New HijackThis logfile, what do i get rid of?

Comments

• Necropolis Hawarden, Wales Icrontian

  December 2005 edited December 2005

  Moved to SVT

  0
• SpywareShooter 127.0.0.1

  December 2005 edited December 2005

  [STEP 1] Fix HijackThis Entries:
  

  Fix the following entries with HijackThis by placing checkmarks in the boxes next to them and clicking "Fix Checked".

  
  O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp4F01.tmp
  
  [STEP 2] Remove Malicious Files:
  

  Locate the following files using Windows Explorer (the My Computer icon or shortcut) and delete them from your computer.

  
  C:\WINDOWS\system32\hp4F01.tmp
  
  [STEP 3]Report Back to us:
  

  Once you have followed all of the steps above please reboot your computer and post a new HijackThis log.

  0
• sonofgondor1219

  December 2005 edited December 2005

  i could not delete the hp4F01.temp file because it is being used by an program, this program is adware which i cant turn off, is there anything i could download that might work. i feel like this next logfile will be worse, because i think the adware spread.
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:21:14 PM, on 12/27/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\nvctrl.exe
  C:\WINDOWS\system32\mssearchnet.exe
  C:\WINDOWS\SYSTEM32\rundll32.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\michael valalik\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fe.assumption.edu/exchweb/bin/auth/owalogon.asp?url=https://fe.assumption.edu/exchange&reason=0
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O2 - BHO: (no name) - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp4F01.tmp
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (file missing)
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccess/ie/bridge-c8.cab
  O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} - http://adserver.sharewareonline.com/adserver/Install.cab
  O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://D:\components\hidinputmonitorx.ocx
  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info.apple.com/iTunes4/WW/win/019-0312.20050111.MmVrT/iTunesSetup.exe
  O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://D:\components\A9.ocx
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} (WMVHDRatingCtrl Class) - file://D:\components\wmvhdrating.ocx
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  0
• sonofgondor1219

  December 2005 edited December 2005

  ?

  0
• Trogan London, UK

  December 2005 edited December 2005

  Please read these instructions carefully and print them out! Be sure to follow ALL instructions!
  
  Download smitRem.zip and save the file to your desktop.
  Right click on the file and extract it to it's own folder on the desktop.
  
  Place a shortcut to Panda ActiveScan on your desktop.
  
  Please download the trial version of Ewido Security Suite here:
  http://www.ewido.net/en/download/
  
  Please read Ewido Setup Instructions
  Install it, and update the definitions to the newest files. Do NOT run a scan yet.
  
  If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
  Ad-Aware SE Setup
  Don't run it yet!
  
  Next, please reboot your computer in SafeMode by doing the following:

  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.

  Now scan with HJT and place a checkmark next to each of the following items and click 'Fix Checked':
  
  ===================================================
  O2 - BHO: (no name) - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp4F01.tmp
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (file missing)
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Me.../bridge-c8.cab
  O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540013} - http://adserver.sharewareonline.com/...er/Install.cab
  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.info...TunesSetup.exe
  ===================================================
  
  Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
  Wait for the tool to complete and disk cleanup to finish.
  
  The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
  
  
  Open Ad-aware and do a full scan. Remove all it finds.
  
  
  Run Ewido:

  • Click on scanner
  • Click Complete System Scan and the scan will begin.
  • During the scan it will prompt you to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop

  Close Ewido
  
  Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.
  
  Reboot back into Windows and click the Panda ActiveScan shortcut.
  
  - Once you are on the Panda site click the Scan your PC button
  - A new window will open...click the Check Now button
  - Enter your Country
  - Enter your State/Province
  - Enter your e-mail address and click send
  - Select either Home User or Company
  - Click the big Scan Now button
  - If it wants to install an ActiveX component allow it
  - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  - When download is complete, click on Local Disks to start the scan
  - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  
  Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
  
  Let us know if any problems persist.

