exe
O4 - HKLM\..\RunOnce: [atlxt.exe] C:\WINDOWS\system32\atlxt.exe
O4 - HKLM\..\RunOnce: [ippm32.exe] C:\WINDOWS\system32\ippm32.exe
O4 - HKLM\..\RunOnce: [crgb.exe] C:\WINDOWS\system32\crgb.exe
O4 - HKLM\..\RunOnce: [syskx32.exe] C:\WINDOWS\syskx32.exe
O4 - HKLM\..\RunOnce: [d3tg.exe] C:\WINDOWS\system32\d3tg.exe
O4 - HKLM\..\RunOnce: [atlug.exe] C:\WINDOWS\system32\atlug.exe
O4 - HKLM\..\RunOnce: [cros32.exe] C:\WINDOWS\system32\cros32.exe
O4 - HKLM\..\RunOnce: [iemz32.exe] C:\WINDOWS\iemz32.exe
O4 - HKLM\..\RunOnce: [d3hl.exe] C:\WINDOWS\d3hl.exe
O4 - HKLM\..\RunOnce: [ipgb32.exe] C:\WINDOWS\ipgb32.exe
O4 - HKLM\..\RunOnce: [atlxq32.exe] C:\WINDOWS\system32\atlxq32.exe
O4 - HKLM\..\RunOnce: [mfcfy.exe] C:\WINDOWS\system32\mfcfy.exe
O4 - HKLM\..\RunOnce: [appfy.exe] C:\WINDOWS\appfy.exe
O4 - HKLM\..\RunOnce: [atliq32.exe] C:\WINDOWS\system32\atliq32.exe
O4 - HKLM\..\RunOnce: [msnm32.exe] C:\WINDOWS\system32\msnm32.exe
O4 - HKLM\..\RunOnce: [atliy32.exe] C:\WINDOWS\system32\atliy32.exe
O4 - HKLM\..\RunOnce: [netnc.exe] C:\WINDOWS\netnc.exe
O4 - HKLM\..\RunOnce: [apivc32.exe] C:\WINDOWS\system32\apivc32.exe
O4 - HKLM\..\RunOnce: [mfckz32.exe] C:\WINDOWS\mfckz32.exe
O4 - HKLM\..\RunOnce: [syshv32.exe] C:\WINDOWS\system32\syshv32.exe
O4 - HKLM\..\RunOnce: [apikh32.exe] C:\WINDOWS\apikh32.exe
O4 - HKLM\..\RunOnce: [ntol.exe] C:\WINDOWS\system32\ntol.exe
O4 - HKLM\..\RunOnce: [adddo.exe] C:\WINDOWS\adddo.exe
O4 - HKLM\..\RunOnce: [iega.exe] C:\WINDOWS\iega.exe
O4 - HKLM\..\RunOnce: [mfcwp32.exe] C:\WINDOWS\system32\mfcwp32.exe
O4 - HKLM\..\RunOnce: [ipmw.exe] C:\WINDOWS\system32\ipmw.exe
O4 - HKLM\..\RunOnce: [crqa32.exe] C:\WINDOWS\system32\crqa32.exe
O4 - HKLM\..\RunOnce: [sdkab.exe] C:\WINDOWS\system32\sdkab.exe
O4 - HKLM\..\RunOnce: [sdkfy32.exe] C:\WINDOWS\system32\sdkfy32.exe
O4 - HKLM\..\RunOnce: [sdkuu32.exe] C:\WINDOWS\system32\sdkuu32.exe
O4 - HKLM\..\RunOnce: [ieel.exe] C:\WINDOWS\system32\ieel.exe
O4 - HKLM\..\RunOnce: [addom.exe] C:\WINDOWS\system32\addom.exe
O4 - HKLM\..\RunOnce: [crnt32.exe] C:\WINDOWS\system32\crnt32.exe
O4 - HKLM\..\RunOnce: [appci.exe] C:\WINDOWS\system32\appci.exe
O4 - HKLM\..\RunOnce: [mfcbq.exe] C:\WINDOWS\mfcbq.exe
O4 - HKLM\..\RunOnce: [ntlr.exe] C:\WINDOWS\ntlr.exe
O4 - HKLM\..\RunOnce: [applr32.exe] C:\WINDOWS\applr32.exe
O4 - HKLM\..\RunOnce: [sdkrn32.exe] C:\WINDOWS\sdkrn32.exe
O4 - HKLM\..\RunOnce: [addrn.exe] C:\WINDOWS\system32\addrn.exe
O4 - HKLM\..\RunOnce: [ievz.exe] C:\WINDOWS\ievz.exe
O4 - HKLM\..\RunOnce: [atlkp32.exe] C:\WINDOWS\system32\atlkp32.exe
O4 - HKLM\..\RunOnce: [ipjw32.exe] C:\WINDOWS\ipjw32.exe
O4 - HKLM\..\RunOnce: [apiei.exe] C:\WINDOWS\apiei.exe
O4 - HKLM\..\RunOnce: [sysdp32.exe] C:\WINDOWS\sysdp32.exe
O4 - HKLM\..\RunOnce: [crbf32.exe] C:\WINDOWS\system32\crbf32.exe
O4 - HKLM\..\RunOnce: [sdkwp.exe] C:\WINDOWS\sdkwp.exe
O4 - HKLM\..\RunOnce: [msat32.exe] C:\WINDOWS\msat32.exe
O4 - HKLM\..\RunOnce: [crkt.exe] C:\WINDOWS\crkt.exe
O4 - HKLM\..\RunOnce: [d3qq32.exe] C:\WINDOWS\d3qq32.exe
O4 - HKLM\..\RunOnce: [cref32.exe] C:\WINDOWS\system32\cref32.exe
O4 - HKLM\..\RunOnce: [apijj32.exe] C:\WINDOWS\system32\apijj32.exe
O4 - HKLM\..\RunOnce: [d3ev32.exe] C:\WINDOWS\system32\d3ev32.exe
O4 - HKLM\..\RunOnce: [sysjz.exe] C:\WINDOWS\sysjz.exe
O4 - HKLM\..\RunOnce: [ntxt.exe] C:\WINDOWS\system32\ntxt.exe
O4 - HKLM\..\RunOnce: [apibf.exe] C:\WINDOWS\system32\apibf.exe
O4 - HKLM\..\RunOnce: [atlcn.exe] C:\WINDOWS\atlcn.exe
O4 - HKLM\..\RunOnce: [ipnm.exe] C:\WINDOWS\ipnm.exe
O4 - HKLM\..\RunOnce: [winbp.exe] C:\WINDOWS\system32\winbp.exe
O4 - HKLM\..\RunOnce: [ipkv32.exe] C:\WINDOWS\system32\ipkv32.exe
O4 - HKLM\..\RunOnce: [javapz.exe] C:\WINDOWS\javapz.exe
O4 - HKLM\..\RunOnce: [sdkyz32.exe] C:\WINDOWS\system32\sdkyz32.exe
O4 - HKLM\..\RunOnce: [ntmw.exe] C:\WINDOWS\ntmw.exe
O4 - HKLM\..\RunOnce: [sdksl.exe] C:\WINDOWS\sdksl.exe
O4 - HKLM\..\RunOnce: [appgp.exe] C:\WINDOWS\appgp.exe
O4 - HKLM\..\RunOnce: [appvk32.exe] C:\WINDOWS\system32\appvk32.exe
O4 - HKLM\..\RunOnce: [javauk32.exe] C:\WINDOWS\javauk32.exe
O4 - HKLM\..\RunOnce: [winpw32.exe] C:\WINDOWS\system32\winpw32.exe
O4 - HKLM\..\RunOnce: [crxr32.exe] C:\WINDOWS\system32\crxr32.exe
O4 - HKLM\..\RunOnce: [apiil32.exe] C:\WINDOWS\system32\apiil32.exe
O4 - HKLM\..\RunOnce: [winvn32.exe] C:\WINDOWS\system32\winvn32.exe
O4 - HKLM\..\RunOnce: [ierz.exe] C:\WINDOWS\system32\ierz.exe
O4 - HKLM\..\RunOnce: [sdkpo32.exe] C:\WINDOWS\system32\sdkpo32.exe
O4 - HKLM\..\RunOnce: [msin32.exe] C:\WINDOWS\system32\msin32.exe
O4 - HKLM\..\RunOnce: [iecy32.exe] C:\WINDOWS\system32\iecy32.exe
O4 - HKLM\..\RunOnce: [sdkhu32.exe] C:\WINDOWS\sdkhu32.exe
O4 - HKLM\..\RunOnce: [javahi32.exe] C:\WINDOWS\javahi32.exe
O4 - HKLM\..\RunOnce: [atlab32.exe] C:\WINDOWS\system32\atlab32.exe
O4 - HKLM\..\RunOnce: [mfcaj32.exe] C:\WINDOWS\system32\mfcaj32.exe
O4 - HKLM\..\RunOnce: [sdkkk32.exe] C:\WINDOWS\sdkkk32.exe
O4 - HKLM\..\RunOnce: [sdkmb32.exe] C:\WINDOWS\system32\sdkmb32.exe
O4 - HKLM\..\RunOnce: [msdj32.exe] C:\WINDOWS\system32\msdj32.exe
O4 - HKLM\..\RunOnce: [cryn.exe] C:\WINDOWS\cryn.exe
O4 - HKLM\..\RunOnce: [apixc32.exe] C:\WINDOWS\apixc32.exe
O4 - HKLM\..\RunOnce: [addvs32.exe] C:\WINDOWS\system32\addvs32.exe
O4 - HKLM\..\RunOnce: [appva.exe] C:\WINDOWS\appva.exe
O4 - HKLM\..\RunOnce: [addea.exe] C:\WINDOWS\system32\addea.exe
O4 - HKLM\..\RunOnce: [nettx32.exe] C:\WINDOWS\nettx32.exe
O4 - HKLM\..\RunOnce: [javajf32.exe] C:\WINDOWS\system32\javajf32.exe
O4 - HKLM\..\RunOnce: [ntei.exe] C:\WINDOWS\system32\ntei.exe
O4 - HKLM\..\RunOnce: [apply32.exe] C:\WINDOWS\system32\apply32.exe
O4 - HKLM\..\RunOnce: [iebn32.exe] C:\WINDOWS\iebn32.exe
O4 - HKLM\..\RunOnce: [sysbv.exe] C:\WINDOWS\sysbv.exe
O4 - HKLM\..\RunOnce: [iekw.exe] C:\WINDOWS\system32\iekw.exe
O4 - HKLM\..\RunOnce: [apitc32.exe] C:\WINDOWS\apitc32.exe
O4 - HKLM\..\RunOnce: [addsr.exe] C:\WINDOWS\system32\addsr.exe
O4 - HKLM\..\RunOnce: [d3qh32.exe] C:\WINDOWS\system32\d3qh32.exe
O4 - HKLM\..\RunOnce: [iphx32.exe] C:\WINDOWS\iphx32.exe
O4 - HKLM\..\RunOnce: [nthf.exe] C:\WINDOWS\nthf.exe
O4 - HKLM\..\RunOnce: [ippf.exe] C:\WINDOWS\system32\ippf.exe
O4 - HKLM\..\RunOnce: [msfc32.exe] C:\WINDOWS\msfc32.exe
O4 - HKLM\..\RunOnce: [winvj32.exe] C:\WINDOWS\winvj32.exe
O4 - HKLM\..\RunOnce: [ieyn.exe] C:\WINDOWS\system32\ieyn.exe
O4 - HKLM\..\RunOnce: [sdkxd32.exe] C:\WINDOWS\sdkxd32.exe
O4 - HKLM\..\RunOnce: [apins32.exe] C:\WINDOWS\system32\apins32.exe
O4 - HKLM\..\RunOnce: [apiva.exe] C:\WINDOWS\system32\apiva.exe
O4 - HKLM\..\RunOnce: [mfcwb.exe] C:\WINDOWS\mfcwb.exe
O4 - HKLM\..\RunOnce: [javaly32.exe] C:\WINDOWS\system32\javaly32.exe
O4 - HKLM\..\RunOnce: [msjf32.exe] C:\WINDOWS\system32\msjf32.exe
O4 - HKLM\..\RunOnce: [crfj.exe] C:\WINDOWS\crfj.exe
O4 - HKLM\..\RunOnce: [sdkas32.exe] C:\WINDOWS\sdkas32.exe
O4 - HKLM\..\RunOnce: [ipdw.exe] C:\WINDOWS\system32\ipdw.exe
O4 - HKLM\..\RunOnce: [appcm32.exe] C:\WINDOWS\system32\appcm32.exe
O4 - HKLM\..\RunOnce: [iesb32.exe] C:\WINDOWS\iesb32.exe
O4 - HKLM\..\RunOnce: [sysaj.exe] C:\WINDOWS\system32\sysaj.exe
O4 - HKLM\..\RunOnce: [apiwt32.exe] C:\WINDOWS\system32\apiwt32.exe
O4 - HKLM\..\RunOnce: [netej.exe] C:\WINDOWS\system32\netej.exe
O4 - HKLM\..\RunOnce: [apiej.exe] C:\WINDOWS\system32\apiej.exe
O4 - HKLM\..\RunOnce: [javauy32.exe] C:\WINDOWS\system32\javauy32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Buckeye_Sam

You may want to print out these instructions or save them to your desktop as a text file with Notepad because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet.

1. Prepare CWShredder for use:
   • Download CWShredder.
   • Save CWShredder.exe to a convenient location.
   • Please do not do anything with it yet.
2. Prepare AboutBuster for use:
   • Download AboutBuster.
   • Unzip the contents of AboutBuster.zip and an AboutBuster directory will be created.
   • Navigate to the AboutBuster directory and double-click on AboutBuster.exe.
   • Click "OK" at the prompt with instructions.
   • Click "Update" and then "Check For Update" to begin the update process.
   • If any updates exist please download them by clicking "Download Update".
   • You should not run the program yet so click "Exit".
3. Prepare cwsserviceremove.reg for use:
   • Download cwsserviceremove.zip.
   • Unzip the contents of cwsserviceremove.zip (cwsserviceremove.reg) to your desktop.
   • Please do not do anything with it yet.

Reconfigure Windows XP to show hidden files:
Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

Boot into Safe Mode:
Restart your computer and immediately begin tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.
To return to normal mode just restart your computer as you normally would.

1. Run CWShredder:
   • Double-click on CWShredder.exe.
   • Click "Fix ->" and click "OK" at the prompt.
   • CWShredder will scan and clean your system of CWS files.
   • Click "Next->" and then "Exit".
2. Remove the offending service:
   • Double-click on cwsserviceremove.reg you downloaded earlier.
   • When it asks you to merge the information to the registry click "Yes".
3. Run AboutBuster and save the logs:
   • Browse to where you saved AboutBuster and run AboutBuster.exe.
   • Click OK at the directions prompt.
   • Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
   • Click Yes to allow it to shutdown explorer.exe.
   • It will begin to your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
   • When it has finished, click Save Log. Make sure you save it as I need a copy of it.
4. Clean out temporary files:
   • Start | Run | type cleanmgr | OK
   • Let it scan your system for files to remove.
   • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
   • Click "OK" to remove them.
   • Click "Yes" to confirm the deletion.
5. Restart your computer normally to return to normal mode.
6. Free TrendMicro Housecall scan:
   • Vist the TrendMicro Housecall website.
   • Select your country from the drop-down list and click "Go".
   • Choose "Yes" at the ActiveX Security Warning prompt.
   • Please wait while the Housecall engine is updated.
   • Select the drives to be scanned by placing a check in their respective boxes.
   • Check the "Auto Clean" box.
   • Click "SCAN" in order to begin scanning your system.
   • Please be patient while Housecall scans your system for malicious files.
   • If not auto-cleaned, remove anything it finds.
   • Click "Close" to exit the Housecall scanner.
   • Choose "Yes" at the HouseCall message prompt.
7. Prepare your reply:
   • Please post a fresh HijackThis log
   • Please post the AboutBuster log.
   • Please note any complications you had.

michellgomez

Good Evening Sam,

Thank you for assisting me.

I followed your instructions. TrendMicro HouseCall found 25 viruses but could not delete 2 because they were "in use." A Java thing.

FYI....when I rebooted, the about:blank IE opened. Also, Antivirus-gold is still on my desktop.

Here are my logs.

About Buster Log:


AboutBuster 5.0 reference file 30
Scan started on [7/10/2005] at [7:41:30 PM]

---

Removed Stream! C:\WINDOWS\cmsetacl.log:ygkwcf
Removed Stream! C:\WINDOWS\erjyh.log:ncjmpp
Removed Stream! C:\WINDOWS\Greenstone.bmp:djvuzx
Removed Stream! C:\WINDOWS\iiisa.dat:wkfabh
Removed Stream! C:\WINDOWS\iis6.log:shpab
Removed Stream! C:\WINDOWS\KB817778.log:sclnqn
Removed Stream! C:\WINDOWS\KB828035.log:oehaui
Removed Stream! C:\WINDOWS\KB834707.log:hfzgps
Removed Stream! C:\WINDOWS\KB896422.log:fldvm
Removed Stream! C:\WINDOWS\Lexmark_ICM.ini:mgflcl
Removed Stream! C:\WINDOWS\LEXSTAT.INI:ehxywv
Removed Stream! C:\WINDOWS\msdfmap.ini:xltmq
Removed Stream! C:\WINDOWS\OEWABLog.txt:adtvf
Removed Stream! C:\WINDOWS\Q308677.log:mlfikv
Removed Stream! C:\WINDOWS\Q313450.log:emxoex
Removed Stream! C:\WINDOWS\Q329390.log:elcyzu
Removed Stream! C:\WINDOWS\Q331953.log:xmndbe
Removed Stream! C:\WINDOWS\Q810565.log:xrpfk
Removed Stream! C:\WINDOWS\smscfg.ini:ryvqkp
Removed Stream! C:\WINDOWS\Sti_Trace.log:kygves
Removed Stream! C:\WINDOWS\wiadebug.log:eired
Removed Stream! C:\WINDOWS\WININIT.INI:pcuxa
Removed Stream! C:\WINDOWS\WMPrfAra.prx:icmcu
Removed Stream! C:\WINDOWS\wmprfsky.prx:mledvk
Removed Stream! C:\WINDOWS\wmsetup.log:eewipv
Removed Stream! C:\WINDOWS\_ds1.tmp:aiijwt
Removed Stream! C:\WINDOWS\_ds1.tmp:amzlj

---

Removed File! : C:\Windows\imdru.dat
Removed File! : C:\Windows\ovzsu.dat
Removed File! : C:\Windows\xupvg.dat
Removed File! : C:\Windows\System32\auidr.dat
Removed File! : C:\Windows\System32\axzwx.dat
Removed File! : C:\Windows\System32\ulhmq.dat
Removed File! : C:\Windows\System32\xspmp.dat

