1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Need help getting rid of [email protected] virus

Discussion in 'Virus & Other Malware Removal' started by Villa, Feb 13, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Operating System is Windows XP.

    I keep getting the message System Alert: [email protected] and it asks me to click balloon to download security software. My virus scan showed up a virus in isadd.dll file. It cannot delete this and I have tried to manually delete it, but it is not allowed. Having read various threads I can see there is a solution using Hijack this.
    Please help.
     
  2. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Click here to download HJTsetup.exe:

    http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item5
    Scroll down to the download section

    Save HJTsetup.exe to your desktop.

    Double click on the HJTsetup.exe icon on your desktop.
    By default it will install to C:\Program Files\Hijack This.
    Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    Put a check by Create a desktop icon then click Next again.
    Continue to follow the rest of the prompts from there.
    At the final dialogue box click Finish and it will launch Hijack This.
    Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    Click Save to save the log file and then the log will open in notepad.
    Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    Come back here to this thread and Paste the log in your next reply.
    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
     
  3. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Logfile of HijackThis v1.99.1
    Scan saved at 21:08:42, on 13/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Virgin Broadband\PCguard\fws.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Image ActiveX Object\isamntr.exe
    C:\Program Files\Image ActiveX Object\pmsnrr.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\mbssm32.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Virgin Broadband\PCguard\Rps.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Image ActiveX Object\pmmnt.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\Image ActiveX Object\isamini.exe
    C:\Program Files\palmOne\Hotsync.exe
    c:\windows\system32\mbsrm32.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Command Software\dvpapi.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O1 - Hosts: 207.44.236.200 sitefinder.verisign.com
    O1 - Hosts: 207.44.236.200 sitefinder-idn.verisign.com
    O1 - Hosts: 207.44.236.200 coolsearch.com
    O1 - Hosts: 207.44.236.200 www.coolsearch.com
    O1 - Hosts: 207.44.236.200 cool-search.ws
    O1 - Hosts: 207.44.236.200 www.cool-search.ws
    O1 - Hosts: 207.44.236.200 Aavc.com
    O1 - Hosts: 207.44.236.200 www.Aavc.com
    O1 - Hosts: 207.44.236.200 Acjp.com
    O1 - Hosts: 207.44.236.200 www.Acjp.com
    O1 - Hosts: 207.44.236.200 Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 www.Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 Ebch.com
    O1 - Hosts: 207.44.236.200 www.Ebch.com
    O1 - Hosts: 207.44.236.200 Ebdv.com
    O1 - Hosts: 207.44.236.200 www.Ebdv.com
    O1 - Hosts: 207.44.236.200 Ebdw.com
    O1 - Hosts: 207.44.236.200 www.Ebdw.com
    O1 - Hosts: 207.44.236.200 Ebjp.com
    O1 - Hosts: 207.44.236.200 www.Ebjp.com
    O1 - Hosts: 207.44.236.200 Ebkn.com
    O1 - Hosts: 207.44.236.200 www.Ebkn.com
    O1 - Hosts: 207.44.236.200 Ebky.com
    O1 - Hosts: 207.44.236.200 www.Ebky.com
    O1 - Hosts: 207.44.236.200 Eblv.com
    O1 - Hosts: 207.44.236.200 www.Eblv.com
    O1 - Hosts: 207.44.236.200 Ebvr.com
    O1 - Hosts: 207.44.236.200 www.Ebvr.com
    O1 - Hosts: 207.44.236.200 Ecmh.com
