LaurenB Hijack This Log

Unknown
edited January 2006 in Spyware & Virus Removal
I am not exactly what you would call a computer wiz so i am really sorry if i did something incorrectly but i am trying very hard at following the directions.

My problem is that i am trying to remove Home Search Assistant from my computer.
Another is that my homepage is always automatically set back to an about:blank in the address line and then a random word in the search box i've gotten such worda as valium, breast enlargement, xanax. and others similar.
Also whenever i do a google search a little window will popup window will show up and try and get me to click on links refereing to whatever i typed in. i'm sure there are other problems but i am just not aware of them. show up

Ok and then here is my Log File

Logfile of HijackThis v1.99.1
Scan saved at 9:12:51 PM, on 1/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ipzq32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ssisvr32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\LaureBai\LOCALS~1\Temp\5A8.tmp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\atlkn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\Documents and Settings\LaureBai\My Documents\Hijack this\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\niaxt.dll/sp.html#10001%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {1B86035E-F039-33BA-B60C-D015083C16FD} - C:\WINDOWS\system32\appkw32.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [NPDTray] C:\PROGRA~1\ThinkPad\UTILIT~1\NPDTray.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [5A8.tmp] C:\DOCUME~1\LaureBai\LOCALS~1\Temp\5A8.tmp.exe
O4 - HKLM\..\Run: [5A9.tmp] C:\DOCUME~1\LaureBai\LOCALS~1\Temp\5A9.tmp.exe
O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
O4 - HKLM\..\Run: [5A8.tmp.exe] C:\DOCUME~1\LaureBai\LOCALS~1\Temp\5A8.tmp.exe
O4 - HKLM\..\Run: [5A9.tmp.exe] C:\DOCUME~1\LaureBai\LOCALS~1\Temp\5A9.tmp.exe
O4 - HKLM\..\Run: [d3tl32.exe] C:\WINDOWS\d3tl32.exe
O4 - HKLM\..\Run: [atlkn.exe] C:\WINDOWS\system32\atlkn.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/102b40baed5bb6b72620/netzip/RdxIE601.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-B370F3A38B93}: Domain = gps.edu
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipzq32.exe
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc - C:\WINDOWS\system32\ssisvr32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


If there is anyhelp to be offered, i am overly and greatly appreciative.

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Download CWShredder 2.19 from here.

    For 9X http://www.derbilk.de/SpSeHjfix109.zip

    Download\'SpSeHjfix\' to the desktop and then
    right click a blank part of the desktop and select new folder, call it spfix
    unzip the file into that folder.

    Disconnect from the net and Close ALL OPEN PROGRAMS.
    Run 'SpSeHjfix'. and click on "Start Disinfection".
    When it's finished it will reboot your machine to finish the cleaning process.
    The tool creates a log of the fix which will appear in the folder.

    If it doesn't find any of the SE files or any hidden reinstallers it will say system clean and not go on to next stage.

    Run the shredder and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.

    Reboot.

    Download CCleaner and install, then run it.
    1. Uncheck "Cookies" under "Internet Explorer".
    2. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.
    3. Close when finished.

    Post a fresh HJT log and the log that was created by 'SpSeHjfix'.
  • LaurenB
    edited January 2006
    Here is the new Hijack this Log

    Logfile of HijackThis v1.99.1
    Scan saved at 10:32:47 PM, on 1/1/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Speed Disk\nopdb.exe
    C:\WINDOWS\system32\ssisvr32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\atlkn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ipzq32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\LaureBai\My Documents\Hijack this\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gps.edu/index2.php?page=157&show=bruiser2.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {6E15F4D5-4588-FA6E-9B33-7152B249E5A0} - C:\WINDOWS\system32\sysoc.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Class - {AA8263C2-BEC0-1A3A-53EC-210BF773BE14} - C:\WINDOWS\apint32.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
    O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
    O4 - HKLM\..\Run: [atlkn.exe] C:\WINDOWS\system32\atlkn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/102b40baed5bb6b72620/netzip/RdxIE601.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-B370F3A38B93}: Domain = gps.edu
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipzq32.exe
    O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
    O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc - C:\WINDOWS\system32\ssisvr32.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


    And then the other lof from the spfix thing



    (1/1/05 10:14:49 PM) SPSeHjFix started v1.1.2
    (1/1/05 10:14:49 PM) OS: WinXP Service Pack 2 (5.1.2600)
    (1/1/05 10:14:49 PM) Language: english
    (1/1/05 10:14:49 PM) Win-Path: C:\WINDOWS
    (1/1/05 10:14:49 PM) System-Path: C:\WINDOWS\system32
    (1/1/05 10:14:49 PM) Temp-Path: C:\DOCUME~1\LaureBai\LOCALS~1\Temp\
    (1/1/05 10:14:53 PM) Disinfection started
    (1/1/05 10:14:53 PM) UBF: 8 - UBB: 4 - UBR: 29
    (1/1/05 10:14:53 PM) UBF: 8 - UBB: 4 - UBR: 29
    (1/1/05 10:14:53 PM) Stealth-String not found
    (1/1/05 10:14:53 PM) Not infected->END
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Can you please do the following.

