Options

w32.Jeefo Virus

Unknown
edited August 2008 in Spyware & Virus Removal
Hey, I got the jeefo virus somehow and it just keeps duplicating tmp files. I cant delete these tmp files and when i try it makes my computer go really slow. ive tried to restart in safe mode but for some reason my safe mode doesnt work either...... I click start in administrator and it just restarts the computer? anybody know what needs to be done? Help would be appreciated. :D
«1

Comments

  • TroganTrogan London, UK
    edited July 2008
    Download HJTInstall.exe to your Desktop.
    • Doubleclick HJTInstall.exe to install it.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Save the log to a convenient location as you'll need to post it soon.
    • Don't use the Analyse This button, its findings are dangerous if misinterpreted.
    • Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
  • wongger
    edited July 2008
    Alright i did what you told me the log is -

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:51:29 PM, on 7/25/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    C:\Program Files\Yahoo!\NAV\navapsvc.exe
    C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\SurferClient.exe
    C:\PROGRA~1\Yahoo!\YOP\yop.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
    C:\Program Files\Lexmark 2200 Series\lxbvbmon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\lexpps.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\PROGRA~1\Yahoo!\YOP\secstat.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Yahoo!\NAV\NAVW32.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/ca//c
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ca.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! Canada
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8E8FCD8E-3FD4-4D51-97ED-5A14EAB88FA7}: NameServer = 85.255.116.41,85.255.112.148
    O17 - HKLM\System\CCS\Services\Tcpip\..\{95483D9F-3DBA-42A0-BC9F-331DF6AB0382}: NameServer = 85.255.116.41,85.255.112.148
    O17 - HKLM\System\CCS\Services\Tcpip\..\{AA95C946-FD9E-41B0-B1E3-2F2DDDFA4B02}: NameServer = 85.255.116.41,85.255.112.148
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.41 85.255.112.148
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.116.41 85.255.112.148
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.41 85.255.112.148
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: AutomatedSurfer (SurferService) - Unknown owner - C:\WINDOWS\system32\srvany.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 18079 bytes
  • TroganTrogan London, UK
    edited July 2008
    Hi wongger,

    Please do the following...

    1. You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

    Please download FixWareout from one of these sites and save it to your desktop:
    http://downloads.subratam.org/Fixwareout.exe
    [url] http://download.bleepingcomputer.com/lonny/Fixwareout.exe[/url]
    • Double click Fixwareout.exe to run it.
    • Click Next, then Install.
    • Make sure Run fixit is checked and click Finish.
    • The fix will begin; follow the prompts.
    • You will be asked to reboot your computer; please do so.
    • Your system may take longer than usual to load; this is normal.
    • At the end of the fix, you may need to restart your computer again.
    • A report.txt file will be created in the C:\fixwareout folder. Please keep it safe as I'll need to see it soon.
    Now lets check some settings on your system.

    (2000/XP) Only
    • Click Start > Connect to > Show all connections.
    • Right click on your default connection, usually local area connection for cable and dsl.
    • Left click on Properties.
    • Click the Networking tab.
    • Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically.
    • Press OK twice to get out of the properties screen and reboot if it asks. (That option might not be avaiable on some systems).
    Next!
    • Click Start > Run type cmd and hit OK.
    • Type ipconfig /flushdns then hit enter, (Note: there is a space between ipconfig and /flushdns).
    • Type exit hit enter.

    2. I need to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button.
    • Save the file to your desktop, with the default name of uninstall_list
    • Copy & Paste the entire contents of that file in your in your next post.

    3. Please post the following...

    FixWareout report
    Uninstall list
    New HijackThis log
  • wongger
    edited July 2008
    Ok, well I couldn't find the connect to folder so I couldn't do that, and it wouldn't let me flushdns. Here is the report and the new hijack this log

    ~~~~~ Prerun check

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    "nameserver"="85.255.116.41 85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{8E8FCD8E-3FD4-4D51-97ED-5A14EAB88FA7}
    "nameserver"="85.255.116.41,85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{95483D9F-3DBA-42A0-BC9F-331DF6AB0382}
    "nameserver"="85.255.116.41,85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AA95C946-FD9E-41B0-B1E3-2F2DDDFA4B02}
    "nameserver"="85.255.116.41,85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{8E8FCD8E-3FD4-4D51-97ED-5A14EAB88FA7}
    "DhcpNameServer"="85.255.116.41,85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AA80EB78-93F8-4454-B225-F7C435817F56}
    "DhcpNameServer"="85.255.116.41,85.255.112.148" <Value cleared.
    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{AA95C946-FD9E-41B0-B1E3-2F2DDDFA4B02}
    "DhcpNameServer"="85.255.116.41,85.255.112.148" <Value cleared.

    Could not flush the DNS Resolver Cache: Function failed during execution.


    System was rebooted successfully.

    ~~~~~ Postrun check
    HKLM\SOFTWARE\~\Winlogon\ "System"=""
    ....
    ....
    ~~~~~ Misc files.
    ....
    ~~~~~ Checking for older varients.
    ....

    ~~~~~ Current runs (hklm hkcu "run" Keys Only)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NI.UWFX5"="\"C:\\Documents and Settings\\SPENCER\\Local Settings\\Temporary Internet Files\\Content.IE5\\UFJI6IFA\\WinFixer2005ScannerInstall[1].exe\""
    "SurfNavigator"="C:\\WINDOWS\\system32\\SurferClient.exe"
    "AutomatedSurfer"="C:\\WINDOWS\\system32\\SurferClient.exe"
    "YPC"="C:\\PROGRA~1\\Yahoo!\\PARENT~1\\ypc.exe"
    "YOP"="C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe /autostart"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\""
    "QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
    "PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
    "PD0630 STISvc"="RunDLL32.exe P0630Pin.dll,RunDLL32EP 513"
    "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
    "MyWebSearch Email Plugin"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe"
    "Lexmark 2200 Series"="\"C:\\Program Files\\Lexmark 2200 Series\\lxbvbmgr.exe\""
    "KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k"
    "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
    "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
    "Fbmxb"="C:\\Program Files\\Lywck\\Vtnymt.exe"
    "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
    "BearFlix"="\"C:\\Program Files\\BearFlix\\BearFlix.exe\" /pause"
    "ATIModeChange"="Ati2mdxx.exe"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "msnmsgr"="\"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\" /background"
    "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
    "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\ypager.exe\" -quiet"
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
    "AutomatedSurfer"="C:\\WINDOWS\\system32\\SurferClient.exe"
    ....
    Hosts file was reset, If you use a custom hosts file please replace it...
    C:\WINDOWS\System32\AUTOEXEC.NT missing
    ~~~~~ End report ~~~~~

    and the hijack this log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:59:57 PM, on 7/27/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device

    Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    C:\Program Files\Yahoo!\NAV\navapsvc.exe
    C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\srvany.exe
    C:\WINDOWS\system32\SurferClient.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://google.daemonsearch.com/ca//c
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

    http://ca.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

    http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www

    .yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

    http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

    http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

    http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows

    Internet Explorer provided by Yahoo! Canada
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88}

    - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} -

    C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-

    784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} -

    C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1

    \SPYBOT~1\SDHelper.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

    C:\Program Files\Yahoo!\common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} -

    C:\Program Files\Yahoo!\common\YIeTagBm.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

    C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} -

    C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-

    5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows

    Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1}

    - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program

    Files\Yahoo!\NAV\NavShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-

    64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} -

    C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}

    - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no

    file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

    C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program

    Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} -

    C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

    - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} -

    C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local

    Settings\Temporary Internet Files\Content.IE5

    \UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05

    \bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe"

    -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

    Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1

    \bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200

    Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil

    /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software

    Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe"

    /pause
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec

    Shared\DJSNETCN.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows

    Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe"

    -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe"

    -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

    "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

    Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

    Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program

    Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

    Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM

    Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Search -

    http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program

    Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program

    Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

    C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-

    00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} -

    C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-

    2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}

    - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-

    12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-

    82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D}

    - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

    C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-

    00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -

    C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O16 - DPF: RaptisoftGameLoader -

    http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

    http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) -

    http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient

    Class) -

    http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -

    http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class)

    - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -

    C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) -

    http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

    http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} -

    http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

    http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/w

    uweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin

    Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) -

    http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient

    Class) -

    http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer

    Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) -

    http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

    (MsnMessengerSetupDownloadControl Class) -

    http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

    http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient

    Class) -

    http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} -

    http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)

    - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown

    Class) -

    http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common

    Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

    C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation -

    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program

    Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc)

    - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -

    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation

    - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) -

    Symantec Corporation - C:\Program Files\Common Files\Symantec

    Shared\DJSNETCN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program

    Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

    C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1

    \Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec

    Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero

    BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -

    Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec

    Corporation - C:\Program Files\Common Files\Symantec Shared\Security

    Console\NSCSRVCE.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -

    CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation -

    C:\Program Files\Yahoo!\NAV\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec

    Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common

    Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: AutomatedSurfer (SurferService) - Unknown owner -

    C:\WINDOWS\system32\srvany.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

    Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation -

    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 16720 bytes
  • TroganTrogan London, UK
    edited July 2008
    Hi,
    Ok, well I couldn't find the connect to folder so I couldn't do that
    Click Start > Control Panel > Network Connections. This will get you to the same folder.
    and it wouldn't let me flushdns. Here is the report and the new hijack this log
    Try this:
    • Go to Start > Run and type in services.msc then press Enter
    • Scroll down to DNS Client
    • Double-Click on DNS Client
    • Select to Start under Service status
    • Click OK and close the Service window.
    Now you can run - ipconfig /flushdns
    • Click Start > Run type cmd and hit OK.
    • Type ipconfig /flushdns then hit enter, (Note: there is a space between ipconfig and /flushdns).
    • Type exit hit enter.

