guarduptodate or no good

Unknown · May 2006

Hi there
I've just registerd today after reading your post to help remove java.byte verify ! exploit
I have run a virus check via zone alarm.and it has detected this as a virus with no known cure Knowing next to nothing about these things I cant help wodnering if this is one and the same prob. as the next one I have listed.
Also i have had my home page hijacked and now it keeps going directly to guarduptodate.com. This is one son of a headache
Also i was havingproblems with a little yellow triangle with an! in the middle...this seemed to constantly send in bogus virus alerts. I have used Z.A to kill this and that seems to have cured the prob...for now
Also have avg installed (freeware)and Avast
There was a short time when my home page went directly to "blank" then on to gaurdoptodate regardless of what i put into my preffered home page setting on general options address bar.
This seemed to go to 404dns eventually havent had that happen since i killed the yellow peril triangle
But, and for me a really big ask as i am a buider and barely know how to spell computer !! can you help me?????? I have run a scan via HJT and will send the report in this but I gotta tell you I'm not even sure how to make a post!
( ok worked that one out.with your help)

Logfile of HijackThis v1.99.1
Scan saved at 22:49:15, on 14/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\voipbuster.com\voipbuster\voipbuster.exe
C:\Program Files\Telefonica\Kit ADSL USB\dslmon.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.ex e
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TUGZip\TUGZip.exe
C:\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer proporcionado por Telefónica Net
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hpEC92.tmp
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Telefonica] C:\Program Files\Telefonica\KitAIM\InstaladoresUSB1.5\Comtren d2\Install.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VoipBuster] "C:\program files\voipbuster.com\voipbuster\voipbuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Consola KIT ADSL.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMenu.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by15fd.bay15.hotmail.msn.com/...x/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{63ECA16C-5338-4F02-A4EC-61E5B0E980D6}: NameServer = 80.58.61.250 80.58.61.254
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Really Really hope you can help.........and if you can PLEASE try to keep it in dumbo language........!!!
many many thanks in advance

Nova p.s. running windows xp

chiaz · May 2006

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.
______________________________

Please download the trial version of Ewido anti-malware 3.5 from here:
http://www.ewido.net/en/download/

Install Ewido anti-malware.
When installing, under Additional Options uncheck Install background guard and Install scan via context menu.
When you run Ewido for the first time, you could get a warning "Database could not be found!". Click Ok.
The program will prompt you to update. Click the Ok button.
The program will now go to the main screen.

You will need to update Ewido to the latest definition files.

On the left-hand side of the main screen click the Update Button.
Click on Start.

The update will start and a progress bar will show the updates being installed.
Once finished updating, close Ewido.

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates. Make sure to close Ewido before installing the update.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

IMPORTANT: Do NOT run any other options until you are asked to do so!

Post # 2 - Clean

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Warning: running option #2 on a non infected computer will remove your Desktop background.
______________________________

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer and quit any instances of Windows Explorer.
Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido, and run a full scan.

Click on Scanner
Click on Settings
- Under How to scan all boxes should be checked
- Under Unwanted Software all boxes should be checked
- Under What to scan select Scan every file
- Click on Ok
Click on Complete System Scan to start the scan process.
Let the program scan the machine.

If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.

Click Save Report button
Save the report to your Desktop

Close Ewido and Reboot in Normal Mode.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________

Please post:

c:\rapport.txt
Ewido log
A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

nova · May 2006

Scan done at 21:06:31.50, 17/05/2006
Run from C:\Documents and Settings\Christian\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\hp????.tmp FOUND !
C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\regperf.exe FOUND !
C:\WINDOWS\system32\simpole.tlb FOUND !
C:\WINDOWS\system32\stdole3.tlb FOUND !
C:\WINDOWS\system32\1024\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christian\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

chiaz · May 2006

Please post Ewido log and a new HijackThis log as well.

nova · May 2006

chiawaikian wrote:

Please post Ewido log and a new HijackThis log as well.