  0
• sonofgondor1219

  December 2005 edited December 2005

  Incident Status Location
  
  Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\michael valalik\Application Data\Sskknwrd.dll
  Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\michael valalik\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-228d5c98-3a8328bf.zip[a.class]
  Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\michael valalik\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-228d5c98-3a8328bf.zip[Dummy.class]
  Virus:Exploit/ByteVerify Not disinfected C:\Documents and Settings\michael valalik\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\a.jar-228d5c98-3a8328bf.zip[VerifierBug.class]
  Adware:adware/bookedspace Not disinfected C:\WINDOWS\cfgmgr52.ini
  Adware:adware program Not disinfected C:\WINDOWS\system32\data.~
  Spyware:Spyware/SafeSurf Not disinfected C:\WINDOWS\system32\lanbruns.exe
  Adware:adware/upspiralbar Not disinfected C:\WINDOWS\unist2.exe
  
  Logfile of HijackThis v1.99.1
  Scan saved at 3:57:53 AM, on 12/31/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Microsoft Works\WksWP.exe
  C:\Program Files\Microsoft Works\MSWorks.exe
  C:\Program Files\Microsoft Works\wkgdcach.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\iTunes\iTunes.exe
  C:\Documents and Settings\michael valalik\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fe.assumption.edu/exchweb/bin/auth/owalogon.asp?url=https://fe.assumption.edu/exchange&reason=0
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://D:\components\hidinputmonitorx.ocx
  O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://D:\components\A9.ocx
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} (WMVHDRatingCtrl Class) - file://D:\components\wmvhdrating.ocx
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O18 - Filter: text/html - (no CLSID) - (no file)
  O18 - Filter: text/plain - (no CLSID) - (no file)
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  
  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: Fri 12/30/2005
  The current time is: 19:14:05.17
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 1932 'explorer.exe'
  
  Starting registry repairs
  
  Deleting files
  
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!
  
  
  
  

  ---

  ewido anti-malware - Scan report

  ---

  
  + Created on: 10:25:40 PM, 12/30/2005
  + Report-Checksum: F588E80B
  
  + Scan result:
  
  HKLM\SOFTWARE\SecureWin -> Spyware.Adlogix : Cleaned with backup
  :mozilla.27:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
  :mozilla.30:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
  :mozilla.31:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
  :mozilla.32:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
  :mozilla.36:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
  :mozilla.38:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
  :mozilla.39:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
  :mozilla.40:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
  :mozilla.43:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
  :mozilla.44:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
  :mozilla.45:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
  :mozilla.46:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
  :mozilla.51:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
  :mozilla.52:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
  :mozilla.53:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
  :mozilla.54:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
  :mozilla.58:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
  :mozilla.59:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
  :mozilla.61:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
  :mozilla.62:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
  :mozilla.63:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
  :mozilla.66:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
  :mozilla.67:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
  :mozilla.68:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
  :mozilla.70:C:\Documents and Settings\michael valalik\Application Data\Mozilla\Firefox\Profiles\68x5x3y0.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
  C:\Program Files\Aprps\ace.dll -> Trojan.Crypt.t : Cleaned with backup
  C:\Program Files\Aprps\CxtPls.dll -> Downloader.Apropo.ag : Cleaned with backup
  C:\Program Files\Aprps\CxtPls.exe -> Downloader.Apropo.ag : Cleaned with backup
  C:\Program Files\Aprps\libexpat.dll -> Trojan.Crypt.t : Cleaned with backup
  C:\Program Files\Aprps\ProxyStub.dll -> Trojan.Crypt.t : Cleaned with backup
  C:\Program Files\Aprps\uninstaller.exe -> Trojan.Crypt.t : Cleaned with backup
  C:\Program Files\Aprps\WinGenerics.dll -> Trojan.Crypt.t : Cleaned with backup
  C:\quarantine\A0022974.EXE.Vir -> Adware.BetterInternet : Error during cleaning
  C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0715NetInstaller.exe -> Not-A-Virus.Downloader.Agent.e : Cleaned with backup
  C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0802NetInstaller.exe -> Not-A-Virus.Downloader.Agent.c : Cleaned with backup
  C:\WINDOWS\system32\adupdater.exe -> Spyware.Adstart : Cleaned with backup
  C:\WINDOWS\system32\oemzud.exe -> Spyware.Adstart : Cleaned with backup
  C:\WINDOWS\system32\wirelanb.dll -> Spyware.SafeSurfing : Cleaned with backup
  