    Also, you didn't post the Uninstall list
    I need to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button.
    • Save the file to your desktop, with the default name of uninstall_list
    • Copy & Paste the entire contents of that file in your in your next post.
  • wongger
    edited July 2008
    Two problems I right click and go to properties on my internet connection but there is no "networking" tab the only tabs i have are general, authentication and advanced.

    The next problem is that when I go to DNS Client the start button under service status is unable to be clicked. . . .

    But here is my uninstall log

    Adobe Flash Player ActiveX
    Adobe Flash Player Plugin
    Adobe Reader 7.1.0
    Adobe Reader Korean Fonts
    Advanced Video FX Utility
    AnyDVD
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft PhotoImpression 4
    ASIO4ALL
    Ask Toolbar
    ATI Display Driver
    AutoIt v3.2.0.1
    AutomatedSurfer
    AviSynth 2.5
    BearFlix
    Big Fish Games Client
    BitTorrent 3.4.2
    Bonjour
    CadStd
    CC_ccProxyExt
    ccCommon
    ccPxyCore
    CleanUp!
    Click MusicalKEYS 3.0.214
    Collab
    CopyToDVD
    Counter-Strike
    Counter-Strike: Source
    Counter-Strike: Source
    Creative Photo Manager
    Creative WebCam Center
    Creative WebCam Live! Driver (1.02.03.0606)
    Creative WebCam Live! User's Guide (English)
    Digimax Master
    DivX Content Uploader
    DivX Web Player
    DVD Shrink 3.1.6
    DVD X Rescue
    DVDFab Platinum 2.9.7.2
    dvdSanta 4.00
    eBay Toolbar
    Full Tilt Poker
    GearDrivers
    Google Earth
    Guitar Pro 5.0
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    HijackThis 2.0.2
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB926239)
    HP Imaging Device Functions 6.0
    HP Photosmart Cameras 6.0
    HP Photosmart Essential
    HP Solution Center and Imaging Support Tools 6.0
    HP Update
    HyperCam 2
    IL Download Manager
    Intel(R) Extreme Graphics Driver
    Intel(R) PRO Network Adapters and Drivers
    InterActual Player
    Internet Worm Protection
    InterVideo WinDVD 4
    IrfanView (remove only)
    iTunes
    J2SE Runtime Environment 5.0 Update 1
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 5
    J2SE Runtime Environment 5.0 Update 6
    Java 2 Runtime Environment, SE v1.4.2
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) SE Runtime Environment 6 Update 1
    Lexmark 2200 Series
    Lexmark Fax Solutions
    LimeWire 4.16.6
    Machinist2DLL
    Macromedia Shockwave Player
    Messenger Plus! Live
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Encarta Encyclopedia Standard 2004
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Streets and Trips 2004
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Word 2002
    Microsoft Works
    Microsoft Works 2004 Setup Launcher
    Microsoft Works Suite Add-in for Microsoft Word
    Moving Desktop
    Mozilla Firefox (2.0.0.16)
    MP3 Rocket
    MPIO Software Installation
    MSRedist
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    NAVShortcut
    Neonatal Resuscitation DVD-ROM
    Nero 7
    Nero PhotoShow Express
    Norton AntiSpam
    Norton AntiVirus 2006
    Norton AntiVirus Help
    Norton AntiVirus Parent MSI
    Norton AntiVirus SYMLT MSI
    Norton Internet Security
    Norton Internet Security
    Norton Personal Firewall
    Norton Personal Firewall
    Norton Personal Firewall
    Norton Protection Center
    Norton WMI Update
    Norton WMI Update
    Optex Flash Reader-Writer
    PartyPoker
    Pokemon Light
    PokerStars
    PokerStars.net
    PowerISO
    Prassi PrimoDVD 2.0 (English)
    QuickTime
    rgcAudio z3ta+ v1.0
    Rogers Self Healing (remove only)
    Rogers Update Manager (remove only)
    Rogers Yahoo! Applications
    RollerCoaster Tycoon 3 Platinum
    SAMSUNG CDMA Modem Driver Set
    Samsung Media Studio
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Samsung PC Studio
    Samsung PC Studio 3 USB Driver Installer
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB883939)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB896688)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899588)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901190)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB903235)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911280)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922760)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Sibelius Scorch (ActiveX Only)
    Smart Audio Converter
    SPBBC
    Spybot - Search & Destroy 1.4
    Starcraft
    Steam
    StepMania (remove only)
    StepMania CVS (remove only)
    SurfNavigator
    Symantec
    Uninstall JL2005A Toy Camera
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896727)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB908531)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB929338)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB931836)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    URGE
    Videora iPod Converter 3.04
    Viewpoint Manager (Remove Only)
    Viewpoint Media Player
    Vodafone 804SS USB driver Software
    Vuze
    WebCam Live! Product Registration
    Winamp (remove only)
    Windows Genuine Advantage v1.3.0254.0
    Windows Installer 3.1 (KB893803)
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Live installer
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Toolbar
    Windows Live Toolbar
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows XP Hotfix - KB834707
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885884
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    Windows XP Service Pack 2
    WinPcap 3.1
    WinRAR archiver
    Wizardbrush 6
    WizardsOverHogwarts
    WorldPokerTour
    YP-U1
  • TroganTrogan London, UK
    edited July 2008
    Hi,
    Two problems I right click and go to properties on my internet connection but there is no "networking" tab the only tabs i have are general, authentication and advanced.
    It will be under General.
    The next problem is that when I go to DNS Client the start button under service status is unable to be clicked. . . .
    You've got to give more detail. Is it the box grayed? Does it say Service status: Started?

    Please do the following...

    1. Note about poker games:

    You appear to be a fan of games, but I think it's important to note that often these kind of programs are installed with other unwanted software, namely spyware or adware. If you did not install these programs yourself, or you do not use them any more, I would definitely recommend that you uninstall them from your computer, even if it is simply a precautionary measure. The amount of different poker software which arises on the internet means it is impossible to keep track of which ones are infected and which ones are not. If you do use the software, and wish to continue doing so, please ignore this. If you do decide to go ahead and remove the poker software, you should be able uninstall them via add/remove which can be found in the control panel. Let me know if you have any problems whilst doing so.
    Here are links to some poker sites regarded as safe for your reference.

    2. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 update7.
    • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications."
    • Click the "Download" button to the right.
    • Check the box that says: "Accept License Agreement."
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
      • AutomatedSurfer
      • J2SE Runtime Environment 5.0 Update 1
      • J2SE Runtime Environment 5.0 Update 10
      • J2SE Runtime Environment 5.0 Update 11
      • J2SE Runtime Environment 5.0 Update 5
      • J2SE Runtime Environment 5.0 Update 6
      • Java 2 Runtime Environment, SE v1.4.2
      • Java(TM) 6 Update 3
      • Java(TM) 6 Update 5
      • Java(TM) SE Runtime Environment 6 Update 1
      • SurfNavigator
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

    3. Please post a new HijackThis log. Note: when Notepad opens, click the Format tab and uncheck Word Wrap.
  • wongger
    edited July 2008
    Ok I fixed the DNS Client it was on disabled I put it to automatic than clicked start, so I can run the ipconfig /flushdns now

    Also I uninstalled all of the java programs you told me to and installed the new one

    here is the new hijack this log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:30:58 PM, on 7/29/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\SurferClient.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    C:\Program Files\Yahoo!\NAV\navapsvc.exe
    C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\srvany.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/ca//c
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ca.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! Canada
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: AutomatedSurfer (SurferService) - Unknown owner - C:\WINDOWS\system32\srvany.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 16463 bytes

    Thank you so much all your help :D
  • TroganTrogan London, UK
    edited July 2008
    Hi,

    Did you uninstall AutomatedSurfer and SurfNavigator as instructed?

    Please visit this webpage for download links, and instructions for running ComboFix:

    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:
    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    2. Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New HijackThis log.
  • wongger
    edited July 2008
    I did uninstall those two programs, they do not show up in add/remove programs anymore.

