Please advise on results of scans and HJTlog

Unknown
edited January 2007 in Spyware & Virus Removal
My computer often gives me a "internet explorer must close" dialogue as well as my home page changing from whatever I make it to "www.Dell.com".

Thank you for any advice you can give.

Sincerely
Josh


Here are the logs from the scans and HJT.


Activscan
Incident Status Location

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\RobynMichelle\Cookies\robynmichelle@atdmt[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\RobynMichelle\Cookies\robynmichelle@com[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\RobynMichelle\Cookies\robynmichelle@mediaplex[1].txt
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\RobynMichelle\Cookies\robynmichelle@www.myaffiliateprogram[2].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\RobynMichelle\Cookies\robynmichelle@zedo[1].txt

Wednesday, January 03, 2007 1:34:58 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 3/01/2007
Kaspersky Anti-Virus database records: 241343

Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 50999
Number of viruses found 1
Number of infected objects 6 / 0
Number of suspicious objects 0
Duration of the scan process 00:52:05

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-01-02_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74E2747D.exe Infected: Trojan.Win32.Crypt.t skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\RobynMichelle\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped

C:\Documents and Settings\RobynMichelle\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Application Data\Sunbelt Software\CounterSpy\SunEventsData.sdb Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\History\History.IE5\MSHist012007010320070104\index.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Temp\~DF415A.tmp Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Temp\~DF680B.tmp Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\ntuser.dat Object is locked skipped

C:\Documents and Settings\RobynMichelle\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Adovices\ace.dll Infected: Trojan.Win32.Crypt.t skipped

C:\Program Files\Adovices\shidosys.exe Infected: Trojan.Win32.Crypt.t skipped

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\eengine\EPERSIST.DAT Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Norton AntiVirus\Savrt\0052NAV~.TMP Object is locked skipped

C:\Program Files\Norton AntiVirus\Savrt\0753NAV~.TMP Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\SYSTEM32\alrv6mon.exe Infected: Trojan.Win32.Crypt.t skipped

C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped

C:\WINDOWS\SYSTEM32\LogFiles\HTTPERR\httperr1.log Object is locked skipped

C:\WINDOWS\SYSTEM32\srvmsnap.dll Infected: Trojan.Win32.Crypt.t skipped

C:\WINDOWS\SYSTEM32\termscms.exe Infected: Trojan.Win32.Crypt.t skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\~DF2545.tmp Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


BitDefender Online Scanner
Scan report generated at: Wed, Jan 03, 2007 - 03:08:40

Scan path: C:\;D:\;

Statistics
Time 01:29:08
Files 246335
Folders 4070
Boot Sectors 3
Archives 3692
Packed Files 24686

Results
Identified Viruses 1
Infected Files 1
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 2

Engines Info
Virus Definitions 366306
Engine build AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)
Scan plugins 14
Archive plugins 38
Unpack plugins 6
E-mail plugins 6
System plugins 1

Scan Settings
First Action Disinfect
Second Action Delete
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes


Scanned File Status
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74E2747D.exe=>(Quarantine-2) Infected with: Trojan.Crypt.T
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74E2747D.exe=>(Quarantine-2) Disinfection failed
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\74E2747D.exe=>(Quarantine-2) Deleted




Logfile of HijackThis v1.99.1
Scan saved at 10:24:20 AM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Comments

  • joshrussia
    edited January 2007
    Have I posted enough info...or the right info...

    I am hopin to get this thing running so that I can use it...


    Thanks alot for any help you can give...
    JOsh
  • TroganTrogan London, UK
    edited January 2007
    Hi Josh! :)

    Your HijackThis log is fairly clean.

    Do you know what Adovices is? Let me know in your next reply.

    A few things I'd like you to do...

    1. We need to scan a file:
    • Go to VirusTotal
    • Copy and paste the following file path into the Search Box at the top of the page:
        C:\WINDOWS\SYSTEM32\alrv6mon.exe
      [*]Click on the Send button
      [*]Save a copy of the results and post them in your next reply.
      Do the same for the following files:

      C:\WINDOWS\SYSTEM32\srvmsnap.dll
      C:\WINDOWS\SYSTEM32\termscms.exe

      2. I need to see another log from HijackThis.
      • Run Hijackthis.
      • Click on Open the Misc Tools section.
      • Next click on Open uninstall manager.
      • Press the Save list button.
      • Save the file to your desktop, with the default name of uninstall_list
      • Copy & Paste the entire contents of that file in your in your next post.
      3. Post the following...