    O1 - Hosts: 207.44.236.200 www.Ecmh.com
    O1 - Hosts: 207.44.236.200 Ecwz.com
    O1 - Hosts: 207.44.236.200 www.Ecwz.com
    O1 - Hosts: 207.44.236.200 Ecyb.com
    O1 - Hosts: 207.44.236.200 www.Ecyb.com
    O1 - Hosts: 207.44.236.200 Eduy.com
    O1 - Hosts: 207.44.236.200 www.Eduy.com
    O1 - Hosts: 207.44.236.200 Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 www.Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 Ibmx.com
    O1 - Hosts: 207.44.236.200 www.Ibmx.com
    O1 - Hosts: 207.44.236.200 Icwb.com
    O1 - Hosts: 207.44.236.200 www.Icwb.com
    O1 - Hosts: 207.44.236.200 Icwo.com
    O1 - Hosts: 207.44.236.200 www.Icwo.com
    O1 - Hosts: 207.44.236.200 Icwp.com
    O1 - Hosts: 207.44.236.200 www.Icwp.com
    O1 - Hosts: 207.44.236.200 Iddh.com
    O1 - Hosts: 207.44.236.200 www.Iddh.com
    O1 - Hosts: 207.44.236.200 Idhh.com
    O1 - Hosts: 207.44.236.200 www.Idhh.com
    O1 - Hosts: 207.44.236.200 Ifiz.com
    O1 - Hosts: 207.44.236.200 www.Ifiz.com
    O1 - Hosts: 207.44.236.200 Ifsearch.com
    O1 - Hosts: 207.44.236.200 www.Ifsearch.com
    O1 - Hosts: 207.44.236.200 Iguu.com
    O1 - Hosts: 207.44.236.200 www.Iguu.com
    O1 - Hosts: 207.44.236.200 Isearchhere.com
    O1 - Hosts: 207.44.236.200 www.Isearchhere.com
    O1 - Hosts: 207.44.236.200 Iwantosearch.com
    O1 - Hosts: 207.44.236.200 www.Iwantosearch.com
    O1 - Hosts: 207.44.236.200 Ohyea.org
    O1 - Hosts: 207.44.236.200 www.Ohyea.org
    O1 - Hosts: 207.44.236.200 Opensearch.org
    O1 - Hosts: 207.44.236.200 www.Opensearch.org
    O1 - Hosts: 207.44.236.200 Samz.com
    O1 - Hosts: 207.44.236.200 www.Samz.com
    O1 - Hosts: 207.44.236.200 Saoe.com
    O1 - Hosts: 207.44.236.200 www.Saoe.com
    O1 - Hosts: 207.44.236.200 Sbjr.com
    O1 - Hosts: 207.44.236.200 www.Sbjr.com
    O1 - Hosts: 207.44.236.200 Sbnl.com
    O1 - Hosts: 207.44.236.200 www.Sbnl.com
    O1 - Hosts: 207.44.236.200 Sbnt.com
    O1 - Hosts: 207.44.236.200 www.Sbnt.com
    O1 - Hosts: 207.44.236.200 Scbm.com
    O1 - Hosts: 207.44.236.200 www.Scbm.com
    O1 - Hosts: 207.44.236.200 Sckr.com
    O1 - Hosts: 207.44.236.200 www.Sckr.com
    O1 - Hosts: 207.44.236.200 Scrk.com
    O1 - Hosts: 207.44.236.200 www.Scrk.com
    O1 - Hosts: 207.44.236.200 Sdry.com
    O1 - Hosts: 207.44.236.200 www.Sdry.com
    O1 - Hosts: 207.44.236.200 Searchbee.net
    O1 - Hosts: 207.44.236.200 www.Searchbee.net
    O1 - Hosts: 207.44.236.200 Searchhotsex.com
    O1 - Hosts: 207.44.236.200 www.Searchhotsex.com
    O1 - Hosts: 207.44.236.200 Seld.com
    O1 - Hosts: 207.44.236.200 www.Seld.com
    O1 - Hosts: 207.44.236.200 Sfux.com
    O1 - Hosts: 207.44.236.200 www.Sfux.com
    O1 - Hosts: 207.44.236.200 Sipo.com
    O1 - Hosts: 207.44.236.200 www.Sipo.com
    O1 - Hosts: 207.44.236.200 Smds.com
    O1 - Hosts: 207.44.236.200 www.Smds.com
    O1 - Hosts: 207.44.236.200 Srib.com
    O1 - Hosts: 207.44.236.200 www.Srib.com
    O1 - Hosts: 207.44.236.200 Srox.com
    O1 - Hosts: 207.44.236.200 www.Srox.com
    O1 - Hosts: 207.44.236.200 Srsf.com
    O1 - Hosts: 207.44.236.200 www.Srsf.com
    O1 - Hosts: 207.44.236.200 Ssaw.com
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Virgin Broadband\PCguard\FBHR.dll
    O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Image ActiveX Object\isadd.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Image ActiveX Object\iesplugin.dll (file missing)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
    O4 - HKLM\..\Run: [AntiVermeans] C:\Program Files\AntiVermeans\AntiVermeans.exe /h
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PCguard Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\fws.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
     