    I ran the combofix here is that log:
    ComboFix 08-07-29.1 - SPENCER 2008-07-30 18:37:36.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT -4:00]
    Running from: C:\Documents and Settings\SPENCER\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\MOE\Application Data\Starware
    C:\Documents and Settings\MOE\Application Data\Starware\BrowserSearch\BrowserSearch.xml
    C:\Documents and Settings\MOE\Application Data\Starware\BrowserSearch\BrowserSearch.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Games\GamesOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Games\GamesOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Layouts\PreferencesLayout.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Layouts\PreferencesLayout.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Layouts\ToolbarLayout.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Layouts\ToolbarLayout.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Manager\ManagerOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Manager\ManagerOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Movies\MoviesOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Movies\MoviesOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Reference\ReferenceOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Reference\ReferenceOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Screensavers\ScreensaversOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Screensavers\ScreensaversOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\SearchAssistPlus\SearchAssistPlusOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\SearchMatch\SearchMatchOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\SearchMatch\SearchMatchOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Toolbar\TBProductsOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Toolbar\TBProductsOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\TravelSearch\TravelSearchOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\TravelSearch\TravelSearchOptions.xml.backup
    C:\Documents and Settings\MOE\Application Data\Starware\Weather\AlertArchive.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Weather\WeatherOptions.xml
    C:\Documents and Settings\MOE\Application Data\Starware\Weather\WeatherOptions.xml.backup
    C:\Documents and Settings\SPENCER\Application Data\FunWebProducts
    C:\Documents and Settings\SPENCER\Application Data\WinAntiVirus Pro 2006
    C:\Documents and Settings\SPENCER\Application Data\WinAntiVirus Pro 2006\Logs\update.log
    C:\Documents and Settings\SPENCER\Application Data\WinAntiVirus Pro 2006\Logs\wa6Support.log
    C:\Documents and Settings\SPENCER\Application Data\WinAntiVirus Pro 2006\Logs\winav.log
    C:\Program Files\internet explorer\msimg32.dll
    C:\Program Files\Mozilla Firefox\plugins\npclntax.dll
    C:\Program Files\MyWebSearch
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
    C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
    C:\Program Files\winantivirus pro 2006
    C:\Program Files\winantivirus pro 2006\alerts.txt
    C:\Program Files\winantivirus pro 2006\ASupdater.dat
    C:\Program Files\winantivirus pro 2006\avcom.log
    C:\Program Files\winantivirus pro 2006\AWBase\database\enemies.dat
    C:\Program Files\winantivirus pro 2006\AWBase\vbpv.dat
    C:\Program Files\winantivirus pro 2006\BkSites.dat
    C:\Program Files\winantivirus pro 2006\bnlink.dat
    C:\Program Files\winantivirus pro 2006\bpupdater.dat
    C:\Program Files\winantivirus pro 2006\history.db
    C:\Program Files\winantivirus pro 2006\img\button.gif
    C:\Program Files\winantivirus pro 2006\img\button2.gif
    C:\Program Files\winantivirus pro 2006\img\header.gif
    C:\Program Files\winantivirus pro 2006\img\logo.gif
    C:\Program Files\winantivirus pro 2006\img\spacer.gif
    C:\Program Files\winantivirus pro 2006\img\top_line.gif
    C:\Program Files\winantivirus pro 2006\img\top1.jpg
    C:\Program Files\winantivirus pro 2006\img\top2.jpg
    C:\Program Files\winantivirus pro 2006\lapv.dat
    C:\Program Files\winantivirus pro 2006\License.rtf
    C:\Program Files\winantivirus pro 2006\PGBase\vbpv.dat
    C:\Program Files\winantivirus pro 2006\PGupdater.dat
    C:\Program Files\winantivirus pro 2006\phigh.bin
    C:\Program Files\winantivirus pro 2006\pmedium.bin
    C:\Program Files\winantivirus pro 2006\prc.dat
    C:\Program Files\winantivirus pro 2006\prerules.xml
    C:\Program Files\winantivirus pro 2006\programs.bin
    C:\Program Files\winantivirus pro 2006\ps.dat
    C:\Program Files\winantivirus pro 2006\pv.dat
    C:\Program Files\winantivirus pro 2006\res\cross.gif
    C:\Program Files\winantivirus pro 2006\res\Register.gif
    C:\Program Files\winantivirus pro 2006\res\wa6p.gif
    C:\Program Files\winantivirus pro 2006\settings.bin
    C:\Program Files\winantivirus pro 2006\sr.log
    C:\Program Files\winantivirus pro 2006\st.dat
    C:\Program Files\winantivirus pro 2006\support.url
    C:\Program Files\winantivirus pro 2006\traffic.txt
    C:\Program Files\winantivirus pro 2006\unins000.dat
    C:\Program Files\winantivirus pro 2006\UninstallPage.html
    C:\Program Files\winantivirus pro 2006\up.dat
    C:\Program Files\winantivirus pro 2006\updater.dat
    C:\Program Files\winantivirus pro 2006\WABase\vbase000.dat
    C:\Program Files\winantivirus pro 2006\WABase\vbpv.dat
    C:\Program Files\winantivirus pro 2006\WAupdater.dat
    C:\Program Files\winantivirus pro 2006\worldmap.swf
    C:\WINDOWS\Downloaded Program Files\setup.inf
    C:\WINDOWS\msnimport.exe
    C:\WINDOWS\pp.exe
    C:\WINDOWS\system32\f3PSSavr.scr
    C:\WINDOWS\system32\stera.job
    C:\WINDOWS\system32\stera.log

    .
    ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
    .

    2008-07-29 19:28 . 2008-06-10 02:32 73,728 --a
    C:\WINDOWS\system32\javacpl.cpl
    2008-07-29 19:18 . 2008-07-29 19:18 <DIR> d
    C:\Program Files\Common Files\Java
    2008-07-29 18:44 . 2008-07-29 18:48 <DIR> d
    C:\Documents and Settings\SPENCER\.SunDownloadManager
    2008-07-28 20:57 . 2008-07-30 16:47 54,156 --ah
    C:\WINDOWS\QTFont.qfn
    2008-07-28 20:57 . 2008-07-28 20:57 1,409 --a
    C:\WINDOWS\QTFont.for
    2008-07-26 19:23 . 2008-07-26 19:23 10 --a
    C:\WINDOWS\WININIT.INI
    2008-07-26 19:04 . 2008-07-27 18:53 <DIR> d
    C:\fixwareout
    2008-07-25 18:50 . 2008-07-25 18:50 <DIR> d
    C:\Program Files\Trend Micro
    2008-07-24 12:04 . 2008-07-24 12:04 <DIR> d
    C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
    2008-07-09 09:19 . 2008-07-09 09:19 <DIR> d
    C:\Program Files\Lavasoft
    2008-07-09 09:19 . 2008-07-24 12:04 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-23 13:53 . 2008-06-23 13:53 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Azureus
    2008-06-23 13:52 . 2008-06-23 13:52 <DIR> d
    C:\Program Files\AskSBar
    2008-06-23 13:50 . 2008-06-23 13:51 <DIR> d
    C:\Program Files\Vuze
    2008-06-20 13:41 . 2008-06-20 13:41 245,248
    c--- C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-06-20 06:44 . 2008-06-20 06:44 138,368
    c--- C:\WINDOWS\system32\dllcache\afd.sys
    2008-06-13 23:09 . 2008-06-13 23:09 <DIR> d
    C:\Program Files\Guitar Pro 5
    2008-06-13 22:11 . 2008-06-13 22:11 <DIR> d
    C:\Program Files\¼Ò¸®¹Ù´Ù
    2008-06-01 22:58 . 2008-06-01 22:58 <DIR> d
    C:\Program Files\iPod
    2008-06-01 22:57 . 2008-06-01 22:58 <DIR> d
    C:\Program Files\iTunes
    2008-06-01 22:55 . 2008-06-01 22:55 <DIR> d
    C:\Program Files\Bonjour
    2008-06-01 22:53 . 2008-06-01 22:54 <DIR> d
    C:\Program Files\QuickTime

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-30 22:32
    d
    w C:\Program Files\Common Files\Symantec Shared
    2008-07-30 13:19
    d
    w C:\Program Files\Warcraft III
    2008-07-30 02:31
    d
    w C:\Documents and Settings\All Users\Application Data\DVD Shrink
    2008-07-29 23:28
    d
    w C:\Program Files\Java
    2008-07-29 23:02
    d
    w C:\Program Files\eBay
    2008-07-29 23:01
    d--h--w C:\Program Files\InstallShield Installation Information
    2008-07-29 22:58
    d
    w C:\Documents and Settings\SPENCER\Application Data\Atari
    2008-07-29 22:30
    d
    w C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-07-29 19:22
    d
    w C:\Documents and Settings\SPENCER\Application Data\LimeWire
    2008-07-26 23:38
    d
    w C:\Program Files\WorldPokerTour
    2008-07-26 23:37
    d
    w C:\Program Files\PokerStars.NET
    2008-07-26 23:37
    d
    w C:\Program Files\DVDneXtCOPY
    2008-07-26 23:23
    d
    w C:\Program Files\ATI Technologies
    2008-07-26 04:39 35,488 ----a-w C:\Documents and Settings\SPENCER\Application Data\wklnhst.dat
    2008-07-25 13:48
    d
    w C:\Documents and Settings\MOE\Application Data\FaxCtr
    2008-07-25 13:45 4,556 ----a-w C:\Documents and Settings\MOE\Application Data\wklnhst.dat
    2008-07-24 15:58
    d
    w C:\Program Files\Spybot - Search & Destroy
    2008-07-24 15:58
    d
    w C:\Program Files\Silkroad
    2008-07-24 15:58
    d
    w C:\Program Files\Samsung
    2008-07-24 15:58
    d
    w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-07-24 15:56
    d
    w C:\Program Files\Steam
    2008-07-22 05:09
    d
    w C:\Program Files\Full Tilt Poker
    2008-07-09 13:19
    d
    w C:\Program Files\Common Files\Wise Installation Wizard
    2008-07-09 13:15
    d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-06-21 23:10
    d
    w C:\Documents and Settings\SPENCER\Application Data\uTorrent
    2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-10 01:25
    d
    w C:\Program Files\StepMania
    2008-06-08 17:14
    d
    w C:\Program Files\Diablo II
    2008-06-07 02:48
    d
    w C:\Program Files\Starcraft
    2008-06-01 17:10
    d
    w C:\Program Files\Common Files\Adobe
    2008-05-31 21:30
    d
    w C:\Documents and Settings\SPENCER\Application Data\AdobeUM
    2008-05-29 01:37
    d
    w C:\Program Files\PartyGaming
    2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-11-30 02:33 64,712 ----a-w C:\Documents and Settings\SPENCER\Application Data\GDIPFONTCACHEV1.DAT
    2006-10-28 21:26 60,400 ----a-w C:\Documents and Settings\MOE\Application Data\GDIPFONTCACHEV1.DAT
    2005-10-09 16:39 5,920 ----a-w C:\Documents and Settings\All Users\Application Data\ypinfo.bin
    2004-04-15 20:48 9,912,734 ----a-w C:\Documents and Settings\SIMON\14664-pdf.zip
    . 
    <pre>
----a-w         2,245,048 2005-11-10 15:45:06  C:\Documents and Settings\ALBERT\My Documents\My Received Files\andypoggrams\Andy's programs\dvdSanta 4.00 - Create Your Own DVD Movies! Setup .exe
</pre>