      1) Scan results
      2) Uninstall list
      3) New HijackThis log
    • joshrussia
      edited January 2007
      Thanks alot for checking me out...

      Here is the info you have requested...First the VirusTotal scans and then the HJT log...


      Complete scanning result of "alrv6mon.exe", received in VirusTotal at 01.04.2007, 16:35:12 (CET).
      Antivirus Version Update Result
      AntiVir 7.3.0.21 01.04.2007 no virus found
      Authentium 4.93.8 12.30.2006 no virus found
      Avast 4.7.892.0 12.30.2006 no virus found
      AVG 386 01.04.2007 no virus found
      BitDefender 7.2 01.04.2007 no virus found
      CAT-QuickHeal 8.00 01.03.2007 (Suspicious) - DNAScan
      ClamAV devel-20060426 01.04.2007 no virus found
      DrWeb 4.33 01.04.2007 Trojan.AproposAd
      eSafe 7.0.14.0 01.04.2007 no virus found
      eTrust-InoculateIT 23.73.104 01.04.2007 Win32/Propo!Trojan
      eTrust-Vet 30.3.3301 01.04.2007 Win32/Propo
      Ewido 4.0 01.04.2007 no virus found
      Fortinet 2.82.0.0 01.03.2007 no virus found
      F-Prot 3.16f 01.04.2007 no virus found
      F-Prot4 4.2.1.29 01.03.2007 no virus found
      Ikarus T3.1.0.27 01.04.2007 no virus found
      Kaspersky 4.0.2.24 01.04.2007 Trojan.Win32.Crypt.t
      McAfee 4931 01.03.2007 potentially unwanted program Adware-Apropos
      Microsoft 1.1904 01.04.2007 no virus found
      NOD32v2 1956 01.04.2007 no virus found
      Norman 5.80.02 12.31.2007 no virus found
      Panda 9.0.0.4 01.03.2007 Suspicious file
      Prevx1 V2 01.04.2007 no virus found
      Sophos 4.13.0 01.04.2007 no virus found
      Sunbelt 2.2.907.0 12.18.2006 no virus found
      TheHacker 6.0.3.142 01.04.2007 no virus found
      UNA 1.83 01.04.2007 no virus found
      VBA32 3.11.1 01.03.2007 suspected of Unknown.Win32Virus
      VirusBuster 4.3.19:9 01.04.2007 no virus found
      Aditional Information
      File size: 417792 bytes
      MD5: 5f8b6061a47b6a4c7b045317576cb4ae
      SHA1: a6af9a879777f460dd8ead543e4e69d60b175c84
      VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
      > Go to: Home Contactar En Español

      www.virustotal.com :: ©Hispasec Sistemas 2004-06:: e-mail info@virustotal

      STATUS: FINISHED
      Complete scanning result of "srvmsnap.dll", received in VirusTotal at 01.04.2007, 16:41:45 (CET).
      Antivirus Version Update Result
      AntiVir 7.3.0.21 01.04.2007 no virus found
      Authentium 4.93.8 12.30.2006 no virus found
      Avast 4.7.892.0 12.30.2006 Win32:Small-MX
      AVG 386 01.04.2007 no virus found
      BitDefender 7.2 01.04.2007 no virus found
      CAT-QuickHeal 8.00 01.03.2007 no virus found
      ClamAV devel-20060426 01.04.2007 no virus found
      DrWeb 4.33 01.04.2007 Trojan.AproposAd
      eSafe 7.0.14.0 01.04.2007 no virus found
      eTrust-InoculateIT 23.73.104 01.04.2007 no virus found
      eTrust-Vet 30.3.3301 01.04.2007 Win32/Propo
      Ewido 4.0 01.04.2007 no virus found
      Fortinet 2.82.0.0 01.03.2007 no virus found
      F-Prot 3.16f 01.04.2007 no virus found
      F-Prot4 4.2.1.29 01.03.2007 no virus found
      Ikarus T3.1.0.27 01.04.2007 no virus found
      Kaspersky 4.0.2.24 01.04.2007 Trojan.Win32.Crypt.t
      McAfee 4931 01.03.2007 no virus found
      Microsoft 1.1904 01.04.2007 no virus found
      NOD32v2 1956 01.04.2007 no virus found
      Norman 5.80.02 12.31.2007 no virus found
      Panda 9.0.0.4 01.03.2007 no virus found
      Prevx1 V2 01.04.2007 no virus found
      Sophos 4.13.0 01.04.2007 no virus found
      Sunbelt 2.2.907.0 12.18.2006 no virus found
      TheHacker 6.0.3.142 01.04.2007 no virus found
      UNA 1.83 01.04.2007 no virus found
      VBA32 3.11.1 01.03.2007 suspected of Unknown.Win32Virus
      VirusBuster 4.3.19:9 01.04.2007 no virus found
      Aditional Information
      File size: 45056 bytes
      MD5: 6ea505939074532e101aefdd3e46ccfb