  4. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

    Please download SmitfraudFix (by S!Ri)
    Extract the content (a folder named SmitfraudFix) to your Desktop.

    Next, please reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, a menu with options should appear;
    • Select the first option, to run Windows in Safe Mode, then press "Enter".
    • Choose your usual account.
    Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
    Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

    You will be prompted: "Registry cleaning - Do you want to clean the registry?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

    The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

    The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

    A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new hijack log.

    The report can also be found at the root of the system drive, usually at C:\rapport.txt

    Warning: running option #2 on a non infected computer will remove your Desktop background.
    =========================
    Download Superantispyware (SAS)

    http://www.superantispyware.com/superantispywarefreevspro.html

    Install it and double-click the icon on your desktop to run it.
    · It will ask if you want to update the program definitions, click Yes.
    · Under Configuration and Preferences, click the Preferences button.
    · Click the Scanning Control tab.
    · Under Scanner Options make sure the following are checked:
    o Close browsers before scanning
    o Scan for tracking cookies
    o Terminate memory threats before quarantining.
    o Please leave the others unchecked.
    o Click the Close button to leave the control center screen.
    · On the main screen, under Scan for Harmful Software click Scan your computer.
    · On the left check C:\Fixed Drive.
    · On the right, under Complete Scan, choose Perform Complete Scan.
    · Click Next to start the scan. Please be patient while it scans your computer.
    · After the scan is complete a summary box will appear. Click OK.
    · Make sure everything in the white box has a check next to it, then click Next.
    · It will quarantine what it found and if it asks if you want to reboot, click Yes.
    · To retrieve the removal information for me please do the following:
    o After reboot, double-click the SUPERAntispyware icon on your desktop.
    o Click Preferences. Click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o It will open in your default text editor (such as Notepad/Wordpad).
    o Please highlight everything in the notepad, then right-click and choose copy.
    · Click close and close again to exit the program.
    · Please paste that information here for me with a new HijackThis log.
    ================
    Download the HostsXpert 3.7 - Hosts File Manager.
    • Unzip HostsXpert 3.7 - Hosts File Manager to a convenient folder such as C:\HostsXpert 3.7 - Hosts File Manager
    • Run HostsXpert 3.7 - Hosts File Manager from its new home
    • Click "Make Hosts Writable?" in the upper right corner (If available).
    • Click Restore Microsoft’s Host File and then click OK.
    • Click the X to exit the program.
    • Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
    ===================
    Post one hijack log after doing all of this along with the SmitFraud and SuperAnti logs
     