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 10:16 171464]
    "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [N/A]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04 139264]
    "AutomatedSurfer"="C:\WINDOWS\system32\SurferClient.exe" [2007-04-15 17:55 102400]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NI.UWFX5"="C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe" [N/A]
    "SurfNavigator"="C:\WINDOWS\system32\SurferClient.exe" [2007-04-15 17:55 102400]
    "AutomatedSurfer"="C:\WINDOWS\system32\SurferClient.exe" [2007-04-15 17:55 102400]
    "YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-06-03 16:32 352256]
    "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-05-16 17:34 448040]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-11-06 04:27 200704]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
    "Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 09:08 57344]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 22:32 208952]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 01:08 49152]
    "Fbmxb"="C:\Program Files\Lywck\Vtnymt.exe" [N/A]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-12 11:30 53408]
    "BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [N/A]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "PD0630 STISvc"="P0630Pin.dll" [2005-06-05 13:01 36864 C:\WINDOWS\system32\P0630Pin.dll]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "DJSNetCN"="C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe" [2006-02-02 18:54 54976]

    C:\Documents and Settings\ALBERT\Start Menu\Programs\Startup\
    LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 17:32:57 147456]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 01:28:44 282624]
    InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-09-19 16:48:11 98304]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.MJPG"= jl_mjpg2.drv
    "MSACM.MI-SC4"= MI-SC4.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestPopUpKiller]
    C:\Program Files\BestPopUpKiller\BestPopupKiller.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEx]
    C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe [N/A]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    --a
    2008-03-27 21:52 1271032 c:\Program Files\Steam\steam.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
    --a
    2005-09-12 15:21 40960 C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "C:\\Program Files\\WinMX\\WinMX.exe"=
    "C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Starcraft\\StarCraft.exe"=
    "C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
    "C:\\Program Files\\Warcraft III\\war3.exe"=
    "C:\\WINDOWS\\system32\\rtcshare.exe"=
    "C:\\Program Files\\NetMeeting\\conf.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike\\hl.exe"=
    "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike source\\hl2.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
    "C:\\Program Files\\Valve\\Steam\\Steam.exe"=
    "C:\\Program Files\\Steam\\Steam.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3333:TCP"= 3333:TCP:softmod

    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-12-10 21:30]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
    R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 13:53]
    S2 SurferService;AutomatedSurfer;C:\WINDOWS\system32\srvany.exe [1997-05-14 23:49]
    S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys [2004-06-04 13:21]
    S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
    S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-05 21:44]
    S3 Revolution1;Revolution1;C:\Documents and Settings\SPENCER\Desktop\Revolution Engine 6.2\SHAK3.sys []
    S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4;C:\Program Files\Ufasoft\IcqSnif\usft_sn4.sys []

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder

    2008-07-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

    2008-07-30 C:\WINDOWS\Tasks\B3A68A4296893EC2.job
    - c:\docume~1\albert\applic~1\axisli~1\ford save rule.exe []

    2008-07-30 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

    2008-07-26 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - ALBERT.job
    - C:\PROGRA~1\Yahoo!\NAV\Navw32.exe [2006-04-14 00:48]
    .
    .
    Supplementary Scan
    .
    R0 -: HKCU-Main,Start Page = hxxp://google.daemonsearch.com/ca//c
    R0 -: HKLM-Main,Start Page = hxxp://ca.yahoo.com
    R0 -: HKLM-Main,Search Bar = hxxp://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 -: HKCU-Internet Settings,ProxyOverride = <local>;*.local
    O8 -: &AIM Search - C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 -: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 -: eBay Search - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 -: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe

    O16 -: RaptisoftGameLoader - hxxp://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    C:\WINDOWS\Downloaded Program Files\OSD28E7.OSD
    C:\WINDOWS\Downloaded Program Files\RSGameLoader.dll

    O16 -: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} - hxxp://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    C:\WINDOWS\Downloaded Program Files\FB_OCX.inf


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-30 18:41:46
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-07-30 18:46:14
    ComboFix-quarantined-files.txt 2008-07-30 22:45:09

    Pre-Run: 4,972,285,952 bytes free
    Post-Run: 5,051,064,320 bytes free

    320 --- E O F --- 2008-07-25 07:03:56

    Hijack this log to follow in next post
  • wongger
    edited July 2008
    Here is the hijack this log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:49:35 PM, on 7/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    C:\Program Files\Yahoo!\NAV\navapsvc.exe
    C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Yahoo!\NAV\NAVW32.EXE
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\SurferClient.exe
    C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\lexpps.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/ca//c
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/sb/*http://www.yahoo.com/search/ie.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
    O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: AutomatedSurfer (SurferService) - Unknown owner - C:\WINDOWS\system32\srvany.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 16030 bytes
  • TroganTrogan London, UK
    edited July 2008
    Hi,

    Please do the following...

    1. Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.
    @echo off
    sc stop "SurferService"
    sc delete "SurferService"
    exit
    Double click FixServices.bat. A window will open and close. This is normal.

    2. Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)

    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

    O4 - HKLM\..\Run: [NI.UWFX5] "C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe"
    O4 - HKLM\..\Run: [SurfNavigator] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKLM\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe
    O4 - HKCU\..\Run: [AutomatedSurfer] C:\WINDOWS\system32\SurferClient.exe

    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZNfox000

    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

    - Close ALL open windows (especially Internet Explorer!)
    - Click Fix Checked
    Close HiajckThis

    3. Open Notepad and copy/paste the text in the Quote Box below into it:
    File::
    C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe
    C:\WINDOWS\system32\SurferClient.exe
    c:\docume~1\albert\applic~1\axisli~1\ford save rule.exe

    Save this as CFScript.txt to your Desktop

    CFScript.gif

    Referring to the picture above, drag CFScript.txt into ComboFix.exe

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

    4. Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases

        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer

        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save Report As button:
        • Change Save as type: to Text file
        • Save this as Kaspersky scan to your Desktop
        [*]Post the Kaspersky report in your next reply.


        5. Please post the following...

        ComboFix log
        Kaspersky report
        New HijackThis log

        Also, do you know what this is?
        C:\Program Files\¼Ò¸®¹Ù´Ù

        You know what SpyEx is? Did you install it?
      • wongger
        edited July 2008
        Thank you for your help Very much appreciated :D

        Ok well, im not sure what C:\Program Files\¼Ò¸®¹Ù´Ù is, and I dont know what spyex is. . . . should i install it?


        Ok so the programs where deleted through hijackthis and the combo fix scan went well here is the logs you need.

         ComboFix 08-07-29.1 - SPENCER 2008-07-31 19:06:09.2 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.169 [GMT -4:00]
        Running from: C:\Documents and Settings\SPENCER\Desktop\ComboFix.exe
        Command switches used :: C:\Documents and Settings\SPENCER\Desktop\CFScript.txt
        * Created a new restore point

        FILE ::
        c:\docume~1\albert\applic~1\axisli~1\ford save rule.exe
        C:\Documents and Settings\SPENCER\Local Settings\Temporary Internet Files\Content.IE5\UFJI6IFA\WinFixer2005ScannerInstall[1].exe
        C:\WINDOWS\system32\SurferClient.exe
        .

        ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\WINDOWS\system32\SurferClient.exe

        .
        ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
        .

        2008-07-29 19:28 . 2008-06-10 02:32 73,728 --a
        C:\WINDOWS\system32\javacpl.cpl
        2008-07-29 19:18 . 2008-07-29 19:18 <DIR> d
        C:\Program Files\Common Files\Java
        2008-07-29 18:44 . 2008-07-29 18:48 <DIR> d
        C:\Documents and Settings\SPENCER\.SunDownloadManager
        2008-07-28 20:57 . 2008-07-31 18:51 54,156 --ah
        C:\WINDOWS\QTFont.qfn
        2008-07-28 20:57 . 2008-07-28 20:57 1,409 --a
        C:\WINDOWS\QTFont.for
        2008-07-26 19:23 . 2008-07-26 19:23 10 --a
        C:\WINDOWS\WININIT.INI
        2008-07-26 19:04 . 2008-07-27 18:53 <DIR> d
        C:\fixwareout
        2008-07-25 18:50 . 2008-07-25 18:50 <DIR> d
        C:\Program Files\Trend Micro
        2008-07-24 12:04 . 2008-07-24 12:04 <DIR> d
        C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
        2008-07-09 09:19 . 2008-07-09 09:19 <DIR> d
        C:\Program Files\Lavasoft
        2008-07-09 09:19 . 2008-07-24 12:04 <DIR> d
        C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-06-23 13:53 . 2008-06-23 13:53 <DIR> d
        C:\Documents and Settings\All Users\Application Data\Azureus
        2008-06-23 13:52 . 2008-06-23 13:52 <DIR> d
        C:\Program Files\AskSBar
        2008-06-23 13:50 . 2008-06-23 13:51 <DIR> d
        C:\Program Files\Vuze
        2008-06-20 13:41 . 2008-06-20 13:41 245,248
        c--- C:\WINDOWS\system32\dllcache\mswsock.dll
        2008-06-20 06:44 . 2008-06-20 06:44 138,368
        c--- C:\WINDOWS\system32\dllcache\afd.sys
        2008-06-13 23:09 . 2008-06-13 23:09 <DIR> d
        C:\Program Files\Guitar Pro 5
        2008-06-13 22:11 . 2008-06-13 22:11 <DIR> d
        C:\Program Files\¼Ò¸®¹Ù´Ù
        2008-06-01 22:58 . 2008-06-01 22:58 <DIR> d
        C:\Program Files\iPod
        2008-06-01 22:57 . 2008-06-01 22:58 <DIR> d
        C:\Program Files\iTunes
        2008-06-01 22:55 . 2008-06-01 22:55 <DIR> d
        C:\Program Files\Bonjour
        2008-06-01 22:53 . 2008-06-01 22:54 <DIR> d
        C:\Program Files\QuickTime