      STATUS: FINISHED
      Complete scanning result of "termscms.exe", received in VirusTotal at 01.04.2007, 16:42:51 (CET).
      Antivirus Version Update Result
      AntiVir 7.3.0.21 01.04.2007 no virus found
      Authentium 4.93.8 12.30.2006 no virus found
      Avast 4.7.892.0 12.30.2006 no virus found
      AVG 386 01.04.2007 no virus found
      BitDefender 7.2 01.04.2007 no virus found
      CAT-QuickHeal 8.00 01.03.2007 (Suspicious) - DNAScan
      ClamAV devel-20060426 01.04.2007 no virus found
      DrWeb 4.33 01.04.2007 Trojan.AproposAd
      eSafe 7.0.14.0 01.04.2007 no virus found
      eTrust-InoculateIT 23.73.104 01.04.2007 Win32/Propo!Trojan
      eTrust-Vet 30.3.3301 01.04.2007 Win32/Propo
      Ewido 4.0 01.04.2007 no virus found
      Fortinet 2.82.0.0 01.03.2007 no virus found
      F-Prot 3.16f 01.04.2007 no virus found
      F-Prot4 4.2.1.29 01.03.2007 no virus found
      Ikarus T3.1.0.27 01.04.2007 Trojan.Win32.Crypt.t
      Kaspersky 4.0.2.24 01.04.2007 Trojan.Win32.Crypt.t
      McAfee 4931 01.03.2007 potentially unwanted program Adware-Apropos
      Microsoft 1.1904 01.04.2007 no virus found
      NOD32v2 1956 01.04.2007 no virus found
      Norman 5.80.02 12.31.2007 no virus found
      Panda 9.0.0.4 01.03.2007 Suspicious file
      Prevx1 V2 01.04.2007 no virus found
      Sophos 4.13.0 01.04.2007 no virus found
      Sunbelt 2.2.907.0 12.18.2006 no virus found
      TheHacker 6.0.3.142 01.04.2007 no virus found
      UNA 1.83 01.04.2007 no virus found
      VBA32 3.11.1 01.03.2007 suspected of Unknown.Win32Virus
      VirusBuster 4.3.19:9 01.04.2007 no virus found
      Aditional Information
      File size: 139264 bytes
      MD5: d68b90d7045c12f744235206ab3dcb9d
      SHA1: adb92840a6991337a23ffef20251fc446fa2fb0e


