[daisy flower]

Logfile of HijackThis v1.98.0
Scan saved at 9:00:53 PM, on 7/29/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Watkins\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://qibrs.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://qibrs.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://qibrs.dll/index.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {27F01197-47D8-D201-61BE-174D3F206568} - C:\WINDOWS\ipeg32.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Tech-In-A-Box] C:\techbox\techbox.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Internet Explorer] IEXPLORE.EXE
O4 - HKLM\..\Run: [ntoq32.exe] C:\WINDOWS\ntoq32.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\RunServices: [Internet Explorer] IEXPLORE.EXE
O4 - HKLM\..\RunOnce: [mfcch.exe] C:\WINDOWS\mfcch.exe
O4 - HKLM\..\RunOnce: [appzj32.exe] C:\WINDOWS\system32\appzj32.exe
O4 - HKLM\..\RunOnce: [sdkso.exe] C:\WINDOWS\sdkso.exe
O4 - HKLM\..\RunOnce: [atloh32.exe] C:\WINDOWS\atloh32.exe
O4 - HKLM\..\RunOnce: [atluc32.exe] C:\WINDOWS\atluc32.exe
O4 - HKLM\..\RunOnce: [ntcp32.exe] C:\WINDOWS\ntcp32.exe
O4 - HKLM\..\RunOnce: [iezy32.exe] C:\WINDOWS\system32\iezy32.exe
O4 - HKLM\..\RunOnce: [apiti.exe] C:\WINDOWS\system32\apiti.exe
O4 - HKCU\..\Run: [Internet Explorer] IEXPLORE.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: StumbleUpon: &Blog This - res://C:\WINDOWS\DOWNLO~1\STUMBL~1.DLL/blogimage
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll

[Flrman1]

First please do this:

Download the attached zip file and unzip it to your desktop. Doubleclick to run it. It will get a list of active services. Please post the list that is generated.

[Flrman1]

As to your mention of the get active services script used at the link at CC. I've been using it for a couple of weeks now Bill. Remember I mentioned it in my PM the other day.

[daisy flower]

I will completely disconnect infected computer after tonight. Will review post from work, print them out, and bring them home to infected computer. I will patiently wait for specific step by step instructions, and am very grateful for you help and patience.

These are the Current Active Services:

APPLICATION LAYER GATEWAY SERVICE: ALG
C:\WINDOWS\System32\alg.exe

WINDOWS AUDIO: AudioSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs

COMPUTER BROWSER: Browser
C:\WINDOWS\System32\svchost.exe -k netsvcs

CRYPTOGRAPHIC SERVICES: CryptSvc
C:\WINDOWS\system32\svchost.exe -k netsvcs

DHCP CLIENT: Dhcp
C:\WINDOWS\System32\svchost.exe -k netsvcs

ERROR REPORTING SERVICE: ERSvc
C:\WINDOWS\System32\svchost.exe -k netsvcs

COM+ EVENT SYSTEM: EventSystem
C:\WINDOWS\System32\svchost.exe -k netsvcs

FAST USER SWITCHING COMPATIBILITY: FastUserSwitchingCompatibility
C:\WINDOWS\System32\svchost.exe -k netsvcs

HELP AND SUPPORT: helpsvc
C:\WINDOWS\System32\svchost.exe -k netsvcs

SERVER: lanmanserver
C:\WINDOWS\System32\svchost.exe -k netsvcs

WORKSTATION: lanmanworkstation
C:\WINDOWS\System32\svchost.exe -k netsvcs

NETWORK CONNECTIONS: Netman
C:\WINDOWS\System32\svchost.exe -k netsvcs

NETWORK LOCATION AWARENESS (NLA): Nla
C:\WINDOWS\System32\svchost.exe -k netsvcs

REMOTE ACCESS AUTO CONNECTION MANAGER: RasAuto
C:\WINDOWS\System32\svchost.exe -k netsvcs

REMOTE ACCESS CONNECTION MANAGER: RasMan
C:\WINDOWS\System32\svchost.exe -k netsvcs

TASK SCHEDULER: Schedule
C:\WINDOWS\System32\svchost.exe -k netsvcs

SECONDARY LOGON: seclogon
C:\WINDOWS\System32\svchost.exe -k netsvcs

SYSTEM EVENT NOTIFICATION: SENS
C:\WINDOWS\system32\svchost.exe -k netsvcs

INTERNET CONNECTION FIREWALL (ICF) / INTERNET CONNECTION SHARING (ICS): SharedAccess
C:\WINDOWS\System32\svchost.exe -k netsvcs