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-07-31 23:11
        d
        w C:\Program Files\Common Files\Symantec Shared
        2008-07-31 13:48
        d
        w C:\Program Files\Warcraft III
        2008-07-31 04:04
        d
        w C:\Documents and Settings\SPENCER\Application Data\LimeWire
        2008-07-30 02:31
        d
        w C:\Documents and Settings\All Users\Application Data\DVD Shrink
        2008-07-29 23:28
        d
        w C:\Program Files\Java
        2008-07-29 23:02
        d
        w C:\Program Files\eBay
        2008-07-29 23:01
        d--h--w C:\Program Files\InstallShield Installation Information
        2008-07-29 22:58
        d
        w C:\Documents and Settings\SPENCER\Application Data\Atari
        2008-07-29 22:30
        d
        w C:\Documents and Settings\All Users\Application Data\WholeSecurity
        2008-07-26 23:38
        d
        w C:\Program Files\WorldPokerTour
        2008-07-26 23:37
        d
        w C:\Program Files\PokerStars.NET
        2008-07-26 23:37
        d
        w C:\Program Files\DVDneXtCOPY
        2008-07-26 23:23
        d
        w C:\Program Files\ATI Technologies
        2008-07-26 04:39 35,488 ----a-w C:\Documents and Settings\SPENCER\Application Data\wklnhst.dat
        2008-07-25 13:48
        d
        w C:\Documents and Settings\MOE\Application Data\FaxCtr
        2008-07-25 13:45 4,556 ----a-w C:\Documents and Settings\MOE\Application Data\wklnhst.dat
        2008-07-24 15:58
        d
        w C:\Program Files\Spybot - Search & Destroy
        2008-07-24 15:58
        d
        w C:\Program Files\Silkroad
        2008-07-24 15:58
        d
        w C:\Program Files\Samsung
        2008-07-24 15:58
        d
        w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-07-24 15:56
        d
        w C:\Program Files\Steam
        2008-07-22 05:09
        d
        w C:\Program Files\Full Tilt Poker
        2008-07-09 13:19
        d
        w C:\Program Files\Common Files\Wise Installation Wizard
        2008-07-09 13:15
        d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-21 23:10
        d
        w C:\Documents and Settings\SPENCER\Application Data\uTorrent
        2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
        2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
        2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
        2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
        2008-06-10 01:25
        d
        w C:\Program Files\StepMania
        2008-06-08 17:14
        d
        w C:\Program Files\Diablo II
        2008-06-07 02:48
        d
        w C:\Program Files\Starcraft
        2008-06-01 17:10
        d
        w C:\Program Files\Common Files\Adobe
        2008-05-31 21:30
        d
        w C:\Documents and Settings\SPENCER\Application Data\AdobeUM
        2008-05-29 01:37
        d
        w C:\Program Files\PartyGaming
        2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
        2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
        2007-11-30 02:33 64,712 ----a-w C:\Documents and Settings\SPENCER\Application Data\GDIPFONTCACHEV1.DAT
        2006-10-28 21:26 60,400 ----a-w C:\Documents and Settings\MOE\Application Data\GDIPFONTCACHEV1.DAT
        2005-10-09 16:39 5,920 ----a-w C:\Documents and Settings\All Users\Application Data\ypinfo.bin
        2004-04-15 20:48 9,912,734 ----a-w C:\Documents and Settings\SIMON\14664-pdf.zip
        . 
        <pre>
----a-w         2,245,048 2005-11-10 15:45:06  C:\Documents and Settings\ALBERT\My Documents\My Received Files\andypoggrams\Andy's programs\dvdSanta 4.00 - Create Your Own DVD Movies! Setup .exe
</pre>


        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
        "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 10:16 171464]
        "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [N/A]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04 139264]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-06-03 16:32 352256]
        "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-05-16 17:34 448040]
        "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
        "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-11-06 04:27 200704]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 09:08 57344]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
        "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 22:32 208952]
        "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 01:08 49152]
        "Fbmxb"="C:\Program Files\Lywck\Vtnymt.exe" [N/A]
        "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-12 11:30 53408]
        "BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [N/A]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
        "PD0630 STISvc"="P0630Pin.dll" [2005-06-05 13:01 36864 C:\WINDOWS\system32\P0630Pin.dll]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
        "DJSNetCN"="C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe" [2006-02-02 18:54 54976]

        C:\Documents and Settings\ALBERT\Start Menu\Programs\Startup\
        LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 17:32:57 147456]

        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
        HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 01:28:44 282624]
        InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-09-19 16:48:11 98304]
        Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "VIDC.MJPG"= jl_mjpg2.drv
        "MSACM.MI-SC4"= MI-SC4.acm

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestPopUpKiller]
        C:\Program Files\BestPopUpKiller\BestPopupKiller.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
        C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEx]
        C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
        --a
        2008-03-27 21:52 1271032 c:\Program Files\Steam\steam.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
        --a
        2005-09-12 15:21 40960 C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\WINDOWS\\system32\\LEXPPS.EXE"=
        "C:\\Program Files\\WinMX\\WinMX.exe"=
        "C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Starcraft\\StarCraft.exe"=
        "C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
        "C:\\Program Files\\Warcraft III\\war3.exe"=
        "C:\\WINDOWS\\system32\\rtcshare.exe"=
        "C:\\Program Files\\NetMeeting\\conf.exe"=
        "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike\\hl.exe"=
        "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike source\\hl2.exe"=
        "C:\\Program Files\\LimeWire\\LimeWire.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\WINDOWS\\system32\\dpvsetup.exe"=
        "C:\\Program Files\\uTorrent\\utorrent.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "C:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
        "C:\\Program Files\\Valve\\Steam\\Steam.exe"=
        "C:\\Program Files\\Steam\\Steam.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "3333:TCP"= 3333:TCP:softmod

        R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-12-10 21:30]
        R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
        R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 13:53]
        S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys [2004-06-04 13:21]
        S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
        S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-05 21:44]
        S3 Revolution1;Revolution1;C:\Documents and Settings\SPENCER\Desktop\Revolution Engine 6.2\SHAK3.sys []
        S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4;C:\Program Files\Ufasoft\IcqSnif\usft_sn4.sys []
        .
        Contents of the 'Scheduled Tasks' folder

        2008-07-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

        2008-07-31 C:\WINDOWS\Tasks\B3A68A4296893EC2.job
        - c:\docume~1\albert\applic~1\axisli~1\ford save rule.exe []

        2008-07-31 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

        2008-07-26 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - ALBERT.job
        - C:\PROGRA~1\Yahoo!\NAV\Navw32.exe [2006-04-14 00:48]
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-07-31 19:11:43
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-07-31 19:22:25
        ComboFix-quarantined-files.txt 2008-07-31 23:22:15
        ComboFix2.txt 2008-07-30 22:46:15

        Pre-Run: 9,284,157,440 bytes free
        Post-Run: 9,342,795,776 bytes free

        205 --- E O F --- 2008-07-25 07:03:56


        The rest to follow.
      • wongger
        edited August 2008
        Here is kaspersky log:
        KASPERSKY ONLINE SCANNER 7 REPORT
        Friday, August 1, 2008
        Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
        Kaspersky Online Scanner 7 version: 7.0.25.0
        Program database last update: Friday, August 01, 2008 06:01:12
        Records in database: 1038388

        Scan settings:
        Scan using the following database: extended
        Scan archives: yes
        Scan mail databases: yes

        Scan area - My Computer:
        A:\
        C:\
        D:\
        E:\
        F:\
        G:\

        Scan statistics:
        Files scanned: 105488
        Threat name: 19
        Infected objects: 53
        Suspicious objects: 0
        Duration of the scan: 03:54:32


        File name / Threat name / Threats count
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\018235E6.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\04FD7372.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\062A2383.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\07AB3D0A.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\17D056BC.exe Infected: P2P-Worm.Win32.VB.dw 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\199E401B.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1A15705C.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1AB24FAF.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1B7626D8.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1BB76E90.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1C75198D.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\21FC1A19.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\225B68BC.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\225E01A9.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\314869C4.exe Infected: P2P-Worm.Win32.VB.dw 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\319E7F32.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34351AD7.TMP Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36D017AF.exe Infected: Backdoor.Win32.Kbot.s 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C127B35.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3E407E09.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\48690BEA.wma Infected: Trojan-Downloader.WMA.Wimad.l 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A085FF8.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A5A13DC.exe Infected: not-a-virus:AdWare.Win32.2Search.i 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B3373F7.exe Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B7F5AF1.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4DB73B28.tmp Infected: Backdoor.Win32.Agent.ckj 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4DFF619A.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4E4B4186.exe Infected: not-a-virus:AdWare.Win32.2Search.h 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4E4B4186.exe Infected: not-a-virus:AdWare.Win32.2Search.i 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\513464EF.TMP Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\535C53B2.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\558A0020.TMP Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\59DF1289.TMP Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64117DE4.TMP Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C8934D0.wma Infected: Trojan-Downloader.WMA.GetCodec.b 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C995616.exe Infected: not-a-virus:AdWare.Win32.TrafficSol.o 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C995616.exe Infected: not-a-virus:AdWare.Win32.BHO.adj 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6C995616.exe Infected: not-a-virus:AdWare.Win32.BHO.ww 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6E0412BA.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6E3E7E9B.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75570E0B.wma Infected: Trojan-Downloader.WMA.Wimad.d 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\75AB10CA.exe Infected: Backdoor.Win32.Small.emf 1
        C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\79572D55.tmp Infected: Virus.Win32.Hidrag.a 1
        C:\Documents and Settings\SIMON\Shared\07 Track 7.wma Infected: Trojan-Downloader.WMA.Wimad.l 1
        C:\My Downloads\downloadedprograms\downloaded programs\BSINSTALL.exe Infected: not-a-virus:AdTool.Win32.WhenU.a 1
        C:\Program Files\Ares\My Shared Folder\Young Jeezy ft. R. kelly - Go Getta.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
        C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch.i 1
        C:\Program Files\MSN\msgthemes_valentine.exe Infected: not-a-virus:AdWare.Win32.180Solutions.am 1
        C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
        C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au 1
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1
        C:\QooBox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch 1

        The selected area was scanned.