  5. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    SmitFraudFix v2.141

    Scan done at 22:24:40.65, 13/02/2007
    Run from C:\Documents and Settings\Nathan\Desktop\SmitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    207.44.236.200 sitefinder.verisign.com
    207.44.236.200 sitefinder-idn.verisign.com
    207.44.236.200 coolsearch.com
    207.44.236.200 www.coolsearch.com
    207.44.236.200 cool-search.ws
    207.44.236.200 www.cool-search.ws
    207.44.236.200 Aavc.com
    207.44.236.200 www.Aavc.com
    207.44.236.200 Acjp.com
    207.44.236.200 www.Acjp.com
    207.44.236.200 Amazingautossearch.com
    207.44.236.200 www.Amazingautossearch.com
    207.44.236.200 Ebch.com
    207.44.236.200 www.Ebch.com
    207.44.236.200 Ebdv.com
    207.44.236.200 www.Ebdv.com
    207.44.236.200 Ebdw.com
    207.44.236.200 www.Ebdw.com
    207.44.236.200 Ebjp.com
    207.44.236.200 www.Ebjp.com
    207.44.236.200 Ebkn.com
    207.44.236.200 www.Ebkn.com
    207.44.236.200 Ebky.com
    207.44.236.200 www.Ebky.com
    207.44.236.200 Eblv.com
    207.44.236.200 www.Eblv.com
    207.44.236.200 Ebvr.com
    207.44.236.200 www.Ebvr.com
    207.44.236.200 Ecmh.com
    207.44.236.200 www.Ecmh.com
    207.44.236.200 Ecwz.com
    207.44.236.200 www.Ecwz.com
    207.44.236.200 Ecyb.com
    207.44.236.200 www.Ecyb.com
    207.44.236.200 Eduy.com
    207.44.236.200 www.Eduy.com
    207.44.236.200 Errorfreesearch.com
    207.44.236.200 www.Errorfreesearch.com
    207.44.236.200 Ibmx.com
    207.44.236.200 www.Ibmx.com
    207.44.236.200 Icwb.com
    207.44.236.200 www.Icwb.com
    207.44.236.200 Icwo.com
    207.44.236.200 www.Icwo.com
    207.44.236.200 Icwp.com
    207.44.236.200 www.Icwp.com
    207.44.236.200 Iddh.com
    207.44.236.200 www.Iddh.com
    207.44.236.200 Idhh.com
    207.44.236.200 www.Idhh.com
    207.44.236.200 Ifiz.com
    207.44.236.200 www.Ifiz.com
    207.44.236.200 Ifsearch.com
    207.44.236.200 www.Ifsearch.com
    207.44.236.200 Iguu.com
    207.44.236.200 www.Iguu.com
    207.44.236.200 Isearchhere.com
    207.44.236.200 www.Isearchhere.com
    207.44.236.200 Iwantosearch.com
    207.44.236.200 www.Iwantosearch.com
    207.44.236.200 Ohyea.org
    207.44.236.200 www.Ohyea.org
    207.44.236.200 Opensearch.org
    207.44.236.200 www.Opensearch.org
    207.44.236.200 Samz.com
    207.44.236.200 www.Samz.com
    207.44.236.200 Saoe.com
    207.44.236.200 www.Saoe.com
    207.44.236.200 Sbjr.com
    207.44.236.200 www.Sbjr.com
    207.44.236.200 Sbnl.com
    207.44.236.200 www.Sbnl.com
    207.44.236.200 Sbnt.com
    207.44.236.200 www.Sbnt.com
    207.44.236.200 Scbm.com
    207.44.236.200 www.Scbm.com
    207.44.236.200 Sckr.com
    207.44.236.200 www.Sckr.com
    207.44.236.200 Scrk.com
    207.44.236.200 www.Scrk.com
    207.44.236.200 Sdry.com
    207.44.236.200 www.Sdry.com
    207.44.236.200 Searchbee.net
    207.44.236.200 www.Searchbee.net
    207.44.236.200 Searchhotsex.com
    207.44.236.200 www.Searchhotsex.com
    207.44.236.200 Seld.com
    207.44.236.200 www.Seld.com
    207.44.236.200 Sfux.com
    207.44.236.200 www.Sfux.com
    207.44.236.200 Sipo.com
    207.44.236.200 www.Sipo.com
    207.44.236.200 Smds.com
    207.44.236.200 www.Smds.com
    207.44.236.200 Srib.com
    207.44.236.200 www.Srib.com
    207.44.236.200 Srox.com
    207.44.236.200 www.Srox.com
    207.44.236.200 Srsf.com
    207.44.236.200 www.Srsf.com
    207.44.236.200 Ssaw.com
    207.44.236.200 www.Ssaw.com
    207.44.236.200 Ssby.com
    207.44.236.200 www.Ssby.com
    207.44.236.200 Surj.com
    207.44.236.200 www.Surj.com
    207.44.236.200 Tbvg.com
    207.44.236.200 www.Tbvg.com
    207.44.236.200 Tdak.com
    207.44.236.200 www.Tdak.com
    207.44.236.200 Tjar.com
    207.44.236.200 www.Tjar.com
    207.44.236.200 Tjaw.com
    207.44.236.200 www.Tjaw.com
    207.44.236.200 Tjdo.com
    207.44.236.200 www.Tjdo.com
    207.44.236.200 Tjgo.com
    207.44.236.200 www.Tjgo.com
    207.44.236.200 Torc.com
    207.44.236.200 www.Torc.com
    207.44.236.200 Wabq.com
    207.44.236.200 www.Wabq.com
    207.44.236.200 Wabu.com
    207.44.236.200 www.Wabu.com
    207.44.236.200 Wbkb.com
    207.44.236.200 www.Wbkb.com
    207.44.236.200 Wflu.com
    207.44.236.200 www.Wflu.com
    207.44.236.200 I-lookup.net
    207.44.236.200 www.I-lookup.net
    207.44.236.200 Ilookup.com
    207.44.236.200 www.Ilookup.com
    207.44.236.200 surferbar.com
    207.44.236.200 www.surferbar.com
    207.44.236.200 coolfreesoftware.com
    207.44.236.200 www.coolfreesoftware.com
    207.44.236.200 PassThisOn.com
    207.44.236.200 www.PassThisOn.com
    207.44.236.200 whazit.com
    207.44.236.200 www.whazit.com
    207.44.236.200 Address.com
    207.44.236.200 www.Address.com
    207.44.236.200 joker.com
    207.44.236.200 www.joker.com
    207.44.236.200 searching.net
    207.44.236.200 www.searching.net
    207.44.236.200 ultsearch.com
    207.44.236.200 www.ultsearch.com