      Uninstall list

      Ad-Aware SE Personal
      Adobe Download Manager 1.2 (Remove Only)
      Adobe Reader 6.0.1
      All About Me
      Amazing ABC's and 123's
      America Online (Choose which version to remove)
      Animal Antics
      AOL Coach Version 1.0(Build:20040229.1 en)
      AOL Connectivity Services
      ATI Control Panel
      ATI Display Driver
      BCM V.92 56K Modem
      Broadcom Advanced Control Suite
      ccCommon
      CCleaner (remove only)
      Celebrations & School Events
      Dell Media Experience
      Dell ResourceCD
      Dell Solution Center
      Dell Support 5.0.0 (766)
      DS21Patch
      DVDSentry
      Hijackthis 1.99.1
      HijackThis 1.99.1
      Hotfix for Windows Media Format SDK (KB902344)
      Hotfix for Windows XP (KB915865)
      hp deskjet 3820 series (Remove only)
      HP Image Zone 3.5
      HP PSC & OfficeJet 3.5
      HP Software Update
      InterActual Player
      Internet Worm Protection
      iTunes
      Jasc Paint Shop Photo Album
      Jasc Paint Shop Pro 8 Dell Edition
      Java 2 Runtime Environment, SE v1.4.2
      Kaspersky Online Scanner
      Learn2 Player (Uninstall Only)
      LiveUpdate 3.0 (Symantec Corporation)
      Logitech QuickCam Software
      Logitech® Camera Driver
      Macromedia Flash Player 8
      Microsoft .NET Framework 1.1
      Microsoft Encarta Encyclopedia Standard 2003
      Microsoft Internationalized Domain Names Mitigation APIs
      Microsoft National Language Support Downlevel APIs
      Microsoft Office XP Professional
      Microsoft Picture It! Photo 7.0
      Microsoft Streets and Trips 2002
      Microsoft Word 2002
      Microsoft Works 2003 Setup Launcher
      Microsoft Works 7.0
      Modem Helper
      MSXML 4.0 SP2 (KB927978)
      NAVShortcut
      Norton AntiVirus 2006
      Norton AntiVirus 2006 (Symantec Corporation)
      Norton AntiVirus Help
      Norton AntiVirus Parent MSI
      Norton AntiVirus SYMLT MSI
      Norton Protection Center
      Norton WMI Update
      Odyssey Client
      Panda ActiveScan
      PowerDVD
      Pure Networks Port Magic
      QuickSet
      QuickTime
      RealOne Player
      School Time Borders
      Security Update for Step By Step Interactive Training (KB898458)
      Security Update for Windows Media Player (KB911564)
      Security Update for Windows Media Player 10 (KB911565)
      Security Update for Windows Media Player 10 (KB917734)
      Security Update for Windows Media Player 6.4 (KB925398)
      Security Update for Windows XP (KB890046)
      Security Update for Windows XP (KB893756)
      Security Update for Windows XP (KB896358)
      Security Update for Windows XP (KB896422)
      Security Update for Windows XP (KB896423)
      Security Update for Windows XP (KB896424)
      Security Update for Windows XP (KB896428)
      Security Update for Windows XP (KB899587)
      Security Update for Windows XP (KB899591)
      Security Update for Windows XP (KB900725)
      Security Update for Windows XP (KB901017)
      Security Update for Windows XP (KB901214)
      Security Update for Windows XP (KB902400)
      Security Update for Windows XP (KB904706)
      Security Update for Windows XP (KB905414)
      Security Update for Windows XP (KB905749)
      Security Update for Windows XP (KB908519)
      Security Update for Windows XP (KB911562)
      Security Update for Windows XP (KB911567)
      Security Update for Windows XP (KB911927)
      Security Update for Windows XP (KB912812)
      Security Update for Windows XP (KB912919)
      Security Update for Windows XP (KB913446)
      Security Update for Windows XP (KB913580)
      Security Update for Windows XP (KB914388)
      Security Update for Windows XP (KB914389)
      Security Update for Windows XP (KB916281)
      Security Update for Windows XP (KB917159)
      Security Update for Windows XP (KB917344)
      Security Update for Windows XP (KB917422)
      Security Update for Windows XP (KB917953)
      Security Update for Windows XP (KB918439)
      Security Update for Windows XP (KB918899)
      Security Update for Windows XP (KB919007)
      Security Update for Windows XP (KB920213)
      Security Update for Windows XP (KB920214)
      Security Update for Windows XP (KB920670)
      Security Update for Windows XP (KB920683)
      Security Update for Windows XP (KB920685)
      Security Update for Windows XP (KB921398)
      Security Update for Windows XP (KB921883)
      Security Update for Windows XP (KB922616)
      Security Update for Windows XP (KB922760)
      Security Update for Windows XP (KB922819)
      Security Update for Windows XP (KB923191)
      Security Update for Windows XP (KB923414)
      Security Update for Windows XP (KB923689)
      Security Update for Windows XP (KB923694)
      Security Update for Windows XP (KB923980)
      Security Update for Windows XP (KB924191)
      Security Update for Windows XP (KB924270)
      Security Update for Windows XP (KB924496)
      Security Update for Windows XP (KB925486)
      Security Update for Windows XP (KB926255)
      Shockwave
      Sonic RecordNow!
      SPBBC
      Spybot - Search & Destroy 1.4
      SpywareBlaster v3.5.1
      Sunbelt CounterSpy
      Symantec
      Synaptics Pointing Device Driver
      Update for Windows XP (KB894391)
      Update for Windows XP (KB898461)
      Update for Windows XP (KB900485)
      Update for Windows XP (KB908531)
      Update for Windows XP (KB910437)
      Update for Windows XP (KB911280)
      Update for Windows XP (KB916595)
      Update for Windows XP (KB920872)
      Update for Windows XP (KB922582)
      Viewpoint Media Player
      Weather Bears Clever Calendars
      Windows Installer 3.1 (KB893803)
      Windows Internet Explorer 7
      Windows Media Format Runtime
      Windows Media Player 10
      Windows XP Hotfix - KB873339
      Windows XP Hotfix - KB885250
      Windows XP Hotfix - KB885835
      Windows XP Hotfix - KB885836
      Windows XP Hotfix - KB885884
      Windows XP Hotfix - KB886185
      Windows XP Hotfix - KB887472
      Windows XP Hotfix - KB887742
      Windows XP Hotfix - KB888113
      Windows XP Hotfix - KB888302
      Windows XP Hotfix - KB890859
      Windows XP Hotfix - KB891781
      Windows XP Service Pack 2
      Wireless-G Notebook Adapter
      Write On
    • joshrussia
      edited January 2007
      Also, not sure what Adovices is...???