        And here is Hijack This log:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 10:06:15 AM, on 8/1/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16674)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
        C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\system32\LEXBCES.EXE
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
        C:\Program Files\Yahoo!\NAV\navapsvc.exe
        C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Viewpoint\Common\ViewpointService.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
        C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
        C:\Program Files\Yahoo!\NAV\NAVW32.EXE
        C:\Program Files\Windows Live\Messenger\usnsvc.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\RunDLL32.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
        C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/ca//c
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
        O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O2 - BHO: IYBookmarkHO Class - {8B11A219-80C8-4B42-B558-B8C14D1AA8C4} - C:\Program Files\Yahoo!\browser\ybmho.dll (file missing)
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Yahoo!\NAV\NavShExt.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
        O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (file missing)
        O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (file missing)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
        O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
        O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
        O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
        O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
        O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe"
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [Fbmxb] C:\Program Files\Lywck\Vtnymt.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
        O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
        O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
        O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
        O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab30149.cab
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
        O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093383440836
        O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
        O16 - DPF: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} (FB_OCX Control) - http://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Yahoo!\NPF\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\navapsvc.exe
        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
        O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Yahoo!\NAV\SAVScan.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
        O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

        --
        End of file - 14953 bytes
      • TroganTrogan London, UK
        edited August 2008
        Hi,
        Ok well, im not sure what C:\Program Files\¼Ò¸®¹Ù´Ù is, and I dont know what spyex is. . . . should i install it?
        In that case we will remove them.

        Please do the following...

        1. Find and delete the following in RED:

        C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe
        C:\Program Files\¼Ò¸®¹Ù´Ù

        2. Please Download NoLop to your desktop from one of the links below...
        Link 1
        Link 2
        Link 3
        • First close any other programs you have running as this will require a reboot
        • Double click NoLop.exe to run it
        • Now click the button labelled "Search and Destroy"
          <<your computer will now be scanned for infected files>>
        • When scanning is finished you will be prompted to reboot only if infected, Click OK
        • Now click the "REBOOT" Button.
        • A Message should popup from NoLop. If not, double click the program again and it will finish. Please Post the contents of C:\NoLop.log
        --If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program.-
      • wongger
        edited August 2008
        Ok deleted the one folder, I couldn't find the srohack.exe one so I just left it

        The nolop log is :

        NoLop! Log by Skate_Punk_21

        Fix running from: C:\Documents and Settings\SPENCER\Desktop
        [8/1/2008]
        [4:56:23 PM]

        ---Infection Files Found/Removed---
        C:\WINDOWS\tasks\B3A68A4296893EC2.job

        Beginning Removal...
        Rebooting...
        Removing Lop's Leftover Files/Folders...
        Editing Registry...
        **Fix Complete!**

        ---Listing AppData sub directories---

        C:\Documents and Settings\Administrator.wongs\Application Data\Identities
        C:\Documents and Settings\Administrator.wongs\Application Data\Microsoft
        C:\Documents and Settings\All Users\Application Data\Adobe
        C:\Documents and Settings\All Users\Application Data\Ahead
        C:\Documents and Settings\All Users\Application Data\Amoksendmfcdsurf
        C:\Documents and Settings\All Users\Application Data\Apple
        C:\Documents and Settings\All Users\Application Data\Apple Computer
        C:\Documents and Settings\All Users\Application Data\Azureus
        C:\Documents and Settings\All Users\Application Data\Bigfishgamescache
        C:\Documents and Settings\All Users\Application Data\Dvd Shrink
        C:\Documents and Settings\All Users\Application Data\Ebay
        C:\Documents and Settings\All Users\Application Data\Faxctr
        C:\Documents and Settings\All Users\Application Data\Hp
        C:\Documents and Settings\All Users\Application Data\Ijjigame
        C:\Documents and Settings\All Users\Application Data\Lavasoft
        C:\Documents and Settings\All Users\Application Data\Mcafee.com
        C:\Documents and Settings\All Users\Application Data\Messenger Plus!
        C:\Documents and Settings\All Users\Application Data\Microsoft
        C:\Documents and Settings\All Users\Application Data\Msn6
        C:\Documents and Settings\All Users\Application Data\Musicnotes
        C:\Documents and Settings\All Users\Application Data\Nero
        C:\Documents and Settings\All Users\Application Data\Quicktime
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        C:\Documents and Settings\All Users\Application Data\Symantec
        C:\Documents and Settings\All Users\Application Data\Techsmith
        C:\Documents and Settings\All Users\Application Data\Temp -- EMPTY Directory
        C:\Documents and Settings\All Users\Application Data\Trymedia
        C:\Documents and Settings\All Users\Application Data\Viewpoint
        C:\Documents and Settings\All Users\Application Data\Wholesecurity
        C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
        C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar
        C:\Documents and Settings\All Users\Application Data\Wlinstaller
        C:\Documents and Settings\All Users\Application Data\Yahoo!
        C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
        C:\Documents and Settings\Default User\Application Data\Identities
        C:\Documents and Settings\Default User\Application Data\Microsoft
        C:\Documents and Settings\Localservice\Application Data\Ahead
        C:\Documents and Settings\Localservice\Application Data\Faxctr
        C:\Documents and Settings\Localservice\Application Data\Help
        C:\Documents and Settings\Localservice\Application Data\Macromedia
        C:\Documents and Settings\Localservice\Application Data\Microsoft
        C:\Documents and Settings\Moe\Application Data\Adobe
        C:\Documents and Settings\Moe\Application Data\Adobeum -- EMPTY Directory
        C:\Documents and Settings\Moe\Application Data\Ahead
        C:\Documents and Settings\Moe\Application Data\Aim -- EMPTY Directory
        C:\Documents and Settings\Moe\Application Data\Apple Computer
        C:\Documents and Settings\Moe\Application Data\Arcsoft
        C:\Documents and Settings\Moe\Application Data\Divx
        C:\Documents and Settings\Moe\Application Data\Ebay
        C:\Documents and Settings\Moe\Application Data\Faxctr
        C:\Documents and Settings\Moe\Application Data\Help -- EMPTY Directory
        C:\Documents and Settings\Moe\Application Data\Identities
        C:\Documents and Settings\Moe\Application Data\Intervideo
        C:\Documents and Settings\Moe\Application Data\Leadertech
        C:\Documents and Settings\Moe\Application Data\Macromedia
        C:\Documents and Settings\Moe\Application Data\Media Player Classic
        C:\Documents and Settings\Moe\Application Data\Microsoft
        C:\Documents and Settings\Moe\Application Data\Mozilla
        C:\Documents and Settings\Moe\Application Data\Msn6 -- EMPTY Directory
        C:\Documents and Settings\Moe\Application Data\Raptisoft
        C:\Documents and Settings\Moe\Application Data\Real
        C:\Documents and Settings\Moe\Application Data\Slysoft
        C:\Documents and Settings\Moe\Application Data\Snapfish
        C:\Documents and Settings\Moe\Application Data\Sonic
        C:\Documents and Settings\Moe\Application Data\Sun
        C:\Documents and Settings\Moe\Application Data\Wholesecurity
        C:\Documents and Settings\Moe\Application Data\Yahoo!
        C:\Documents and Settings\Networkservice\Application Data\Azureus
        C:\Documents and Settings\Networkservice\Application Data\Microsoft
        C:\Documents and Settings\Spencer\Application Data\Adobe
        C:\Documents and Settings\Spencer\Application Data\Adobeum
        C:\Documents and Settings\Spencer\Application Data\Ahead
        C:\Documents and Settings\Spencer\Application Data\Aim
        C:\Documents and Settings\Spencer\Application Data\Apple Computer
        C:\Documents and Settings\Spencer\Application Data\Arcsoft
        C:\Documents and Settings\Spencer\Application Data\Atari
        C:\Documents and Settings\Spencer\Application Data\Azureus
        C:\Documents and Settings\Spencer\Application Data\Creative
        C:\Documents and Settings\Spencer\Application Data\Divx
        C:\Documents and Settings\Spencer\Application Data\Ebay
        C:\Documents and Settings\Spencer\Application Data\Faxctr
        C:\Documents and Settings\Spencer\Application Data\Google
        C:\Documents and Settings\Spencer\Application Data\Help -- EMPTY Directory
        C:\Documents and Settings\Spencer\Application Data\Hp
        C:\Documents and Settings\Spencer\Application Data\Identities
        C:\Documents and Settings\Spencer\Application Data\Ijjigame
        C:\Documents and Settings\Spencer\Application Data\Intervideo
        C:\Documents and Settings\Spencer\Application Data\Lavasoft -- EMPTY Directory
        C:\Documents and Settings\Spencer\Application Data\Leadertech
        C:\Documents and Settings\Spencer\Application Data\Limewire
        C:\Documents and Settings\Spencer\Application Data\Macromedia
        C:\Documents and Settings\Spencer\Application Data\Media Player Classic
        C:\Documents and Settings\Spencer\Application Data\Microsoft
        C:\Documents and Settings\Spencer\Application Data\Moyea
        C:\Documents and Settings\Spencer\Application Data\Mozilla
        C:\Documents and Settings\Spencer\Application Data\Npluto Corporation
        C:\Documents and Settings\Spencer\Application Data\Raptisoft
        C:\Documents and Settings\Spencer\Application Data\Real
        C:\Documents and Settings\Spencer\Application Data\Slysoft
        C:\Documents and Settings\Spencer\Application Data\Sonic
        C:\Documents and Settings\Spencer\Application Data\Sun
        C:\Documents and Settings\Spencer\Application Data\U3
        C:\Documents and Settings\Spencer\Application Data\Ufasoft
        C:\Documents and Settings\Spencer\Application Data\Utorrent
        C:\Documents and Settings\Spencer\Application Data\Wholesecurity
        C:\Documents and Settings\Spencer\Application Data\Yahoo!
      • wongger
        edited August 2008
        Oh ya by the way all those infected files found on kaspersky are we going to deleted them? or are they alright?
      • TroganTrogan London, UK
        edited August 2008
        The files found by Kaspersky are in Norton Quarantine. They can be removed by following the instructions here.