---

Scan was COMPLETED SUCCESSFULLY at 7:43:16 PM

HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 9:50:24 PM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\crko.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\WINDOWS\system32\cidaemon.exe
c:\Program Files\Microsoft Works\WksWP.exe
c:\Program Files\Microsoft Works\MSWorks.exe
c:\Program Files\Microsoft Works\wkgdcach.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.375\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {BFBFA424-9910-08B0-2FBF-CC5180D847C2} - C:\WINDOWS\system32\sysrz.dll
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\WINDOWS\system32\msfw.exe
O4 - HKLM\..\Run: [crko.exe] C:\WINDOWS\system32\crko.exe
O4 - HKLM\..\RunOnce: [netys32.exe] C:\WINDOWS\netys32.exe
O4 - HKLM\..\RunOnce: [ieue.exe] C:\WINDOWS\ieue.exe
O4 - HKLM\..\RunOnce: [iezi32.exe] C:\WINDOWS\iezi32.exe
O4 - HKLM\..\RunOnce: [atlln.exe] C:\WINDOWS\atlln.exe
O4 - HKLM\..\RunOnce: [ntpw.exe] C:\WINDOWS\ntpw.exe
O4 - HKLM\..\RunOnce: [sdkxc.exe] C:\WINDOWS\sdkxc.exe
O4 - HKLM\..\RunOnce: [mfcsp32.exe] C:\WINDOWS\mfcsp32.exe
O4 - HKLM\..\RunOnce: [appnb.exe] C:\WINDOWS\appnb.exe
O4 - HKLM\..\RunOnce: [d3sv32.exe] C:\WINDOWS\system32\d3sv32.exe
O4 - HKLM\..\RunOnce: [syssj.exe] C:\WINDOWS\syssj.exe
O4 - HKLM\..\RunOnce: [sdkxp32.exe] C:\WINDOWS\system32\sdkxp32.exe
O4 - HKLM\..\RunOnce: [winaz32.exe] C:\WINDOWS\system32\winaz32.exe
O4 - HKLM\..\RunOnce: [apivx32.exe] C:\WINDOWS\apivx32.exe
O4 - HKLM\..\RunOnce: [ieeb32.exe] C:\WINDOWS\system32\ieeb32.exe
O4 - HKLM\..\RunOnce: [ntjd32.exe] C:\WINDOWS\ntjd32.exe
O4 - HKLM\..\RunOnce: [syspu.exe] C:\WINDOWS\syspu.exe
O4 - HKLM\..\RunOnce: [crip32.exe] C:\WINDOWS\crip32.exe
O4 - HKLM\..\RunOnce: [addte.exe] C:\WINDOWS\system32\addte.exe
O4 - HKLM\..\RunOnce: [mswq32.exe] C:\WINDOWS\system32\mswq32.exe
O4 - HKLM\..\RunOnce: [ntck32.exe] C:\WINDOWS\system32\ntck32.exe
O4 - HKLM\..\RunOnce: [mspa.exe] C:\WINDOWS\system32\mspa.exe
O4 - HKLM\..\RunOnce: [appbx32.exe] C:\WINDOWS\system32\appbx32.exe
O4 - HKLM\..\RunOnce: [sysdc32.exe] C:\WINDOWS\system32\sysdc32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [addht32.exe] C:\WINDOWS\system32\addht32.exe
O4 - HKLM\..\RunOnce: [netcz32.exe] C:\WINDOWS\system32\netcz32.exe
O4 - HKLM\..\RunOnce: [appso.exe] C:\WINDOWS\appso.exe
O4 - HKLM\..\RunOnce: [winvq.exe] C:\WINDOWS\winvq.exe
O4 - HKLM\..\RunOnce: [sysfo.exe] C:\WINDOWS\system32\sysfo.exe
O4 - HKLM\..\RunOnce: [javaee32.exe] C:\WINDOWS\system32\javaee32.exe
O4 - HKLM\..\RunOnce: [apiut.exe] C:\WINDOWS\apiut.exe
O4 - HKLM\..\RunOnce: [mfcxd.exe] C:\WINDOWS\system32\mfcxd.exe
O4 - HKLM\..\RunOnce: [ntbh32.exe] C:\WINDOWS\system32\ntbh32.exe
O4 - HKLM\..\RunOnce: [apilh.exe] C:\WINDOWS\system32\apilh.exe
O4 - HKLM\..\RunOnce: [netrw32.exe] C:\WINDOWS\system32\netrw32.exe
O4 - HKLM\..\RunOnce: [apift32.exe] C:\WINDOWS\apift32.exe
O4 - HKLM\..\RunOnce: [netfj32.exe] C:\WINDOWS\netfj32.exe
O4 - HKLM\..\RunOnce: [sdkkn32.exe] C:\WINDOWS\system32\sdkkn32.exe
O4 - HKLM\..\RunOnce: [addkn.exe] C:\WINDOWS\addkn.exe
O4 - HKLM\..\RunOnce: [d3ar32.exe] C:\WINDOWS\system32\d3ar32.exe
O4 - HKLM\..\RunOnce: [mfcaz.exe] C:\WINDOWS\mfcaz.exe
O4 - HKLM\..\RunOnce: [appji.exe] C:\WINDOWS\system32\appji.exe
O4 - HKLM\..\RunOnce: [netnm.exe] C:\WINDOWS\system32\netnm.exe
O4 - HKLM\..\RunOnce: [appaw.exe] C:\WINDOWS\appaw.exe
O4 - HKLM\..\RunOnce: [winbw.exe] C:\WINDOWS\winbw.exe
O4 - HKLM\..\RunOnce: [netql32.exe] C:\WINDOWS\netql32.exe
O4 - HKLM\..\RunOnce: [javapt32.exe] C:\WINDOWS\javapt32.exe
O4 - HKLM\..\RunOnce: [appgh.exe] C:\WINDOWS\system32\appgh.exe
O4 - HKLM\..\RunOnce: [mfczi32.exe] C:\WINDOWS\mfczi32.exe
O4 - HKLM\..\RunOnce: [ieth.exe] C:\WINDOWS\ieth.exe
O4 - HKLM\..\RunOnce: [netnl.exe] C:\WINDOWS\netnl.exe
O4 - HKLM\..\RunOnce: [wingm.exe] C:\WINDOWS\wingm.exe
O4 - HKLM\..\RunOnce: [mfcci.exe] C:\WINDOWS\mfcci.exe
O4 - HKLM\..\RunOnce: [ntvj32.exe] C:\WINDOWS\ntvj32.exe
O4 - HKLM\..\RunOnce: [crlq.exe] C:\WINDOWS\crlq.exe
O4 - HKLM\..\RunOnce: [syspu32.exe] C:\WINDOWS\syspu32.exe
O4 - HKLM\..\RunOnce: [msyv.exe] C:\WINDOWS\msyv.exe
O4 - HKLM\..\RunOnce: [ipxl32.exe] C:\WINDOWS\ipxl32.exe
O4 - HKLM\..\RunOnce: [sysgb32.exe] C:\WINDOWS\system32\sysgb32.exe
O4 - HKLM\..\RunOnce: [sdkaa.exe] C:\WINDOWS\system32\sdkaa.exe
O4 - HKLM\..\RunOnce: [addul.exe] C:\WINDOWS\system32\addul.exe
O4 - HKLM\..\RunOnce: [iejs.exe] C:\WINDOWS\iejs.exe
O4 - HKLM\..\RunOnce: [sdkul32.exe] C:\WINDOWS\sdkul32.exe
O4 - HKLM\..\RunOnce: [crfe32.exe] C:\WINDOWS\system32\crfe32.exe
O4 - HKLM\..\RunOnce: [apikb32.exe] C:\WINDOWS\system32\apikb32.exe
O4 - HKLM\..\RunOnce: [crnm.exe] C:\WINDOWS\system32\crnm.exe
O4 - HKLM\..\RunOnce: [ntry.exe] C:\WINDOWS\ntry.exe
O4 - HKLM\..\RunOnce: [iego32.exe] C:\WINDOWS\system32\iego32.exe
O4 - HKLM\..\RunOnce: [addxv.exe] C:\WINDOWS\system32\addxv.exe
O4 - HKLM\..\RunOnce: [atlet32.exe] C:\WINDOWS\system32\atlet32.exe
O4 - HKLM\..\RunOnce: [msjp32.exe] C:\WINDOWS\system32\msjp32.exe
O4 - HKLM\..\RunOnce: [mfceb32.exe] C:\WINDOWS\system32\mfceb32.exe
O4 - HKLM\..\RunOnce: [addwi32.exe] C:\WINDOWS\addwi32.exe
O4 - HKLM\..\RunOnce: [msmp.exe] C:\WINDOWS\system32\msmp.exe
O4 - HKLM\..\RunOnce: [mfcku32.exe] C:\WINDOWS\mfcku32.exe
O4 - HKLM\..\RunOnce: [sysgl32.exe] C:\WINDOWS\system32\sysgl32.exe
O4 - HKLM\..\RunOnce: [apibe.exe] C:\WINDOWS\system32\apibe.exe
O4 - HKLM\..\RunOnce: [appfi.exe] C:\WINDOWS\appfi.exe
O4 - HKLM\..\RunOnce: [ipux32.exe] C:\WINDOWS\system32\ipux32.exe
O4 - HKLM\..\RunOnce: [crkf.exe] C:\WINDOWS\system32\crkf.exe
O4 - HKLM\..\RunOnce: [sysoj32.exe] C:\WINDOWS\sysoj32.exe
O4 - HKLM\..\RunOnce: [d3yr.exe] C:\WINDOWS\system32\d3yr.exe
O4 - HKLM\..\RunOnce: [mseg32.exe] C:\WINDOWS\mseg32.exe
O4 - HKLM\..\RunOnce: [d3sd32.exe] C:\WINDOWS\system32\d3sd32.exe
O4 - HKLM\..\RunOnce: [addcb.exe] C:\WINDOWS\system32\addcb.exe
O4 - HKLM\..\RunOnce: [apivc.exe] C:\WINDOWS\system32\apivc.exe
O4 - HKLM\..\RunOnce: [sysmc32.exe] C:\WINDOWS\system32\sysmc32.exe
O4 - HKLM\..\RunOnce: [netar.exe] C:\WINDOWS\system32\netar.exe
O4 - HKLM\..\RunOnce: [ntzg32.exe] C:\WINDOWS\ntzg32.exe
O4 - HKLM\..\RunOnce: [appta32.exe] C:\WINDOWS\appta32.exe
O4 - HKLM\..\RunOnce: [apixe.exe] C:\WINDOWS\system32\apixe.exe
O4 - HKLM\..\RunOnce: [atlye32.exe] C:\WINDOWS\atlye32.exe
O4 - HKLM\..\RunOnce: [atlnb32.exe] C:\WINDOWS\system32\atlnb32.exe
O4 - HKLM\..\RunOnce: [msrx32.exe] C:\WINDOWS\msrx32.exe
O4 - HKLM\..\RunOnce: [mfcnj32.exe] C:\WINDOWS\system32\mfcnj32.exe
O4 - HKLM\..\RunOnce: [netzn.exe] C:\WINDOWS\netzn.exe
O4 - HKLM\..\RunOnce: [apiao32.exe] C:\WINDOWS\system32\apiao32.exe
O4 - HKLM\..\RunOnce: [apipl.exe] C:\WINDOWS\apipl.exe
O4 - HKLM\..\RunOnce: [winab32.exe] C:\WINDOWS\system32\winab32.exe
O4 - HKLM\..\RunOnce: [netdn32.exe] C:\WINDOWS\netdn32.exe
O4 - HKLM\..\RunOnce: [sdkhr.exe] C:\WINDOWS\sdkhr.exe
O4 - HKLM\..\RunOnce: [ntqs32.exe] C:\WINDOWS\ntqs32.exe
O4 - HKLM\..\RunOnce: [ipxo32.exe] C:\WINDOWS\ipxo32.exe
O4 - HKLM\..\RunOnce: [appbt32.exe] C:\WINDOWS\appbt32.exe
O4 - HKLM\..\RunOnce: [ntee32.exe] C:\WINDOWS\system32\ntee32.exe
O4 - HKLM\..\RunOnce: [crjj.exe] C:\WINDOWS\system32\crjj.exe
O4 - HKLM\..\RunOnce: [javakj32.exe] C:\WINDOWS\system32\javakj32.exe
O4 - HKLM\..\RunOnce: [sdkyg32.exe] C:\WINDOWS\system32\sdkyg32.exe
O4 - HKLM\..\RunOnce: [atldc32.exe] C:\WINDOWS\system32\atldc32.exe
O4 - HKLM\..\RunOnce: [msls.exe] C:\WINDOWS\msls.exe
O4 - HKLM\..\RunOnce: [crms32.exe] C:\WINDOWS\system32\crms32.exe
O4 - HKLM\..\RunOnce: [d3jv.exe] C:\WINDOWS\system32\d3jv.exe
O4 - HKLM\..\RunOnce: [winfz32.exe] C:\WINDOWS\winfz32.exe
O4 - HKLM\..\RunOnce: [msoa.exe] C:\WINDOWS\msoa.exe
O4 - HKLM\..\RunOnce: [iecw32.exe] C:\WINDOWS\iecw32.exe
O4 - HKLM\..\RunOnce: [msqt32.exe] C:\WINDOWS\system32\msqt32.exe
O4 - HKLM\..\RunOnce: [ntvq32.exe] C:\WINDOWS\system32\ntvq32.exe
O4 - HKLM\..\RunOnce: [crdj.exe] C:\WINDOWS\system32\crdj.exe
O4 - HKLM\..\RunOnce: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\RunOnce: [atlro32.exe] C:\WINDOWS\system32\atlro32.exe
O4 - HKLM\..\RunOnce: [ipqw.exe] C:\WINDOWS\system32\ipqw.exe
O4 - HKLM\..\RunOnce: [crms.exe] C:\WINDOWS\system32\crms.exe
O4 - HKLM\..\RunOnce: [ieet32.exe] C:\WINDOWS\system32\ieet32.exe
O4 - HKLM\..\RunOnce: [appua.exe] C:\WINDOWS\system32\appua.exe
O4 - HKLM\..\RunOnce: [mfcob32.exe] C:\WINDOWS\system32\mfcob32.exe
O4 - HKLM\..\RunOnce: [mfccy32.exe] C:\WINDOWS\system32\mfccy32.exe
O4 - HKLM\..\RunOnce: [netce.exe] C:\WINDOWS\netce.exe
O4 - HKLM\..\RunOnce: [atlrt.exe] C:\WINDOWS\atlrt.exe
O4 - HKLM\..\RunOnce: [iebm32.exe] C:\WINDOWS\iebm32.exe
O4 - HKLM\..\RunOnce: [winvf.exe] C:\WINDOWS\system32\winvf.exe
O4 - HKLM\..\RunOnce: [mfcrb.exe] C:\WINDOWS\system32\mfcrb.exe
O4 - HKLM\..\RunOnce: [ipjc32.exe] C:\WINDOWS\system32\ipjc32.exe
O4 - HKLM\..\RunOnce: [craj.exe] C:\WINDOWS\system32\craj.exe
O4 - HKLM\..\RunOnce: [mshp32.exe] C:\WINDOWS\system32\mshp32.exe
O4 - HKLM\..\RunOnce: [winmt.exe] C:\WINDOWS\winmt.exe
O4 - HKLM\..\RunOnce: [javaaw.exe] C:\WINDOWS\system32\javaaw.exe
O4 - HKLM\..\RunOnce: [netea.exe] C:\WINDOWS\netea.exe
O4 - HKLM\..\RunOnce: [d3tx32.exe] C:\WINDOWS\d3tx32.exe
O4 - HKLM\..\RunOnce: [sysje.exe] C:\WINDOWS\sysje.exe
O4 - HKLM\..\RunOnce: [mfcni32.exe] C:\WINDOWS\mfcni32.exe
O4 - HKLM\..\RunOnce: [addxj.exe] C:\WINDOWS\addxj.exe
O4 - HKLM\..\RunOnce: [appdg32.exe] C:\WINDOWS\appdg32.exe
O4 - HKLM\..\RunOnce: [addrv32.exe] C:\WINDOWS\system32\addrv32.exe
O4 - HKLM\..\RunOnce: [sysjl.exe] C:\WINDOWS\system32\sysjl.exe
O4 - HKLM\..\RunOnce: [d3ex.exe] C:\WINDOWS\d3ex.exe
O4 - HKLM\..\RunOnce: [appum32.exe] C:\WINDOWS\system32\appum32.exe
O4 - HKLM\..\RunOnce: [winxo.exe] C:\WINDOWS\winxo.exe
O4 - HKLM\..\RunOnce: [winxe.exe] C:\WINDOWS\system32\winxe.exe
O4 - HKLM\..\RunOnce: [javazf32.exe] C:\WINDOWS\javazf32.exe
O4 - HKLM\..\RunOnce: [sdkoc32.exe] C:\WINDOWS\system32\sdkoc32.exe
O4 - HKLM\..\RunOnce: [mfcsg32.exe] C:\WINDOWS\system32\mfcsg32.exe
O4 - HKLM\..\RunOnce: [javans32.exe] C:\WINDOWS\system32\javans32.exe
O4 - HKLM\..\RunOnce: [mssw.exe] C:\WINDOWS\mssw.exe
O4 - HKLM\..\RunOnce: [d3bx32.exe] C:\WINDOWS\system32\d3bx32.exe
O4 - HKLM\..\RunOnce: [crpu32.exe] C:\WINDOWS\crpu32.exe
O4 - HKLM\..\RunOnce: [mspz.exe] C:\WINDOWS\system32\mspz.exe
O4 - HKLM\..\RunOnce: [javaeo.exe] C:\WINDOWS\system32\javaeo.exe
O4 - HKLM\..\RunOnce: [netph32.exe] C:\WINDOWS\netph32.exe
O4 - HKLM\..\RunOnce: [ipis32.exe] C:\WINDOWS\ipis32.exe
O4 - HKLM\..\RunOnce: [appnp32.exe] C:\WINDOWS\system32\appnp32.exe
O4 - HKLM\..\RunOnce: [ntia.exe] C:\WINDOWS\ntia.exe
O4 - HKLM\..\RunOnce: [apimm.exe] C:\WINDOWS\system32\apimm.exe
O4 - HKLM\..\RunOnce: [javabc32.exe] C:\WINDOWS\system32\javabc32.exe
O4 - HKLM\..\RunOnce: [iesj.exe] C:\WINDOWS\system32\iesj.exe
O4 - HKLM\..\RunOnce: [appwn32.exe] C:\WINDOWS\system32\appwn32.exe
O4 - HKLM\..\RunOnce: [winlk32.exe] C:\WINDOWS\system32\winlk32.exe
O4 - HKLM\..\RunOnce: [syszh32.exe] C:\WINDOWS\syszh32.exe
O4 - HKLM\..\RunOnce: [mfcjf.exe] C:\WINDOWS\system32\mfcjf.exe
O4 - HKLM\..\RunOnce: [ntcg.exe] C:\WINDOWS\system32\ntcg.exe
O4 - HKLM\..\RunOnce: [apptg32.exe] C:\WINDOWS\system32\apptg32.exe
O4 - HKLM\..\RunOnce: [sdkiv.exe] C:\WINDOWS\system32\sdkiv.exe
O4 - HKLM\..\RunOnce: [netam.exe] C:\WINDOWS\system32\netam.exe
O4 - HKLM\..\RunOnce: [mfcjm.exe] C:\WINDOWS\mfcjm.exe
O4 - HKLM\..\RunOnce: [javayb32.exe] C:\WINDOWS\system32\javayb32.exe
O4 - HKLM\..\RunOnce: [msor32.exe] C:\WINDOWS\system32\msor32.exe
O4 - HKLM\..\RunOnce: [crju.exe] C:\WINDOWS\crju.exe
O4 - HKLM\..\RunOnce: [netik32.exe] C:\WINDOWS\netik32.exe
O4 - HKLM\..\RunOnce: [appga32.exe] C:\WINDOWS\system32\appga32.exe
O4 - HKLM\..\RunOnce: [atlgi.exe] C:\WINDOWS\atlgi.exe
O4 - HKLM\..\RunOnce: [sdkkr32.exe] C:\WINDOWS\sdkkr32.exe
O4 - HKLM\..\RunOnce: [javakh.exe] C:\WINDOWS\javakh.exe
O4 - HKLM\..\RunOnce: [sdksh.exe] C:\WINDOWS\sdksh.exe
O4 - HKLM\..\RunOnce: [ieix32.exe] C:\WINDOWS\ieix32.exe
O4 - HKLM\..\RunOnce: [appye32.exe] C:\WINDOWS\appye32.exe
O4 - HKLM\..\RunOnce: [winbi.exe] C:\WINDOWS\winbi.exe
O4 - HKLM\..\RunOnce: [addpd32.exe] C:\WINDOWS\system32\addpd32.exe
O4 - HKLM\..\RunOnce: [msos32.exe] C:\WINDOWS\msos32.exe
O4 - HKLM\..\RunOnce: [iena32.exe] C:\WINDOWS\iena32.exe
O4 - HKLM\..\RunOnce: [atlxb32.exe] C:\WINDOWS\atlxb32.exe
O4 - HKLM\..\RunOnce: [crxb.exe] C:\WINDOWS\system32\crxb.exe
O4 - HKLM\..\RunOnce: [syskt32.exe] C:\WINDOWS\syskt32.exe
O4 - HKLM\..\RunOnce: [crai.exe] C:\WINDOWS\system32\crai.exe
O4 - HKLM\..\RunOnce: [apihy32.exe] C:\WINDOWS\system32\apihy32.exe
O4 - HKLM\..\RunOnce: [addxf32.exe] C:\WINDOWS\addxf32.exe
O4 - HKLM\..\RunOnce: [sysbp.exe] C:\WINDOWS\system32\sysbp.exe
O4 - HKLM\..\RunOnce: [atlxt.exe] C:\WINDOWS\system32\atlxt.exe
O4 - HKLM\..\RunOnce: [ippm32.exe] C:\WINDOWS\system32\ippm32.exe
O4 - HKLM\..\RunOnce: [crgb.exe] C:\WINDOWS\system32\crgb.exe
O4 - HKLM\..\RunOnce: [syskx32.exe] C:\WINDOWS\syskx32.exe
O4 - HKLM\..\RunOnce: [iemz32.exe] C:\WINDOWS\iemz32.exe
O4 - HKLM\..\RunOnce: [atliq32.exe] C:\WINDOWS\system32\atliq32.exe
O4 - HKLM\..\RunOnce: [msnm32.exe] C:\WINDOWS\system32\msnm32.exe
O4 - HKLM\..\RunOnce: [atliy32.exe] C:\WINDOWS\system32\atliy32.exe
O4 - HKLM\..\RunOnce: [mfckz32.exe] C:\WINDOWS\mfckz32.exe
O4 - HKLM\..\RunOnce: [syshv32.exe] C:\WINDOWS\system32\syshv32.exe
O4 - HKLM\..\RunOnce: [apikh32.exe] C:\WINDOWS\apikh32.exe
O4 - HKLM\..\RunOnce: [ipmw.exe] C:\WINDOWS\system32\ipmw.exe
O4 - HKLM\..\RunOnce: [crqa32.exe] C:\WINDOWS\system32\crqa32.exe
O4 - HKLM\..\RunOnce: [crnt32.exe] C:\WINDOWS\system32\crnt32.exe
O4 - HKLM\..\RunOnce: [appci.exe] C:\WINDOWS\system32\appci.exe
O4 - HKLM\..\RunOnce: [mfcbq.exe] C:\WINDOWS\mfcbq.exe
O4 - HKLM\..\RunOnce: [ntlr.exe] C:\WINDOWS\ntlr.exe
O4 - HKLM\..\RunOnce: [applr32.exe] C:\WINDOWS\applr32.exe
O4 - HKLM\..\RunOnce: [addrn.exe] C:\WINDOWS\system32\addrn.exe
O4 - HKLM\..\RunOnce: [ievz.exe] C:\WINDOWS\ievz.exe
O4 - HKLM\..\RunOnce: [atlkp32.exe] C:\WINDOWS\system32\atlkp32.exe
O4 - HKLM\..\RunOnce: [ipjw32.exe] C:\WINDOWS\ipjw32.exe
O4 - HKLM\..\RunOnce: [apiei.exe] C:\WINDOWS\apiei.exe
O4 - HKLM\..\RunOnce: [sysdp32.exe] C:\WINDOWS\sysdp32.exe
O4 - HKLM\..\RunOnce: [crbf32.exe] C:\WINDOWS\system32\crbf32.exe
O4 - HKLM\..\RunOnce: [sdkwp.exe] C:\WINDOWS\sdkwp.exe
O4 - HKLM\..\RunOnce: [msat32.exe] C:\WINDOWS\msat32.exe
O4 - HKLM\..\RunOnce: [crkt.exe] C:\WINDOWS\crkt.exe
O4 - HKLM\..\RunOnce: [d3qq32.exe] C:\WINDOWS\d3qq32.exe
O4 - HKLM\..\RunOnce: [cref32.exe] C:\WINDOWS\system32\cref32.exe
O4 - HKLM\..\RunOnce: [apijj32.exe] C:\WINDOWS\system32\apijj32.exe
O4 - HKLM\..\RunOnce: [d3ev32.exe] C:\WINDOWS\system32\d3ev32.exe
O4 - HKLM\..\RunOnce: [sysjz.exe] C:\WINDOWS\sysjz.exe
O4 - HKLM\..\RunOnce: [ntxt.exe] C:\WINDOWS\system32\ntxt.exe
O4 - HKLM\..\RunOnce: [apibf.exe] C:\WINDOWS\system32\apibf.exe