ewido anti-malware - Scan report

+ Created on: 00:24:58, 18/05/2006
+ Report-Checksum: AEE3031B

+ Scan result:

HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Faceplate -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\History -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Stations -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\WebUpdate -> Adware.HiWire : Ignored
HKLM\SOFTWARE\Admanager Controller -> Adware.BlazeFind : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Relevancy -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\video1\dialers -> Dialer.Generic : Cleaned with backup
HKLM\SOFTWARE\video1\dialers\Hot_Tarts_es -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Browser -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Resources -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\video1\dialers -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\video1\dialers\Hot_Tarts_es -> Dialer.Generic : Cleaned with backup
C:\Documents and Settings\Christian\.jpi_cache\jar\1.0\proc.jar-4a433b20-777908bd.zip/MainApp.class -> Trojan.ClassLoader.f : Error during cleaning
:mozilla.6:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Popularix : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
C:\Documents and Settings\Christian\Cookies\christian@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned with backup
C:\Documents and Settings\Christian\Cookies\christian@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Christian\Local Settings\Temp\Cookies\christian@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Program Files\Admanager Controller -> Adware.BlazeFind : Cleaned with backup
C:\Program Files\SearchRelevancy -> Adware.Relevance : Cleaned with backup
C:\Program Files\SearchRelevancy\SearchRelevancy.dll -> Adware.Relevance : Cleaned with backup
C:\Program Files\SearchRelevancy\SearchRelevancy.xml -> Adware.Relevance : Cleaned with backup

::Report End

Smitfraud scan
FraudFix v2.44

Scan done at 23:46:26.46, 17/05/2006
Run from C:\Documents and Settings\Christian\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\hp????.tmp Deleted
C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\regperf.exe Deleted
C:\WINDOWS\system32\simpole.tlb Deleted
C:\WINDOWS\system32\stdole3.tlb Deleted
C:\WINDOWS\system32\1024\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» End

just doing the hijack this one now.............many many many many thanks for all your help the b****ards are gone and my computer is almost back to normal

nova · May 2006

nova wrote:

ewido anti-malware - Scan report

+ Created on: 00:24:58, 18/05/2006
+ Report-Checksum: AEE3031B

+ Scan result:

HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Faceplate -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\History -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Stations -> Adware.HiWire : Ignored
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\WebUpdate -> Adware.HiWire : Ignored
HKLM\SOFTWARE\Admanager Controller -> Adware.BlazeFind : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Relevancy -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\SearchRelevancy\Update -> Adware.SearchRelevancy : Cleaned with backup
HKLM\SOFTWARE\video1\dialers -> Dialer.Generic : Cleaned with backup
HKLM\SOFTWARE\video1\dialers\Hot_Tarts_es -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Browser -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\hiwire\MusicMatch\Resources -> Adware.HiWire : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\video1\dialers -> Dialer.Generic : Cleaned with backup
HKU\S-1-5-21-1715567821-287218729-1801674531-1003\Software\video1\dialers\Hot_Tarts_es -> Dialer.Generic : Cleaned with backup
C:\Documents and Settings\Christian\.jpi_cache\jar\1.0\proc.jar-4a433b20-777908bd.zip/MainApp.class -> Trojan.ClassLoader.f : Error during cleaning
:mozilla.6:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.29:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.31:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.32:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Sexcounter : Cleaned with backup
:mozilla.37:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Paycounter : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Popularix : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.90:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.95:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.96:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Cqcounter : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.118:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.136:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup
C:\Documents and Settings\Christian\Cookies\christian@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned with backup
C:\Documents and Settings\Christian\Cookies\christian@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Christian\Local Settings\Temp\Cookies\christian@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Program Files\Admanager Controller -> Adware.BlazeFind : Cleaned with backup
C:\Program Files\SearchRelevancy -> Adware.Relevance : Cleaned with backup
C:\Program Files\SearchRelevancy\SearchRelevancy.dll -> Adware.Relevance : Cleaned with backup
C:\Program Files\SearchRelevancy\SearchRelevancy.xml -> Adware.Relevance : Cleaned with backup