SHELL HARDWARE DETECTION: ShellHWDetection
C:\WINDOWS\System32\svchost.exe -k netsvcs

TELEPHONY: TapiSrv
C:\WINDOWS\System32\svchost.exe -k netsvcs

TERMINAL SERVICES: TermService
C:\WINDOWS\System32\svchost.exe -k netsvcs

THEMES: Themes
C:\WINDOWS\System32\svchost.exe -k netsvcs

DISTRIBUTED LINK TRACKING CLIENT: TrkWks
C:\WINDOWS\system32\svchost.exe -k netsvcs

UPLOAD MANAGER: uploadmgr
C:\WINDOWS\System32\svchost.exe -k netsvcs

WINDOWS TIME: W32Time
C:\WINDOWS\System32\svchost.exe -k netsvcs

WINDOWS MANAGEMENT INSTRUMENTATION: winmgmt
C:\WINDOWS\system32\svchost.exe -k netsvcs

PORTABLE MEDIA SERIAL NUMBER: WmdmPmSp
C:\WINDOWS\System32\svchost.exe -k netsvcs

AUTOMATIC UPDATES: wuauserv
C:\WINDOWS\system32\svchost.exe -k netsvcs

WIRELESS ZERO CONFIGURATION: WZCSVC
C:\WINDOWS\System32\svchost.exe -k netsvcs

DNS CLIENT: Dnscache
C:\WINDOWS\System32\svchost.exe -k NetworkService

EVENT LOG: Eventlog
C:\WINDOWS\system32\services.exe

PLUG AND PLAY: PlugPlay
C:\WINDOWS\system32\services.exe

LEXBCE SERVER: LexBceS
C:\WINDOWS\system32\LEXBCES.EXE

TCP/IP NETBIOS HELPER: LmHosts
C:\WINDOWS\System32\svchost.exe -k LocalService

SSDP DISCOVERY SERVICE: SSDPSRV
C:\WINDOWS\System32\svchost.exe -k LocalService

WEBCLIENT: WebClient
C:\WINDOWS\System32\svchost.exe -k LocalService

NVIDIA DRIVER HELPER SERVICE: NVSvc
C:\WINDOWS\System32\nvsvc32.exe

PANDA PROCESS PROTECTION SERVICE: PavPrSrv
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

PANDA ANTI-VIRUS SERVICE: PAVSRV
C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe

TREND MICRO PERSONAL FIREWALL: PccPfw
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe

PROTECTED STORAGE: ProtectedStorage
C:\WINDOWS\system32\lsass.exe

SECURITY ACCOUNTS MANAGER: SamSs
C:\WINDOWS\system32\lsass.exe

REMOTE PROCEDURE CALL (RPC): RpcSs
C:\WINDOWS\system32\svchost -k rpcss

PRINT SPOOLER: Spooler
C:\WINDOWS\system32\spoolsv.exe

WINDOWS IMAGE ACQUISITION (WIA): stisvc
C:\WINDOWS\System32\svchost.exe -k imgsvc

TREND NT REALTIME SERVICE: Tmntsrv
"C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe"

TREND MICRO PROXY SERVICE: tmproxy
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

WORKSTATION NETLOGON SERVICE: ½O.#ž‚„�õØ´â
C:\WINDOWS\mfcch.exe /s

[Flrman1]

To Bill

The following is the fix that I have been using Bill. It is almost identical to the one at the link you posted from Computer Cops. I didn't want to interupt the thread and interject this method the yesterday as you were using a method that has worked on occassion albeit a hit and miss scenario. I am a member of the Security Experts group at Computer Cops. The SE group is a private group where the Experts from just about every forum you can think of get together and hash out a lot of these fixes. There are a couple of threads in the SE forum where the fixes for this hijacker are being worked out.

To Daisy:


First Click here to download CWShredder. Do Not run it yet. Download it to the desktop and have it ready to run later.

___________________________________________________________________________
Copy the contents of the Quote Box to Notepad.

Name the file as fix.reg
Save as Type: All Files
****Save on the desktop but don't do anything with it yet. You will run it later in safe mode.

REGEDIT4


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\½O.#ž‚„�õØ´â]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\½O.#ž‚„�õØ´â]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\½O.#ž‚„�õØ´â]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\½O.#ž‚„�õØ´â]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\icoo]

______________________________________________________________________

Now go ahead and set your computer to show hidden files like so:

Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
______________________________________________________________________

Click here to download AboutBuster created by Rubber Ducky.

