Need help with <Hijack This> and possibly other problems

novorias

First off I am doing this to help my sister who's computer has been taken over by I'm not sure what. This not so old computer, it's a 2 year old low-end Compac, takes around 10minutes to be usable once it hits the desktop from so many programs being loaded in the background. The computer DOES NOT have, to my knowledge, any virus protection software on it aside from an outdated Norton Antivirus but does have adaware and spybot so I did use those to try to help it some. I have tried to instal Panda Platinum virus protection since I know it's free but the installation stops saying the computer needs 128MB of ram, which I know for sure it has. I believe it has at least 256 if not 512MB of ram. To top it off somehow no web browsers will work. Whenever I try to load either FireFox or IE I get some Windows message saying the program has experienced an error and needs to be shut down. I was told that this happened AFTER asaware was run so I'm thinking maybe is has something to do with the LSP and maybe running LSP-Fix could help that. None the less I figured a good start, since I really can't do much else at this point, would be to ask all you great people here for help with Hijack this. Anyways here is the Hijack This Log file. Thanks in advance for any help with trying to fix this computer.

Logfile of HijackThis v1.99.1
Scan saved at 7:03:47 PM, on 8/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\T3duZXIA\command.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Clorefox\a3dnvert.exe
C:\WINDOWS\System32\atml_qic.exe
C:\WINDOWS\System32\fxgeki.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\windows\system32\saie.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
C:\WINDOWS\System32\vidctrl\vidctrl.exe
C:\WINDOWS\System32\wintask.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\WINDOWS\System32\Jtkxuc.exe
C:\WINDOWS\System32\winupdt.exe
C:\WINDOWS\System32\dfrgin.exe
C:\WINDOWS\System32\dfrgin.exe
C:\WINDOWS\System32\197_150_ni_5.exe
C:\Program Files\apsi\wtta.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe
C:\Documents and Settings\Owner\Desktop\Virus stuff\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
R3 - URLSearchHook: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - C:\Program Files\SurfSideKick 2\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {305904AA-C7B3-4613-859A-D425C3BA7E61} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {39B4BA24-003E-49CF-97A7-F637BBAF36A5} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {3D9B01D6-BD66-4DAC-B76B-73E1A7749941} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - (no file)
O2 - BHO: (no name) - {A066E56B-7D2F-4EB3-8822-08EBA6FEC25F} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SDWin32 Class - {C2BC314B-6172-478D-9B79-1227E4B80A92} - C:\WINDOWS\System32\mqqhs.dll
O2 - BHO: (no name) - {D1A9CCEB-2486-4C7A-A11E-891328424D70} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {DF2EB925-703F-4126-9FF8-EA66851A24C4} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NAV CfgWiz] c:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KUCM] C:\WINDOWS\KUCM.exe
O4 - HKLM\..\Run: [bkf] C:\WINDOWS\bkf.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe
O4 - HKLM\..\Run: [saie] c:\windows\system32\saie.exe
O4 - HKLM\..\Run: [voxqt] C:\WINDOWS\voxqt.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [dnam] C:\Documents and Settings\Owner\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\System32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [mqqhsc] C:\WINDOWS\System32\mqqhsc.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\dksdpg.exe reg_run
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Zuzyce.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Jtkxuc.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [lwqyfqz] C:\WINDOWS\System32\fxgeki.exe r
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [fontext] C:\WINDOWS\System32\fontext.exe
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - HKCU\..\Run: [197_150_ni_5] C:\WINDOWS\System32\197_150_ni_5.exe
O4 - HKCU\..\Run: [Notn] C:\Program Files\apsi\wtta.exe
O4 - HKCU\..\Run: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - HKCU\..\RunOnce: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\wfnhttp.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T3duZXIA\command.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

novorias

Update: I loaded AVG virus scanner and got rid of around 440 viruses on the computer, then ran Adaware and Spybot search and destroy again, then ran hijcak this again. Here is the newest Hijack this Log that i would like help with. Any help with this would be greatly appreciated