  
  ::Report End

  0
• Trogan London, UK

  December 2005 edited December 2005

  Please move HJT (The DYNAMITE Icon) from your Desktop to its own folder on your C: so backups can be created. Do this before continuing.
  --
  
  You may want to print these instructions or save them as you'll have no internet connection once in Safe Mode
  
  View hidden files and folders - explained here
  
  Go into Safe Mode - explained here
  --
  
  
  Check the following in HJT and click 'Fix Checked' - Close ALL open Browsers first
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fe.assumption.edu/exchweb/bi...hange&reason=0
  
  O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://D:\components\hidinputmonitorx.ocx
  O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://D:\components\A9.ocx
  O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} (WMVHDRatingCtrl Class) - file://D:\components\wmvhdrating.ocx
  
  O18 - Filter: text/html - (no CLSID) - (no file)
  O18 - Filter: text/plain - (no CLSID) - (no file)
  --
  
  
  Find and Delete the following if found:
  
  C:\Documents and Settings\michael valalik\Application Data\Sskknwrd.dll << this file
  C:\WINDOWS\system32\lanbruns.exe << this file
  C:\WINDOWS\unist2.exe << this file
  --
  
  
  Go to Start > Control Panel > Java
  
  Under Temporary Internet Files, click Delete Files...
  
  Make sure all THREE boxes are checked...click OK
  --
  
  
  Reboot into Normal Mode and post a new HJT log

  0
• sonofgondor1219

  December 2005 edited December 2005

  Logfile of HijackThis v1.99.1
  Scan saved at 6:13:30 PM, on 12/31/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\ewido anti-malware\ewidoguard.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  

  0
• Trogan London, UK

  December 2005 edited December 2005

  Your log is clean
  
  
  
  Now that your PC is clean you need to follow these easy steps to keeping it this way:
  
  Secure your Internet Explorer by going here and following the instructions there.
  
  Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.
  
  Use a firewall to help prevent your PC's control being usurped by undesireables.
  
  Install and keep updated, Ad-Aware SE, and Spybot S&D.
  Run them both on a regular basis, following the manufacturer's recommendations.
  
  Install and keep updated, SpywareBlaster 3.4
  
  Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.
  
  Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.
  
  
  Clear your Temp folders.
  Clear out your Temporary internet files and other temp files.
  Go to Start > Settings > Control Panel >Internet Options.
  Under the General tab click the Delete temporary internet files,
  delete all Offline content as well. Clear out Cookies.
  
  Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.
  
  Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)
  
  C:\Documents and Settings\username\Local Settings\Temp\
  
  In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.
  
  Empty the Recycle Bin.
  
  For XP users.
  After something like this it is a good idea to Flush the Restore Points and start fresh.
  To flush the XP system Restore Points.
  
  Go to Start>Run and type msconfig. Press enter.
  
  When msconfig opens, click the Launch System Restore Button.
  On the next page, click the System Restore Settings link on the left.
  
  Check the box labelled 'Turn off System restore'.
  
  Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.
  
  Note that all previous restore points will be lost.
  
  ===============
  
  If you have any more problems, post back.
  
  
  Please consider joining the Folding@Home Project
  Join our Folding@Home team! Alzheimer's, Parkinson's, cancer... we're trying to cure them with our computers! You've at least read a little about it in the greeting I sent you when you signed up for the site. We're always really pleased to greet new members to the team, and it's a quick way to become an appreciated member of the community.
  MORE INFO: READ THIS

  0
• sonofgondor1219

  March 2006 edited March 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 5:48:55 PM, on 3/27/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\iTunes\iTunes.exe
  C:\WINDOWS\SYSTEM32\rundll32.exe
  C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file)
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  0
• sonofgondor1219

  March 2006 edited March 2006

  im having a few more problems with adware on my comp, so i just thought id update this thread. thanks!!

  0
• Trogan London, UK

  March 2006 edited March 2006

  No problem!
  