    Please go to Jotti's and have this file scanned. If it comes back bad, add it to the below fix.

    C:\WINDOWS\system32\ssisvr32.exe

    ===============

    Open a command prompt by:

    1. Clicking "Start", then "Run...".
    2. Enter "cmd" (without the quotes).
    3. Enter "services.msc" (without the quotes).

    -

    Now, locate and 'stop' the following services, if present:

    Network Security Service ( 11Fßä#·ºÄÖ`I) owner ... (C:\WINDOWS\system32\ipzq32.exe)

    Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services. Once stopped, set this service to disabled.

    ===============

    Run HiJackThis then:

    1. Click "Open the Misc Tools Section"
    2. Click "Open Process manager"

    -

    Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

    C:\WINDOWS\system32\atlkn.exe
    C:\WINDOWS\system32\ipzq32.exe

    Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.

    ===============

    Scan with HiJackThis, click "Scan", then check(tick) the following, if present:


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

    R3 - Default URLSearchHook is missing

    O2 - BHO: Class - {6E15F4D5-4588-FA6E-9B33-7152B249E5A0} - C:\WINDOWS\system32\sysoc.dll
    O2 - BHO: Class - {AA8263C2-BEC0-1A3A-53EC-210BF773BE14} - C:\WINDOWS\apint32.dll

    O4 - HKLM\..\Run: [atlkn.exe] C:\WINDOWS\system32\atlkn.exe

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/102b40baed5bb6b...p/RdxIE601.cab

    O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipzq32.exe


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    files...

    C:\WINDOWS\system32\atlkn.exe
    C:\WINDOWS\system32\ipzq32.exe
    C:\WINDOWS\system32\sysoc.dll
    C:\WINDOWS\apint32.dll

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".

    -

    Reboot.

    ===============

    To help protect your system from hostile ActiveX content, or special 'downloadable' files:

    Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

    1) Check for any available updates; if present, they'll be automatically downloaded and installed.
    2) Next, "Enable all protection".
    3) Exit the program.

    -

    Note: Remember to regularly check for updates.

    ===============

    After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
  • LaurenB
    edited January 2006
    I hope i did everything but as i said before i am really really stupid when it comes to computers.

    here is the new logfile

    Logfile of HijackThis v1.99.1
    Scan saved at 11:24:13 PM, on 1/1/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ipzq32.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Speed Disk\nopdb.exe
    C:\WINDOWS\system32\ssisvr32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security

    Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\atlkn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\userinit.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\LaureBai\My Documents\Hijack

    this\hijackthis_199\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL

    = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {24A47C18-4C17-2AC4-710A-F949DD49082D} -

    C:\WINDOWS\ipnn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-

    CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -

    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

    - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

    c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1

    \pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1

    \ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe

    /server"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1

    \SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program

    Files\SpyFighter\SpyFighter.exe" monitor
    O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program

    Files\SpyFighter\AutoUpdate.exe" silent
    O4 - HKLM\..\Run: [atlkn.exe] C:\WINDOWS\system32\atlkn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"

    /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free

    Download Manager\fdm.exe -autorun
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk =

    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

    Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk =

    C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

    Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program

    files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word -

    res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program

    files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page -

    res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel -

    res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program

    files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English -

    res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-

    AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

    C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

    C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-

    BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet

    Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) -

    http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

    Advantage Validation Tool) - http://go.microsoft.com/fwlink/?

    linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

    http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/b

    orris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class)

    - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX

    Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

    http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo

    Uploader Control) -

    http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object)

    - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-

    B370F3A38B93}: Domain = gps.edu
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner

    - C:\WINDOWS\system32\ipzq32.exe
    O23 - Service: ACU Configuration Service (ACS) - Unknown owner -

    C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program

    Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

    C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner -

    C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

    Corporation - C:\Program Files\Common Files\InstallShield\Driver\11

    \Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program

    Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) -

    Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec

    Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec

    Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

    Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\Program

    Files\Speed Disk\nopdb.exe
    O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc

    - C:\WINDOWS\system32\ssisvr32.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec Shared\Security

    Center\SymWSC.exe

    My computer is still doing pretty much everything before it had a moment where my homepage was back to normal but then it reverted to its old about:blank self.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Sorry, I cannot read that log. It looks like c**p. Can you post another log and make sure the formatting is ok please.
  • LaurenB
    edited January 2006
    I hope this is better/actually different.