Logfile of HijackThis v1.99.1
Scan saved at 6:04:20 PM, on 9/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\T3duZXIA\command.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\vidctrl\vidctrl.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\System32\Jtkxuc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\WINDOWS\System32\dfrgin.exe
C:\Program Files\apsi\wtta.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\winupdt.exe
C:\WINDOWS\System32\Vydpgz.exe
C:\WINDOWS\System32\dfrgin.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\ei.exe
C:\Documents and Settings\Owner\Desktop\Virus stuff\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {305904AA-C7B3-4613-859A-D425C3BA7E61} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {39B4BA24-003E-49CF-97A7-F637BBAF36A5} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {3D9B01D6-BD66-4DAC-B76B-73E1A7749941} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {A066E56B-7D2F-4EB3-8822-08EBA6FEC25F} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: SDWin32 Class - {C2BC314B-6172-478D-9B79-1227E4B80A92} - C:\WINDOWS\System32\mqqhs.dll
O2 - BHO: (no name) - {D1A9CCEB-2486-4C7A-A11E-891328424D70} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {DF2EB925-703F-4126-9FF8-EA66851A24C4} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NAV CfgWiz] c:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KUCM] C:\WINDOWS\KUCM.exe
O4 - HKLM\..\Run: [bkf] C:\WINDOWS\bkf.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [dnam] C:\Documents and Settings\Owner\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [mqqhsc] C:\WINDOWS\System32\mqqhsc.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\undztp.exe reg_run
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Zuzyce.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Vydpgz.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [nolbmp] C:\WINDOWS\System32\iamheuk.exe r
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [fontext] C:\WINDOWS\System32\fontext.exe
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - HKCU\..\Run: [197_150_ni_5] C:\WINDOWS\System32\197_150_ni_5.exe
O4 - HKCU\..\Run: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - HKCU\..\Run: [Notn] C:\Program Files\apsi\wtta.exe
O4 - HKCU\..\Run: [Iong] C:\WINDOWS\System32\n?tepad.exe
O4 - HKCU\..\RunOnce: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: tdrc.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\wfnhttp.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T3duZXIA\command.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

mmonnin

Hiya Dan!!

Make sure HJT is in its own folder as it will create some files that you dont want mixed up with anything else. Something like C:\...Desktop\Virus stuff\HJT\HijackThis.exe


Please download miekiemoes' LQfix batch here:
http://www.downloads.subratam.org/LQfix.zip
Unzip it to the desktop but do NOT run it yet.


===============

Next, Open a command prompt by:

1. Clicking "Start", then "Run...".
2. Enter "cmd" (without the quotes).
3. Enter "services.msc" (without the quotes).

-

Now, locate and 'stop' the following services, if present:

Command Service (cmdService) owner ... (C:\WINDOWS\T3duZXIA\command.exe)

Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services.

===============

Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\WINDOWS\T3duZXIA\command.exe
C:\WINDOWS\System32\vidctrl\vidctrl.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\System32\Jtkxuc.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\WINDOWS\System32\dfrgin.exe
C:\Program Files\apsi\wtta.exe
C:\WINDOWS\System32\winupdt.exe
C:\WINDOWS\System32\Vydpgz.exe
C:\WINDOWS\System32\dfrgin.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\KUCM.exe
C:\WINDOWS\bkf.exe
C:\WINDOWS\System32\winupdtl.exe
C:\Program Files\CSBB\CSv10P070.exe
C:\Documents and Settings\Owner\d140113.a.Stub.EXE
C:\WINDOWS\System32\mqqhsc.exe
C:\WINDOWS\System32\undztp.exe
C:\WINDOWS\System32\Zuzyce.exe
C:\WINDOWS\System32\Vydpgz.exe
C:\WINDOWS\System32\iamheuk.exe
C:\WINDOWS\System32\196_150_ni.exe
C:\WINDOWS\System32\197_150_ni_5.exe
C:\WINDOWS\System32\n?tepad.exe
C:\WINDOWS\system32\wfnhttp.dll