  First, please move HJT to its OWN folder, like you did previously. Currently its here:
  
  C:\DOCUME~1\MICHAE~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
  
  
  Remove the following entry with HijackThis: Make sure to close ALL windows first.
  
  O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file)
  
  Now REBOOT!!!
  
  Apart from that, your log is clean.
  
  What kind of problems are you having?

  0
• sonofgondor1219

  March 2006 edited March 2006

  Logfile of HijackThis v1.99.1
  Scan saved at 11:20:10 PM, on 3/27/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\WINDOWS\SYSTEM32\rundll32.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\AIM\aim.exe
  C:\Documents and Settings\michael valalik\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  thats the new logfile, deleting the first item hasnt fixed anything, there is a VirusAlert in my quick launch tray. It keeps trying to get me to install antispyware, and click on its links. I dont know how to get rid of it. I ran ad-aware and ewido. ewido only seemed to delete my temp cookies. adaware wasnt especially useful either. thanks a bunch
  
  the latest scan ive done with Microsoft Antispyware Beta (the application my school network uses) im told i have a ZOLOB trojan downloader of severe level, it says its located somewhere in the registry keys of my comp, but i dont know how to remove it. the antispyware cannot uninstall it itself

  0
• Trogan London, UK

  March 2006 edited March 2006

  There are several variants of the problem and your log is not showing any signs. Can you tell me what you see so I know what fix to use.

  0
• sonofgondor1219

  March 2006 edited March 2006

  Spyware Scan Details
  Start Date: 3/28/2006 2:00:08 AM
  End Date: 3/28/2006 2:19:01 AM
  Total Time: 18 mins 53 secs
  
  Detected Threats
  
  Zolob Trojan Downloader more information...
  Status: Removed
  Severe threat - Severe-risk items have an extreme potential for harm, such as a security exploit, and should be removed.
  
  Infected registry keys/values detected
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wininet.dll
  
  
  Detected Spyware Cookies
  No spyware cookies were found during this scan.
  
  
  these were the results from my latest scan. But they have not gotten rid of the problem. Since my last post the program has installed other programs on my comp, but i have deleted them. does this help, is there anythig else youre looking for specifically?

  0
• Trogan London, UK

  March 2006 edited March 2006

  According to your post above, MS Anti-Spyware has removed the infected file. Like I said before, there are different variants of this infection and your HJT log isn't showing any. However, try the fix below (that you did previously) and see if its works
  
  
  Please read these instructions carefully and print them out! Be sure to follow ALL instructions!
  
  Download smitRem.zip and save the file to your desktop.
  Right click on the file and extract it to it's own folder on the desktop.
  
  Place a shortcut to Panda ActiveScan on your desktop.
  
  Please download the trial version of Ewido Security Suite here:
  http://www.ewido.net/en/download/
  
  Please read Ewido Setup Instructions
  Install it, and update the definitions to the newest files. Do NOT run a scan yet.
  
  If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
  Ad-Aware SE Setup
  Don't run it yet!
  
  Next, please reboot your computer in SafeMode by doing the following:

  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.

  
  ONCE IN SAFE MODE!!!
  
  Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
  Wait for the tool to complete and disk cleanup to finish.
  
  The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
  
  
  Open Ad-aware and do a full scan. Remove all it finds.
  
  
  Run Ewido:

  • Click on scanner
  • Click Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
  • When the scan is finished, click the Save report button at the bottom of the screen.
  • Save the report to your desktop

  Close Ewido
  
  
  Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present.
  
  Reboot back into Windows and click the Panda ActiveScan shortcut.
  
  - Once you are on the Panda site click the Scan your PC button
  - A new window will open...click the Check Now button
  - Enter your Country
  - Enter your State/Province
  - Enter your e-mail address and click send
  - Select either Home User or Company
  - Click the big Scan Now button
  - If it wants to install an ActiveX component allow it
  - It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  - When download is complete, click on Local Disks to start the scan
  - When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  
  Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.
  
  Let us know if any problems persist.