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\uniq Deleted
    C:\WINDOWS\system32\cwgppb.dll Deleted
    C:\Documents and Settings\Nathan\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVermeans 2.1.lnk Deleted
    C:\DOCUME~1\Nathan\STARTM~1\AntiVermeans 2.1.lnk Deleted
    C:\DOCUME~1\Nathan\STARTM~1\Programs\AntiVermeans Deleted
    C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
    C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
    C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url Deleted
    C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url Deleted
    C:\DOCUME~1\Nathan\FAVORI~1\Online Security Test.url Deleted
    C:\Program Files\AntiVermeans\ Deleted
    C:\Program Files\Image ActiveX Object\ Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End


    Logfile of HijackThis v1.99.1
    Scan saved at 22:43:02, on 13/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Virgin Broadband\PCguard\fws.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\mbssm32.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Virgin Broadband\PCguard\Rps.exe
    C:\Program Files\Messenger\msmsgs.exe
    c:\windows\system32\mbsrm32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Command Software\dvpapi.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Virgin Broadband\advisor\BroadbandadvisorComHandler.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O1 - Hosts: 207.44.236.200 sitefinder.verisign.com
    O1 - Hosts: 207.44.236.200 sitefinder-idn.verisign.com
    O1 - Hosts: 207.44.236.200 coolsearch.com
    O1 - Hosts: 207.44.236.200 www.coolsearch.com
    O1 - Hosts: 207.44.236.200 cool-search.ws
    O1 - Hosts: 207.44.236.200 www.cool-search.ws
    O1 - Hosts: 207.44.236.200 Aavc.com
    O1 - Hosts: 207.44.236.200 www.Aavc.com
    O1 - Hosts: 207.44.236.200 Acjp.com
    O1 - Hosts: 207.44.236.200 www.Acjp.com
    O1 - Hosts: 207.44.236.200 Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 www.Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 Ebch.com
    O1 - Hosts: 207.44.236.200 www.Ebch.com
    O1 - Hosts: 207.44.236.200 Ebdv.com
    O1 - Hosts: 207.44.236.200 www.Ebdv.com
    O1 - Hosts: 207.44.236.200 Ebdw.com
    O1 - Hosts: 207.44.236.200 www.Ebdw.com
    O1 - Hosts: 207.44.236.200 Ebjp.com
    O1 - Hosts: 207.44.236.200 www.Ebjp.com
    O1 - Hosts: 207.44.236.200 Ebkn.com
    O1 - Hosts: 207.44.236.200 www.Ebkn.com
    O1 - Hosts: 207.44.236.200 Ebky.com
    O1 - Hosts: 207.44.236.200 www.Ebky.com
    O1 - Hosts: 207.44.236.200 Eblv.com
    O1 - Hosts: 207.44.236.200 www.Eblv.com
    O1 - Hosts: 207.44.236.200 Ebvr.com
    O1 - Hosts: 207.44.236.200 www.Ebvr.com
    O1 - Hosts: 207.44.236.200 Ecmh.com
    O1 - Hosts: 207.44.236.200 www.Ecmh.com
    O1 - Hosts: 207.44.236.200 Ecwz.com
    O1 - Hosts: 207.44.236.200 www.Ecwz.com
    O1 - Hosts: 207.44.236.200 Ecyb.com
    O1 - Hosts: 207.44.236.200 www.Ecyb.com
    O1 - Hosts: 207.44.236.200 Eduy.com
    O1 - Hosts: 207.44.236.200 www.Eduy.com
    O1 - Hosts: 207.44.236.200 Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 www.Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 Ibmx.com
    O1 - Hosts: 207.44.236.200 www.Ibmx.com
    O1 - Hosts: 207.44.236.200 Icwb.com
    O1 - Hosts: 207.44.236.200 www.Icwb.com
    O1 - Hosts: 207.44.236.200 Icwo.com
    O1 - Hosts: 207.44.236.200 www.Icwo.com
    O1 - Hosts: 207.44.236.200 Icwp.com
    O1 - Hosts: 207.44.236.200 www.Icwp.com
    O1 - Hosts: 207.44.236.200 Iddh.com
    O1 - Hosts: 207.44.236.200 www.Iddh.com
    O1 - Hosts: 207.44.236.200 Idhh.com
    O1 - Hosts: 207.44.236.200 www.Idhh.com
    O1 - Hosts: 207.44.236.200 Ifiz.com
    O1 - Hosts: 207.44.236.200 www.Ifiz.com
    O1 - Hosts: 207.44.236.200 Ifsearch.com
    O1 - Hosts: 207.44.236.200 www.Ifsearch.com
    O1 - Hosts: 207.44.236.200 Iguu.com
    O1 - Hosts: 207.44.236.200 www.Iguu.com
    O1 - Hosts: 207.44.236.200 Isearchhere.com
    O1 - Hosts: 207.44.236.200 www.Isearchhere.com
    O1 - Hosts: 207.44.236.200 Iwantosearch.com
    O1 - Hosts: 207.44.236.200 www.Iwantosearch.com
    O1 - Hosts: 207.44.236.200 Ohyea.org
    O1 - Hosts: 207.44.236.200 www.Ohyea.org
    O1 - Hosts: 207.44.236.200 Opensearch.org
    O1 - Hosts: 207.44.236.200 www.Opensearch.org
    O1 - Hosts: 207.44.236.200 Samz.com
    O1 - Hosts: 207.44.236.200 www.Samz.com
    O1 - Hosts: 207.44.236.200 Saoe.com
    O1 - Hosts: 207.44.236.200 www.Saoe.com
    O1 - Hosts: 207.44.236.200 Sbjr.com
    O1 - Hosts: 207.44.236.200 www.Sbjr.com
    O1 - Hosts: 207.44.236.200 Sbnl.com
    O1 - Hosts: 207.44.236.200 www.Sbnl.com
    O1 - Hosts: 207.44.236.200 Sbnt.com
    O1 - Hosts: 207.44.236.200 www.Sbnt.com
    O1 - Hosts: 207.44.236.200 Scbm.com
    O1 - Hosts: 207.44.236.200 www.Scbm.com
    O1 - Hosts: 207.44.236.200 Sckr.com
    O1 - Hosts: 207.44.236.200 www.Sckr.com
    O1 - Hosts: 207.44.236.200 Scrk.com
    O1 - Hosts: 207.44.236.200 www.Scrk.com
    O1 - Hosts: 207.44.236.200 Sdry.com
    O1 - Hosts: 207.44.236.200 www.Sdry.com
    O1 - Hosts: 207.44.236.200 Searchbee.net
    O1 - Hosts: 207.44.236.200 www.Searchbee.net
    O1 - Hosts: 207.44.236.200 Searchhotsex.com
    O1 - Hosts: 207.44.236.200 www.Searchhotsex.com
    O1 - Hosts: 207.44.236.200 Seld.com
    O1 - Hosts: 207.44.236.200 www.Seld.com
    O1 - Hosts: 207.44.236.200 Sfux.com
    O1 - Hosts: 207.44.236.200 www.Sfux.com
    O1 - Hosts: 207.44.236.200 Sipo.com
    O1 - Hosts: 207.44.236.200 www.Sipo.com
    O1 - Hosts: 207.44.236.200 Smds.com
    O1 - Hosts: 207.44.236.200 www.Smds.com
    O1 - Hosts: 207.44.236.200 Srib.com
    O1 - Hosts: 207.44.236.200 www.Srib.com
    O1 - Hosts: 207.44.236.200 Srox.com
    O1 - Hosts: 207.44.236.200 www.Srox.com
    O1 - Hosts: 207.44.236.200 Srsf.com
    O1 - Hosts: 207.44.236.200 www.Srsf.com
    O1 - Hosts: 207.44.236.200 Ssaw.com
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Virgin Broadband\PCguard\pkR.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\Virgin Broadband\PCguard\FBHR.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKLM\..\Run: [PCguard] "C:\Program Files\Virgin Broadband\PCguard\Rps.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: PCguard Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\Virgin Broadband\PCguard\fws.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
     