::Report End

Smitfraud scan
FraudFix v2.44

Scan done at 23:46:26.46, 17/05/2006
Run from C:\Documents and Settings\Christian\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\hp????.tmp Deleted
C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\regperf.exe Deleted
C:\WINDOWS\system32\simpole.tlb Deleted
C:\WINDOWS\system32\stdole3.tlb Deleted
C:\WINDOWS\system32\1024\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» End

just doing the hijack this one now.............many many many many thanks for all your help the b****ards are gone and my computer is almost back to normal

ile of HijackThis v1.99.1
Scan saved at 21:25:24, on 18/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\hphmon05.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\voipbuster.com\voipbuster\voipbuster.exe
C:\Program Files\Telefonica\Kit ADSL USB\dslmon.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\Program Files\TUGZip\TUGZip.exe
C:\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer proporcionado por Telefónica Net
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Telefonica] C:\Program Files\Telefonica\KitAIM\InstaladoresUSB1.5\Comtrend2\Install.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VoipBuster] "C:\program files\voipbuster.com\voipbuster\voipbuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - Global Startup: Consola KIT ADSL.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: TextBridge Instant Access OCR.lnk = C:\Program Files\TextBridge Classic\Bin\TBMenu.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by15fd.bay15.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{63ECA16C-5338-4F02-A4EC-61E5B0E980D6}: NameServer = 80.58.61.250 80.58.61.254
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

chiaz · May 2006

Please download Ad-Aware SE Personal and install it. If you already have Ad-Aware SE, please configure it as indicated below. If you have a previous version of Ad-Aware, please uninstall your current version and install the newest version SE 1.06.

1) Run Ad-Aware, and click Check for updates now.

2) Select Configurations (click the Gear wheel at the top) as follows:

General Button > Safety & Settings: Check (Green) all three.
Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

Click Proceed.

3) To start the scan, Click > "Scan Now" at left

Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
Select "Search for low-risk threats"
Select "Perform full system scan"
Click Next

4) When the scan has completed, select Next.

In the Scanning Results window, select the "Critical Objects" tab.
Right-click on the screen and choose "Select all objects"
Click Next to remove the infections found, and click OK to the prompt.
Restart the computer.

Then run Panda ActiveScan.

Once you are on the Panda site click the Scan your PC button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report.

nova · May 2006

chiawaikian wrote:

Please download Ad-Aware SE Personal and install it. If you already have Ad-Aware SE, please configure it as indicated below. If you have a previous version of Ad-Aware, please uninstall your current version and install the newest version SE 1.06.

1) Run Ad-Aware, and click Check for updates now.

2) Select Configurations (click the Gear wheel at the top) as follows:
General Button > Safety & Settings: Check (Green) all three.

Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

Click Proceed.

3) To start the scan, Click > "Scan Now" at left
Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.

Select "Search for low-risk threats"

Select "Perform full system scan"

Click Next

4) When the scan has completed, select Next.
In the Scanning Results window, select the "Critical Objects" tab.

Right-click on the screen and choose "Select all objects"

Click Next to remove the infections found, and click OK to the prompt.

Restart the computer.

Then run Panda ActiveScan.
Once you are on the Panda site click the Scan your PC button

A new window will open...click the Check Now button

Enter your Country

Enter your State/Province

Enter your e-mail address and click send

Select either Home User or Company

Click the big Scan Now button

If it wants to install an ActiveX component allow it

It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)

When download is complete, click on My Computer to start the scan

When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report.

Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salm.log
Adware:adware/wupd Not disinfected c:\program files\MediaGateway
Dialer:dialer.dgi Not disinfected hkey_local_machine\software\Mpb
Adware:adware/dyfuca Not disinfected Windows Registry
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt[.ccbill.com/]
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Christian\Cookies\christian@xmts[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Christian\Desktop\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Downloads\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\Downloaded Program Files\xmltok_.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\system32\xmltok.dll
Now i have no idea wht to do

suggestions????

chiaz · May 2006

Please download ATF Cleaner by Atribune.