    Logfile of HijackThis v1.99.1
    Scan saved at 1:41:02 AM, on 1/2/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ipzq32.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Speed Disk\nopdb.exe
    C:\WINDOWS\system32\ssisvr32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\atlkn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\LaureBai\My Documents\Hijack this\hijackthis_199\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\goqrd.dll/sp.html#10001%resultposition.net
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {24A47C18-4C17-2AC4-710A-F949DD49082D} - C:\WINDOWS\ipnn.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
    O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
    O4 - HKLM\..\Run: [atlkn.exe] C:\WINDOWS\system32\atlkn.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-B370F3A38B93}: Domain = gps.edu
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ipzq32.exe
    O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
    O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc - C:\WINDOWS\system32\ssisvr32.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Download CWShredder 2.19 from here. Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.

    ===============

    Please download the trial version of Ewido Security Suite here:
    http://www.ewido.net/en/download/
    Install it, and update the definitions to the newest files. Do NOT run a scan yet.

    ===============

    Download AboutBuster 5:

    http://www.besttechie.net/tools/AboutBuster5.zip
    http://www.malwarebytes.biz/AboutBuster5.zip

    Once downloaded, unzip it, and put the folder on your desktop. Then double-click on the AboutBuster icon to start the program.

    Click Update. This will start updating AboutBuster with the latest definition database.

    Once it's done updating and you see that dialog, click Ok.

    Close AboutBuster.

    Reboot into safe mode following the instructions here.

    Start AboutBuster and click Begin Removal.

    When the scan is done, click Ok.


    Run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.

    Save the logfile from the scan. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  • LaurenB
    edited January 2006
    Ok that took a while, but here is the new hijack this log

    Logfile of HijackThis v1.99.1
    Scan saved at 3:43:44 PM, on 1/2/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Speed Disk\nopdb.exe
    C:\WINDOWS\system32\ssisvr32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\LaureBai\My Documents\Hijack this\hijackthis_199\HijackThis.exe

    R3 - Default URLSearchHook is missing
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
    O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-B370F3A38B93}: Domain = gps.edu
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
    O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc - C:\WINDOWS\system32\ssisvr32.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    And then here is the log from the ewido thing
    ewido anti-malware - Scan report

    + Created on: 3:38:53 PM, 1/2/2005
    + Report-Checksum: A12A1FC6

    + Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{D85FBAA5-5F33-6173-D800-EFD4E38AE63E} -> Spyware.CoolWebSearch : Cleaned with backup
    C:\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@trafic[1].txt -> Spyware.Cookie.Trafic : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@www.burstbeacon[1].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
    C:\Documents and Settings\LaureBai\Cookies\laurebai@www.myaffiliateprogram[2].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00003920.TXT -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00003924.TXT -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00003929.TXT -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00003931.TXT -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00003940.TXT -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004422.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004423.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004424.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004425.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004426.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004427.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004428.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004431.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004432.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004433.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004436.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004437.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004438.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004441.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004442.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004443.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004444.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004445.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004448.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004449.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004450.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004452.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004453.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004454.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004487.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004488.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004489.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004496.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004497.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004498.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004510.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004511.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004512.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004571.TXT -> Spyware.Cookie.Com : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004590.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004657.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004658.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004659.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004663.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004664.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004665.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004666.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004667.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004669.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004670.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004671.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004673.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004675.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004676.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004677.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004679.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004681.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004682.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004686.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004687.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004688.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004689.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004690.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004691.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004692.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004693.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004694.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004695.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004698.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004701.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004702.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004703.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004704.TXT -> Spyware.Cookie.Casalemedia : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004706.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004709.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004710.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004711.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004712.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004713.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004714.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004715.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004718.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004719.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004720.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004721.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004742.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004743.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004752.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004781.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004782.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004783.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004784.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004785.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004786.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004787.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004788.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004789.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004790.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004791.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004792.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004892.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004893.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004894.TXT -> Spyware.Cookie.Serving-sys : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004899.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004901.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004902.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004903.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004904.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004905.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004908.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004909.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004910.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004911.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004912.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004913.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004914.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004915.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004916.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004917.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004918.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004919.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004920.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004921.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004922.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004929.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004930.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004931.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004932.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004934.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004935.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00004936.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00005037.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00005141.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00005142.TXT -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\RECYCLER\NPROTECT\00005150.TXT -> Spyware.Cookie.Burstnet : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP119\A0045349.dll -> Adware.SpySheriff : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP119\A0045351.dll -> Spyware.SpywareNo : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP119\A0045352.dll -> Adware.SpySheriff : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP122\A0045497.exe -> Adware.SpySheriff : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP122\A0045498.exe -> Not-A-Virus.Hoax.Win32.Renos.al : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP123\A0045653.DLL -> Adware.SaveNow : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP123\A0046142.EXE -> Spyware.WinAD : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP80\A0028138.dll -> Spyware.WildTangent : Cleaned with backup
    C:\System Volume Information\_restore{E596964C-8DD4-4112-B4FB-31B1FEB009FE}\RP80\A0028153.dll -> Spyware.WildTangent : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup


    ::Report End


    And i would just like to say thank you for all you're doing to help. i know its time consuming and you dont have to help me, so thank you.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    LaurenB wrote:
    And i would just like to say thank you for all you're doing to help. i know its time consuming and you dont have to help me, so thank you.
    No problem :).