Unzip AboutBuster to the Desktop and have it ready to run, but don't run it yet.
_____________________________________________________________________

Copy these instructions to notepad and save them on your desktop for easy access. You must follow these directions exactly and you cannot skip any part of it.

Restart to safe mode.

How to start your computer in safe mode


Perform the following steps in safe mode:

____________________________________________________________________

Double click on fix.reg that you saved earlier to enter into the registry. Answer yes when asked to have it's contents added to the registry.
____________________________________________________________________

Go to Start > Run and type Hijackthis. Press enter to start HijackThis. DO NOT OPEN ANYTHING ELSE!

Put a check by these entries in Hijack This and click the "Fix Checked" button:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://qibrs.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://qibrs.dll/index.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qibrs.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://qibrs.dll/index.html#28129

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {27F01197-47D8-D201-61BE-174D3F206568} - C:\WINDOWS\ipeg32.dll

O4 - HKLM\..\Run: [Internet Explorer] IEXPLORE.EXE

O4 - HKLM\..\Run: [ntoq32.exe] C:\WINDOWS\ntoq32.exe

O4 - HKLM\..\RunServices: [Internet Explorer] IEXPLORE.EXE
O4 - HKLM\..\RunOnce: [mfcch.exe] C:\WINDOWS\mfcch.exe
O4 - HKLM\..\RunOnce: [appzj32.exe] C:\WINDOWS\system32\appzj32.exe
O4 - HKLM\..\RunOnce: [sdkso.exe] C:\WINDOWS\sdkso.exe
O4 - HKLM\..\RunOnce: [atloh32.exe] C:\WINDOWS\atloh32.exe
O4 - HKLM\..\RunOnce: [atluc32.exe] C:\WINDOWS\atluc32.exe
O4 - HKLM\..\RunOnce: [ntcp32.exe] C:\WINDOWS\ntcp32.exe
O4 - HKLM\..\RunOnce: [iezy32.exe] C:\WINDOWS\system32\iezy32.exe
O4 - HKLM\..\RunOnce: [apiti.exe] C:\WINDOWS\system32\apiti.exe
O4 - HKCU\..\Run: [Internet Explorer] IEXPLORE.EXE

Find and delete these files:

C:\WINDOWS\IEXPLORE.EXE
C:\WINDOWS\mfcch.exe
C:\WINDOWS\ipeg32.dll
C:\WINDOWS\sdkso.exe
C:\WINDOWS\atloh32.exe
C:\WINDOWS\atluc32.exe
C:\WINDOWS\ntcp32.exe
C:\WINDOWS\ntoq32.exe
C:\WINDOWS\mfcch.exe
C:\WINDOWS\system32\appzj32.exe
C:\WINDOWS\system32\iezy32.exe
C:\WINDOWS\system32\apiti.exe

Delete any files that have the same name as these files but end with a dll. You should see them right next to each other.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Next navigate to the C:\Documents and Settings\Watkins (Repeat for all user names)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

________________________________________________________________________

Next run aboutbuster. Double click aboutbuster.exe, click OK, click Start, then click OK. This will scan your computer for the bad files and delete them.
_______________________________________________________________________

Finally, run CWShredder. Just click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.
_______________________________________________________________________

Boot back into Windows now.


Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer.



Go here and do an online virus scan.

Be sure and put a check in the box by "Auto Clean" before you do the scan. If it finds anything that it cannot clean have it delete it or make a note of the file location so you can delete it yourself. Housecall will detect the leftover files from this hijacker.



This hijacker is known to alter or delete certain files so check this out please:

Download the Hoster from here . UnZip the file and press "Restore Original Hosts" and press "OK". Exit Program.

If you have Spybot S&D installed you will also need to replace one file.
Go here and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)

Check in the System32 folder to be sure you have a file named Shell.dll. If you do not have one, go to System32\dllcache
Find shell.dll and right click on it. Choose Copy from the menu.
Open System32 and right click on an empty space in the window. Choose Paste from the menu.


control.exe may have been deleted.
See if control.exe is present in C:\windows\system32

If control.exe isn't there, go here, and download control.exe per the instructions at the site.

IMPORTANT!: Please check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your active x security settings in IE as recommended here.



When you are sure you are clean turn System Restore back on and create a restore point.