Double-clickATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browser

ClickFirefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser

ClickOpera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Now restart the computer. As the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

Please delete the following files/folders if found:
C:\Documents and Settings\Christian\Desktop\SmitfraudFix.zip
C:\WINDOWS\Downloaded Program Files\xmltok_.dll
C:\WINDOWS\system32\xmltok.dll

Restart your computer again. You should get back to normal mode.
Rescan with Panda ActiveScan and post the fresh log in your next reply. You should be more or less cleaned up by now.

nova · May 2006

chiawaikian wrote:

Please download ATF Cleaner by Atribune.
Double-click
ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browser
Click
Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
Click
Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Now restart the computer. As the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

Please delete the following files/folders if found:
C:\Documents and Settings\Christian\Desktop\SmitfraudFix.zip
C:\WINDOWS\Downloaded Program Files\xmltok_.dll
C:\WINDOWS\system32\xmltok.dll

Restart your computer again. You should get back to normal mode.
Rescan with Panda ActiveScan and post the fresh log in your next reply. You should be more or less cleaned up by now.

Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salm.log
Adware:adware/wupd Not disinfected c:\program files\MediaGateway
Dialer:dialer.dgi Not disinfected hkey_local_machine\software\Mpb
Adware:adware/dyfuca Not disinfected Windows Registry
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt[.ccbill.com/]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-1715567821-287218729-1801674531-1003\Dc1.zip[SmitfraudFix/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-1715567821-287218729-1801674531-1003\Dc2.zip[SmitfraudFix/Process.exe]
Adware:Adware/SAHAgent Not disinfected C:\RECYCLER\S-1-5-21-1715567821-287218729-1801674531-1003\Dc3.dll
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\Downloaded Program Files\xmltok_.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
So hows it lookin now???? the only thing I am noticing different is my computer seems a lot slower

chiaz · May 2006

1) Go to Control Panel and uninstall:
MediaGateway
Follow all prompts, and reboot if needed.

2) Delete the following if they still exist:
C:\Documents and Settings\Christian\Desktop\SmitfraudFix\
c:\temp\salm.log
c:\program files\MediaGateway
C:\WINDOWS\Downloaded Program Files\xmltok_.dll
C:\WINDOWS\system32\Process.exe

3) Empty your Recycle Bin.

4)Please run Notepad and paste the following text into a new file:

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\Mpb]

Save the file to the desktop as fix.reg and make sure the "Save as Type" field says "All Files". Then please go to the desktop and double-click on fix.reg, and click Yes to merge it with the registry.

5) Rescan with Panda ActiveScan and post the new log here. Your computer should be clean by now.

nova · May 2006

Hi there!! ok bin to add/remove progs and no sign of media gateway i do have macromediaflashplayer there but with no content no measure of space used and indeed it will not let me remove what is left.
Using search i can locate mediagateway in c:\prog files but when looking on screen at my prog files it doesnt exist.
when i go to exlore and track it down hit properties it comes up but again with no content hidden or otherwise.
one or two other things that may be relevant........
on my desktop i now have a square with a gear gog in it marked......SetPaths.vbs also another with a script roll picture marked
SetPaths.bat one other thing which i am presuming is an integral part of this prob. when i go to my hotmail acc. although the box marked save address is checked it always asks me for my email address
p.s.
when i did the last removals/checks i did not find xmltok_.dll and i used the search from the start up menu

chiaz · May 2006

Let's see a new Panda log.

nova · May 2006

chiawaikian wrote:

Let's see a new Panda log.

O.K. I have the log............and meanwhile I have searched using the search tool in start to see what is there.