O4 - HKLM\..\RunOnce: [ipnm.exe] C:\WINDOWS\ipnm.exe
O4 - HKLM\..\RunOnce: [winbp.exe] C:\WINDOWS\system32\winbp.exe
O4 - HKLM\..\RunOnce: [ipkv32.exe] C:\WINDOWS\system32\ipkv32.exe
O4 - HKLM\..\RunOnce: [sdksl.exe] C:\WINDOWS\sdksl.exe
O4 - HKLM\..\RunOnce: [appgp.exe] C:\WINDOWS\appgp.exe
O4 - HKLM\..\RunOnce: [appvk32.exe] C:\WINDOWS\system32\appvk32.exe
O4 - HKLM\..\RunOnce: [javauk32.exe] C:\WINDOWS\javauk32.exe
O4 - HKLM\..\RunOnce: [winpw32.exe] C:\WINDOWS\system32\winpw32.exe
O4 - HKLM\..\RunOnce: [crxr32.exe] C:\WINDOWS\system32\crxr32.exe
O4 - HKLM\..\RunOnce: [apiil32.exe] C:\WINDOWS\system32\apiil32.exe
O4 - HKLM\..\RunOnce: [winvn32.exe] C:\WINDOWS\system32\winvn32.exe
O4 - HKLM\..\RunOnce: [ierz.exe] C:\WINDOWS\system32\ierz.exe
O4 - HKLM\..\RunOnce: [sdkpo32.exe] C:\WINDOWS\system32\sdkpo32.exe
O4 - HKLM\..\RunOnce: [msin32.exe] C:\WINDOWS\system32\msin32.exe
O4 - HKLM\..\RunOnce: [iecy32.exe] C:\WINDOWS\system32\iecy32.exe
O4 - HKLM\..\RunOnce: [sdkhu32.exe] C:\WINDOWS\sdkhu32.exe
O4 - HKLM\..\RunOnce: [javahi32.exe] C:\WINDOWS\javahi32.exe
O4 - HKLM\..\RunOnce: [atlab32.exe] C:\WINDOWS\system32\atlab32.exe
O4 - HKLM\..\RunOnce: [mfcaj32.exe] C:\WINDOWS\system32\mfcaj32.exe
O4 - HKLM\..\RunOnce: [sdkkk32.exe] C:\WINDOWS\sdkkk32.exe
O4 - HKLM\..\RunOnce: [sdkmb32.exe] C:\WINDOWS\system32\sdkmb32.exe
O4 - HKLM\..\RunOnce: [msdj32.exe] C:\WINDOWS\system32\msdj32.exe
O4 - HKLM\..\RunOnce: [cryn.exe] C:\WINDOWS\cryn.exe
O4 - HKLM\..\RunOnce: [apixc32.exe] C:\WINDOWS\apixc32.exe
O4 - HKLM\..\RunOnce: [addvs32.exe] C:\WINDOWS\system32\addvs32.exe
O4 - HKLM\..\RunOnce: [appva.exe] C:\WINDOWS\appva.exe
O4 - HKLM\..\RunOnce: [addea.exe] C:\WINDOWS\system32\addea.exe
O4 - HKLM\..\RunOnce: [ntei.exe] C:\WINDOWS\ntei.exe
O4 - HKLM\..\RunOnce: [sysbv.exe] C:\WINDOWS\sysbv.exe
O4 - HKLM\..\RunOnce: [iekw.exe] C:\WINDOWS\system32\iekw.exe
O4 - HKLM\..\RunOnce: [apitc32.exe] C:\WINDOWS\apitc32.exe
O4 - HKLM\..\RunOnce: [addsr.exe] C:\WINDOWS\system32\addsr.exe
O4 - HKLM\..\RunOnce: [d3qh32.exe] C:\WINDOWS\system32\d3qh32.exe
O4 - HKLM\..\RunOnce: [iphx32.exe] C:\WINDOWS\iphx32.exe
O4 - HKLM\..\RunOnce: [winvj32.exe] C:\WINDOWS\winvj32.exe
O4 - HKLM\..\RunOnce: [ieyn.exe] C:\WINDOWS\system32\ieyn.exe
O4 - HKLM\..\RunOnce: [sdkxd32.exe] C:\WINDOWS\sdkxd32.exe
O4 - HKLM\..\RunOnce: [apins32.exe] C:\WINDOWS\system32\apins32.exe
O4 - HKLM\..\RunOnce: [apiva.exe] C:\WINDOWS\system32\apiva.exe
O4 - HKLM\..\RunOnce: [mfcwb.exe] C:\WINDOWS\mfcwb.exe
O4 - HKLM\..\RunOnce: [javaly32.exe] C:\WINDOWS\system32\javaly32.exe
O4 - HKLM\..\RunOnce: [msjf32.exe] C:\WINDOWS\system32\msjf32.exe
O4 - HKLM\..\RunOnce: [crfj.exe] C:\WINDOWS\crfj.exe
O4 - HKLM\..\RunOnce: [sdkas32.exe] C:\WINDOWS\sdkas32.exe
O4 - HKLM\..\RunOnce: [ipdw.exe] C:\WINDOWS\system32\ipdw.exe
O4 - HKLM\..\RunOnce: [iesb32.exe] C:\WINDOWS\iesb32.exe
O4 - HKLM\..\RunOnce: [sysaj.exe] C:\WINDOWS\system32\sysaj.exe
O4 - HKLM\..\RunOnce: [apiwt32.exe] C:\WINDOWS\system32\apiwt32.exe
O4 - HKLM\..\RunOnce: [netej.exe] C:\WINDOWS\system32\netej.exe
O4 - HKLM\..\RunOnce: [apiej.exe] C:\WINDOWS\system32\apiej.exe
O4 - HKLM\..\RunOnce: [javauy32.exe] C:\WINDOWS\system32\javauy32.exe
O4 - HKLM\..\RunOnce: [iesg32.exe] C:\WINDOWS\system32\iesg32.exe
O4 - HKLM\..\RunOnce: [d3ns.exe] C:\WINDOWS\system32\d3ns.exe
O4 - HKLM\..\RunOnce: [netmz32.exe] C:\WINDOWS\system32\netmz32.exe
O4 - HKLM\..\RunOnce: [appkp.exe] C:\WINDOWS\appkp.exe
O4 - HKLM\..\RunOnce: [msje32.exe] C:\WINDOWS\msje32.exe
O4 - HKLM\..\RunOnce: [sdkzu32.exe] C:\WINDOWS\system32\sdkzu32.exe
O4 - HKLM\..\RunOnce: [sdkzc32.exe] C:\WINDOWS\system32\sdkzc32.exe
O4 - HKLM\..\RunOnce: [iejc32.exe] C:\WINDOWS\iejc32.exe
O4 - HKLM\..\RunOnce: [iprc.exe] C:\WINDOWS\iprc.exe
O4 - HKLM\..\RunOnce: [apihf.exe] C:\WINDOWS\apihf.exe
O4 - HKLM\..\RunOnce: [sysgf32.exe] C:\WINDOWS\sysgf32.exe
O4 - HKLM\..\RunOnce: [netuu32.exe] C:\WINDOWS\system32\netuu32.exe
O4 - HKLM\..\RunOnce: [ieuc32.exe] C:\WINDOWS\ieuc32.exe
O4 - HKLM\..\RunOnce: [ipuk.exe] C:\WINDOWS\system32\ipuk.exe
O4 - HKLM\..\RunOnce: [atlyo.exe] C:\WINDOWS\atlyo.exe
O4 - HKLM\..\RunOnce: [addiv.exe] C:\WINDOWS\addiv.exe
O4 - HKLM\..\RunOnce: [sysrv.exe] C:\WINDOWS\sysrv.exe
O4 - HKLM\..\RunOnce: [apigk.exe] C:\WINDOWS\system32\apigk.exe
O4 - HKLM\..\RunOnce: [sysad32.exe] C:\WINDOWS\system32\sysad32.exe
O4 - HKLM\..\RunOnce: [sdkwh32.exe] C:\WINDOWS\system32\sdkwh32.exe
O4 - HKLM\..\RunOnce: [winzt.exe] C:\WINDOWS\system32\winzt.exe
O4 - HKLM\..\RunOnce: [syslb.exe] C:\WINDOWS\syslb.exe
O4 - HKLM\..\RunOnce: [d3di.exe] C:\WINDOWS\system32\d3di.exe
O4 - HKLM\..\RunOnce: [crei32.exe] C:\WINDOWS\crei32.exe
O4 - HKLM\..\RunOnce: [javatf32.exe] C:\WINDOWS\system32\javatf32.exe
O4 - HKLM\..\RunOnce: [apixb32.exe] C:\WINDOWS\apixb32.exe
O4 - HKLM\..\RunOnce: [crsn32.exe] C:\WINDOWS\system32\crsn32.exe
O4 - HKLM\..\RunOnce: [iexr.exe] C:\WINDOWS\iexr.exe
O4 - HKLM\..\RunOnce: [d3uo.exe] C:\WINDOWS\d3uo.exe
O4 - HKLM\..\RunOnce: [msal.exe] C:\WINDOWS\system32\msal.exe
O4 - HKLM\..\RunOnce: [netoh.exe] C:\WINDOWS\netoh.exe
O4 - HKLM\..\RunOnce: [ieat.exe] C:\WINDOWS\ieat.exe
O4 - HKLM\..\RunOnce: [netdc32.exe] C:\WINDOWS\system32\netdc32.exe
O4 - HKLM\..\RunOnce: [iedk.exe] C:\WINDOWS\iedk.exe
O4 - HKLM\..\RunOnce: [crho.exe] C:\WINDOWS\system32\crho.exe
O4 - HKLM\..\RunOnce: [winwl32.exe] C:\WINDOWS\winwl32.exe
O4 - HKLM\..\RunOnce: [ntec32.exe] C:\WINDOWS\ntec32.exe
O4 - HKLM\..\RunOnce: [sdkek.exe] C:\WINDOWS\sdkek.exe
O4 - HKLM\..\RunOnce: [ntnk.exe] C:\WINDOWS\ntnk.exe
O4 - HKLM\..\RunOnce: [ntib32.exe] C:\WINDOWS\ntib32.exe
O4 - HKLM\..\RunOnce: [appnx32.exe] C:\WINDOWS\appnx32.exe
O4 - HKLM\..\RunOnce: [sdkqr32.exe] C:\WINDOWS\sdkqr32.exe
O4 - HKLM\..\RunOnce: [d3uv.exe] C:\WINDOWS\system32\d3uv.exe
O4 - HKLM\..\RunOnce: [javavw32.exe] C:\WINDOWS\javavw32.exe
O4 - HKLM\..\RunOnce: [crjb32.exe] C:\WINDOWS\system32\crjb32.exe
O4 - HKLM\..\RunOnce: [mswf.exe] C:\WINDOWS\mswf.exe
O4 - HKLM\..\RunOnce: [d3xf32.exe] C:\WINDOWS\system32\d3xf32.exe
O4 - HKLM\..\RunOnce: [crlc.exe] C:\WINDOWS\crlc.exe
O4 - HKLM\..\RunOnce: [d3rz.exe] C:\WINDOWS\d3rz.exe
O4 - HKLM\..\RunOnce: [winkp32.exe] C:\WINDOWS\winkp32.exe
O4 - HKLM\..\RunOnce: [apiuq32.exe] C:\WINDOWS\system32\apiuq32.exe
O4 - HKLM\..\RunOnce: [msuy.exe] C:\WINDOWS\msuy.exe
O4 - HKLM\..\RunOnce: [ntvx.exe] C:\WINDOWS\system32\ntvx.exe
O4 - HKLM\..\RunOnce: [ipey.exe] C:\WINDOWS\ipey.exe
O4 - HKLM\..\RunOnce: [mstn32.exe] C:\WINDOWS\system32\mstn32.exe
O4 - HKLM\..\RunOnce: [crxw.exe] C:\WINDOWS\crxw.exe
O4 - HKLM\..\RunOnce: [nethp32.exe] C:\WINDOWS\nethp32.exe
O4 - HKLM\..\RunOnce: [ipbi.exe] C:\WINDOWS\system32\ipbi.exe
O4 - HKLM\..\RunOnce: [d3xe.exe] C:\WINDOWS\d3xe.exe
O4 - HKLM\..\RunOnce: [syspf32.exe] C:\WINDOWS\system32\syspf32.exe
O4 - HKLM\..\RunOnce: [atlfn.exe] C:\WINDOWS\system32\atlfn.exe
O4 - HKLM\..\RunOnce: [ipbr32.exe] C:\WINDOWS\ipbr32.exe
O4 - HKLM\..\RunOnce: [ipbx32.exe] C:\WINDOWS\system32\ipbx32.exe
O4 - HKLM\..\RunOnce: [ntmr32.exe] C:\WINDOWS\system32\ntmr32.exe
O4 - HKLM\..\RunOnce: [atlrn32.exe] C:\WINDOWS\atlrn32.exe
O4 - HKLM\..\RunOnce: [ipyg.exe] C:\WINDOWS\ipyg.exe
O4 - HKLM\..\RunOnce: [apino.exe] C:\WINDOWS\apino.exe
O4 - HKLM\..\RunOnce: [wingg32.exe] C:\WINDOWS\system32\wingg32.exe
O4 - HKLM\..\RunOnce: [addra32.exe] C:\WINDOWS\addra32.exe
O4 - HKLM\..\RunOnce: [d3ww32.exe] C:\WINDOWS\d3ww32.exe
O4 - HKLM\..\RunOnce: [appzi.exe] C:\WINDOWS\system32\appzi.exe
O4 - HKLM\..\RunOnce: [sysvu32.exe] C:\WINDOWS\system32\sysvu32.exe
O4 - HKLM\..\RunOnce: [crtb.exe] C:\WINDOWS\crtb.exe
O4 - HKLM\..\RunOnce: [apisr32.exe] C:\WINDOWS\apisr32.exe
O4 - HKLM\..\RunOnce: [sdklq32.exe] C:\WINDOWS\system32\sdklq32.exe
O4 - HKLM\..\RunOnce: [javawj32.exe] C:\WINDOWS\javawj32.exe
O4 - HKLM\..\RunOnce: [apibf32.exe] C:\WINDOWS\apibf32.exe
O4 - HKLM\..\RunOnce: [crer.exe] C:\WINDOWS\crer.exe
O4 - HKLM\..\RunOnce: [ntav32.exe] C:\WINDOWS\system32\ntav32.exe
O4 - HKLM\..\RunOnce: [mfcyk.exe] C:\WINDOWS\mfcyk.exe
O4 - HKLM\..\RunOnce: [iexa32.exe] C:\WINDOWS\iexa32.exe
O4 - HKLM\..\RunOnce: [javanp32.exe] C:\WINDOWS\system32\javanp32.exe
O4 - HKLM\..\RunOnce: [crvx.exe] C:\WINDOWS\system32\crvx.exe
O4 - HKLM\..\RunOnce: [javawy.exe] C:\WINDOWS\javawy.exe
O4 - HKLM\..\RunOnce: [systv32.exe] C:\WINDOWS\system32\systv32.exe
O4 - HKLM\..\RunOnce: [atlkc32.exe] C:\WINDOWS\system32\atlkc32.exe
O4 - HKLM\..\RunOnce: [addfg.exe] C:\WINDOWS\system32\addfg.exe
O4 - HKLM\..\RunOnce: [crew32.exe] C:\WINDOWS\system32\crew32.exe
O4 - HKLM\..\RunOnce: [sdkes32.exe] C:\WINDOWS\system32\sdkes32.exe
O4 - HKLM\..\RunOnce: [netcq32.exe] C:\WINDOWS\netcq32.exe
O4 - HKLM\..\RunOnce: [crmq32.exe] C:\WINDOWS\system32\crmq32.exe
O4 - HKLM\..\RunOnce: [atlmy32.exe] C:\WINDOWS\atlmy32.exe
O4 - HKLM\..\RunOnce: [javahk32.exe] C:\WINDOWS\system32\javahk32.exe
O4 - HKLM\..\RunOnce: [msmo.exe] C:\WINDOWS\msmo.exe
O4 - HKLM\..\RunOnce: [crup32.exe] C:\WINDOWS\system32\crup32.exe
O4 - HKLM\..\RunOnce: [crjm.exe] C:\WINDOWS\crjm.exe
O4 - HKLM\..\RunOnce: [crpi.exe] C:\WINDOWS\system32\crpi.exe
O4 - HKLM\..\RunOnce: [mfcuf.exe] C:\WINDOWS\mfcuf.exe
O4 - HKLM\..\RunOnce: [d3oq.exe] C:\WINDOWS\d3oq.exe
O4 - HKLM\..\RunOnce: [sdkef.exe] C:\WINDOWS\system32\sdkef.exe
O4 - HKLM\..\RunOnce: [apiwy32.exe] C:\WINDOWS\system32\apiwy32.exe
O4 - HKLM\..\RunOnce: [netij.exe] C:\WINDOWS\netij.exe
O4 - HKLM\..\RunOnce: [appgx.exe] C:\WINDOWS\system32\appgx.exe
O4 - HKLM\..\RunOnce: [netkb.exe] C:\WINDOWS\system32\netkb.exe
O4 - HKLM\..\RunOnce: [javavb32.exe] C:\WINDOWS\system32\javavb32.exe
O4 - HKLM\..\RunOnce: [mslj.exe] C:\WINDOWS\system32\mslj.exe
O4 - HKLM\..\RunOnce: [apppf32.exe] C:\WINDOWS\apppf32.exe
O4 - HKLM\..\RunOnce: [syszn.exe] C:\WINDOWS\system32\syszn.exe
O4 - HKLM\..\RunOnce: [winec32.exe] C:\WINDOWS\winec32.exe
O4 - HKLM\..\RunOnce: [systz32.exe] C:\WINDOWS\system32\systz32.exe
O4 - HKLM\..\RunOnce: [javayd32.exe] C:\WINDOWS\system32\javayd32.exe
O4 - HKLM\..\RunOnce: [wintp32.exe] C:\WINDOWS\system32\wintp32.exe
O4 - HKLM\..\RunOnce: [atlft.exe] C:\WINDOWS\atlft.exe
O4 - HKLM\..\RunOnce: [atlli32.exe] C:\WINDOWS\atlli32.exe
O4 - HKLM\..\RunOnce: [atlaf32.exe] C:\WINDOWS\system32\atlaf32.exe
O4 - HKLM\..\RunOnce: [apizs.exe] C:\WINDOWS\apizs.exe
O4 - HKLM\..\RunOnce: [apppz.exe] C:\WINDOWS\apppz.exe
O4 - HKLM\..\RunOnce: [iezs.exe] C:\WINDOWS\system32\iezs.exe
O4 - HKLM\..\RunOnce: [sdkkl32.exe] C:\WINDOWS\sdkkl32.exe
O4 - HKLM\..\RunOnce: [javade32.exe] C:\WINDOWS\system32\javade32.exe
O4 - HKLM\..\RunOnce: [nthy32.exe] C:\WINDOWS\nthy32.exe
O4 - HKLM\..\RunOnce: [mfcxg.exe] C:\WINDOWS\system32\mfcxg.exe
O4 - HKLM\..\RunOnce: [ieev32.exe] C:\WINDOWS\system32\ieev32.exe
O4 - HKLM\..\RunOnce: [javaul32.exe] C:\WINDOWS\javaul32.exe
O4 - HKLM\..\RunOnce: [crut.exe] C:\WINDOWS\system32\crut.exe
O4 - HKLM\..\RunOnce: [javadb.exe] C:\WINDOWS\javadb.exe
O4 - HKLM\..\RunOnce: [javare.exe] C:\WINDOWS\system32\javare.exe
O4 - HKLM\..\RunOnce: [ievi.exe] C:\WINDOWS\ievi.exe
O4 - HKLM\..\RunOnce: [appgj32.exe] C:\WINDOWS\system32\appgj32.exe
O4 - HKLM\..\RunOnce: [winjk32.exe] C:\WINDOWS\winjk32.exe
O4 - HKLM\..\RunOnce: [addde.exe] C:\WINDOWS\addde.exe
O4 - HKLM\..\RunOnce: [criv.exe] C:\WINDOWS\criv.exe
O4 - HKLM\..\RunOnce: [addee.exe] C:\WINDOWS\system32\addee.exe
O4 - HKLM\..\RunOnce: [syseg32.exe] C:\WINDOWS\syseg32.exe
O4 - HKLM\..\RunOnce: [apidr32.exe] C:\WINDOWS\system32\apidr32.exe
O4 - HKLM\..\RunOnce: [winiu.exe] C:\WINDOWS\system32\winiu.exe
O4 - HKLM\..\RunOnce: [sysmh.exe] C:\WINDOWS\system32\sysmh.exe
O4 - HKLM\..\RunOnce: [sdkaj32.exe] C:\WINDOWS\sdkaj32.exe
O4 - HKLM\..\RunOnce: [sysrc32.exe] C:\WINDOWS\sysrc32.exe
O4 - HKLM\..\RunOnce: [javawe.exe] C:\WINDOWS\javawe.exe
O4 - HKLM\..\RunOnce: [sysev.exe] C:\WINDOWS\sysev.exe
O4 - HKLM\..\RunOnce: [sysjs32.exe] C:\WINDOWS\sysjs32.exe
O4 - HKLM\..\RunOnce: [javaoo32.exe] C:\WINDOWS\system32\javaoo32.exe
O4 - HKLM\..\RunOnce: [adddd.exe] C:\WINDOWS\system32\adddd.exe
O4 - HKLM\..\RunOnce: [msgz32.exe] C:\WINDOWS\msgz32.exe
O4 - HKLM\..\RunOnce: [appzv.exe] C:\WINDOWS\system32\appzv.exe
O4 - HKLM\..\RunOnce: [sdkga32.exe] C:\WINDOWS\system32\sdkga32.exe
O4 - HKLM\..\RunOnce: [mfclu.exe] C:\WINDOWS\mfclu.exe
O4 - HKLM\..\RunOnce: [msla.exe] C:\WINDOWS\system32\msla.exe
O4 - HKLM\..\RunOnce: [ipzu.exe] C:\WINDOWS\system32\ipzu.exe
O4 - HKLM\..\RunOnce: [cris32.exe] C:\WINDOWS\cris32.exe
O4 - HKLM\..\RunOnce: [apinm32.exe] C:\WINDOWS\apinm32.exe
O4 - HKLM\..\RunOnce: [netwx.exe] C:\WINDOWS\netwx.exe
O4 - HKLM\..\RunOnce: [javaoq.exe] C:\WINDOWS\javaoq.exe
O4 - HKLM\..\RunOnce: [mfcfy32.exe] C:\WINDOWS\mfcfy32.exe
O4 - HKLM\..\RunOnce: [apizp32.exe] C:\WINDOWS\system32\apizp32.exe
O4 - HKLM\..\RunOnce: [mfcom.exe] C:\WINDOWS\mfcom.exe
O4 - HKLM\..\RunOnce: [apitb.exe] C:\WINDOWS\apitb.exe
O4 - HKLM\..\RunOnce: [iehf.exe] C:\WINDOWS\system32\iehf.exe
O4 - HKLM\..\RunOnce: [netbr.exe] C:\WINDOWS\netbr.exe
O4 - HKLM\..\RunOnce: [atlry.exe] C:\WINDOWS\atlry.exe
O4 - HKLM\..\RunOnce: [iebr32.exe] C:\WINDOWS\system32\iebr32.exe
O4 - HKLM\..\RunOnce: [winvk.exe] C:\WINDOWS\system32\winvk.exe
O4 - HKLM\..\RunOnce: [mfcqo.exe] C:\WINDOWS\mfcqo.exe
O4 - HKLM\..\RunOnce: [ntjh32.exe] C:\WINDOWS\system32\ntjh32.exe
O4 - HKLM\..\RunOnce: [crzo.exe] C:\WINDOWS\crzo.exe
O4 - HKLM\..\RunOnce: [sysds32.exe] C:\WINDOWS\sysds32.exe
O4 - HKLM\..\RunOnce: [msnb.exe] C:\WINDOWS\msnb.exe
O4 - HKLM\..\RunOnce: [mssp32.exe] C:\WINDOWS\mssp32.exe
O4 - HKLM\..\RunOnce: [mshm32.exe] C:\WINDOWS\system32\mshm32.exe
O4 - HKLM\..\RunOnce: [sysga.exe] C:\WINDOWS\sysga.exe
O4 - HKLM\..\RunOnce: [d3wh.exe] C:\WINDOWS\d3wh.exe
O4 - HKLM\..\RunOnce: [ntga32.exe] C:\WINDOWS\system32\ntga32.exe
O4 - HKLM\..\RunOnce: [adduc32.exe] C:\WINDOWS\adduc32.exe
O4 - HKLM\..\RunOnce: [apioh.exe] C:\WINDOWS\apioh.exe
O4 - HKLM\..\RunOnce: [winws.exe] C:\WINDOWS\winws.exe
O4 - HKLM\..\RunOnce: [d3pr.exe] C:\WINDOWS\d3pr.exe
O4 - HKLM\..\RunOnce: [ntlv.exe] C:\WINDOWS\ntlv.exe
O4 - HKLM\..\RunOnce: [sysub32.exe] C:\WINDOWS\system32\sysub32.exe
O4 - HKLM\..\RunOnce: [msma.exe] C:\WINDOWS\system32\msma.exe
O4 - HKLM\..\RunOnce: [netac32.exe] C:\WINDOWS\netac32.exe
O4 - HKLM\..\RunOnce: [mfckb.exe] C:\WINDOWS\mfckb.exe
O4 - HKLM\..\RunOnce: [atlzd32.exe] C:\WINDOWS\system32\atlzd32.exe
O4 - HKLM\..\RunOnce: [atlcn32.exe] C:\WINDOWS\system32\atlcn32.exe
O4 - HKLM\..\RunOnce: [addxw.exe] C:\WINDOWS\system32\addxw.exe
O4 - HKLM\..\RunOnce: [mfcky.exe] C:\WINDOWS\system32\mfcky.exe
O4 - HKLM\..\RunOnce: [addgc.exe] C:\WINDOWS\addgc.exe
O4 - HKLM\..\RunOnce: [ieyj32.exe] C:\WINDOWS\ieyj32.exe
O4 - HKLM\..\RunOnce: [addel32.exe] C:\WINDOWS\system32\addel32.exe
O4 - HKLM\..\RunOnce: [crxe32.exe] C:\WINDOWS\crxe32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\netys32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