    Can you please do the following.

    Please go to Jotti's and have this file scanned. Post the results back here.

    C:\WINDOWS\system32\ssisvr32.exe

    ===============

    Scan with HiJackThis, click "Scan", then check(tick) the following, if present:


    R3 - Default URLSearchHook is missing


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
  • LaurenB
    edited January 2006
    Here is the new log

    Logfile of HijackThis v1.99.1
    Scan saved at 5:05:03 PM, on 1/2/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\QCONSVC.EXE
    C:\Program Files\Speed Disk\nopdb.exe
    C:\WINDOWS\system32\ssisvr32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\userinit.exe
    C:\Documents and Settings\LaureBai\My Documents\Hijack this\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gps.edu/index2.php?page=157&show=bruiser2.htm
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
    O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\system32\atiptaxx.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SpyFighterMonitor] "C:\Program Files\SpyFighter\SpyFighter.exe" monitor
    O4 - HKLM\..\Run: [SpyFighterUpdate] "C:\Program Files\SpyFighter\AutoUpdate.exe" silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D0B5B58D-8CB9-4EDB-8BB0-9D34AEF727CF} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\Software\..\Telephony: DomainName = gps.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B482E537-D809-482C-BA8D-B370F3A38B93}: Domain = gps.edu
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = gps.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = gps.edu
    O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
    O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
    O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
    O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
    O23 - Service: Software Secure Service (SSISvr32) - SoftwareSecure Inc - C:\WINDOWS\system32\ssisvr32.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    And then my computer's homepage is now back to normal and will actually stay with that setting, and then also when ever i do searches the little annoying pop-window doesnt show up any more. so i dont know what you had me do that got rid of those annoyences but thank you thank you thank you

    I hope this exciting adventure is finding its way to the end. but yeah i think i put in here all that you asked for.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Crunchie wrote:
    No problem :).

    Can you please do the following.

    Please go to Jotti's and have this file scanned. Post the results back here.

    C:\WINDOWS\system32\ssisvr32.exe
    Cool. But what about this one? Can you please have the file scanned. I have no idea what it is :).
  • LaurenB
    edited January 2006
    when i scanned it it just would say it was fine, and stuff.

    and i dont know what you are looking for in it.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    LaurenB wrote:
    when i scanned it it just would say it was fine, and stuff.

    and i dont know what you are looking for in it.
    I am attempting to ensure you have a clean bill of health :). As I said before, I do not recognise that file and as you were so infected, there is a possibility that the file is a bad one.
    I uploaded a file to show you what I was asking for;

    Status:
    OK
    MD5 9b615972127a2b466086edf52ceb6c01
    Packers detected:
    -
    Scanner results
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    Fortinet
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    UNA
    Found nothing
    VBA32
    Found nothing

    That is what you should get if that file is in fact, clean.
  • LaurenB
    edited January 2006
    That is identical to the results that i am getting with my file. Which i guess means it is ok, hopefully. and if it is, i just would like to say thank you so so much for helping me fix my computer, it is so greatly appreciated on my end. so just thanks so much.
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    Congratulations! Your log looks clean - good work!

    ===============

    Now that your PC is clean you need to follow these easy steps to keeping it this way:

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

    Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.

    Install and keep updated, Ad-Aware SE, and Spybot S&D.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.


    Clear your Temp folders.
    Clear out your Temporary internet files and other temp files.
    Go to Start > Settings > Control Panel >Internet Options.
    Under the General tab click the Delete temporary internet files,
    delete all Offline content as well. Clear out Cookies.

    Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.

    For XP users.
    After something like this it is a good idea to Flush the Restore Points and start fresh.
    To flush the XP system Restore Points.

    Go to Start>Run and type msconfig. Press enter.

    When msconfig opens, click the Launch System Restore Button.
    On the next page, click the System Restore Settings link on the left.

    Check the box labelled 'Turn off System restore'.

    Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.

    Note that all previous restore points will be lost.

    ===============

    If you have any more problems, post back.

    -

    Happy surfing,

    crunchie.
  • LaurenB
    edited January 2006
    Thank you so so so so much
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2006
    You are wery, wery, wery, wery welcome :).

    This thread is now closed. If you need it reopened, please send a PM to one of our Mods.

    Include the link to the thread and detail why you need it reopened.

    If this is not your thread please start a New Topic.
This discussion has been closed.