Folder marked Smitfraudfix
c:\Documents and Settings\Christian\Desktop\

Command script folder marked Smitfraudfix.cmd
c:\DocumentsandSettings\Christian\Desktop\Smitfraudfix

Folder marked Smitfraudfix
c:\Temp

As above.a secondary folder marked Smitfraudfix.cmd
c:\Temp\Smitfraudfix

found c:\Temp\salm.log

found c:\programfiles\MediaGateway

This I cant find anywhere else and the only way of removing it seems to be to right click and hit delete

xmltok_.dll or indeed anything with xmltok cannot find anywhere

Process.exe found in
c:\Documents and Settings\Christian\Destop\Smitfraudfix

Also in
c:\WINDOWS\sytem32

Also found these

qprocess.exe
c:\WINDOWS\system32

then in blue print

qprocess.exe
c:\WINDOWS\system32\dllcache

Ok hope all this helps.
now for the panda log

Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salm.log
Adware:adware/wupd Not disinfected c:\program files\MediaGateway
Dialer:dialer.dgi Not disinfected hkey_local_machine\software\Mpb
Adware:adware/dyfuca Not disinfected Windows Registry
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt[.ccbill.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Christian\Cookies\christian@questionmarket[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe
Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\Downloaded Program Files\xmltok_.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe

chiaz · May 2006

Download Avenger from here:
http://swandog46.geekstogo.com/

Open the program. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this:
c:\temp\salm.log
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\Downloaded Program Files\xmltok_.dll
C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe

and click 'Done'

Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

Now delete this folder:
c:\program files\MediaGateway

Post the Avenger output.txt, which you can find at C:\Avenger\.txt. Also rescan with Panda ActiveScan and post the new log in your next reply.

nova · May 2006

chiawaikian wrote:

Download Avenger from here:
http://swandog46.geekstogo.com/

Open the program. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this:
c:\temp\salm.log
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\Downloaded Program Files\xmltok_.dll
C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe

and click 'Done'

Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

Now delete this folder:
c:\program files\MediaGateway

Post the Avenger output.txt, which you can find at C:\Avenger\.txt. Also rescan with Panda ActiveScan and post the new log in your next reply.

O.K.
I still have on screen\desktop showing GetPaths.vbs
SetPaths.bat
SmitFraudfix folder icon
Should i just right click and delete these??

Avenger text
gfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\fpynjtss

*******************

Script file located at: \??\C:\WINDOWS\lwnptadw.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File c:\temp\salm.log deleted successfully.
File C:\WINDOWS\system32\Process.exe deleted successfully.
File C:\WINDOWS\Downloaded Program Files\xmltok_.dll deleted successfully.
File C:\Documents and Settings\Christian\Desktop\SmitfraudFix\Process.exe

deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Panda scan

Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salmau.dat
Dialer:dialer.dgi Not disinfected hkey_local_machine\software\Mpb
Adware:adware/dyfuca Not disinfected Windows Registry
Potentially unwanted tool:Application/Processor Not disinfected C:\avenger\backup.zip[avenger/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\avenger\backup.zip[avenger/Process.exe-ren-238]
Adware:Adware/SAHAgent Not disinfected C:\avenger\backup.zip[avenger/xmltok_.dll]
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt[.ccbill.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Christian\Cookies\christian@questionmarket[1].txt

chiaz · May 2006

Resatrt the computer. As the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

Open Avenger again. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this:
c:\temp\salmau.dat

and click 'Done'
Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

You can delete these from your desktop:
GetPaths.vbs
SetPaths.bat
SmitFraudfix folder icon

Also run Notepad and paste the following text into a new file:

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\Mpb]

Save the file to the desktop as fix.reg and make sure the "Save as Type" field says "All Files". Then please go to the desktop and double-click on fix.reg, and click Yes to merge it with the registry.

Rescan with Panda ActiveScan and post the new log here.

nova · May 2006

chiawaikian wrote:

Resatrt the computer. As the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

Open Avenger again. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this:
c:\temp\salmau.dat

and click 'Done'
Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

You can delete these from your desktop:
GetPaths.vbs
SetPaths.bat
SmitFraudfix folder icon

Also run Notepad and paste the following text into a new file:

Save the file to the desktop as fix.reg and make sure the "Save as Type" field says "All Files". Then please go to the desktop and double-click on fix.reg, and click Yes to merge it with the registry.