michellgomez

I don't know why there are smileys in my AboutBuster log. I did not place them there. When I submitted my reply, I received an error message about 30 seconds timing out. Here is my AboutBuster log again.

AboutBuster 5.0 reference file 30
Scan started on [7/10/2005] at [7:41:30 PM]

---

Removed Stream! C:\WINDOWS\cmsetacl.log:ygkwcf
Removed Stream! C:\WINDOWS\erjyh.log:ncjmpp
Removed Stream! C:\WINDOWS\Greenstone.bmp:djvuzx
Removed Stream! C:\WINDOWS\iiisa.dat:wkfabh
Removed Stream! C:\WINDOWS\iis6.log:shpab
Removed Stream! C:\WINDOWS\KB817778.log:sclnqn
Removed Stream! C:\WINDOWS\KB828035.log:oehaui
Removed Stream! C:\WINDOWS\KB834707.log:hfzgps
Removed Stream! C:\WINDOWS\KB896422.log:fldvm
Removed Stream! C:\WINDOWS\Lexmark_ICM.ini:mgflcl
Removed Stream! C:\WINDOWS\LEXSTAT.INI:ehxywv
Removed Stream! C:\WINDOWS\msdfmap.ini:xltmq
Removed Stream! C:\WINDOWS\OEWABLog.txt:adtvf
Removed Stream! C:\WINDOWS\Q308677.log:mlfikv
Removed Stream! C:\WINDOWS\Q313450.log:emxoex
Removed Stream! C:\WINDOWS\Q329390.log:elcyzu
Removed Stream! C:\WINDOWS\Q331953.log:xmndbe
Removed Stream! C:\WINDOWS\Q810565.log:xrpfk
Removed Stream! C:\WINDOWS\smscfg.ini:ryvqkp
Removed Stream! C:\WINDOWS\Sti_Trace.log:kygves
Removed Stream! C:\WINDOWS\wiadebug.log:eired
Removed Stream! C:\WINDOWS\WININIT.INI:pcuxa
Removed Stream! C:\WINDOWS\WMPrfAra.prx:icmcu
Removed Stream! C:\WINDOWS\wmprfsky.prx:mledvk
Removed Stream! C:\WINDOWS\wmsetup.log:eewipv
Removed Stream! C:\WINDOWS\_ds1.tmp:aiijwt
Removed Stream! C:\WINDOWS\_ds1.tmp:amzlj

---

Removed File! : C:\Windows\imdru.dat
Removed File! : C:\Windows\ovzsu.dat
Removed File! : C:\Windows\xupvg.dat
Removed File! : C:\Windows\System32\auidr.dat
Removed File! : C:\Windows\System32\axzwx.dat
Removed File! : C:\Windows\System32\ulhmq.dat
Removed File! : C:\Windows\System32\xspmp.dat

---

Scan was COMPLETED SUCCESSFULLY at 7:43:16 PM

Buckeye_Sam

Don't worry about the smiley's. That's just how the forum interprets certain random characters.

Some of these steps are going to be repetitive, but please follow them all.

You have an HSA infection. The filenames on this type of infection can change each time you reboot your computer or use Internet Explorer. With that in mind, some of these filenames may be different. But the pattern is the same and you may be able to determine the correct files to remove. The sooner you perform this fix, the higher it's chances for success.

Much of this fix has to be performed in Safe Mode where you won't be able to access the Internet.

Please print out these instructions.


Step 1
Download CWShredder but don't run it yet.


Step 2
Download AboutBuster
Unzip it to your desktop but don't run it yet.


Step 3
Download Ad-aware SE 1.06
Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


Step 5
Make sure that you can VIEW ALL HIDDEN FILES.