  0
• sonofgondor1219

  March 2006 edited March 2006

  the panda scan picked up 7 spyware files and 6 unwanted files, but for some reason it wouldnt let me save a logfile. when i asked for a file it told me it would take a minute, but i noticed there was an error on the bottom of the page. This program keeps trying to install VirusScanQuake on my computer, its crazy, here is everything else you were looking for.
  
  
  smitRem © log file
  version 2.8
  
  by noahdfear
  
  
  Microsoft Windows XP [Version 5.1.2600]
  The current date is: Tue 03/28/2006
  The current time is: 19:52:29.50
  
  Running from
  C:\Documents and Settings\michael valalik\Desktop\smitRem
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Pre-run SharedTask Export
  
  (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
  Copyright(C) 2006 BleepingComputer.com
  
  Registry Pseudo-Format Mode (Not a valid reg file):
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
  "{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
  @=&quot;%SystemRoot%\System32\browseui.dll"
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
  @=&quot;%SystemRoot%\System32\browseui.dll"
  
  
  [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}\InProcServer32]
  @=&quot;C:\WINDOWS\system32\stickrep.dll"
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  checking for ShudderLTD key
  
  ShudderLTD key not present!
  
  checking for PSGuard.com key
  
  
  PSGuard.com key not present!
  
  
  checking for WinHound.com key
  
  
  WinHound.com key not present!
  
  spyaxe uninstaller NOT present
  Winhound uninstaller NOT present
  SpywareStrike uninstaller NOT present
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Existing Pre-run Files
  
  
  ~~~ Program Files ~~~
  
  Security Toolbar
  
  
  ~~~ Shortcuts ~~~
  
  Online Security Guide.url
  Security Troubleshooting.url
  
  
  ~~~ Favorites ~~~
  
  Antivirus Test Online.url
  
  
  ~~~ system32 folder ~~~
  
  1024 dir
  ld****.tmp
  ncompat.tlb
  
  
  ~~~ Icons in System32 ~~~
  
  ts.ico
  ot.ico
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 648 'explorer.exe'
  
  Starting registry repairs
  
  Registry repairs complete
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  SharedTask Export after registry fix
  
  (GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
  Copyright(C) 2006 BleepingComputer.com
  
  Registry Pseudo-Format Mode (Not a valid reg file):
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
  "{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
  @=&quot;%SystemRoot%\System32\browseui.dll"
  
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
  @=&quot;%SystemRoot%\System32\browseui.dll"
  
  
  [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}\InProcServer32]
  @=&quot;C:\WINDOWS\system32\stickrep.dll"
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Deleting files
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  Remaining Post-run Files
  
  
  ~~~ Program Files ~~~
  
  
  
  ~~~ Shortcuts ~~~
  
  
  
  ~~~ Favorites ~~~
  
  
  
  ~~~ system32 folder ~~~
  
  
  
  ~~~ Icons in System32 ~~~
  
  
  
  ~~~ Windows directory ~~~
  
  
  
  ~~~ Drive root ~~~
  
  
  ~~~ Miscellaneous Files/folders ~~~
  
  
  ~~~ Wininet.dll ~~~
  
  CLEAN!
  
  
  
  

  ---

  ewido anti-malware - Scan report

  ---

  
  + Created on: 9:19:15 PM, 3/28/2006
  + Report-Checksum: 41398372
  
  + Scan result:
  
  No infected objects found.
  
  
  ::Report End
  
  
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:23:23 PM, on 3/28/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
  C:\WINDOWS\system32\WDBtnMgr.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
  C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
  C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\AIM\aim.exe
  C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\Program Files\Dantz\Retrospect\retrorun.exe
  C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Microsoft Works\WksWP.exe
  C:\Program Files\Microsoft Works\MSWorks.exe
  C:\Program Files\Microsoft Works\wkgdcach.exe
  C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  C:\Documents and Settings\michael valalik\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
  O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
  O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
  O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
  O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
  O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
  O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
  O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
  O8 - Extra context menu item: Translate Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
  O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096647604687
  O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
  O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
  O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
  O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
  O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
  O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

  0
• Trogan London, UK

  March 2006 edited March 2006

  VirusScanQuake sounds similar to SpywareQuake. Follow the removal instructions here and see if they help.
  
  Let me know how it goes

  0