        Can you run ComboFix one more time and post the new log back here. Also, let me know how the computer is running.
      • wongger
        edited August 2008
        Ok I deleted them :D lol. My computer still seems slow when im playing an online game I keep getting lag, when I never used to so i dunno maybe i need to defrag? or deleted some junk.

        Here is the combo fix log:

        ComboFix 08-07-29.1 - SPENCER 2008-08-02 18:35:44.3 - NTFSx86
        Running from: C:\Documents and Settings\SPENCER\Desktop\ComboFix.exe
        .

        ((((((((((((((((((((((((( Files Created from 2008-07-02 to 2008-08-02 )))))))))))))))))))))))))))))))
        .

        2008-08-01 17:00 . 2008-08-01 17:03 <DIR> d
        C:\NoLopBackups
        2008-07-29 19:28 . 2008-06-10 02:32 73,728 --a
        C:\WINDOWS\system32\javacpl.cpl
        2008-07-29 19:18 . 2008-07-29 19:18 <DIR> d
        C:\Program Files\Common Files\Java
        2008-07-29 18:44 . 2008-07-29 18:48 <DIR> d
        C:\Documents and Settings\SPENCER\.SunDownloadManager
        2008-07-28 20:57 . 2008-08-02 18:29 54,156 --ah
        C:\WINDOWS\QTFont.qfn
        2008-07-28 20:57 . 2008-07-28 20:57 1,409 --a
        C:\WINDOWS\QTFont.for
        2008-07-26 19:23 . 2008-07-26 19:23 10 --a
        C:\WINDOWS\WININIT.INI
        2008-07-26 19:04 . 2008-07-27 18:53 <DIR> d
        C:\fixwareout
        2008-07-25 18:50 . 2008-07-25 18:50 <DIR> d
        C:\Program Files\Trend Micro
        2008-07-24 12:04 . 2008-07-24 12:04 <DIR> d
        C:\WINDOWS\DED53B0BB67C4244AE6AD6FD3C28D1EF.TMP
        2008-07-09 09:19 . 2008-07-09 09:19 <DIR> d
        C:\Program Files\Lavasoft
        2008-07-09 09:19 . 2008-07-24 12:04 <DIR> d
        C:\Documents and Settings\All Users\Application Data\Lavasoft

        .
        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-08-02 22:34
        d
        w C:\Program Files\Common Files\Symantec Shared
        2008-08-01 23:50
        d
        w C:\Program Files\Warcraft III
        2008-08-01 16:37
        d
        w C:\Documents and Settings\SPENCER\Application Data\LimeWire
        2008-07-30 02:31
        d
        w C:\Documents and Settings\All Users\Application Data\DVD Shrink
        2008-07-29 23:28
        d
        w C:\Program Files\Java
        2008-07-29 23:02
        d
        w C:\Program Files\eBay
        2008-07-29 23:01
        d--h--w C:\Program Files\InstallShield Installation Information
        2008-07-29 22:58
        d
        w C:\Documents and Settings\SPENCER\Application Data\Atari
        2008-07-29 22:30
        d
        w C:\Documents and Settings\All Users\Application Data\WholeSecurity
        2008-07-26 23:38
        d
        w C:\Program Files\WorldPokerTour
        2008-07-26 23:37
        d
        w C:\Program Files\PokerStars.NET
        2008-07-26 23:37
        d
        w C:\Program Files\DVDneXtCOPY
        2008-07-26 23:23
        d
        w C:\Program Files\ATI Technologies
        2008-07-26 04:39 35,488 ----a-w C:\Documents and Settings\SPENCER\Application Data\wklnhst.dat
        2008-07-25 13:48
        d
        w C:\Documents and Settings\MOE\Application Data\FaxCtr
        2008-07-25 13:45 4,556 ----a-w C:\Documents and Settings\MOE\Application Data\wklnhst.dat
        2008-07-24 15:58
        d
        w C:\Program Files\Spybot - Search & Destroy
        2008-07-24 15:58
        d
        w C:\Program Files\Silkroad
        2008-07-24 15:58
        d
        w C:\Program Files\Samsung
        2008-07-24 15:58
        d
        w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-07-24 15:56
        d
        w C:\Program Files\Steam
        2008-07-22 05:09
        d
        w C:\Program Files\Full Tilt Poker
        2008-07-09 13:19
        d
        w C:\Program Files\Common Files\Wise Installation Wizard
        2008-07-09 13:15
        d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-23 17:53
        d
        w C:\Documents and Settings\All Users\Application Data\Azureus
        2008-06-23 17:52
        d
        w C:\Program Files\AskSBar
        2008-06-23 17:51
        d
        w C:\Program Files\Vuze
        2008-06-21 23:10
        d
        w C:\Documents and Settings\SPENCER\Application Data\uTorrent
        2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
        2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
        2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
        2008-06-14 03:09
        d
        w C:\Program Files\Guitar Pro 5
        2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
        2008-06-10 01:25
        d
        w C:\Program Files\StepMania
        2008-06-08 17:14
        d
        w C:\Program Files\Diablo II
        2008-06-07 02:48
        d
        w C:\Program Files\Starcraft
        2008-06-02 02:58
        d
        w C:\Program Files\iTunes
        2008-06-02 02:58
        d
        w C:\Program Files\iPod
        2008-06-02 02:55
        d
        w C:\Program Files\Bonjour
        2008-06-02 02:54
        d
        w C:\Program Files\QuickTime
        2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
        2007-11-30 02:33 64,712 ----a-w C:\Documents and Settings\SPENCER\Application Data\GDIPFONTCACHEV1.DAT
        2006-10-28 21:26 60,400 ----a-w C:\Documents and Settings\MOE\Application Data\GDIPFONTCACHEV1.DAT
        2005-10-09 16:39 5,920 ----a-w C:\Documents and Settings\All Users\Application Data\ypinfo.bin
        2004-04-15 20:48 9,912,734 ----a-w C:\Documents and Settings\SIMON\14664-pdf.zip
        . 
        <pre>
----a-w         2,245,048 2005-11-10 15:45:06  C:\Documents and Settings\ALBERT\My Documents\My Received Files\andypoggrams\Andy's programs\dvdSanta 4.00 - Create Your Own DVD Movies! Setup .exe
</pre>


        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
        "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 10:16 171464]
        "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [N/A]
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04 139264]
        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-06-03 16:32 352256]
        "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-05-16 17:34 448040]
        "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
        "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-11-06 04:27 200704]
        "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
        "Lexmark 2200 Series"="C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe" [2004-02-13 09:08 57344]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
        "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 22:32 208952]
        "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 01:08 49152]
        "Fbmxb"="C:\Program Files\Lywck\Vtnymt.exe" [N/A]
        "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-04-12 11:30 53408]
        "BearFlix"="C:\Program Files\BearFlix\BearFlix.exe" [N/A]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
        "PD0630 STISvc"="P0630Pin.dll" [2005-06-05 13:01 36864 C:\WINDOWS\system32\P0630Pin.dll]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
        "DJSNetCN"="C:\Program Files\Common Files\Symantec Shared\DJSNETCN.exe" [2006-02-02 18:54 54976]

        C:\Documents and Settings\ALBERT\Start Menu\Programs\Startup\
        LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2008-02-08 17:32:57 147456]

        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
        HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 01:28:44 282624]
        InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2004-09-19 16:48:11 98304]
        Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "VIDC.MJPG"= jl_mjpg2.drv
        "MSACM.MI-SC4"= MI-SC4.acm

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BestPopUpKiller]
        C:\Program Files\BestPopUpKiller\BestPopupKiller.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eBayToolbar]
        C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEx]
        C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe [N/A]