Step 6
Reboot your computer into SAFE MODE


Step 7
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {BFBFA424-9910-08B0-2FBF-CC5180D847C2} - C:\WINDOWS\system32\sysrz.dll
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\Run: [msfw.exe] C:\WINDOWS\system32\msfw.exe
O4 - HKLM\..\Run: [crko.exe] C:\WINDOWS\system32\crko.exe
O4 - HKLM\..\RunOnce: [netys32.exe] C:\WINDOWS\netys32.exe
O4 - HKLM\..\RunOnce: [ieue.exe] C:\WINDOWS\ieue.exe
O4 - HKLM\..\RunOnce: [iezi32.exe] C:\WINDOWS\iezi32.exe
O4 - HKLM\..\RunOnce: [atlln.exe] C:\WINDOWS\atlln.exe
O4 - HKLM\..\RunOnce: [ntpw.exe] C:\WINDOWS\ntpw.exe
O4 - HKLM\..\RunOnce: [sdkxc.exe] C:\WINDOWS\sdkxc.exe
O4 - HKLM\..\RunOnce: [mfcsp32.exe] C:\WINDOWS\mfcsp32.exe
O4 - HKLM\..\RunOnce: [appnb.exe] C:\WINDOWS\appnb.exe
O4 - HKLM\..\RunOnce: [d3sv32.exe] C:\WINDOWS\system32\d3sv32.exe
O4 - HKLM\..\RunOnce: [syssj.exe] C:\WINDOWS\syssj.exe
O4 - HKLM\..\RunOnce: [sdkxp32.exe] C:\WINDOWS\system32\sdkxp32.exe
O4 - HKLM\..\RunOnce: [winaz32.exe] C:\WINDOWS\system32\winaz32.exe
O4 - HKLM\..\RunOnce: [apivx32.exe] C:\WINDOWS\apivx32.exe
O4 - HKLM\..\RunOnce: [ieeb32.exe] C:\WINDOWS\system32\ieeb32.exe
O4 - HKLM\..\RunOnce: [ntjd32.exe] C:\WINDOWS\ntjd32.exe
O4 - HKLM\..\RunOnce: [syspu.exe] C:\WINDOWS\syspu.exe
O4 - HKLM\..\RunOnce: [crip32.exe] C:\WINDOWS\crip32.exe
O4 - HKLM\..\RunOnce: [addte.exe] C:\WINDOWS\system32\addte.exe
O4 - HKLM\..\RunOnce: [mswq32.exe] C:\WINDOWS\system32\mswq32.exe
O4 - HKLM\..\RunOnce: [ntck32.exe] C:\WINDOWS\system32\ntck32.exe
O4 - HKLM\..\RunOnce: [mspa.exe] C:\WINDOWS\system32\mspa.exe
O4 - HKLM\..\RunOnce: [appbx32.exe] C:\WINDOWS\system32\appbx32.exe
O4 - HKLM\..\RunOnce: [sysdc32.exe] C:\WINDOWS\system32\sysdc32.exe
O4 - HKLM\..\RunOnce: [addxh32.exe] C:\WINDOWS\system32\addxh32.exe
O4 - HKLM\..\RunOnce: [addht32.exe] C:\WINDOWS\system32\addht32.exe
O4 - HKLM\..\RunOnce: [netcz32.exe] C:\WINDOWS\system32\netcz32.exe
O4 - HKLM\..\RunOnce: [appso.exe] C:\WINDOWS\appso.exe
O4 - HKLM\..\RunOnce: [winvq.exe] C:\WINDOWS\winvq.exe
O4 - HKLM\..\RunOnce: [sysfo.exe] C:\WINDOWS\system32\sysfo.exe
O4 - HKLM\..\RunOnce: [javaee32.exe] C:\WINDOWS\system32\javaee32.exe
O4 - HKLM\..\RunOnce: [apiut.exe] C:\WINDOWS\apiut.exe
O4 - HKLM\..\RunOnce: [mfcxd.exe] C:\WINDOWS\system32\mfcxd.exe
O4 - HKLM\..\RunOnce: [ntbh32.exe] C:\WINDOWS\system32\ntbh32.exe
O4 - HKLM\..\RunOnce: [apilh.exe] C:\WINDOWS\system32\apilh.exe
O4 - HKLM\..\RunOnce: [netrw32.exe] C:\WINDOWS\system32\netrw32.exe
O4 - HKLM\..\RunOnce: [apift32.exe] C:\WINDOWS\apift32.exe
O4 - HKLM\..\RunOnce: [netfj32.exe] C:\WINDOWS\netfj32.exe
O4 - HKLM\..\RunOnce: [sdkkn32.exe] C:\WINDOWS\system32\sdkkn32.exe
O4 - HKLM\..\RunOnce: [addkn.exe] C:\WINDOWS\addkn.exe
O4 - HKLM\..\RunOnce: [d3ar32.exe] C:\WINDOWS\system32\d3ar32.exe
O4 - HKLM\..\RunOnce: [mfcaz.exe] C:\WINDOWS\mfcaz.exe
O4 - HKLM\..\RunOnce: [appji.exe] C:\WINDOWS\system32\appji.exe
O4 - HKLM\..\RunOnce: [netnm.exe] C:\WINDOWS\system32\netnm.exe
O4 - HKLM\..\RunOnce: [appaw.exe] C:\WINDOWS\appaw.exe
O4 - HKLM\..\RunOnce: [winbw.exe] C:\WINDOWS\winbw.exe
O4 - HKLM\..\RunOnce: [netql32.exe] C:\WINDOWS\netql32.exe
O4 - HKLM\..\RunOnce: [javapt32.exe] C:\WINDOWS\javapt32.exe
O4 - HKLM\..\RunOnce: [appgh.exe] C:\WINDOWS\system32\appgh.exe
O4 - HKLM\..\RunOnce: [mfczi32.exe] C:\WINDOWS\mfczi32.exe
O4 - HKLM\..\RunOnce: [ieth.exe] C:\WINDOWS\ieth.exe
O4 - HKLM\..\RunOnce: [netnl.exe] C:\WINDOWS\netnl.exe
O4 - HKLM\..\RunOnce: [wingm.exe] C:\WINDOWS\wingm.exe
O4 - HKLM\..\RunOnce: [mfcci.exe] C:\WINDOWS\mfcci.exe
O4 - HKLM\..\RunOnce: [ntvj32.exe] C:\WINDOWS\ntvj32.exe
O4 - HKLM\..\RunOnce: [crlq.exe] C:\WINDOWS\crlq.exe
O4 - HKLM\..\RunOnce: [syspu32.exe] C:\WINDOWS\syspu32.exe
O4 - HKLM\..\RunOnce: [msyv.exe] C:\WINDOWS\msyv.exe
O4 - HKLM\..\RunOnce: [ipxl32.exe] C:\WINDOWS\ipxl32.exe
O4 - HKLM\..\RunOnce: [sysgb32.exe] C:\WINDOWS\system32\sysgb32.exe
O4 - HKLM\..\RunOnce: [sdkaa.exe] C:\WINDOWS\system32\sdkaa.exe
O4 - HKLM\..\RunOnce: [addul.exe] C:\WINDOWS\system32\addul.exe
O4 - HKLM\..\RunOnce: [iejs.exe] C:\WINDOWS\iejs.exe
O4 - HKLM\..\RunOnce: [sdkul32.exe] C:\WINDOWS\sdkul32.exe
O4 - HKLM\..\RunOnce: [crfe32.exe] C:\WINDOWS\system32\crfe32.exe
O4 - HKLM\..\RunOnce: [apikb32.exe] C:\WINDOWS\system32\apikb32.exe
O4 - HKLM\..\RunOnce: [crnm.exe] C:\WINDOWS\system32\crnm.exe
O4 - HKLM\..\RunOnce: [ntry.exe] C:\WINDOWS\ntry.exe
O4 - HKLM\..\RunOnce: [iego32.exe] C:\WINDOWS\system32\iego32.exe
O4 - HKLM\..\RunOnce: [addxv.exe] C:\WINDOWS\system32\addxv.exe
O4 - HKLM\..\RunOnce: [atlet32.exe] C:\WINDOWS\system32\atlet32.exe
O4 - HKLM\..\RunOnce: [msjp32.exe] C:\WINDOWS\system32\msjp32.exe
O4 - HKLM\..\RunOnce: [mfceb32.exe] C:\WINDOWS\system32\mfceb32.exe
O4 - HKLM\..\RunOnce: [addwi32.exe] C:\WINDOWS\addwi32.exe
O4 - HKLM\..\RunOnce: [msmp.exe] C:\WINDOWS\system32\msmp.exe
O4 - HKLM\..\RunOnce: [mfcku32.exe] C:\WINDOWS\mfcku32.exe
O4 - HKLM\..\RunOnce: [sysgl32.exe] C:\WINDOWS\system32\sysgl32.exe
O4 - HKLM\..\RunOnce: [apibe.exe] C:\WINDOWS\system32\apibe.exe
O4 - HKLM\..\RunOnce: [appfi.exe] C:\WINDOWS\appfi.exe
O4 - HKLM\..\RunOnce: [ipux32.exe] C:\WINDOWS\system32\ipux32.exe
O4 - HKLM\..\RunOnce: [crkf.exe] C:\WINDOWS\system32\crkf.exe
O4 - HKLM\..\RunOnce: [sysoj32.exe] C:\WINDOWS\sysoj32.exe
O4 - HKLM\..\RunOnce: [d3yr.exe] C:\WINDOWS\system32\d3yr.exe
O4 - HKLM\..\RunOnce: [mseg32.exe] C:\WINDOWS\mseg32.exe
O4 - HKLM\..\RunOnce: [d3sd32.exe] C:\WINDOWS\system32\d3sd32.exe
O4 - HKLM\..\RunOnce: [addcb.exe] C:\WINDOWS\system32\addcb.exe
O4 - HKLM\..\RunOnce: [apivc.exe] C:\WINDOWS\system32\apivc.exe
O4 - HKLM\..\RunOnce: [sysmc32.exe] C:\WINDOWS\system32\sysmc32.exe
O4 - HKLM\..\RunOnce: [netar.exe] C:\WINDOWS\system32\netar.exe
O4 - HKLM\..\RunOnce: [ntzg32.exe] C:\WINDOWS\ntzg32.exe
O4 - HKLM\..\RunOnce: [appta32.exe] C:\WINDOWS\appta32.exe
O4 - HKLM\..\RunOnce: [apixe.exe] C:\WINDOWS\system32\apixe.exe
O4 - HKLM\..\RunOnce: [atlye32.exe] C:\WINDOWS\atlye32.exe
O4 - HKLM\..\RunOnce: [atlnb32.exe] C:\WINDOWS\system32\atlnb32.exe
O4 - HKLM\..\RunOnce: [msrx32.exe] C:\WINDOWS\msrx32.exe
O4 - HKLM\..\RunOnce: [mfcnj32.exe] C:\WINDOWS\system32\mfcnj32.exe
O4 - HKLM\..\RunOnce: [netzn.exe] C:\WINDOWS\netzn.exe
O4 - HKLM\..\RunOnce: [apiao32.exe] C:\WINDOWS\system32\apiao32.exe
O4 - HKLM\..\RunOnce: [apipl.exe] C:\WINDOWS\apipl.exe
O4 - HKLM\..\RunOnce: [winab32.exe] C:\WINDOWS\system32\winab32.exe
O4 - HKLM\..\RunOnce: [netdn32.exe] C:\WINDOWS\netdn32.exe
O4 - HKLM\..\RunOnce: [sdkhr.exe] C:\WINDOWS\sdkhr.exe
O4 - HKLM\..\RunOnce: [ntqs32.exe] C:\WINDOWS\ntqs32.exe
O4 - HKLM\..\RunOnce: [ipxo32.exe] C:\WINDOWS\ipxo32.exe
O4 - HKLM\..\RunOnce: [appbt32.exe] C:\WINDOWS\appbt32.exe
O4 - HKLM\..\RunOnce: [ntee32.exe] C:\WINDOWS\system32\ntee32.exe
O4 - HKLM\..\RunOnce: [crjj.exe] C:\WINDOWS\system32\crjj.exe
O4 - HKLM\..\RunOnce: [javakj32.exe] C:\WINDOWS\system32\javakj32.exe
O4 - HKLM\..\RunOnce: [sdkyg32.exe] C:\WINDOWS\system32\sdkyg32.exe
O4 - HKLM\..\RunOnce: [atldc32.exe] C:\WINDOWS\system32\atldc32.exe
O4 - HKLM\..\RunOnce: [msls.exe] C:\WINDOWS\msls.exe
O4 - HKLM\..\RunOnce: [crms32.exe] C:\WINDOWS\system32\crms32.exe
O4 - HKLM\..\RunOnce: [d3jv.exe] C:\WINDOWS\system32\d3jv.exe
O4 - HKLM\..\RunOnce: [winfz32.exe] C:\WINDOWS\winfz32.exe
O4 - HKLM\..\RunOnce: [msoa.exe] C:\WINDOWS\msoa.exe
O4 - HKLM\..\RunOnce: [iecw32.exe] C:\WINDOWS\iecw32.exe
O4 - HKLM\..\RunOnce: [msqt32.exe] C:\WINDOWS\system32\msqt32.exe
O4 - HKLM\..\RunOnce: [ntvq32.exe] C:\WINDOWS\system32\ntvq32.exe
O4 - HKLM\..\RunOnce: [crdj.exe] C:\WINDOWS\system32\crdj.exe
O4 - HKLM\..\RunOnce: [syshn.exe] C:\WINDOWS\system32\syshn.exe
O4 - HKLM\..\RunOnce: [atlro32.exe] C:\WINDOWS\system32\atlro32.exe
O4 - HKLM\..\RunOnce: [ipqw.exe] C:\WINDOWS\system32\ipqw.exe
O4 - HKLM\..\RunOnce: [crms.exe] C:\WINDOWS\system32\crms.exe
O4 - HKLM\..\RunOnce: [ieet32.exe] C:\WINDOWS\system32\ieet32.exe
O4 - HKLM\..\RunOnce: [appua.exe] C:\WINDOWS\system32\appua.exe
O4 - HKLM\..\RunOnce: [mfcob32.exe] C:\WINDOWS\system32\mfcob32.exe
O4 - HKLM\..\RunOnce: [mfccy32.exe] C:\WINDOWS\system32\mfccy32.exe
O4 - HKLM\..\RunOnce: [netce.exe] C:\WINDOWS\netce.exe
O4 - HKLM\..\RunOnce: [atlrt.exe] C:\WINDOWS\atlrt.exe
O4 - HKLM\..\RunOnce: [iebm32.exe] C:\WINDOWS\iebm32.exe
O4 - HKLM\..\RunOnce: [winvf.exe] C:\WINDOWS\system32\winvf.exe
O4 - HKLM\..\RunOnce: [mfcrb.exe] C:\WINDOWS\system32\mfcrb.exe
O4 - HKLM\..\RunOnce: [ipjc32.exe] C:\WINDOWS\system32\ipjc32.exe
O4 - HKLM\..\RunOnce: [craj.exe] C:\WINDOWS\system32\craj.exe
O4 - HKLM\..\RunOnce: [mshp32.exe] C:\WINDOWS\system32\mshp32.exe
O4 - HKLM\..\RunOnce: [winmt.exe] C:\WINDOWS\winmt.exe
O4 - HKLM\..\RunOnce: [javaaw.exe] C:\WINDOWS\system32\javaaw.exe
O4 - HKLM\..\RunOnce: [netea.exe] C:\WINDOWS\netea.exe
O4 - HKLM\..\RunOnce: [d3tx32.exe] C:\WINDOWS\d3tx32.exe
O4 - HKLM\..\RunOnce: [sysje.exe] C:\WINDOWS\sysje.exe
O4 - HKLM\..\RunOnce: [mfcni32.exe] C:\WINDOWS\mfcni32.exe
O4 - HKLM\..\RunOnce: [addxj.exe] C:\WINDOWS\addxj.exe
O4 - HKLM\..\RunOnce: [appdg32.exe] C:\WINDOWS\appdg32.exe
O4 - HKLM\..\RunOnce: [addrv32.exe] C:\WINDOWS\system32\addrv32.exe
O4 - HKLM\..\RunOnce: [sysjl.exe] C:\WINDOWS\system32\sysjl.exe
O4 - HKLM\..\RunOnce: [d3ex.exe] C:\WINDOWS\d3ex.exe
O4 - HKLM\..\RunOnce: [appum32.exe] C:\WINDOWS\system32\appum32.exe
O4 - HKLM\..\RunOnce: [winxo.exe] C:\WINDOWS\winxo.exe
O4 - HKLM\..\RunOnce: [winxe.exe] C:\WINDOWS\system32\winxe.exe
O4 - HKLM\..\RunOnce: [javazf32.exe] C:\WINDOWS\javazf32.exe
O4 - HKLM\..\RunOnce: [sdkoc32.exe] C:\WINDOWS\system32\sdkoc32.exe
O4 - HKLM\..\RunOnce: [mfcsg32.exe] C:\WINDOWS\system32\mfcsg32.exe
O4 - HKLM\..\RunOnce: [javans32.exe] C:\WINDOWS\system32\javans32.exe
O4 - HKLM\..\RunOnce: [mssw.exe] C:\WINDOWS\mssw.exe
O4 - HKLM\..\RunOnce: [d3bx32.exe] C:\WINDOWS\system32\d3bx32.exe
O4 - HKLM\..\RunOnce: [crpu32.exe] C:\WINDOWS\crpu32.exe
O4 - HKLM\..\RunOnce: [mspz.exe] C:\WINDOWS\system32\mspz.exe
O4 - HKLM\..\RunOnce: [javaeo.exe] C:\WINDOWS\system32\javaeo.exe
O4 - HKLM\..\RunOnce: [netph32.exe] C:\WINDOWS\netph32.exe
O4 - HKLM\..\RunOnce: [ipis32.exe] C:\WINDOWS\ipis32.exe
O4 - HKLM\..\RunOnce: [appnp32.exe] C:\WINDOWS\system32\appnp32.exe
O4 - HKLM\..\RunOnce: [ntia.exe] C:\WINDOWS\ntia.exe
O4 - HKLM\..\RunOnce: [apimm.exe] C:\WINDOWS\system32\apimm.exe
O4 - HKLM\..\RunOnce: [javabc32.exe] C:\WINDOWS\system32\javabc32.exe
O4 - HKLM\..\RunOnce: [iesj.exe] C:\WINDOWS\system32\iesj.exe
O4 - HKLM\..\RunOnce: [appwn32.exe] C:\WINDOWS\system32\appwn32.exe
O4 - HKLM\..\RunOnce: [winlk32.exe] C:\WINDOWS\system32\winlk32.exe
O4 - HKLM\..\RunOnce: [syszh32.exe] C:\WINDOWS\syszh32.exe
O4 - HKLM\..\RunOnce: [mfcjf.exe] C:\WINDOWS\system32\mfcjf.exe
O4 - HKLM\..\RunOnce: [ntcg.exe] C:\WINDOWS\system32\ntcg.exe
O4 - HKLM\..\RunOnce: [apptg32.exe] C:\WINDOWS\system32\apptg32.exe
O4 - HKLM\..\RunOnce: [sdkiv.exe] C:\WINDOWS\system32\sdkiv.exe
O4 - HKLM\..\RunOnce: [netam.exe] C:\WINDOWS\system32\netam.exe
O4 - HKLM\..\RunOnce: [mfcjm.exe] C:\WINDOWS\mfcjm.exe
O4 - HKLM\..\RunOnce: [javayb32.exe] C:\WINDOWS\system32\javayb32.exe
O4 - HKLM\..\RunOnce: [msor32.exe] C:\WINDOWS\system32\msor32.exe
O4 - HKLM\..\RunOnce: [crju.exe] C:\WINDOWS\crju.exe
O4 - HKLM\..\RunOnce: [netik32.exe] C:\WINDOWS\netik32.exe
O4 - HKLM\..\RunOnce: [appga32.exe] C:\WINDOWS\system32\appga32.exe
O4 - HKLM\..\RunOnce: [atlgi.exe] C:\WINDOWS\atlgi.exe
O4 - HKLM\..\RunOnce: [sdkkr32.exe] C:\WINDOWS\sdkkr32.exe
O4 - HKLM\..\RunOnce: [javakh.exe] C:\WINDOWS\javakh.exe
O4 - HKLM\..\RunOnce: [sdksh.exe] C:\WINDOWS\sdksh.exe
O4 - HKLM\..\RunOnce: [ieix32.exe] C:\WINDOWS\ieix32.exe
O4 - HKLM\..\RunOnce: [appye32.exe] C:\WINDOWS\appye32.exe
O4 - HKLM\..\RunOnce: [winbi.exe] C:\WINDOWS\winbi.exe
O4 - HKLM\..\RunOnce: [addpd32.exe] C:\WINDOWS\system32\addpd32.exe
O4 - HKLM\..\RunOnce: [msos32.exe] C:\WINDOWS\msos32.exe
O4 - HKLM\..\RunOnce: [iena32.exe] C:\WINDOWS\iena32.exe
O4 - HKLM\..\RunOnce: [atlxb32.exe] C:\WINDOWS\atlxb32.exe
O4 - HKLM\..\RunOnce: [crxb.exe] C:\WINDOWS\system32\crxb.exe
O4 - HKLM\..\RunOnce: [syskt32.exe] C:\WINDOWS\syskt32.exe
O4 - HKLM\..\RunOnce: [crai.exe] C:\WINDOWS\system32\crai.exe
O4 - HKLM\..\RunOnce: [apihy32.exe] C:\WINDOWS\system32\apihy32.exe
O4 - HKLM\..\RunOnce: [addxf32.exe] C:\WINDOWS\addxf32.exe
O4 - HKLM\..\RunOnce: [sysbp.exe] C:\WINDOWS\system32\sysbp.exe
O4 - HKLM\..\RunOnce: [atlxt.exe] C:\WINDOWS\system32\atlxt.exe
O4 - HKLM\..\RunOnce: [ippm32.exe] C:\WINDOWS\system32\ippm32.exe
O4 - HKLM\..\RunOnce: [crgb.exe] C:\WINDOWS\system32\crgb.exe
O4 - HKLM\..\RunOnce: [syskx32.exe] C:\WINDOWS\syskx32.exe
O4 - HKLM\..\RunOnce: [iemz32.exe] C:\WINDOWS\iemz32.exe
O4 - HKLM\..\RunOnce: [atliq32.exe] C:\WINDOWS\system32\atliq32.exe
O4 - HKLM\..\RunOnce: [msnm32.exe] C:\WINDOWS\system32\msnm32.exe
O4 - HKLM\..\RunOnce: [atliy32.exe] C:\WINDOWS\system32\atliy32.exe
O4 - HKLM\..\RunOnce: [mfckz32.exe] C:\WINDOWS\mfckz32.exe
O4 - HKLM\..\RunOnce: [syshv32.exe] C:\WINDOWS\system32\syshv32.exe
O4 - HKLM\..\RunOnce: [apikh32.exe] C:\WINDOWS\apikh32.exe
O4 - HKLM\..\RunOnce: [ipmw.exe] C:\WINDOWS\system32\ipmw.exe
O4 - HKLM\..\RunOnce: [crqa32.exe] C:\WINDOWS\system32\crqa32.exe
O4 - HKLM\..\RunOnce: [crnt32.exe] C:\WINDOWS\system32\crnt32.exe
O4 - HKLM\..\RunOnce: [appci.exe] C:\WINDOWS\system32\appci.exe
O4 - HKLM\..\RunOnce: [mfcbq.exe] C:\WINDOWS\mfcbq.exe
O4 - HKLM\..\RunOnce: [ntlr.exe] C:\WINDOWS\ntlr.exe
O4 - HKLM\..\RunOnce: [applr32.exe] C:\WINDOWS\applr32.exe
O4 - HKLM\..\RunOnce: [addrn.exe] C:\WINDOWS\system32\addrn.exe
O4 - HKLM\..\RunOnce: [ievz.exe] C:\WINDOWS\ievz.exe
O4 - HKLM\..\RunOnce: [atlkp32.exe] C:\WINDOWS\system32\atlkp32.exe
O4 - HKLM\..\RunOnce: [ipjw32.exe] C:\WINDOWS\ipjw32.exe
O4 - HKLM\..\RunOnce: [apiei.exe] C:\WINDOWS\apiei.exe
O4 - HKLM\..\RunOnce: [sysdp32.exe] C:\WINDOWS\sysdp32.exe
O4 - HKLM\..\RunOnce: [crbf32.exe] C:\WINDOWS\system32\crbf32.exe
O4 - HKLM\..\RunOnce: [sdkwp.exe] C:\WINDOWS\sdkwp.exe
O4 - HKLM\..\RunOnce: [msat32.exe] C:\WINDOWS\msat32.exe
O4 - HKLM\..\RunOnce: [crkt.exe] C:\WINDOWS\crkt.exe
O4 - HKLM\..\RunOnce: [d3qq32.exe] C:\WINDOWS\d3qq32.exe
O4 - HKLM\..\RunOnce: [cref32.exe] C:\WINDOWS\system32\cref32.exe
O4 - HKLM\..\RunOnce: [apijj32.exe] C:\WINDOWS\system32\apijj32.exe
O4 - HKLM\..\RunOnce: [d3ev32.exe] C:\WINDOWS\system32\d3ev32.exe
O4 - HKLM\..\RunOnce: [sysjz.exe] C:\WINDOWS\sysjz.exe
O4 - HKLM\..\RunOnce: [ntxt.exe] C:\WINDOWS\system32\ntxt.exe
O4 - HKLM\..\RunOnce: [apibf.exe] C:\WINDOWS\system32\apibf.exe
O4 - HKLM\..\RunOnce: [ipnm.exe] C:\WINDOWS\ipnm.exe
O4 - HKLM\..\RunOnce: [winbp.exe] C:\WINDOWS\system32\winbp.exe