To create a restore point:

Single-click Start and point to All Programs.
Mouse over Accessories, then System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done.

[daisy flower]

ok....now I have tried to go back and run get active services...and get error "the compressed (zip) folder is corrupted or invalid when trying to open it...When unzipping it....no files found

[Flrman1]

Originally Posted by daisy flower

ok....now I have tried to go back and run get active services...and get error "the compressed (zip) folder is corrupted or invalid when trying to open it...When unzipping it....no files found

Don't worry about that now. I got the info that I needed from the Active services list that you posted. I posted the directions for the fix already. See my last post.

Good luck!

[Byteman]

DF-
You may need to find the folder that you first unzipped the original download to...zipped files often put up that message when extraction has taken place before...
[EDIT::: never mind the above as flrman1 replied while I was posting]
Hi Mark! Nice work. I have seen you use the tools many times> very aware here of the good work you are into. I just posted what I could find, that CC thread was the first result in a Google search. I wasn't referring her there... just in case someone may have need of a possible fix... if it is an old .reg or does not work as well --will change to something new. Newer tools are what we all going to be getting tons of it looks like! Your hard work is appreciated!
anyway, thank you very much...
Now I see what you mean about services and I think what you meant in regard to AB not always showing/removing running services... this whole type of thing will pretty much be a work in progress, seems to me...given the things that are invading computers recently.
Just trying to keep up with the latest is the real work.
Well I have to go make this eMachine XP Home Edition into XP Second Edition somehow so the owner's kids can play safely.

Daisyflower: You did a great job...after you get all cleared up> the one more thing you can do after finishing with the pc for the evening is...simply turn off the cable modem by pressing the power button, unhooking the cable is also effective but may give something a jolt of current...
Of course the protective programs can help a lot but the safe bet is to turn off the modem, that's what I do every shutdown.

[daisy flower]

whew....everything went fine...the only issue I had in safe mode was I could not run aboutbuster. Will do it all again if needed, but wanted to check first. No viruses found in online housecall scan...but do have two that were popping up while, doing online housecall, in Trend Micro Internet Security that I loaded earlier. Doesn't seem to be any problems with anything right now, but will wait to hear a reply before doing any play on computer.