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
        --a
        2008-03-27 21:52 1271032 c:\Program Files\Steam\steam.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YeppStudioAgent]
        --a
        2005-09-12 15:21 40960 C:\Program Files\Samsung\Samsung Media Studio\SamsungMediaStudioAgent.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001
        "AntiVirusOverride"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\WINDOWS\\system32\\LEXPPS.EXE"=
        "C:\\Program Files\\WinMX\\WinMX.exe"=
        "C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Starcraft\\StarCraft.exe"=
        "C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
        "C:\\Program Files\\Warcraft III\\war3.exe"=
        "C:\\WINDOWS\\system32\\rtcshare.exe"=
        "C:\\Program Files\\NetMeeting\\conf.exe"=
        "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike\\hl.exe"=
        "C:\\Program Files\\Steam\\SteamApps\\spwncer\\counter-strike source\\hl2.exe"=
        "C:\\Program Files\\LimeWire\\LimeWire.exe"=
        "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
        "C:\\WINDOWS\\system32\\dpvsetup.exe"=
        "C:\\Program Files\\uTorrent\\utorrent.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "C:\\Program Files\\Full Tilt Poker\\FullTiltPoker.exe"=
        "C:\\Program Files\\Valve\\Steam\\Steam.exe"=
        "C:\\Program Files\\Steam\\Steam.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "3333:TCP"= 3333:TCP:softmod

        R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-12-10 21:30]
        R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
        R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 13:53]
        S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys [2004-06-04 13:21]
        S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 17:10]
        S3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2005-06-05 21:44]
        S3 Revolution1;Revolution1;C:\Documents and Settings\SPENCER\Desktop\Revolution Engine 6.2\SHAK3.sys []
        S3 UfasoftSnifDriver4;Ufasoft Snif Driver v4;C:\Program Files\Ufasoft\IcqSnif\usft_sn4.sys []

        *Newly Created Service* - ERASERUTILDRV10741
        .
        Contents of the 'Scheduled Tasks' folder

        2008-07-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

        2008-08-02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]

        2008-08-02 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - ALBERT.job
        - C:\PROGRA~1\Yahoo!\NAV\Navw32.exe [2006-04-14 00:48]
        .
        .
        Supplementary Scan
        .
        R0 -: HKLM-Main,Start Page = hxxp://ca.yahoo.com
        R1 -: HKCU-Internet Settings,ProxyOverride = <local>;*.local
        O8 -: &AIM Search - C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
        O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 -: eBay Search - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
        O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
        O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
        O9 -: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe

        O16 -: RaptisoftGameLoader - hxxp://www.miniclip.com/hamsterball/raptisoftgameloader.cab
        C:\WINDOWS\Downloaded Program Files\OSD28E7.OSD
        C:\WINDOWS\Downloaded Program Files\RSGameLoader.dll

        O16 -: {8B95CDB4-7F5F-44FA-803E-1F31963D711F} - hxxp://download.soribada.com/down/Filebada/OCX/FB_OCX.CAB
        C:\WINDOWS\Downloaded Program Files\FB_OCX.inf


        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-08-02 18:41:35
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-08-02 18:48:41
        ComboFix-quarantined-files.txt 2008-08-02 22:47:54
        ComboFix2.txt 2008-07-31 23:22:27
        ComboFix3.txt 2008-07-30 22:46:15

        Pre-Run: 31,011,508,224 bytes free
        Post-Run: 31,049,580,544 bytes free

        205 --- E O F --- 2008-07-25 07:03:56
      • TroganTrogan London, UK
        edited August 2008
        Hi,
        Ok I deleted them :D lol. My computer still seems slow when im playing an online game I keep getting lag, when I never used to so i dunno maybe i need to defrag? or deleted some junk.
        The computer looks clean of malware, but lets do the last step and see how it goes.

        Please do the following...

        1. Run HijackThis and click on Open the Misc Tools section.
        Click on Delete a file on reboot...
        Copy and paste the following into the "File name:" text box and then click Open:

        C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe

        When you are asked "Do you want to restart your computer now?", click OK.

        Your PC MUST reboot to delete the file!

        2.
        Open Notepad!
        Copy and Paste everything from the Quote box into Notepad:
        REGEDIT4

        [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEx]

        Go to File > Save As
        Save File name as Fix.reg
        Change Save as Type to All Files and save the file to your desktop.

        Close Notepad, and double-click Fix.reg on your Desktop. When it asks if you want to merge the info to the registry, hit YES/OK

        3. Download OTMoveIt by OldTimer from here to your Desktop.
        • Run OTMoveIt
        • Click on CleanUp!
        • Press Yes to download the files needed
        • Once completed, press Yes to reboot the computer.
        Delete OTMoveIt from your Desktop.
      • wongger
        edited August 2008
        I tried to delete that srohack file but it said there was no such file. . . . but the other 2 steps went well

        thanks again for all your help :D
      • TroganTrogan London, UK
        edited August 2008
        Hi,
        • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

        • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
          C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe
        • Return to OTMoveIt2, right click in the "Paste Custom List Of Files/Patterns To Move" window (under the yellow bar) and choose Paste.
        • Click the red Moveit! button.

        • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
        • Close OTMoveIt2
        Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
      • wongger
        edited August 2008
        This is what it said,
        File/Folder C:\Documents and Settings\SPENCER\Desktop\New Folder (2)\srohack.exe not found.

        OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08042008_005120
      • TroganTrogan London, UK
        edited August 2008
        OK, that's fine.

        How is the computer running now?
      • wongger
        edited August 2008
        Its running alot better than it used to. One more question though can i delete the fixservices.bat file and the fix.reg?
      • TroganTrogan London, UK
        edited August 2008
        Yes, you can delete those files.

        Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
        (Vista users must ensure that any programs are Vista compatible BEFORE installing )

        You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
        1. CLEAR & RESET SYSTEM RESTORE'S CACHE - (System Volume Information folder)
          Go to Start > Run > type control sysdm.cpl,,4 & press Enter
          • Tick on the checkbox - Turn off System Restore on all drives
          • Click Apply
          Turn it back 'On' by unticking the same checkbox & click OK

        2. DISABLE THE VIEWING OF SYSTEM FILES
          From Windows Explorer, go to Tools > Folder Options> View tab.
          • Untick - Show hidden files and folder
          • Tick - Hide file extensions for known types
          • Tick - Hide protected operating system files
          Click Yes to confirm & then click OK

        3. SECURING INTERNET EXPLORER
          From within Internet Explorer click on the Tools menu and then click on Internet Options.
          • Select the Security tab
            • Click once on the Internet icon so it becomes highlighted.
            • Select Custom Level .
              • Change 'Download signed ActiveX controls' to Prompt
              • Change 'Download unsigned ActiveX controls' to Disable
              • Change 'Initialize and script ActiveX controls not marked as safe' to Disable
              • Change 'Installation of desktop items' to Prompt
              • Change 'Launching programs and files in an IFRAME' to Prompt
              • Change 'Navigate sub-frames across different domains' to Prompt
              • When all these changes have been made, click on the OK button.
            • If it prompts you as to whether or not you want to save the settings, press the Yes button.
          • Select OK to exit the Internet Properties page.

        4. ANTIVIRUS SOFTWARE
          It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

          See this link for a listing of some online & their stand-alone antivirus programs:

          Virus, Spyware, and Malware Protection and Removal Resources ? http://www.bleepingcomputer.com/forums/topict405.html

          It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

        5. FIREWALL
          Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here ? http://www.bleepingcomputer.com/forums/tutorial60.html

        6. Microsoft Windows Update - http://www.windowsupdate.com
          Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

        7. SPYBOT - SEARCH & DESTROY
          Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here ? http://www.bleepingcomputer.com/forums/tutorial43.html

        8. AD-AWARE
          Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here ? http://www.bleepingcomputer.com/forums/tutorial48.html

        9. SPYWAREBLASTER
          SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.

          Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here ? http://www.bleepingcomputer.com/forums/tutorial49.html

        10. IE-SPYAD
          IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm
        Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

        Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
        • http://www.trillian.cc - Trillian or http://www.miranda-im.com - Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
        • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
        • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
        • http://toolbar.google.com/ - Google Toolbar - Get the free google toolbar to help stop pop up windows.
        • http://cleanup.stevengould.org/ - CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
        • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

          ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

          NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

        • http://www.winpatrol.com/ -Winpatrol - Download and install the free version of Winpatrol.
          A tutorial for this product is located here: http://www.winpatrol.com/features.html
        To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

        After doing all these, your system will be optimised against future threats.

        It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.

        Please respond to this thread one more time so we can mark this thread as resolved.
      • wongger
        edited August 2008
        Ok, Thank you for all your help Trogan. You helped me out so much, wow THANKS !!!
      • wongger
        edited August 2008
        Actrually one more thing Trogan if you dont mind. Can you help me get rid or counterstrike and counterstrike source? I can't do it from add/remove programs it keeps asking me to login when ever I click on remove...... Then after that it just slows down my computer and nothing happens so I have to ctrl alt delete and close it.
      • TroganTrogan London, UK
        edited August 2008
        Have you tried uninstalling in Safe Mode? Not sure if this will work, but it's worth a try.

        To get into Safe Mode, do the following...
        • If the computer is running, shut down Windows, and then turn off the power.
        • Wait 30 seconds, and then turn the computer on.
        • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
        • Ensure that the Safe Mode option is selected.
        • Press Enter. The computer then begins to start in Safe mode.
        • Login on your usual account.

        • When done, restart the computer as normal to get back into Normal Mode.
      • wongger
        edited August 2008
        Still didnt work, its alright though ill figure it out.

        THanks again for all your help :D Your very helpful THANKS!
      Sign In or Register to comment.