O4 - HKLM\..\RunOnce: [ipkv32.exe] C:\WINDOWS\system32\ipkv32.exe
O4 - HKLM\..\RunOnce: [sdksl.exe] C:\WINDOWS\sdksl.exe
O4 - HKLM\..\RunOnce: [appgp.exe] C:\WINDOWS\appgp.exe
O4 - HKLM\..\RunOnce: [appvk32.exe] C:\WINDOWS\system32\appvk32.exe
O4 - HKLM\..\RunOnce: [javauk32.exe] C:\WINDOWS\javauk32.exe
O4 - HKLM\..\RunOnce: [winpw32.exe] C:\WINDOWS\system32\winpw32.exe
O4 - HKLM\..\RunOnce: [crxr32.exe] C:\WINDOWS\system32\crxr32.exe
O4 - HKLM\..\RunOnce: [apiil32.exe] C:\WINDOWS\system32\apiil32.exe
O4 - HKLM\..\RunOnce: [winvn32.exe] C:\WINDOWS\system32\winvn32.exe
O4 - HKLM\..\RunOnce: [ierz.exe] C:\WINDOWS\system32\ierz.exe
O4 - HKLM\..\RunOnce: [sdkpo32.exe] C:\WINDOWS\system32\sdkpo32.exe
O4 - HKLM\..\RunOnce: [msin32.exe] C:\WINDOWS\system32\msin32.exe
O4 - HKLM\..\RunOnce: [iecy32.exe] C:\WINDOWS\system32\iecy32.exe
O4 - HKLM\..\RunOnce: [sdkhu32.exe] C:\WINDOWS\sdkhu32.exe
O4 - HKLM\..\RunOnce: [javahi32.exe] C:\WINDOWS\javahi32.exe
O4 - HKLM\..\RunOnce: [atlab32.exe] C:\WINDOWS\system32\atlab32.exe
O4 - HKLM\..\RunOnce: [mfcaj32.exe] C:\WINDOWS\system32\mfcaj32.exe
O4 - HKLM\..\RunOnce: [sdkkk32.exe] C:\WINDOWS\sdkkk32.exe
O4 - HKLM\..\RunOnce: [sdkmb32.exe] C:\WINDOWS\system32\sdkmb32.exe
O4 - HKLM\..\RunOnce: [msdj32.exe] C:\WINDOWS\system32\msdj32.exe
O4 - HKLM\..\RunOnce: [cryn.exe] C:\WINDOWS\cryn.exe
O4 - HKLM\..\RunOnce: [apixc32.exe] C:\WINDOWS\apixc32.exe
O4 - HKLM\..\RunOnce: [addvs32.exe] C:\WINDOWS\system32\addvs32.exe
O4 - HKLM\..\RunOnce: [appva.exe] C:\WINDOWS\appva.exe
O4 - HKLM\..\RunOnce: [addea.exe] C:\WINDOWS\system32\addea.exe
O4 - HKLM\..\RunOnce: [ntei.exe] C:\WINDOWS\ntei.exe
O4 - HKLM\..\RunOnce: [sysbv.exe] C:\WINDOWS\sysbv.exe
O4 - HKLM\..\RunOnce: [iekw.exe] C:\WINDOWS\system32\iekw.exe
O4 - HKLM\..\RunOnce: [apitc32.exe] C:\WINDOWS\apitc32.exe
O4 - HKLM\..\RunOnce: [addsr.exe] C:\WINDOWS\system32\addsr.exe
O4 - HKLM\..\RunOnce: [d3qh32.exe] C:\WINDOWS\system32\d3qh32.exe
O4 - HKLM\..\RunOnce: [iphx32.exe] C:\WINDOWS\iphx32.exe
O4 - HKLM\..\RunOnce: [winvj32.exe] C:\WINDOWS\winvj32.exe
O4 - HKLM\..\RunOnce: [ieyn.exe] C:\WINDOWS\system32\ieyn.exe
O4 - HKLM\..\RunOnce: [sdkxd32.exe] C:\WINDOWS\sdkxd32.exe
O4 - HKLM\..\RunOnce: [apins32.exe] C:\WINDOWS\system32\apins32.exe
O4 - HKLM\..\RunOnce: [apiva.exe] C:\WINDOWS\system32\apiva.exe
O4 - HKLM\..\RunOnce: [mfcwb.exe] C:\WINDOWS\mfcwb.exe
O4 - HKLM\..\RunOnce: [javaly32.exe] C:\WINDOWS\system32\javaly32.exe
O4 - HKLM\..\RunOnce: [msjf32.exe] C:\WINDOWS\system32\msjf32.exe
O4 - HKLM\..\RunOnce: [crfj.exe] C:\WINDOWS\crfj.exe
O4 - HKLM\..\RunOnce: [sdkas32.exe] C:\WINDOWS\sdkas32.exe
O4 - HKLM\..\RunOnce: [ipdw.exe] C:\WINDOWS\system32\ipdw.exe
O4 - HKLM\..\RunOnce: [iesb32.exe] C:\WINDOWS\iesb32.exe
O4 - HKLM\..\RunOnce: [sysaj.exe] C:\WINDOWS\system32\sysaj.exe
O4 - HKLM\..\RunOnce: [apiwt32.exe] C:\WINDOWS\system32\apiwt32.exe
O4 - HKLM\..\RunOnce: [netej.exe] C:\WINDOWS\system32\netej.exe
O4 - HKLM\..\RunOnce: [apiej.exe] C:\WINDOWS\system32\apiej.exe
O4 - HKLM\..\RunOnce: [javauy32.exe] C:\WINDOWS\system32\javauy32.exe
O4 - HKLM\..\RunOnce: [iesg32.exe] C:\WINDOWS\system32\iesg32.exe
O4 - HKLM\..\RunOnce: [d3ns.exe] C:\WINDOWS\system32\d3ns.exe
O4 - HKLM\..\RunOnce: [netmz32.exe] C:\WINDOWS\system32\netmz32.exe
O4 - HKLM\..\RunOnce: [appkp.exe] C:\WINDOWS\appkp.exe
O4 - HKLM\..\RunOnce: [msje32.exe] C:\WINDOWS\msje32.exe
O4 - HKLM\..\RunOnce: [sdkzu32.exe] C:\WINDOWS\system32\sdkzu32.exe
O4 - HKLM\..\RunOnce: [sdkzc32.exe] C:\WINDOWS\system32\sdkzc32.exe
O4 - HKLM\..\RunOnce: [iejc32.exe] C:\WINDOWS\iejc32.exe
O4 - HKLM\..\RunOnce: [iprc.exe] C:\WINDOWS\iprc.exe
O4 - HKLM\..\RunOnce: [apihf.exe] C:\WINDOWS\apihf.exe
O4 - HKLM\..\RunOnce: [sysgf32.exe] C:\WINDOWS\sysgf32.exe
O4 - HKLM\..\RunOnce: [netuu32.exe] C:\WINDOWS\system32\netuu32.exe
O4 - HKLM\..\RunOnce: [ieuc32.exe] C:\WINDOWS\ieuc32.exe
O4 - HKLM\..\RunOnce: [ipuk.exe] C:\WINDOWS\system32\ipuk.exe
O4 - HKLM\..\RunOnce: [atlyo.exe] C:\WINDOWS\atlyo.exe
O4 - HKLM\..\RunOnce: [addiv.exe] C:\WINDOWS\addiv.exe
O4 - HKLM\..\RunOnce: [sysrv.exe] C:\WINDOWS\sysrv.exe
O4 - HKLM\..\RunOnce: [apigk.exe] C:\WINDOWS\system32\apigk.exe
O4 - HKLM\..\RunOnce: [sysad32.exe] C:\WINDOWS\system32\sysad32.exe
O4 - HKLM\..\RunOnce: [sdkwh32.exe] C:\WINDOWS\system32\sdkwh32.exe
O4 - HKLM\..\RunOnce: [winzt.exe] C:\WINDOWS\system32\winzt.exe
O4 - HKLM\..\RunOnce: [syslb.exe] C:\WINDOWS\syslb.exe
O4 - HKLM\..\RunOnce: [d3di.exe] C:\WINDOWS\system32\d3di.exe
O4 - HKLM\..\RunOnce: [crei32.exe] C:\WINDOWS\crei32.exe
O4 - HKLM\..\RunOnce: [javatf32.exe] C:\WINDOWS\system32\javatf32.exe
O4 - HKLM\..\RunOnce: [apixb32.exe] C:\WINDOWS\apixb32.exe
O4 - HKLM\..\RunOnce: [crsn32.exe] C:\WINDOWS\system32\crsn32.exe
O4 - HKLM\..\RunOnce: [iexr.exe] C:\WINDOWS\iexr.exe
O4 - HKLM\..\RunOnce: [d3uo.exe] C:\WINDOWS\d3uo.exe
O4 - HKLM\..\RunOnce: [msal.exe] C:\WINDOWS\system32\msal.exe
O4 - HKLM\..\RunOnce: [netoh.exe] C:\WINDOWS\netoh.exe
O4 - HKLM\..\RunOnce: [ieat.exe] C:\WINDOWS\ieat.exe
O4 - HKLM\..\RunOnce: [netdc32.exe] C:\WINDOWS\system32\netdc32.exe
O4 - HKLM\..\RunOnce: [iedk.exe] C:\WINDOWS\iedk.exe
O4 - HKLM\..\RunOnce: [crho.exe] C:\WINDOWS\system32\crho.exe
O4 - HKLM\..\RunOnce: [winwl32.exe] C:\WINDOWS\winwl32.exe
O4 - HKLM\..\RunOnce: [ntec32.exe] C:\WINDOWS\ntec32.exe
O4 - HKLM\..\RunOnce: [sdkek.exe] C:\WINDOWS\sdkek.exe
O4 - HKLM\..\RunOnce: [ntnk.exe] C:\WINDOWS\ntnk.exe
O4 - HKLM\..\RunOnce: [ntib32.exe] C:\WINDOWS\ntib32.exe
O4 - HKLM\..\RunOnce: [appnx32.exe] C:\WINDOWS\appnx32.exe
O4 - HKLM\..\RunOnce: [sdkqr32.exe] C:\WINDOWS\sdkqr32.exe
O4 - HKLM\..\RunOnce: [d3uv.exe] C:\WINDOWS\system32\d3uv.exe
O4 - HKLM\..\RunOnce: [javavw32.exe] C:\WINDOWS\javavw32.exe
O4 - HKLM\..\RunOnce: [crjb32.exe] C:\WINDOWS\system32\crjb32.exe
O4 - HKLM\..\RunOnce: [mswf.exe] C:\WINDOWS\mswf.exe
O4 - HKLM\..\RunOnce: [d3xf32.exe] C:\WINDOWS\system32\d3xf32.exe
O4 - HKLM\..\RunOnce: [crlc.exe] C:\WINDOWS\crlc.exe
O4 - HKLM\..\RunOnce: [d3rz.exe] C:\WINDOWS\d3rz.exe
O4 - HKLM\..\RunOnce: [winkp32.exe] C:\WINDOWS\winkp32.exe
O4 - HKLM\..\RunOnce: [apiuq32.exe] C:\WINDOWS\system32\apiuq32.exe
O4 - HKLM\..\RunOnce: [msuy.exe] C:\WINDOWS\msuy.exe
O4 - HKLM\..\RunOnce: [ntvx.exe] C:\WINDOWS\system32\ntvx.exe
O4 - HKLM\..\RunOnce: [ipey.exe] C:\WINDOWS\ipey.exe
O4 - HKLM\..\RunOnce: [mstn32.exe] C:\WINDOWS\system32\mstn32.exe
O4 - HKLM\..\RunOnce: [crxw.exe] C:\WINDOWS\crxw.exe
O4 - HKLM\..\RunOnce: [nethp32.exe] C:\WINDOWS\nethp32.exe
O4 - HKLM\..\RunOnce: [ipbi.exe] C:\WINDOWS\system32\ipbi.exe
O4 - HKLM\..\RunOnce: [d3xe.exe] C:\WINDOWS\d3xe.exe
O4 - HKLM\..\RunOnce: [syspf32.exe] C:\WINDOWS\system32\syspf32.exe
O4 - HKLM\..\RunOnce: [atlfn.exe] C:\WINDOWS\system32\atlfn.exe
O4 - HKLM\..\RunOnce: [ipbr32.exe] C:\WINDOWS\ipbr32.exe
O4 - HKLM\..\RunOnce: [ipbx32.exe] C:\WINDOWS\system32\ipbx32.exe
O4 - HKLM\..\RunOnce: [ntmr32.exe] C:\WINDOWS\system32\ntmr32.exe
O4 - HKLM\..\RunOnce: [atlrn32.exe] C:\WINDOWS\atlrn32.exe
O4 - HKLM\..\RunOnce: [ipyg.exe] C:\WINDOWS\ipyg.exe
O4 - HKLM\..\RunOnce: [apino.exe] C:\WINDOWS\apino.exe
O4 - HKLM\..\RunOnce: [wingg32.exe] C:\WINDOWS\system32\wingg32.exe
O4 - HKLM\..\RunOnce: [addra32.exe] C:\WINDOWS\addra32.exe
O4 - HKLM\..\RunOnce: [d3ww32.exe] C:\WINDOWS\d3ww32.exe
O4 - HKLM\..\RunOnce: [appzi.exe] C:\WINDOWS\system32\appzi.exe
O4 - HKLM\..\RunOnce: [sysvu32.exe] C:\WINDOWS\system32\sysvu32.exe
O4 - HKLM\..\RunOnce: [crtb.exe] C:\WINDOWS\crtb.exe
O4 - HKLM\..\RunOnce: [apisr32.exe] C:\WINDOWS\apisr32.exe
O4 - HKLM\..\RunOnce: [sdklq32.exe] C:\WINDOWS\system32\sdklq32.exe
O4 - HKLM\..\RunOnce: [javawj32.exe] C:\WINDOWS\javawj32.exe
O4 - HKLM\..\RunOnce: [apibf32.exe] C:\WINDOWS\apibf32.exe
O4 - HKLM\..\RunOnce: [crer.exe] C:\WINDOWS\crer.exe
O4 - HKLM\..\RunOnce: [ntav32.exe] C:\WINDOWS\system32\ntav32.exe
O4 - HKLM\..\RunOnce: [mfcyk.exe] C:\WINDOWS\mfcyk.exe
O4 - HKLM\..\RunOnce: [iexa32.exe] C:\WINDOWS\iexa32.exe
O4 - HKLM\..\RunOnce: [javanp32.exe] C:\WINDOWS\system32\javanp32.exe
O4 - HKLM\..\RunOnce: [crvx.exe] C:\WINDOWS\system32\crvx.exe
O4 - HKLM\..\RunOnce: [javawy.exe] C:\WINDOWS\javawy.exe
O4 - HKLM\..\RunOnce: [systv32.exe] C:\WINDOWS\system32\systv32.exe
O4 - HKLM\..\RunOnce: [atlkc32.exe] C:\WINDOWS\system32\atlkc32.exe
O4 - HKLM\..\RunOnce: [addfg.exe] C:\WINDOWS\system32\addfg.exe
O4 - HKLM\..\RunOnce: [crew32.exe] C:\WINDOWS\system32\crew32.exe
O4 - HKLM\..\RunOnce: [sdkes32.exe] C:\WINDOWS\system32\sdkes32.exe
O4 - HKLM\..\RunOnce: [netcq32.exe] C:\WINDOWS\netcq32.exe
O4 - HKLM\..\RunOnce: [crmq32.exe] C:\WINDOWS\system32\crmq32.exe
O4 - HKLM\..\RunOnce: [atlmy32.exe] C:\WINDOWS\atlmy32.exe
O4 - HKLM\..\RunOnce: [javahk32.exe] C:\WINDOWS\system32\javahk32.exe
O4 - HKLM\..\RunOnce: [msmo.exe] C:\WINDOWS\msmo.exe
O4 - HKLM\..\RunOnce: [crup32.exe] C:\WINDOWS\system32\crup32.exe
O4 - HKLM\..\RunOnce: [crjm.exe] C:\WINDOWS\crjm.exe
O4 - HKLM\..\RunOnce: [crpi.exe] C:\WINDOWS\system32\crpi.exe
O4 - HKLM\..\RunOnce: [mfcuf.exe] C:\WINDOWS\mfcuf.exe
O4 - HKLM\..\RunOnce: [d3oq.exe] C:\WINDOWS\d3oq.exe
O4 - HKLM\..\RunOnce: [sdkef.exe] C:\WINDOWS\system32\sdkef.exe
O4 - HKLM\..\RunOnce: [apiwy32.exe] C:\WINDOWS\system32\apiwy32.exe
O4 - HKLM\..\RunOnce: [netij.exe] C:\WINDOWS\netij.exe
O4 - HKLM\..\RunOnce: [appgx.exe] C:\WINDOWS\system32\appgx.exe
O4 - HKLM\..\RunOnce: [netkb.exe] C:\WINDOWS\system32\netkb.exe
O4 - HKLM\..\RunOnce: [javavb32.exe] C:\WINDOWS\system32\javavb32.exe
O4 - HKLM\..\RunOnce: [mslj.exe] C:\WINDOWS\system32\mslj.exe
O4 - HKLM\..\RunOnce: [apppf32.exe] C:\WINDOWS\apppf32.exe
O4 - HKLM\..\RunOnce: [syszn.exe] C:\WINDOWS\system32\syszn.exe
O4 - HKLM\..\RunOnce: [winec32.exe] C:\WINDOWS\winec32.exe
O4 - HKLM\..\RunOnce: [systz32.exe] C:\WINDOWS\system32\systz32.exe
O4 - HKLM\..\RunOnce: [javayd32.exe] C:\WINDOWS\system32\javayd32.exe
O4 - HKLM\..\RunOnce: [wintp32.exe] C:\WINDOWS\system32\wintp32.exe
O4 - HKLM\..\RunOnce: [atlft.exe] C:\WINDOWS\atlft.exe
O4 - HKLM\..\RunOnce: [atlli32.exe] C:\WINDOWS\atlli32.exe
O4 - HKLM\..\RunOnce: [atlaf32.exe] C:\WINDOWS\system32\atlaf32.exe
O4 - HKLM\..\RunOnce: [apizs.exe] C:\WINDOWS\apizs.exe
O4 - HKLM\..\RunOnce: [apppz.exe] C:\WINDOWS\apppz.exe
O4 - HKLM\..\RunOnce: [iezs.exe] C:\WINDOWS\system32\iezs.exe
O4 - HKLM\..\RunOnce: [sdkkl32.exe] C:\WINDOWS\sdkkl32.exe
O4 - HKLM\..\RunOnce: [javade32.exe] C:\WINDOWS\system32\javade32.exe
O4 - HKLM\..\RunOnce: [nthy32.exe] C:\WINDOWS\nthy32.exe
O4 - HKLM\..\RunOnce: [mfcxg.exe] C:\WINDOWS\system32\mfcxg.exe
O4 - HKLM\..\RunOnce: [ieev32.exe] C:\WINDOWS\system32\ieev32.exe
O4 - HKLM\..\RunOnce: [javaul32.exe] C:\WINDOWS\javaul32.exe
O4 - HKLM\..\RunOnce: [crut.exe] C:\WINDOWS\system32\crut.exe
O4 - HKLM\..\RunOnce: [javadb.exe] C:\WINDOWS\javadb.exe
O4 - HKLM\..\RunOnce: [javare.exe] C:\WINDOWS\system32\javare.exe
O4 - HKLM\..\RunOnce: [ievi.exe] C:\WINDOWS\ievi.exe
O4 - HKLM\..\RunOnce: [appgj32.exe] C:\WINDOWS\system32\appgj32.exe
O4 - HKLM\..\RunOnce: [winjk32.exe] C:\WINDOWS\winjk32.exe
O4 - HKLM\..\RunOnce: [addde.exe] C:\WINDOWS\addde.exe
O4 - HKLM\..\RunOnce: [criv.exe] C:\WINDOWS\criv.exe
O4 - HKLM\..\RunOnce: [addee.exe] C:\WINDOWS\system32\addee.exe
O4 - HKLM\..\RunOnce: [syseg32.exe] C:\WINDOWS\syseg32.exe
O4 - HKLM\..\RunOnce: [apidr32.exe] C:\WINDOWS\system32\apidr32.exe
O4 - HKLM\..\RunOnce: [winiu.exe] C:\WINDOWS\system32\winiu.exe
O4 - HKLM\..\RunOnce: [sysmh.exe] C:\WINDOWS\system32\sysmh.exe
O4 - HKLM\..\RunOnce: [sdkaj32.exe] C:\WINDOWS\sdkaj32.exe
O4 - HKLM\..\RunOnce: [sysrc32.exe] C:\WINDOWS\sysrc32.exe
O4 - HKLM\..\RunOnce: [javawe.exe] C:\WINDOWS\javawe.exe
O4 - HKLM\..\RunOnce: [sysev.exe] C:\WINDOWS\sysev.exe
O4 - HKLM\..\RunOnce: [sysjs32.exe] C:\WINDOWS\sysjs32.exe
O4 - HKLM\..\RunOnce: [javaoo32.exe] C:\WINDOWS\system32\javaoo32.exe
O4 - HKLM\..\RunOnce: [adddd.exe] C:\WINDOWS\system32\adddd.exe
O4 - HKLM\..\RunOnce: [msgz32.exe] C:\WINDOWS\msgz32.exe
O4 - HKLM\..\RunOnce: [appzv.exe] C:\WINDOWS\system32\appzv.exe
O4 - HKLM\..\RunOnce: [sdkga32.exe] C:\WINDOWS\system32\sdkga32.exe
O4 - HKLM\..\RunOnce: [mfclu.exe] C:\WINDOWS\mfclu.exe
O4 - HKLM\..\RunOnce: [msla.exe] C:\WINDOWS\system32\msla.exe
O4 - HKLM\..\RunOnce: [ipzu.exe] C:\WINDOWS\system32\ipzu.exe
O4 - HKLM\..\RunOnce: [cris32.exe] C:\WINDOWS\cris32.exe
O4 - HKLM\..\RunOnce: [apinm32.exe] C:\WINDOWS\apinm32.exe
O4 - HKLM\..\RunOnce: [netwx.exe] C:\WINDOWS\netwx.exe
O4 - HKLM\..\RunOnce: [javaoq.exe] C:\WINDOWS\javaoq.exe
O4 - HKLM\..\RunOnce: [mfcfy32.exe] C:\WINDOWS\mfcfy32.exe
O4 - HKLM\..\RunOnce: [apizp32.exe] C:\WINDOWS\system32\apizp32.exe
O4 - HKLM\..\RunOnce: [mfcom.exe] C:\WINDOWS\mfcom.exe
O4 - HKLM\..\RunOnce: [apitb.exe] C:\WINDOWS\apitb.exe
O4 - HKLM\..\RunOnce: [iehf.exe] C:\WINDOWS\system32\iehf.exe
O4 - HKLM\..\RunOnce: [netbr.exe] C:\WINDOWS\netbr.exe
O4 - HKLM\..\RunOnce: [atlry.exe] C:\WINDOWS\atlry.exe
O4 - HKLM\..\RunOnce: [iebr32.exe] C:\WINDOWS\system32\iebr32.exe
O4 - HKLM\..\RunOnce: [winvk.exe] C:\WINDOWS\system32\winvk.exe
O4 - HKLM\..\RunOnce: [mfcqo.exe] C:\WINDOWS\mfcqo.exe
O4 - HKLM\..\RunOnce: [ntjh32.exe] C:\WINDOWS\system32\ntjh32.exe
O4 - HKLM\..\RunOnce: [crzo.exe] C:\WINDOWS\crzo.exe
O4 - HKLM\..\RunOnce: [sysds32.exe] C:\WINDOWS\sysds32.exe
O4 - HKLM\..\RunOnce: [msnb.exe] C:\WINDOWS\msnb.exe
O4 - HKLM\..\RunOnce: [mssp32.exe] C:\WINDOWS\mssp32.exe
O4 - HKLM\..\RunOnce: [mshm32.exe] C:\WINDOWS\system32\mshm32.exe
O4 - HKLM\..\RunOnce: [sysga.exe] C:\WINDOWS\sysga.exe
O4 - HKLM\..\RunOnce: [d3wh.exe] C:\WINDOWS\d3wh.exe
O4 - HKLM\..\RunOnce: [ntga32.exe] C:\WINDOWS\system32\ntga32.exe
O4 - HKLM\..\RunOnce: [adduc32.exe] C:\WINDOWS\adduc32.exe
O4 - HKLM\..\RunOnce: [apioh.exe] C:\WINDOWS\apioh.exe
O4 - HKLM\..\RunOnce: [winws.exe] C:\WINDOWS\winws.exe
O4 - HKLM\..\RunOnce: [d3pr.exe] C:\WINDOWS\d3pr.exe
O4 - HKLM\..\RunOnce: [ntlv.exe] C:\WINDOWS\ntlv.exe
O4 - HKLM\..\RunOnce: [sysub32.exe] C:\WINDOWS\system32\sysub32.exe
O4 - HKLM\..\RunOnce: [msma.exe] C:\WINDOWS\system32\msma.exe
O4 - HKLM\..\RunOnce: [netac32.exe] C:\WINDOWS\netac32.exe
O4 - HKLM\..\RunOnce: [mfckb.exe] C:\WINDOWS\mfckb.exe
O4 - HKLM\..\RunOnce: [atlzd32.exe] C:\WINDOWS\system32\atlzd32.exe
O4 - HKLM\..\RunOnce: [atlcn32.exe] C:\WINDOWS\system32\atlcn32.exe
O4 - HKLM\..\RunOnce: [addxw.exe] C:\WINDOWS\system32\addxw.exe
O4 - HKLM\..\RunOnce: [mfcky.exe] C:\WINDOWS\system32\mfcky.exe
O4 - HKLM\..\RunOnce: [addgc.exe] C:\WINDOWS\addgc.exe
O4 - HKLM\..\RunOnce: [ieyj32.exe] C:\WINDOWS\ieyj32.exe
O4 - HKLM\..\RunOnce: [addel32.exe] C:\WINDOWS\system32\addel32.exe
O4 - HKLM\..\RunOnce: [crxe32.exe] C:\WINDOWS\crxe32.exe