Thanks again

Here is the virus log


Log List
"Time","Scan Type","Source Type","Virus Name","Infected Source","First Action","Second Action"
"19:13","Real-time Scan","File","WORM_RBOT.ER","C:\windows\system32\dailin.exe","Quarantine Successful",""
"19:28","Real-time Scan","File","TROJ_DELF.RA","C:\WINDOWS\2_0_1browserhelper2.dll","Quarantin e Successful",""
"19:29","Real-time Scan","File","TROJ_DLOADER.F","C:\Documents and Settings\Watkins\Application Data\oeta.exe","Quarantine Successful",""
"20:35","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:35","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"20:37","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:37","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"20:39","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:40","Real-time Scan","File","SPYW_TWANT.C","C:\windows\ipeg32.dll","Deny Access",""
"20:40","Real-time Scan","File","SPYW_TWANT.B","C:\windows\ntoq32.exe","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:44","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:45","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:45","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:45","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ipeg32.dll","Deny Access",""
"20:50","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:51","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:56","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:57","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"20:57","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\sysfe.dll","Deny Access",""
"21:03","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:05","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\sysfe.dll","Deny Access",""
"21:05","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\NTOQ32.EXE","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:06","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\netqa.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\netoy32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:07","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ntoq32.exe","Deny Access",""
"21:08","Real-time Scan","File","TROJ_EMT.A","C:\WINDOWS\ntoq32.exe.$$$","Quarantine Successful",""
"21:11","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\netqa.exe","Deny Access",""
"21:21","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javace.exe","Deny Access",""
"21:24","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\ipob32.dll","Deny Access",""
"21:36","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\sysfe.dll","Deny Access",""
"21:36","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ipcw32.exe","Deny Access",""
"21:36","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\apiih.exe","Deny Access",""
"21:38","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\netnf.exe","Deny Access",""
"21:38","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\winmf.exe","Deny Access",""
"21:39","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\appkh.exe","Deny Access",""
"21:39","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\d3lq32.exe","Deny Access",""
"21:43","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\netqa.exe","Deny Access",""
"21:44","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\apiih.exe","Deny Access",""
"21:44","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\netnf.exe","Deny Access",""
"21:46","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\winmf.exe","Deny Access",""
"21:46","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\d3lq32.exe","Deny Access",""
"21:55","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\ipob32.dll","Deny Access",""
"22:11","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\mfcgs32.exe","Deny Access",""
"22:14","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\addlc32.exe","Deny Access",""
"22:14","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\cryw.exe","Deny Access",""
"22:14","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\msup.exe","Deny Access",""
"22:20","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javavu.exe","Deny Access",""
"23:09","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\sysfe.dll","Deny Access",""
"23:14","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\system32\sysfe.dll","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\netqa.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\apiih.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\netnf.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\winmf.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\d3lq32.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\atlge.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\d3rs.exe","Deny Access",""
"23:15","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\mfcgs32.exe","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\addlc32.exe","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\system32\ipob32.dll","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\cryw.exe","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\msup.exe","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\system32\crks.exe","Deny Access",""
"23:16","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\netqa.exe","Deny Access",""
"23:18","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\apiih.exe","Deny Access",""
"23:18","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\netnf.exe","Deny Access",""
"23:19","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\winmf.exe","Deny Access",""
"23:20","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\d3lq32.exe","Deny Access",""
"23:20","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\atlge.exe","Deny Access",""
"23:21","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\vkxwvc.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\opvvxx.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javace.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\lotvoi.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\iquetf.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\ekqxcc.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\sianib.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\WINDOWS\syhodm.dat","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\netoy32.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ipcw32.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\appkh.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\atllq.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javavu.exe","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\Documents and Settings\Watkins\Desktop\backups\backup-20040728-204226-246.dll","Deny Access",""
"23:22","Real-time Scan","File","SPYW_TWANT.C","C:\Documents and Settings\Watkins\Desktop\backups\backup-20040729-052929-447.dll","Deny Access",""
"23:23","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\d3rs.exe","Deny Access",""
"23:24","Real-time Scan","File","ADW_ISTBAR.II","C:\Program Files\ISTsvc\istsvc.exe","Deny Access",""
"23:27","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\mfcgs32.exe","Deny Access",""
"23:29","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\addlc32.exe","Deny Access",""
"23:29","Real-time Scan","File","SPYW_TWANT.C","C:\windows\system32\ipob32.dll","Deny Access",""
"23:32","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\cryw.exe","Deny Access",""
"23:32","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\msup.exe","Deny Access",""
"23:32","Real-time Scan","File","SPYW_TWANT.B","C:\windows\system32\crks.exe","Deny Access",""
"23:38","Real-time Scan","File","ADW_ISTBAR.II","C:\PROGRAM FILES\ISTsvc\istsvc.exe","Deny Access",""
"23:39","Real-time Scan","File","SPYW_TWANT.B","C:\windows\javace.exe","Deny Access",""
"23:39","Real-time Scan","File","SPYW_TWANT.B","C:\windows\netoy32.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\windows\ipcw32.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\windows\appkh.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\windows\atllq.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\windows\javavu.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javace.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\netoy32.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\ipcw32.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\appkh.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\atllq.exe","Deny Access",""
"23:40","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\javavu.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\netqa.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\apiih.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\netnf.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\winmf.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\d3lq32.exe","Deny Access",""
"23:41","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\atlge.exe","Deny Access",""
"23:42","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\d3rs.exe","Deny Access",""
"23:42","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\mfcgs32.exe","Deny Access",""
"23:42","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\addlc32.exe","Deny Access",""
"23:42","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\cryw.exe","Deny Access",""
"23:42","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\msup.exe","Deny Access",""
"23:43","Real-time Scan","File","SPYW_TWANT.B","C:\WINDOWS\System32\crks.exe","Deny Access",""

[daisy flower]

I did run aboutbuster after posting the last post.

[Byteman]

DaisyFlower: It looks like a couple of items (trojans) were put into quarantine, that is OK for now, they are locked up...

flrman1 may have you delete those in quarantine later on.
I am not that familiar with Panda logs, but also it appears that the SPYW_ entries it could not deal with, that is expected> the special programs we use for ad-junk will handle them coupled with "manual" fixes. Depending on when you made this scan, the files may or may not actually be present.
You do need to check that files your system needs are present RE:

Originally Posted by flrman1

[b]To Daisy:



This hijacker is known to alter or delete certain files so check this out please:

Download the Hoster from here . UnZip the file and press "Restore Original Hosts" and press "OK". Exit Program.