  6. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Please continue and do all of the post and then post the logs
     
  7. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    SUPERAntiSpyware Scan Log
    Generated 02/14/2007 at 00:53 AM

    Application Version : 3.5.1016

    Core Rules Database Version : 3183
    Trace Rules Database Version: 1193

    Scan type : Complete Scan
    Total Scan Time : 02:00:44

    Memory items scanned : 499
    Memory threats detected : 0
    Registry items scanned : 6110
    Registry threats detected : 260
    File items scanned : 94197
    File threats detected : 92

    Adware.Tracking Cookie
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][3].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][3].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][2].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt
    C:\Documents and Settings\Nathan\Cookies\[email protected][1].txt

    Adware.MyWay
    HKCR\CLSID\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{014DA6C9-189F-421A-88CD-07CFE51CFF10}
    HKCR\CLSID\{014DA6C9-189F-421A-88CD-07CFE51CFF10}\InProcServer32
    HKCR\MyWayToolBar.NetscapeShutdown
    HKCR\MyWayToolBar.NetscapeShutdown\CLSID
    HKCR\MyWayToolBar.NetscapeShutdown\CurVer
    HKCR\MyWayToolBar.NetscapeShutdown.1
    HKCR\MyWayToolBar.NetscapeShutdown.1\CLSID
    HKCR\MyWayToolBar.NetscapeStartup
    HKCR\MyWayToolBar.NetscapeStartup\CLSID
    HKCR\MyWayToolBar.NetscapeStartup\CurVer
    HKCR\MyWayToolBar.NetscapeStartup.1
    HKCR\MyWayToolBar.NetscapeStartup.1\CLSID
    HKCR\MyWayToolBar.SettingsPlugin
    HKCR\MyWayToolBar.SettingsPlugin\CLSID
    HKCR\MyWayToolBar.SettingsPlugin\CurVer
    HKCR\MyWayToolBar.SettingsPlugin.1
    HKCR\MyWayToolBar.SettingsPlugin.1\CLSID
    HKCR\CLSID\{014DA6CD-189F-421a-88CD-07CFE51CFF10}
    HKCR\CLSID\{014DA6CD-189F-421a-88CD-07CFE51CFF10}\InProcServer32
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\Control
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus\1
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0D2-F8E0-41ad-92A3-14154ECE70AC}\Version
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\Control
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus\1
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0D3-F8E0-41ad-92A3-14154ECE70AC}\Version
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\ProgID
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0D5-F8E0-41ad-92A3-14154ECE70AC}\VersionIndependentProgID
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\ProgID
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0D7-F8E0-41ad-92A3-14154ECE70AC}\VersionIndependentProgID
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\Control
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\InprocServer32#ThreadingModel
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\MiscStatus\1
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\ProgID
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\Programmable
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\TypeLib
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\Version
    HKCR\CLSID\{0494D0DB-F8E0-41ad-92A3-14154ECE70AC}\VersionIndependentProgID
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}\1.0
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}\1.0\0
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}\1.0\0\win32
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}\1.0\FLAGS
    HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC}\1.0\HELPDIR
    HKLM\Software\MyWay
    HKLM\Software\MyWay\myBar
    HKLM\Software\MyWay\myBar#Dir
    HKLM\Software\MyWay\myBar#CurInstall
    HKLM\Software\MyWay\myBar#Id
    HKLM\Software\MyWay\myBar#CacheDir
    HKLM\Software\MyWay\myBar#HistoryDir
    HKLM\Software\MyWay\myBar#Visible
    HKLM\Software\MyWay\myBar#Maximized
    HKLM\Software\MyWay\myBar#SettingsDir
    HKLM\Software\MyWay\myBar\partner
    HKLM\Software\MyWay\myBar\partner#autologin
    HKLM\Software\MyWay\myBar\partner#cfg
    HKLM\Software\MyWay\myBar\partner#mywayurl
    HKLM\Software\MyWay\myBar\partner#search
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Way Speedbar Uninstall
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Way Speedbar Uninstall#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Way Speedbar Uninstall#UninstallString
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC}
    HKLM\Software\Microsoft\Internet Explorer\Toolbar#{0494D0D9-F8E0-41ad-92A3-14154ECE70AC}
    C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE
    C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    C:\Program Files\MyWay\myBar\1.bin\MYUNSETP.HTA
    C:\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS
    C:\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL
    C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT
    C:\Program Files\MyWay\myBar\1.bin\UNINSTALL.INF
    C:\Program Files\MyWay\myBar\1.bin
    C:\Program Files\MyWay\myBar\Cache\00018FF6.bmp
    C:\Program Files\MyWay\myBar\Cache\00019238.bmp
    C:\Program Files\MyWay\myBar\Cache\0001948A.bmp
    C:\Program Files\MyWay\myBar\Cache\0001CABD
    C:\Program Files\MyWay\myBar\Cache\000303F9
    C:\Program Files\MyWay\myBar\Cache\0004CD10
    C:\Program Files\MyWay\myBar\Cache\00093C9F
    C:\Program Files\MyWay\myBar\Cache\0028F317
    C:\Program Files\MyWay\myBar\Cache\002CC6A5
    C:\Program Files\MyWay\myBar\Cache\0045BEAC
    C:\Program Files\MyWay\myBar\Cache\004F3C9B.bin
    C:\Program Files\MyWay\myBar\Cache\004F3CF9.bin
    C:\Program Files\MyWay\myBar\Cache\004F3D66.bin
    C:\Program Files\MyWay\myBar\Cache\007E2EBC
    C:\Program Files\MyWay\myBar\Cache\files.ini
    C:\Program Files\MyWay\myBar\Cache
    C:\Program Files\MyWay\myBar\History\search
    C:\Program Files\MyWay\myBar\History
    C:\Program Files\MyWay\myBar\Settings
    C:\Program Files\MyWay\myBar
    C:\Program Files\MyWay