Step 8
Now run CWShredder, making sure to click "Fix".


Step 9
Delete these files or directories (Do not be concerned if they do not exist)

C:\WINDOWS\svcgj.dll
C:\WINDOWS\system32\sysrz.dll
C:\WINDOWS\system32\sdkga32.dll
All files from the 04 lines listed above


Step 10
Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.


Step 11
Run a full scan with Adaware.


Reboot your computer to go back to normal mode and post a new hijackthis log and the log from About Buster.

Buckeye_Sam

Don't worry about the smiley's. That's just how the forum interprets certain random characters.

Some of these steps are going to be repetitive, but please follow them all.

You have an HSA infection. The filenames on this type of infection can change each time you reboot your computer or use Internet Explorer. With that in mind, some of these filenames may be different. But the pattern is the same and you may be able to determine the correct files to remove. The sooner you perform this fix, the higher it's chances for success.

Much of this fix has to be performed in Safe Mode where you won't be able to access the Internet.

Please print out these instructions.


Step 1
Download CWShredder but don't run it yet.


Step 2
Download AboutBuster
Unzip it to your desktop but don't run it yet.


Step 3
Download Ad-aware SE 1.06
Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


Step 5
Make sure that you can VIEW ALL HIDDEN FILES.


Step 6
Reboot your computer into SAFE MODE


Step 7
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\svcgj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.searchv.com/1/
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {BFBFA424-9910-08B0-2FBF-CC5180D847C2} - C:\WINDOWS\system32\sysrz.dll
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\Run: [msfw.exe] C:\WINDOWS\system32\msfw.exe
O4 - HKLM\..\Run: [crko.exe] C:\WINDOWS\system32\crko.exe
O4 - HKLM\..\RunOnce: [netys32.exe] C:\WINDOWS\netys32.exe

and all 04 lines listed between...

O4 - HKLM\..\RunOnce: [crxe32.exe] C:\WINDOWS\crxe32.exe



Step 8
Now run CWShredder, making sure to click "Fix".


Step 9
Delete these files or directories (Do not be concerned if they do not exist)

C:\WINDOWS\svcgj.dll
C:\WINDOWS\system32\sysrz.dll
C:\WINDOWS\system32\sdkga32.dll
All files from the 04 lines listed above


Step 10
Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.


Step 11
Run a full scan with Adaware.


Reboot your computer to go back to normal mode and post a new hijackthis log and the log from About Buster.

michellgomez

Good Afternoon Sam,

Hope you are having a great Monday.

Followed your instructions.

I did not find these 2 in HJT to fix:
O2 - BHO: Class - {BFBFA424-9910-08B0-2FBF-CC5180D847C2} - C:\WINDOWS\system32\sysrz.dll
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll

However, there were 3 O2 lines that I did not touch.

The R1 lines containing svcgj.dll were not there either. Their 5 letter extension changed and was the same in every file you requested I fix. Based on some reading I have done on your website, I figured that was HSA changing it's name when I restarted so I fixed them anyhow, but only those that looked exactly the same except for those 5 letters.

Update: HSA and Shopping wizard still here. Antivirus-gold still hijacking my desktop. About:blank IE window at start up is gone, however I did get an IE error message at start up even though I was not yet connected to the internet.

Here are my new posts.

HJT log

Logfile of HijackThis v1.99.1
Scan saved at 5:56:26 PM, on 7/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\winea.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\crko.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.969\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [crko.exe] C:\WINDOWS\system32\crko.exe
O4 - HKLM\..\RunOnce: [d3xu32.exe] C:\WINDOWS\d3xu32.exe
O4 - HKLM\..\RunOnce: [addgn32.exe] C:\WINDOWS\system32\addgn32.exe
O4 - HKLM\..\RunOnce: [sdkgv.exe] C:\WINDOWS\sdkgv.exe
O4 - HKLM\..\RunOnce: [addev.exe] C:\WINDOWS\addev.exe
O4 - HKLM\..\RunOnce: [ieiz.exe] C:\WINDOWS\system32\ieiz.exe
O4 - HKLM\..\RunOnce: [mfcxx32.exe] C:\WINDOWS\mfcxx32.exe
O4 - HKLM\..\RunOnce: [ipne.exe] C:\WINDOWS\ipne.exe
O4 - HKLM\..\RunOnce: [atlmr.exe] C:\WINDOWS\atlmr.exe
O4 - HKLM\..\RunOnce: [ipqn.exe] C:\WINDOWS\ipqn.exe
O4 - HKLM\..\RunOnce: [winea.exe] C:\WINDOWS\winea.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


About:buster


AboutBuster 5.0 reference file 30
Scan started on [7/11/2005] at [5:21:25 PM]

---

Removed Stream! C:\WINDOWS\Q331953.log:jkyevc
Removed Stream! C:\WINDOWS\qivhm.txt:qfwmim
Removed Stream! C:\WINDOWS\QUICKEN.INI:igprkx
Removed Stream! C:\WINDOWS\wmsetup.log:kijwj
Removed Stream! C:\WINDOWS\_ds1.tmp:bdgasq
Removed Stream! C:\WINDOWS\_ds1.tmp:cblcso
Removed Stream! C:\WINDOWS\_ds1.tmp:dxpouv

---

Removed File! : C:\Windows\akabq.dll
Removed File! : C:\Windows\jkkct.dll
Removed File! : C:\Windows\nxhqu.dat
Removed File! : C:\Windows\System32\owcqp.dll
Removed File! : C:\Windows\System32\yaeos.dll

---

Scan was COMPLETED SUCCESSFULLY at 5:23:17 PM

Buckeye_Sam

You have two separate infections and both can be very nasty. We are going to remove the HSA first and then we'll deal with Smitfraud(antivirus gold).


Much of this fix has to be performed in Safe Mode where you won't be able to access the Internet.

Please print out these instructions.

Step 1
Make sure that you can VIEW ALL HIDDEN FILES.


Step 2
Reboot your computer into SAFE MODE


Step 3
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fnbie.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F3DF3C5A-2566-083E-2CA1-07FE7B5682F8} - C:\WINDOWS\system32\sdkga32.dll
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [crko.exe] C:\WINDOWS\system32\crko.exe
O4 - HKLM\..\RunOnce: [d3xu32.exe] C:\WINDOWS\d3xu32.exe
O4 - HKLM\..\RunOnce: [addgn32.exe] C:\WINDOWS\system32\addgn32.exe
O4 - HKLM\..\RunOnce: [sdkgv.exe] C:\WINDOWS\sdkgv.exe
O4 - HKLM\..\RunOnce: [addev.exe] C:\WINDOWS\addev.exe
O4 - HKLM\..\RunOnce: [ieiz.exe] C:\WINDOWS\system32\ieiz.exe
O4 - HKLM\..\RunOnce: [mfcxx32.exe] C:\WINDOWS\mfcxx32.exe
O4 - HKLM\..\RunOnce: [ipne.exe] C:\WINDOWS\ipne.exe
O4 - HKLM\..\RunOnce: [atlmr.exe] C:\WINDOWS\atlmr.exe
O4 - HKLM\..\RunOnce: [ipqn.exe] C:\WINDOWS\ipqn.exe
O4 - HKLM\..\RunOnce: [winea.exe] C:\WINDOWS\winea.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)



Step 4
Now run CWShredder, making sure to click "Fix".


Step 5
Delete these files or directories (Do not be concerned if they do not exist)

C:\WINDOWS\system32\sdkga32.dll
C:\WINDOWS\system32\crko.exe
C:\WINDOWS\system32\ieiz.exe
C:\WINDOWS\system32\addgn32.exe
C:\WINDOWS\fnbie.dll
C:\WINDOWS\sdkgv.exe
C:\WINDOWS\addev.exe
C:\WINDOWS\d3xu32.exe
C:\WINDOWS\mfcxx32.exe
C:\WINDOWS\ipne.exe
C:\WINDOWS\atlmr.exe
C:\WINDOWS\ipqn.exe
C:\WINDOWS\winea.exe
C:\WINDOWS\d3xu32.exe



Step 6
Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.


Step 7
Delete temp files

Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.

Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

Empty the Recycle Bin.



Reboot your computer to go back to normal mode and post a new hijackthis log and the log from About Buster.

michellgomez

Good Evening,

Followed your instructions.

Update: HSA and shopping wizard are still here. Anti-virus gold still on desktop. IE did not open a window on start up to About:Blank AND this time no IE error message!!!

However, upon start up, I did receive a new error message. addrx.dll Bad Image " the application or dll C"\WINDOWS\sdkai32.dll is not a valid image" Don't know if this is important but thought I should report it. This error message has appeared 3 times in the past 5 minutes or so.


HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 9:20:42 PM, on 7/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\apiiz32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\addrx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.531\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {F6961B99-762F-B1BE-0D43-513230AC094F} - C:\WINDOWS\system32\winye32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [apiiz32.exe] C:\WINDOWS\system32\apiiz32.exe
O4 - HKLM\..\RunOnce: [ipck32.exe] C:\WINDOWS\ipck32.exe
O4 - HKLM\..\RunOnce: [mspa32.exe] C:\WINDOWS\mspa32.exe
O4 - HKLM\..\RunOnce: [appxz32.exe] C:\WINDOWS\appxz32.exe
O4 - HKLM\..\RunOnce: [appyv32.exe] C:\WINDOWS\system32\appyv32.exe
O4 - HKLM\..\RunOnce: [msjg.exe] C:\WINDOWS\msjg.exe
O4 - HKLM\..\RunOnce: [addrx.exe] C:\WINDOWS\system32\addrx.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



About: Buster log


AboutBuster 5.0 reference file 30
Scan started on [7/11/2005] at [9:03:50 PM]

---

Removed Stream! C:\WINDOWS\dict.dat:nlanm
Removed Stream! C:\WINDOWS\EReg515.dat:gllxm
Removed Stream! C:\WINDOWS\Q309521.log:lzgtt
Removed Stream! C:\WINDOWS\_ds1.tmp:bmaal

---

No Files Found!

---

Scan was COMPLETED SUCCESSFULLY at 9:05:22 PM

Buckeye_Sam

You are getting closer!

Fix these lines with Hijackthis.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tqnbj.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {F6961B99-762F-B1BE-0D43-513230AC094F} - C:\WINDOWS\system32\winye32.dll
O4 - HKLM\..\Run: [apiiz32.exe] C:\WINDOWS\system32\apiiz32.exe
O4 - HKLM\..\RunOnce: [ipck32.exe] C:\WINDOWS\ipck32.exe
O4 - HKLM\..\RunOnce: [mspa32.exe] C:\WINDOWS\mspa32.exe
O4 - HKLM\..\RunOnce: [appxz32.exe] C:\WINDOWS\appxz32.exe
O4 - HKLM\..\RunOnce: [appyv32.exe] C:\WINDOWS\system32\appyv32.exe
O4 - HKLM\..\RunOnce: [msjg.exe] C:\WINDOWS\msjg.exe
O4 - HKLM\..\RunOnce: [addrx.exe] C:\WINDOWS\system32\addrx.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)



Delete these files.

C:\WINDOWS\system32\tqnbj.dll
C:\WINDOWS\system32\winye32.dll
C:\WINDOWS\system32\apiiz32.exe
C:\WINDOWS\ipck32.exe
C:\WINDOWS\mspa32.exe
C:\WINDOWS\appxz32.exe
C:\WINDOWS\system32\appyv32.exe
C:\WINDOWS\msjg.exe
C:\WINDOWS\system32\addrx.exe
C:\WINDOWS\d3xu32.exe


Run About Buster.

Run CWShredder.

Reboot

Run About Buster once again.


Post a new hijackthis log.

michellgomez

Good Afternoon,

Followed your instructions. I could not locate some of the files in HJT to fix, nor similar ones. They were the R1 ones.

Update: NO error messages on start up!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! HSA and shopping wizard still here. Desktop still hijacked.

Question? Can I fix all the O2 lines with BHO in it? I've been reading some more of the instructionals on this website and I don't see why I need any of them. Plus, it seems as if everytime I fix one, more populate in it's place. But your the expert, so please advise.


HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 4:59:20 PM, on 7/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ipuz.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\cidaemon.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.218\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {36791C41-EE2D-4A40-AF45-24A5ABA6D46E} - C:\WINDOWS\d3fv32.dll
O2 - BHO: Class - {45392883-DD1C-FC42-B1BC-75A19920AD1D} - C:\WINDOWS\appab.dll
O2 - BHO: Class - {A83F2621-E630-7943-FD17-24FC9321228A} - C:\WINDOWS\system32\ipsx.dll
O2 - BHO: Class - {AF9212F9-75F2-52A3-BB07-70FF19A7FBC7} - C:\WINDOWS\system32\addxs32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {CF175BA3-5E1E-3DA5-CADB-A16A0DD61E83} - C:\WINDOWS\netio.dll
O2 - BHO: Class - {D1C4F520-3CF0-B2B6-2A64-9399D51607D3} - C:\WINDOWS\system32\d3pf32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ipuz.exe] C:\WINDOWS\ipuz.exe
O4 - HKLM\..\RunOnce: [winmq.exe] C:\WINDOWS\winmq.exe
O4 - HKLM\..\RunOnce: [crqr.exe] C:\WINDOWS\crqr.exe
O4 - HKLM\..\RunOnce: [javata.exe] C:\WINDOWS\system32\javata.exe
O4 - HKLM\..\RunOnce: [wintf32.exe] C:\WINDOWS\wintf32.exe
O4 - HKLM\..\RunOnce: [javayw32.exe] C:\WINDOWS\javayw32.exe
O4 - HKLM\..\RunOnce: [nttm.exe] C:\WINDOWS\nttm.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


About: Buster Log


AboutBuster 5.0 reference file 30
Scan started on [7/12/2005] at [4:54:40 PM]

---

Removed Stream! C:\WINDOWS\_ds1.tmp:fcqsk

---

No Files Found!

---

Scan was COMPLETED SUCCESSFULLY at 4:57:17 PM

Buckeye_Sam

All of the 02 lines are optional, so yes you can fix them all.

Fix these lines with hijackthis.

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {36791C41-EE2D-4A40-AF45-24A5ABA6D46E} - C:\WINDOWS\d3fv32.dll
O2 - BHO: Class - {45392883-DD1C-FC42-B1BC-75A19920AD1D} - C:\WINDOWS\appab.dll
O2 - BHO: Class - {A83F2621-E630-7943-FD17-24FC9321228A} - C:\WINDOWS\system32\ipsx.dll
O2 - BHO: Class - {AF9212F9-75F2-52A3-BB07-70FF19A7FBC7} - C:\WINDOWS\system32\addxs32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {CF175BA3-5E1E-3DA5-CADB-A16A0DD61E83} - C:\WINDOWS\netio.dll
O2 - BHO: Class - {D1C4F520-3CF0-B2B6-2A64-9399D51607D3} - C:\WINDOWS\system32\d3pf32.dll
O4 - HKLM\..\Run: [ipuz.exe] C:\WINDOWS\ipuz.exe
O4 - HKLM\..\RunOnce: [winmq.exe] C:\WINDOWS\winmq.exe
O4 - HKLM\..\RunOnce: [crqr.exe] C:\WINDOWS\crqr.exe
O4 - HKLM\..\RunOnce: [javata.exe] C:\WINDOWS\system32\javata.exe
O4 - HKLM\..\RunOnce: [wintf32.exe] C:\WINDOWS\wintf32.exe
O4 - HKLM\..\RunOnce: [javayw32.exe] C:\WINDOWS\javayw32.exe
O4 - HKLM\..\RunOnce: [nttm.exe] C:\WINDOWS\nttm.exe



Delete these files.

C:\WINDOWS\d3fv32.dll
C:\WINDOWS\appab.dll
C:\WINDOWS\system32\ipsx.dll
C:\WINDOWS\system32\addxs32.dll
C:\WINDOWS\netio.dll
C:\WINDOWS\system32\d3pf32.dll
C:\WINDOWS\ipuz.exe
C:\WINDOWS\winmq.exe
C:\WINDOWS\crqr.exe
C:\WINDOWS\system32\javata.exe
C:\WINDOWS\wintf32.exe
C:\WINDOWS\javayw32.exe
C:\WINDOWS\nttm.exe



Click Start -> Run -> (type) services.msc

Scroll down and find the service called Remote Procedure Call (RPC) Helper When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.


Run Hijackthis and click on Open the Misc Tools section -> Delete an NT Service
Copy and paste this into the text box and click OK.

11Fßä#·ºÄÖ`I


Reboot and post a new hijackthis log.

michellgomez

Followed your instructions. I put that funky text in the Delete NT text box however, it could not be found or deleted. I tried 3 times, making sure I did not copy any extra spaces before or after the line of text.

Update: HSA, Shoping wizard...check. Hijacked desktop...check. New error message at start up: msvm.exe "the application or dll C:\Windows\d3lr32.dll is not a valid Windows image". about:blank still gone.

Here is my new log.


HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 6:37:45 PM, on 7/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\msvm.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\msmk.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Real\RealOne Player\RealPlay.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX01.907\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {D8044D91-A88E-8AF1-9321-849D547AAE8C} - C:\WINDOWS\system32\nthn.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ipuz.exe] C:\WINDOWS\ipuz.exe
O4 - HKLM\..\Run: [msmk.exe] C:\WINDOWS\system32\msmk.exe
O4 - HKLM\..\RunOnce: [msvm.exe] C:\WINDOWS\msvm.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Buckeye_Sam

We're getting close now.

Fix these lines with hijackthis.

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {D8044D91-A88E-8AF1-9321-849D547AAE8C} - C:\WINDOWS\system32\nthn.dll
O4 - HKLM\..\Run: [ipuz.exe] C:\WINDOWS\ipuz.exe
O4 - HKLM\..\Run: [msmk.exe] C:\WINDOWS\system32\msmk.exe
O4 - HKLM\..\RunOnce: [msvm.exe] C:\WINDOWS\msvm.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\d3xu32.exe" /s (file missing)



Delete these files.

C:\WINDOWS\system32\nthn.dll
C:\WINDOWS\ipuz.exe
C:\WINDOWS\system32\msmk.exe
C:\WINDOWS\msvm.exe
C:\WINDOWS\d3xu32.exe



Run AboutBuster.



Reboot and post a new hijackthis log.

michellgomez

Sam, I finally got it. Incase you didn't get my email...here it is again.

Here we go. HSA, shopping wizard, and desktop hijack still there. About:blank keeps installing itself as my homepage. I also have a hard time getting to this page. I can get to short-media but when I click on our thread, I get a blank page.

Also, you have not been advising to deleted those R1 lines but I have been doing so anyhow. They keep changing the 5 character file names, but they are always there when I go to fix in hjt.

Logfile of HijackThis v1.99.1
Scan saved at 7:25:15 PM, on 7/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\appqs.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.156\HijackThis.exe



AboutBuster 5.0 reference file 30
Scan started on [7/13/2005] at [6:32:12 PM]

---

Removed Stream! C:\WINDOWS\AuthMgr.INI:mcuxx
Removed Stream! C:\WINDOWS\dnybf.txt:cwssv
Removed Stream! C:\WINDOWS\KB891781.log:wjzce
Removed Stream! C:\WINDOWS\KB896428.log:gkcva
Removed Stream! C:\WINDOWS\Q329048.log:ehtyu
Removed Stream! C:\WINDOWS\Q329834.log:ebpmr
Removed Stream! C:\WINDOWS\setupapi.log:kjblwm
Removed Stream! C:\WINDOWS\spupdsvc.log:wrlka
Removed Stream! C:\WINDOWS\_ds1.tmp:aubyz

---

Removed File! : C:\Windows\opkkr.dat
Removed File! : C:\Windows\System32\qnuog.dll
Removed File! : C:\Windows\System32\ynjlm.dll

---

Scan was COMPLETED SUCCESSFULLY at 6:34:01 PM

Buckeye_Sam

You cut the log short. Please post an entire hijackthis log.

michellgomez

Sorry Sam,

I ran HJT again, deleted all of the unfortunately usual R1 lines, BHOs and "default URL hook missing" mess. Ran About:Buster. Ran CWS shredder. Ran About:Buster. Ran Ad-aware. Ran SpyBot SD. Ran About:Buster. Below are the 3 About:buster logs, with the bottom one being the most recent. New HJT log.

Update: HSA shoppingwizard and hijacked desktop, all still here. Also, I have search extender, which I am sure has been here all along but I just noticed it.

Also, now I am getting a bunch of funky widows messages: addnu32.exe: the application or DLL C:WINDOWS\system32\crvk32.dll is not a valid Windows image. Replace crvk with msfb, jelg, apium and apifl. Those are the messages I have received so far, however, I expect there to be more the longer I keep my computer on b/c they appear about once a minute with a different 4-letter string.




AboutBuster 5.0 reference file 30
Scan started on [7/14/2005] at [9:46:34 PM]

---

Removed Stream! C:\WINDOWS\COM+.log:hpfzo
Removed Stream! C:\WINDOWS\dahotfix.log:emhaq
Removed Stream! C:\WINDOWS\dasetup.log:mvjbt
Removed Stream! C:\WINDOWS\fqjsk.dat:oswxf
Removed Stream! C:\WINDOWS\wmprfesp.prx:azdpm
Removed Stream! C:\WINDOWS\_ds1.tmp:afbir

---

Removed File! : C:\Windows\cekvj.dll
Removed File! : C:\Windows\jjqkn.dat
Removed File! : C:\Windows\qvnar.dat
Removed File! : C:\Windows\riskn.dat
Removed File! : C:\Windows\sogvo.dll
Removed File! : C:\Windows\urenx.dat
Removed File! : C:\Windows\ymire.dll
Removed File! : C:\Windows\System32\fjquj.dll
Removed File! : C:\Windows\System32\kbppv.dll
Removed File! : C:\Windows\System32\kedkv.dll
Removed File! : C:\Windows\System32\mcwrl.dll
Removed File! : C:\Windows\System32\qxuvw.dat
Removed File! : C:\Windows\System32\wynlv.dll

---

Scan was COMPLETED SUCCESSFULLY at 9:49:08 PM


AboutBuster 5.0 reference file 30
Scan started on [7/14/2005] at [10:12:49 PM]

---

Removed Stream! C:\WINDOWS\_ds1.tmp:amxye

---

No Files Found!

---

Scan was COMPLETED SUCCESSFULLY at 10:14:33 PM


AboutBuster 5.0 reference file 30
Scan started on [7/14/2005] at [10:22:55 PM]

---

Removed Stream! C:\WINDOWS\_ds1.tmp:bxbun

---

No Files Found!