If you have Spybot S&D installed you will also need to replace one file.
Go here and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)

Check in the System32 folder to be sure you have a file named Shell.dll. If you do not have one, go to System32\dllcache
Find shell.dll and right click on it. Choose Copy from the menu.
Open System32 and right click on an empty space in the window. Choose Paste from the menu.


control.exe may have been deleted.
See if control.exe is present in C:\windows\system32

If control.exe isn't there, go here, and download control.exe per the instructions at the site.

IMPORTANT!: Please check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your active x security settings in IE as recommended here

You should tell us if you had to replace any of those files AND that you have checked Active X settings> you may find that they are changed!
You did have a successful run of AboutBuster after your post, if I read that right....? When you have some time later I am sure flrman1 will be asking for those or NEWER logs along with a new HJT logfile. He may have some steps that differ from the usual way so wait for his directions.

[Flrman1]

Let's see another Hijack This log please.

[daisy flower]

ran Holster
do not have Spybot
copied and pasted shell.dll
control.exe is present
ActiveX settings set to recommendations


About buster Scan from last night

-- Scan 1 --------
About:Buster Version 2.0
Removed! : C:\WINDOWS\bsahe.dat
Removed! : C:\WINDOWS\erruo.dat
Removed! : C:\WINDOWS\javace.exe
Removed! : C:\WINDOWS\pxwxi.dat
Removed! : C:\WINDOWS\netoy32.exe
Removed! : C:\WINDOWS\ntqq32.exe
Removed! : C:\WINDOWS\ipcw32.exe
Removed! : C:\WINDOWS\wmbrn.dat
Removed! : C:\WINDOWS\qibrs.dat
Removed! : C:\WINDOWS\qibrs.dll
Removed! : C:\WINDOWS\escuk.dat
Removed! : C:\WINDOWS\fvuqx.dat
Removed! : C:\WINDOWS\appkh.exe
Removed! : C:\WINDOWS\sysem.exe
Removed! : C:\WINDOWS\ipyv32.exe
Removed! : C:\WINDOWS\atllq.exe
Removed! : C:\WINDOWS\addfq.exe
Removed! : C:\WINDOWS\syspz32.exe
Removed! : C:\WINDOWS\javavu.exe
Removed! : C:\WINDOWS\System32\zfumw.dat
Removed! : C:\WINDOWS\System32\deczg.dll
Removed! : C:\WINDOWS\System32\msbk32.exe
Removed! : C:\WINDOWS\System32\viiva.dat
Removed! : C:\WINDOWS\System32\xegly.dat
Removed! : C:\WINDOWS\System32\qhzik.dll
Removed! : C:\WINDOWS\System32\ekhov.dat
Removed! : C:\WINDOWS\System32\hgffs.dll
Removed! : C:\WINDOWS\System32\netqa.exe
Removed! : C:\WINDOWS\System32\addvc32.exe
Removed! : C:\WINDOWS\System32\apiih.exe
Removed! : C:\WINDOWS\System32\netnf.exe
Removed! : C:\WINDOWS\System32\winmf.exe
Removed! : C:\WINDOWS\System32\d3lq32.exe
Removed! : C:\WINDOWS\System32\atlge.exe
Removed! : C:\WINDOWS\System32\d3rs.exe
Removed! : C:\WINDOWS\System32\sysyf32.exe
Removed! : C:\WINDOWS\System32\mfcgs32.exe
Removed! : C:\WINDOWS\System32\addlc32.exe
Removed! : C:\WINDOWS\System32\cryw.exe
Removed! : C:\WINDOWS\System32\msup.exe
Removed! : C:\WINDOWS\System32\syslz.exe
Removed! : C:\WINDOWS\System32\crks.exe
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 --------
About:Buster Version 2.0
Attempted Clean Of Temp folder.
Pages Reset... Done!

Logfile of HijackThis v1.98.0
Scan saved at 6:32:40 PM, on 7/30/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Watkins\Desktop\hijackthis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Tech-In-A-Box] C:\techbox\techbox.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: StumbleUpon: &Blog This - res://C:\WINDOWS\DOWNLO~1\STUMBL~1.DLL/blogimage
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

[Flrman1]

Clean!

IMPORTANT!: I highly recommend that you go to Windows update and install all "Critical Updates and Service Packs" ASAP!. This will patch numerous security holes in IE and Windows. Many baddies get on your machine by taking advantage of these vulnerabilities. As your machine stands now it is wide open to attack from all sorts of nasties. You need to get these updates IMMEDITELY!

[daisy flower]

all critical updates and services packs installed