      Josh
    • TroganTrogan London, UK
      edited January 2007
      Adovices seems to be bad according to Kaspersky, so we'll remove it.

      Please do the following...

      1. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

      Updating Java:
      • Download the latest version of Java Runtime Environment (JRE) 6 .
      • Click the "Download" button to the right.
      • Check the box that says: "Accept License Agreement."
      • The page will refresh.
      • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
      • Close any programs you may have running - especially your web browser.
      • Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
        • Java 2 Runtime Environment, SE v1.4.2
      • Reboot your computer once all Java components are removed.
      • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
      2. FInd and delete the following Folder:

      C:\Program Files\Adovices <-- This folder

      3. Please download Killbox and save it to your desktop.

      Next, copy everything in the Quote box below by pressing Ctrl+C
      C:\WINDOWS\SYSTEM32\alrv6mon.exe
      C:\WINDOWS\SYSTEM32\srvmsnap.dll
      C:\WINDOWS\SYSTEM32\termscms.exe
      Next, open Killbox
      Go to File tab and select Paste from Clipboard
      Select the Delete on Reboot option
      Select All Files
      Now click on the Red Circle with the White X
      Press Yes to reboot your computer.

      4. After the computer has rebooted...

      Open HijackThis
      - Click the Do a system scan only button
      - Check the following entries (below)

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

      - Close ALL open windows (especially Internet Explorer!)
      - Click Fix Checked
      Close HiajckThis

      5. Please post a new HijackThis log and let me know how the computer is.
    • joshrussia
      edited January 2007
      Thanks for all of your help...

      I followed your steps...

      The home page is still reverting back to www.dell.com...

      The Internet error message which was appearing seems to be gone...

      Here is the Hjt log...

      Josh

      Logfile of HijackThis v1.99.1
      Scan saved at 12:54:48 PM, on 1/2/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.5730.0011)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
      C:\WINDOWS\system32\spoolsv.exe
      c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
      C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
      C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      C:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
      C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\alrv6mon.exe
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\WINDOWS\system32\LVCOMSX.EXE
      C:\Program Files\Logitech\Video\CameraAssistant.exe
      C:\WINDOWS\system32\ElkCtrl.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
      C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
      C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
      C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
      C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
      C:\Documents and Settings\RobynMichelle\My Documents\virus\hijackthis\HijackThis.exe
      C:\Program Files\Norton AntiVirus\NAVW32.EXE

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
      O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
      O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe
      O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
      O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - Global Startup: Wireless-G Notebook Adapter.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
      O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
      O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
      O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
      O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
      O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
      O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
      O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
      O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
      O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
      O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    • TroganTrogan London, UK
      edited January 2007
      This HijackThis is old. Even older than the first one you posted.

      To remove DELL, do this:

      Open HijackThis
      - Click the Do a system scan only button
      - Check the following entries (below)

      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

      - Close ALL open windows (especially Internet Explorer!)
      - Click Fix Checked
      Close HiajckThis

      Reboot and post a new HijackThis log please.
    • TroganTrogan London, UK
      edited January 2007
      Whilst we appreciate that you may be busy, it has been 7 days or more since we heard from you.

      Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Spyware & Virus Removal Forum

      If you wish this topic reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

      Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.
      If you are not the user who started this thread, you must start a new Thread instead :)
    This discussion has been closed.