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

===============

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://mail.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {305904AA-C7B3-4613-859A-D425C3BA7E61} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {39B4BA24-003E-49CF-97A7-F637BBAF36A5} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {3D9B01D6-BD66-4DAC-B76B-73E1A7749941} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {A066E56B-7D2F-4EB3-8822-08EBA6FEC25F} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {D1A9CCEB-2486-4C7A-A11E-891328424D70} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {DF2EB925-703F-4126-9FF8-EA66851A24C4} - C:\Program Files\CSBB\CSBB.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [KUCM] C:\WINDOWS\KUCM.exe
O4 - HKLM\..\Run: [bkf] C:\WINDOWS\bkf.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [dnam] C:\Documents and Settings\Owner\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\System32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [mqqhsc] C:\WINDOWS\System32\mqqhsc.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\undztp.exe reg_run
O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\Zuzyce.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\System32\Vydpgz.exe
O4 - HKLM\..\Run: [nolbmp] C:\WINDOWS\System32\iamheuk.exe r
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - HKCU\..\Run: [197_150_ni_5] C:\WINDOWS\System32\197_150_ni_5.exe
O4 - HKCU\..\Run: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - HKCU\..\Run: [Notn] C:\Program Files\apsi\wtta.exe
O4 - HKCU\..\Run: [Iong] C:\WINDOWS\System32\n?tepad.exe
O4 - HKCU\..\RunOnce: [dfrgin] C:\WINDOWS\System32\dfrgin.exe
O4 - Global Startup: tdrc.exe
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\wfnhttp.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\T3duZXIA\command.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Now, with all windows closed except HiJackThis, click "Fix checked".

===============
Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the option to Boot into safe mode with networking

For additional help in booting into Safe Mode, see the following site:
http://www.short-media.com/forum/showpost.php?p=175908&postcount=6

================


Once in Safe Mode, please run LQfix.bat

Uninstall Media Access if it is in Add/Remove Programs

Go to this site and follow the instructions to remove WindUpdates:
http://www.iamnotageek.com/a/417-p1.php

Go to this site and follow its instructsion to remove a Worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.navidad.16896.html


=================



Locate and Quarantine the following item(s), if present. Make sure your able to view system and hidden files/ folders. Follow the instructions here to quarantine files.

files...

C:\WINDOWS\T3duZXIA\command.exe
C:\WINDOWS\System32\vidctrl\vidctrl.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\System32\Jtkxuc.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\WINDOWS\System32\dfrgin.exe
C:\Program Files\apsi\wtta.exe
C:\WINDOWS\System32\winupdt.exe
C:\WINDOWS\System32\Vydpgz.exe
C:\WINDOWS\System32\dfrgin.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\KUCM.exe
C:\WINDOWS\bkf.exe
C:\WINDOWS\System32\winupdtl.exe
C:\Program Files\CSBB\CSv10P070.exe
C:\Documents and Settings\Owner\d140113.a.Stub.EXE
C:\WINDOWS\System32\mqqhsc.exe
C:\WINDOWS\System32\undztp.exe
C:\WINDOWS\System32\Zuzyce.exe
C:\WINDOWS\System32\Vydpgz.exe
C:\WINDOWS\System32\iamheuk.exe
C:\WINDOWS\System32\196_150_ni.exe
C:\WINDOWS\System32\197_150_ni_5.exe
C:\WINDOWS\System32\n?tepad.exe
C:\WINDOWS\system32\wfnhttp.dll

Delete these folders...

C:\WINDOWS\T3duZXIA\
C:\WINDOWS\System32\vidctrl\
C:\Program Files\Media Access\
C:\Program Files\apsi\
C:\Program Files\CSBB\

Delete EVERYTHING in the temp folder...
C:\DOCUME~1\Owner\LOCALS~1\Temp\

Reboot and post another log file for me once all this is done. If you have any questions, message me on here or call Adam and I will get ahold of you.

primesuspect

Sorry about the crazy delay. We're working on beefing up our SWAT TEAM staff. Do you still need help with this issue?

mmonnin

I think he reformated the computer in the end.