    Trojan.WinAntiSpyware/WinAntiVirus 2006/2007
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#DeviceDesc
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000#Capabilities
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF\0000\Control
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#Service
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#Legacy
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#ConfigFlags
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#Class
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#ClassGUID
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#DeviceDesc
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000#Capabilities
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VSPF_HK\0000\Control
    HKLM\SYSTEM\CurrentControlSet\Services\vspf
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#Type
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#Start
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#Tag
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#Group
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#DependOnService
    HKLM\SYSTEM\CurrentControlSet\Services\vspf#DependOnGroup
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Security
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Security#Security
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum#INITSTARTFAILED
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#Type
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#Start
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#ErrorControl
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#Tag
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#ImagePath
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#DisplayName
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk#Group
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Security
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Security#Security
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum#0
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum#Count
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum#NextInstance
    HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum#INITSTARTFAILED
    HKU\S-1-5-21-3782857886-3377683052-3907900261-1005\Software\WinAntiVirus Pro 2007
    C:\WINDOWS\system32\stera.job
    C:\Program Files\Common Files\WinAntiVirus Pro 2007\err.log
    C:\Program Files\Common Files\WinAntiVirus Pro 2007\uwa7pcw.exe
    C:\Program Files\Common Files\WinAntiVirus Pro 2007\WAPChk.dll
    C:\Program Files\Common Files\WinAntiVirus Pro 2007
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007\Logs\update.log
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007\Logs\wa6Support.log
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007\Logs
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007\PGE.dat
    C:\Documents and Settings\Nathan\Application Data\WinAntiVirus Pro 2007
    \WA7P\Quar
    \WA7P
    C:\DOCUMENTS AND SETTINGS\NATHAN\LOCAL SETTINGS\TEMP\NI.UWA7P_0001_N91M0809\SETUP.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP114\A0168846.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP114\A0168847.SYS
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP114\A0168852.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP114\A0168862.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP114\A0168871.SYS
    C:\WINDOWS\Prefetch\UWA7PCW.EXE-08941290.pf