Rescan with Panda ActiveScan and post the new log here.

been to avenger

Pasted your data
Reply as follows

Are you sure you want to execute the commands in selected script?
click yes
Error: selected file does not appear to be a valid script press ok to log error
press ok
error code: 0

press ok
pressed ok nothing happens ...reboot restart my comp and still nothing happens

been to my desk top and deleted getpaths
set paths
smitfraudfixicons by right clicking and deleting.........empty recycle bin

????????

chiaz · May 2006

Try to follow the rest of the instructions, and then post a new Panda ActiveScan log.

nova · May 2006

chiawaikian wrote:

Try to follow the rest of the instructions, and then post a new Panda ActiveScan log.

Sorry for the delay I had to go away for a few days

Here is the panda scan

And I noticed it came accross 2 potential hackers
I suspect one of them is an online poker site I play
PartyPoker.com

Incident Status Location

Adware:adware/ncase Not disinfected c:\temp\salmau.dat
Adware:adware/dyfuca Not disinfected Windows Registry
Potentially unwanted tool:Application/Processor Not disinfected C:\avenger\backup.zip[avenger/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\avenger\backup.zip[avenger/Process.exe-ren-238]
Adware:Adware/SAHAgent Not disinfected C:\avenger\backup.zip[avenger/xmltok_.dll]
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Application Data\Mozilla\Profiles\Default User\80jhvpe1.slt\cookies.txt[.ccbill.com/]
Spyware:Cookie/Admotion Not disinfected C:\Documents and Settings\Christian\Cookies\christian@admotion.com[2].txt
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Christian\Cookies\christian@adserver.terra[2].txt
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Christian\Cookies\christian@as1.falkag[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Christian\Cookies\christian@bluestreak[1].txt
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Christian\Cookies\christian@ccbill[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Christian\Cookies\christian@questionmarket[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Christian\Cookies\christian@serving-sys[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Christian\Cookies\christian@terra.com[1].txt
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Christian\Cookies\christian@tradedoubler[2].txt

chiaz · May 2006

The following instructions involve editing the registry manually, follow it only if you are confident of doing it.

1) Back up the registry:
http://windowsxp.mvps.org/registry.htm

2) Then restart the computer. As the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

3) Once in safe mode, remove the Startup Entry in the Registry

* Click on Start, Run, Type REGEDIT and Click OK
* Click the pluses(+) next to the following items
o HKEY_LOCAL_MACHINE
o Software
o Microsoft
o Windows
o CurrentVersion
o Run
* Right-Click on the file MSBB and click DELETE
* Check for any randomly named entries pointing to an EXE file of the same name in the Windows directory
(this can be part of the NCASE infection as well)
* Click the pluses(+) next to the following items
o HKEY_LOCAL_MACHINE
o Software
o Microsoft
o Windows
o CurrentVersion
o Uninstall
* Right-click and Delete the following folders
o nCase
o msbb
* Click the pluses(+) next to the following items
o HKEY_Current_User
o Software
* Right-click and Delete the folder called 180solutions

4) Delete the NCASE folder and/or the MSBB.exe file

* Open My Computer, Drive C, Program Files
* Right-click on the NCASE folder (if it exists) and Delete it, you may also find a 180Solutions folder, delete this as well.
* Look for and Delete MSBB.EXE in the System or System32 directory under Windows

5) Remove the Active X Control (if present)

* Open My Computer, Drive C, Windows, Downloaded Program Files folder
* Right-click on the nCaseInstaller Class entry (if present) and click Delete
* Close back out to the Desktop

6) Reboot the computer in Normal Mode.

7) Delete the Avenger backup:
C:\avenger\backup.zip

8) Delete everything in this folder (Do not delete the folder itself):
C:\Documents and Settings\Christian\Cookies\

9) Rescan with Panda ActiveScan and post the new log.

guarduptodate or no good

Comments