---

Scan was COMPLETED SUCCESSFULLY at 10:24:27 PM




HJT

Logfile of HijackThis v1.99.1
Scan saved at 10:38:16 PM, on 7/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msdv.exe
C:\WINDOWS\addnu32.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX03.672\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {63FF24F4-3A79-8B02-6E12-81C9BAAFF3A0} - C:\WINDOWS\system32\mssq.dll
O2 - BHO: Class - {9E0E94E6-F2FC-52E4-E589-519846F8629C} - C:\WINDOWS\atlmg32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [appqs.exe] C:\WINDOWS\system32\appqs.exe
O4 - HKLM\..\Run: [addgo32.exe] C:\WINDOWS\addgo32.exe
O4 - HKLM\..\Run: [msdv.exe] C:\WINDOWS\system32\msdv.exe
O4 - HKLM\..\RunOnce: [netna.exe] C:\WINDOWS\netna.exe
O4 - HKLM\..\RunOnce: [mssr.exe] C:\WINDOWS\mssr.exe
O4 - HKLM\..\RunOnce: [mfcsg.exe] C:\WINDOWS\mfcsg.exe
O4 - HKLM\..\RunOnce: [javaqt32.exe] C:\WINDOWS\javaqt32.exe
O4 - HKLM\..\RunOnce: [javaif32.exe] C:\WINDOWS\javaif32.exe
O4 - HKLM\..\RunOnce: [ieio.exe] C:\WINDOWS\ieio.exe
O4 - HKLM\..\RunOnce: [ieiq32.exe] C:\WINDOWS\ieiq32.exe
O4 - HKLM\..\RunOnce: [iper.exe] C:\WINDOWS\system32\iper.exe
O4 - HKLM\..\RunOnce: [winer32.exe] C:\WINDOWS\winer32.exe
O4 - HKLM\..\RunOnce: [iptu32.exe] C:\WINDOWS\iptu32.exe
O4 - HKLM\..\RunOnce: [ntkq.exe] C:\WINDOWS\system32\ntkq.exe
O4 - HKLM\..\RunOnce: [netzn.exe] C:\WINDOWS\system32\netzn.exe
O4 - HKLM\..\RunOnce: [wintg.exe] C:\WINDOWS\wintg.exe
O4 - HKLM\..\RunOnce: [ntij.exe] C:\WINDOWS\ntij.exe
O4 - HKLM\..\RunOnce: [mfcln.exe] C:\WINDOWS\mfcln.exe
O4 - HKLM\..\RunOnce: [systb.exe] C:\WINDOWS\system32\systb.exe
O4 - HKLM\..\RunOnce: [apicj32.exe] C:\WINDOWS\apicj32.exe
O4 - HKLM\..\RunOnce: [mswl32.exe] C:\WINDOWS\mswl32.exe
O4 - HKLM\..\RunOnce: [apiac32.exe] C:\WINDOWS\apiac32.exe
O4 - HKLM\..\RunOnce: [crxh32.exe] C:\WINDOWS\crxh32.exe
O4 - HKLM\..\RunOnce: [ipyx.exe] C:\WINDOWS\ipyx.exe
O4 - HKLM\..\RunOnce: [addkq.exe] C:\WINDOWS\system32\addkq.exe
O4 - HKLM\..\RunOnce: [ntpy.exe] C:\WINDOWS\system32\ntpy.exe
O4 - HKLM\..\RunOnce: [javaiz32.exe] C:\WINDOWS\javaiz32.exe
O4 - HKLM\..\RunOnce: [netta32.exe] C:\WINDOWS\netta32.exe
O4 - HKLM\..\RunOnce: [mfcqv32.exe] C:\WINDOWS\mfcqv32.exe
O4 - HKLM\..\RunOnce: [creg32.exe] C:\WINDOWS\creg32.exe
O4 - HKLM\..\RunOnce: [atlhf.exe] C:\WINDOWS\atlhf.exe
O4 - HKLM\..\RunOnce: [sdkel32.exe] C:\WINDOWS\system32\sdkel32.exe
O4 - HKLM\..\RunOnce: [crao.exe] C:\WINDOWS\system32\crao.exe
O4 - HKLM\..\RunOnce: [appxb.exe] C:\WINDOWS\appxb.exe
O4 - HKLM\..\RunOnce: [ipnq32.exe] C:\WINDOWS\ipnq32.exe
O4 - HKLM\..\RunOnce: [winbt32.exe] C:\WINDOWS\system32\winbt32.exe
O4 - HKLM\..\RunOnce: [sdkjj32.exe] C:\WINDOWS\sdkjj32.exe
O4 - HKLM\..\RunOnce: [adddu32.exe] C:\WINDOWS\adddu32.exe
O4 - HKLM\..\RunOnce: [crou32.exe] C:\WINDOWS\system32\crou32.exe
O4 - HKLM\..\RunOnce: [apiqj32.exe] C:\WINDOWS\system32\apiqj32.exe
O4 - HKLM\..\RunOnce: [winph.exe] C:\WINDOWS\winph.exe
O4 - HKLM\..\RunOnce: [winyx32.exe] C:\WINDOWS\system32\winyx32.exe
O4 - HKLM\..\RunOnce: [sysgf.exe] C:\WINDOWS\sysgf.exe
O4 - HKLM\..\RunOnce: [mfcpt32.exe] C:\WINDOWS\system32\mfcpt32.exe
O4 - HKLM\..\RunOnce: [sdknq32.exe] C:\WINDOWS\system32\sdknq32.exe
O4 - HKLM\..\RunOnce: [msex32.exe] C:\WINDOWS\system32\msex32.exe
O4 - HKLM\..\RunOnce: [apiyz32.exe] C:\WINDOWS\apiyz32.exe
O4 - HKLM\..\RunOnce: [addwg32.exe] C:\WINDOWS\system32\addwg32.exe
O4 - HKLM\..\RunOnce: [ipum.exe] C:\WINDOWS\ipum.exe
O4 - HKLM\..\RunOnce: [apivm.exe] C:\WINDOWS\system32\apivm.exe
O4 - HKLM\..\RunOnce: [addqm.exe] C:\WINDOWS\system32\addqm.exe
O4 - HKLM\..\RunOnce: [appky32.exe] C:\WINDOWS\system32\appky32.exe
O4 - HKLM\..\RunOnce: [ipzn.exe] C:\WINDOWS\ipzn.exe
O4 - HKLM\..\RunOnce: [winna.exe] C:\WINDOWS\winna.exe
O4 - HKLM\..\RunOnce: [winit32.exe] C:\WINDOWS\system32\winit32.exe
O4 - HKLM\..\RunOnce: [javayx.exe] C:\WINDOWS\system32\javayx.exe
O4 - HKLM\..\RunOnce: [addnu32.exe] C:\WINDOWS\addnu32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\netna.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Buckeye_Sam

You are going to be an expert on this infection by the time we get rid of it for good.
I guess it's time we take off the gloves and get serious here. Let's get you fixed up.


==============


Please download and install Mozilla Firefox to use as an alternate browser while we are fixing your computer.

http://www.mozilla.org/products/firefox/

Once you have Firefox installed do not use IE again until you are clean.


==============


Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


==============


Reboot into Safe mode.


==============


Click Start -> Run -> (type) services.msc

Scroll down and find the service called Remote Procedure Call (RPC) Helper When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.


Run Hijackthis and click on Open the Misc Tools section -> Delete an NT Service
Copy and paste this into the text box and click OK.

11Fßä#·ºÄÖ`I


Do not reboot yet if it asks you to.


==============


Fix these lines with Hijackthis.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xvuru.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {63FF24F4-3A79-8B02-6E12-81C9BAAFF3A0} - C:\WINDOWS\system32\mssq.dll
O2 - BHO: Class - {9E0E94E6-F2FC-52E4-E589-519846F8629C} - C:\WINDOWS\atlmg32.dll
O4 - HKLM\..\Run: [appqs.exe] C:\WINDOWS\system32\appqs.exe
O4 - HKLM\..\Run: [addgo32.exe] C:\WINDOWS\addgo32.exe
O4 - HKLM\..\Run: [msdv.exe] C:\WINDOWS\system32\msdv.exe
O4 - HKLM\..\RunOnce: [netna.exe] C:\WINDOWS\netna.exe
O4 - HKLM\..\RunOnce: [mssr.exe] C:\WINDOWS\mssr.exe
O4 - HKLM\..\RunOnce: [mfcsg.exe] C:\WINDOWS\mfcsg.exe
O4 - HKLM\..\RunOnce: [javaqt32.exe] C:\WINDOWS\javaqt32.exe
O4 - HKLM\..\RunOnce: [javaif32.exe] C:\WINDOWS\javaif32.exe
O4 - HKLM\..\RunOnce: [ieio.exe] C:\WINDOWS\ieio.exe
O4 - HKLM\..\RunOnce: [ieiq32.exe] C:\WINDOWS\ieiq32.exe
O4 - HKLM\..\RunOnce: [iper.exe] C:\WINDOWS\system32\iper.exe
O4 - HKLM\..\RunOnce: [winer32.exe] C:\WINDOWS\winer32.exe
O4 - HKLM\..\RunOnce: [iptu32.exe] C:\WINDOWS\iptu32.exe
O4 - HKLM\..\RunOnce: [ntkq.exe] C:\WINDOWS\system32\ntkq.exe
O4 - HKLM\..\RunOnce: [netzn.exe] C:\WINDOWS\system32\netzn.exe
O4 - HKLM\..\RunOnce: [wintg.exe] C:\WINDOWS\wintg.exe
O4 - HKLM\..\RunOnce: [ntij.exe] C:\WINDOWS\ntij.exe
O4 - HKLM\..\RunOnce: [mfcln.exe] C:\WINDOWS\mfcln.exe
O4 - HKLM\..\RunOnce: [systb.exe] C:\WINDOWS\system32\systb.exe
O4 - HKLM\..\RunOnce: [apicj32.exe] C:\WINDOWS\apicj32.exe
O4 - HKLM\..\RunOnce: [mswl32.exe] C:\WINDOWS\mswl32.exe
O4 - HKLM\..\RunOnce: [apiac32.exe] C:\WINDOWS\apiac32.exe
O4 - HKLM\..\RunOnce: [crxh32.exe] C:\WINDOWS\crxh32.exe
O4 - HKLM\..\RunOnce: [ipyx.exe] C:\WINDOWS\ipyx.exe
O4 - HKLM\..\RunOnce: [addkq.exe] C:\WINDOWS\system32\addkq.exe
O4 - HKLM\..\RunOnce: [ntpy.exe] C:\WINDOWS\system32\ntpy.exe
O4 - HKLM\..\RunOnce: [javaiz32.exe] C:\WINDOWS\javaiz32.exe
O4 - HKLM\..\RunOnce: [netta32.exe] C:\WINDOWS\netta32.exe
O4 - HKLM\..\RunOnce: [mfcqv32.exe] C:\WINDOWS\mfcqv32.exe
O4 - HKLM\..\RunOnce: [creg32.exe] C:\WINDOWS\creg32.exe
O4 - HKLM\..\RunOnce: [atlhf.exe] C:\WINDOWS\atlhf.exe
O4 - HKLM\..\RunOnce: [sdkel32.exe] C:\WINDOWS\system32\sdkel32.exe
O4 - HKLM\..\RunOnce: [crao.exe] C:\WINDOWS\system32\crao.exe
O4 - HKLM\..\RunOnce: [appxb.exe] C:\WINDOWS\appxb.exe
O4 - HKLM\..\RunOnce: [ipnq32.exe] C:\WINDOWS\ipnq32.exe
O4 - HKLM\..\RunOnce: [winbt32.exe] C:\WINDOWS\system32\winbt32.exe
O4 - HKLM\..\RunOnce: [sdkjj32.exe] C:\WINDOWS\sdkjj32.exe
O4 - HKLM\..\RunOnce: [adddu32.exe] C:\WINDOWS\adddu32.exe
O4 - HKLM\..\RunOnce: [crou32.exe] C:\WINDOWS\system32\crou32.exe
O4 - HKLM\..\RunOnce: [apiqj32.exe] C:\WINDOWS\system32\apiqj32.exe
O4 - HKLM\..\RunOnce: [winph.exe] C:\WINDOWS\winph.exe
O4 - HKLM\..\RunOnce: [winyx32.exe] C:\WINDOWS\system32\winyx32.exe
O4 - HKLM\..\RunOnce: [sysgf.exe] C:\WINDOWS\sysgf.exe
O4 - HKLM\..\RunOnce: [mfcpt32.exe] C:\WINDOWS\system32\mfcpt32.exe
O4 - HKLM\..\RunOnce: [sdknq32.exe] C:\WINDOWS\system32\sdknq32.exe
O4 - HKLM\..\RunOnce: [msex32.exe] C:\WINDOWS\system32\msex32.exe
O4 - HKLM\..\RunOnce: [apiyz32.exe] C:\WINDOWS\apiyz32.exe
O4 - HKLM\..\RunOnce: [addwg32.exe] C:\WINDOWS\system32\addwg32.exe
O4 - HKLM\..\RunOnce: [ipum.exe] C:\WINDOWS\ipum.exe
O4 - HKLM\..\RunOnce: [apivm.exe] C:\WINDOWS\system32\apivm.exe
O4 - HKLM\..\RunOnce: [addqm.exe] C:\WINDOWS\system32\addqm.exe
O4 - HKLM\..\RunOnce: [appky32.exe] C:\WINDOWS\system32\appky32.exe
O4 - HKLM\..\RunOnce: [ipzn.exe] C:\WINDOWS\ipzn.exe
O4 - HKLM\..\RunOnce: [winna.exe] C:\WINDOWS\winna.exe
O4 - HKLM\..\RunOnce: [winit32.exe] C:\WINDOWS\system32\winit32.exe
O4 - HKLM\..\RunOnce: [javayx.exe] C:\WINDOWS\system32\javayx.exe
O4 - HKLM\..\RunOnce: [addnu32.exe] C:\WINDOWS\addnu32.exe


==============


Run CWShredder, making sure to click "Fix".

Run AboutBuster.

Then please run Ewido, and run a full scan. Save the log from the scan for me.


=============


Finally reboot back to normal mode and run this online virus scan using Firefox. Do not use Internet Explorer.

http://uk.trendmicro-europe.com/consumer/housecall/housecall_launch.php


=============


Please reboot once more and then post the following logs and info.

1. Hijackthis log.
2. Ewido log.
3. AboutBuster log.
4. Report from TrendMicro scan.

michellgomez

Hello Sam,

Had some successes and some problems with the latest round of instructions. I was unable to install Firefox. I finally did get it, but I did the safe-mode stuff first, then rebooted, to IE to try FireFox again. I now have Firefox. Basically, I've been in IE. Bad girl. I know.

I could not run Housecall at all. The "client would not start" I tried to go to the USA site, but it would scan b/c I was on FireFox.

Ewido removed 5,104 infections. That's gotta be a record!!!!
I cannot post the Ewido report. This forum has a 50,000 character limit. When I tried to submit it, it was almost 500,000 characters. I can break it up in to 6 posts or email it to you if you still need it. Just let me know.

AND...HSA, search extender, and shopping wizard are gone!!!! My desktop, however, is still hijacked by the advertisement for Anti-Virus gold.

Here are the logs I have. (I think my HJT log is clean!!!!)

HJT

Logfile of HijackThis v1.99.1
Scan saved at 11:05:55 AM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.359\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

About:Buster

AboutBuster 5.0 reference file 30
Scan started on [7/16/2005] at [8:43:49 PM]

---

Removed Stream! C:\WINDOWS\dmsjr.txt:hkdkyc
Removed Stream! C:\WINDOWS\DtcInstall.log:alvptn
Removed Stream! C:\WINDOWS\_ds1.tmp:cmuhy

---

Removed File! : C:\Windows\wfwgl.dll
Removed File! : C:\Windows\System32\gfrpz.dll
Removed File! : C:\Windows\System32\ihmaf.dll
Removed File! : C:\Windows\System32\qvnqd.dat

---

Scan was COMPLETED SUCCESSFULLY at 8:46:34 PM

Buckeye_Sam

That's ok, I don't need the Ewido log. Even though I am curious about 5104 infected files...Wow!

The good news is that it looks like HSA is gone.
It's ok to use IE again if you want to.

Now let's fix your smitfraud problem. It should be much easier.


Download smitRem.zip and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.


If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan it will prompt you to clean files, click OK
• When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut(ok to use IE for this), then do a full system scan. Make sure the autoclean box is checked!
Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log.

michellgomez

YEAH!!!! My desktop is back to normal. HSA, Search Extender, and Shopping Wizard are still gone.

But, ewido found 3,707 infections this time. (I think they are from the HJT quarantine. It asked if I wanted to remove the archive and I told it yes. ( I still think I should get an award for the most infected computer, at 5,104)). ActiveScan found 6 but didnot clean them.

SmitFiles

Pre-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Windows directory ~~~

screen.html


~~~ Drive root ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Post-run Files Present


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Wininet.dll ~~~

CLEAN!


HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 7:32:47 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Fix Computer Stuff\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [Desktop Weather 3] C:\Program Files\The Weather Channel\The Weather Channel.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_bromas2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_virus2/?l=chat_sexo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partners/earthlink/otto/install.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

If there is not another post from me preceeding this post, consider it that the ewido file was again too large. Again, if needed, I can email or break up in to several posts.

Buckeye_Sam

Just a little more to clean up in your log.
Fix these lines with hijackthis.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O4 - HKCU\..\Run: [DivX Updater] C:\WINDOWS\System32\DivX.Exe
O9 - Extra button: Bromas y chistes - {068C36CF-483E-4CA8-A7F2-10EFFDA49C45} - http://www.accesoplugin.com/prom/a_...exo&ver=1&t=new (file missing)
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Antivirus - {4358161B-A4B8-498E-8019-3DAB50DFD578} - http://www.accesoplugin.com/prom/a_...exo&ver=1&t=new (file missing)
O9 - Extra button: Chat de Sexo - {C8950078-94A4-4C32-BB9C-4666357965AF} - C:\chat_sexo\index.htm (file missing)
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/...tto/install.cab



Delete this file, if present.

C:\WINDOWS\System32\DivX.Exe



Reboot and post one last hijackthis log. Let me know of any problems that you are still having.

michellgomez

Here you go.
No problems other than my computer still takes forever to start up compared to before infection. Well, not starting up, it's after I log in and the darn thing is trying to load my desktop and start printer, internet, norton, and stuff.

I did about:buster too.


AboutBuster 5.0 reference file 30
Scan started on [7/19/2005] at [5:12:43 PM]

---

Removed Stream! C:\WINDOWS\_ds1.tmp:cnqmyg
Removed Stream! C:\WINDOWS\_ds1.tmp:ddkjj

---

No Files Found!

---

Scan was COMPLETED SUCCESSFULLY at 5:14:00 PM


HJT

Logfile of HijackThis v1.99.1
Scan saved at 5:57:05 PM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\lxamsp32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
C:\Program Files\LexmarkX63\ACMonitor_X63.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\EarthLink TotalAccess\FastLane\IPClient.exe
C:\Program Files\EarthLink TotalAccess\Accelerator\ElinkAcc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fix Computer Stuff\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [lxamsp32.exe] lxamsp32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\EarthLink TotalAccess\Accelerator\PropelAC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\EarthLink TotalAccess\Spyware Blocker\SpywareBlocker.exe" /0
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\EarthLink TotalAccess\Accelerator\\pac-image.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} (Symantec Download Bridge) - https://www.earthlink.net/i/store/SymDlBrg.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab36385.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2D5380FB-F57B-46F1-B901-96E46A8A242D}: NameServer = 207.69.188.187 207.69.188.186
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Buckeye_Sam

These are some optional fixes you can make with Hijackthis in order to free up some resources and improve your boot up time.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe


It would also be a good time to run some basic maintenance on your computer like scandisc and defrag. And if you don't already have a registry cleaning program I would recommend running one like Ace Utilities.

http://www.acelogix.com/aceutils.html


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
   
   You can find instructions on how to enable and reenable system restore here:
   
   Managing Windows Millenium System Restore
   
   or
   
   Windows XP System Restore Guide
   
   Renable system restore with instructions from tutorial above
   
   
2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
   1. From within Internet Explorer click on the Tools menu and then click on Options.
   2. Click once on the Security tab
   3. Click once on the Internet icon so it becomes highlighted.
   4. Click once on the Custom Level button.
      1. Change the Download signed ActiveX controls to Prompt
         
      2. Change the Download unsigned ActiveX controls to Disable
         
      3. Change the Initialize and script ActiveX controls not marked as safe to Disable
         
      4. Change the Installation of desktop items to Prompt
         
      5. Change the Launching programs and files in an IFRAME to Prompt
         
      6. Change the Navigate sub-frames across different domains to Prompt
         
      7. When all these settings have been made, click on the OK button.
         
      8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
   5. Next press the Apply button and then the OK to exit the Internet Properties page.
   
   
3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
   
   See this link for a listing of some online & their stand-alone antivirus programs:
   
   Virus, Spyware, and Malware Protection and Removal Resources
   
   
4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
   
   For a tutorial on Firewalls and a listing of some available ones see the link below:
   
   Understanding and Using Firewalls
   
   
6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
   
   A tutorial on installing & using this product can be found here:
   
   Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
   
   
8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
   
   A tutorial on installing & using this product can be found here:
   
   Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
   
   
9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
   
   A tutorial on installing & using this product can be found here:
   
   Using SpywareBlaster to protect your computer from Spyware and Malware
   
   
10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.