    Malware.SpyHeal
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\cuusDLdzc
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\fxadigiKY
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\geiFl
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\Implemented Categories
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\Implemented Categories\{C501EDBE-9E70-11D1-9053-00C04FD9189D}
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\InprocServer32
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\InprocServer32#ThreadingModel
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\ProgID
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\Programmable
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\szAWhp
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\tdCseVihA
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\ToolBoxBitmap32
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\VersionIndependentProgID
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\vwsbvgApboXqa
    HKCR\CLSID\{B0CB769E-2057-5D37-EA39-F7F57583005F}\wstyeur
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}\1.0
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}\1.0\0
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}\1.0\0\win32
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}\1.0\FLAGS
    HKCR\TypeLib\{BE9DD753-BB1A-4B56-9A06-5BD5E02C90AE}\1.0\HELPDIR
    HKCR\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}
    HKCR\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}\ProxyStubClsid
    HKCR\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}\ProxyStubClsid32
    HKCR\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}\TypeLib
    HKCR\Interface\{0A479D87-72AC-4DCE-A3F1-FDC882390F60}\TypeLib#Version
    HKCR\Interface\{161D399B-0789-4402-864E-F4347690BD48}
    HKCR\Interface\{161D399B-0789-4402-864E-F4347690BD48}\ProxyStubClsid
    HKCR\Interface\{161D399B-0789-4402-864E-F4347690BD48}\ProxyStubClsid32
    HKCR\Interface\{161D399B-0789-4402-864E-F4347690BD48}\TypeLib
    HKCR\Interface\{161D399B-0789-4402-864E-F4347690BD48}\TypeLib#Version
    HKCR\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}
    HKCR\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}\ProxyStubClsid
    HKCR\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}\ProxyStubClsid32
    HKCR\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}\TypeLib
    HKCR\Interface\{16737204-F9B6-45D0-BA08-EC632ACA96EA}\TypeLib#Version
    HKCR\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}
    HKCR\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}\ProxyStubClsid
    HKCR\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}\ProxyStubClsid32
    HKCR\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}\TypeLib
    HKCR\Interface\{22C0F9FE-1453-4925-A7C9-7D118611770E}\TypeLib#Version
    HKCR\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}
    HKCR\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}\ProxyStubClsid
    HKCR\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}\ProxyStubClsid32
    HKCR\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}\TypeLib
    HKCR\Interface\{37EEB3B8-A21E-4799-9266-9EC7D945674B}\TypeLib#Version
    HKCR\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}
    HKCR\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}\ProxyStubClsid
    HKCR\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}\ProxyStubClsid32
    HKCR\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}\TypeLib
    HKCR\Interface\{3BEE5AE6-A4D8-4FD3-B5D5-1385CEA2A22C}\TypeLib#Version
    HKCR\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}
    HKCR\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}\ProxyStubClsid
    HKCR\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}\ProxyStubClsid32
    HKCR\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}\TypeLib
    HKCR\Interface\{46593BFA-1D7A-4A56-90EE-88E852649F3D}\TypeLib#Version
    HKCR\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}
    HKCR\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}\ProxyStubClsid
    HKCR\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}\ProxyStubClsid32
    HKCR\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}\TypeLib
    HKCR\Interface\{4A7CC1B7-3BA5-4CF6-8098-56D315EBEE11}\TypeLib#Version
    HKCR\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}
    HKCR\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}\ProxyStubClsid
    HKCR\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}\ProxyStubClsid32
    HKCR\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}\TypeLib
    HKCR\Interface\{55DADDE6-2501-415A-BC5F-6F75D6E771C5}\TypeLib#Version
    HKCR\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}
    HKCR\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}\ProxyStubClsid
    HKCR\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}\ProxyStubClsid32
    HKCR\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}\TypeLib
    HKCR\Interface\{6C6E6CB6-8156-4901-AA42-B535181D17A3}\TypeLib#Version
    HKCR\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}
    HKCR\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}\ProxyStubClsid
    HKCR\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}\ProxyStubClsid32
    HKCR\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}\TypeLib
    HKCR\Interface\{775AD947-7128-4774-8623-55FADB5F74BB}\TypeLib#Version
    HKCR\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}
    HKCR\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}\ProxyStubClsid
    HKCR\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}\ProxyStubClsid32
    HKCR\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}\TypeLib
    HKCR\Interface\{77DF43A0-4CD3-4BE1-B4FC-8B9F3857CBB6}\TypeLib#Version
    HKCR\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}
    HKCR\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}\ProxyStubClsid
    HKCR\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}\ProxyStubClsid32
    HKCR\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}\TypeLib
    HKCR\Interface\{80787CB9-2E40-42BA-927A-C7E09C2C3D2E}\TypeLib#Version
    HKCR\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}
    HKCR\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}\ProxyStubClsid
    HKCR\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}\ProxyStubClsid32
    HKCR\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}\TypeLib
    HKCR\Interface\{8458EDF5-1DFD-4BF0-95AC-1D7463031D92}\TypeLib#Version
    HKCR\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}
    HKCR\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}\ProxyStubClsid
    HKCR\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}\ProxyStubClsid32
    HKCR\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}\TypeLib
    HKCR\Interface\{C5BB6E2B-6CB5-4AAD-AEF7-2484D3E04EEF}\TypeLib#Version
    HKCR\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}
    HKCR\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}\ProxyStubClsid
    HKCR\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}\ProxyStubClsid32
    HKCR\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}\TypeLib
    HKCR\Interface\{E7137690-A900-4F77-824E-EC0177D74FD0}\TypeLib#Version
    C:\Program Files\SpyHeals\sq.ini
    C:\Program Files\SpyHeals

    Trojan.Media-Codec
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Alert Popup#UninstallString
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#user32.dll [ C:\Program Files\Image ActiveX Object\isamntr.exe ]
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run#rare [ C:\Program Files\Image ActiveX Object\pmsnrr.exe ]

    Adware.HotBar (Low Risk)
    C:\PROGRAM FILES\HBINST\HBINST.EXE

    Trojan Downloader-SystemAlert.Process
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP116\A0172998.DLL

    Malware.AntiVermins
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP116\A0173004.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{1450A557-4027-4F57-AFFC-65B5F7AFB22A}\RP116\A0173009.EXE

    Trojan.WinAntiSpyware/WinAntiVirus 2006
    C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWA7P_0001_N91M0809NETINSTALLER.EXE
    C:\WINDOWS\Prefetch\UWA7P_0001_N91M0809NETINSTALL-37605A5E.pf

    RelevantKnowledge Spyware Component
    C:\WINDOWS\SYSTEM32\COMPONENTS\RLXF.DLL
    C:\WINDOWS\SYSTEM32\RLLS.DLL
    C:\WINDOWS\SYSTEM32\RLVKNLG.EXE
     
  8. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Logfile of HijackThis v1.99.1
    Scan saved at 01:09:01, on 14/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\mbssm32.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    c:\windows\system32\mbsrm32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O1 - Hosts: 207.44.236.200 sitefinder.verisign.com
    O1 - Hosts: 207.44.236.200 sitefinder-idn.verisign.com
    O1 - Hosts: 207.44.236.200 coolsearch.com
    O1 - Hosts: 207.44.236.200 www.coolsearch.com
    O1 - Hosts: 207.44.236.200 cool-search.ws
    O1 - Hosts: 207.44.236.200 www.cool-search.ws
    O1 - Hosts: 207.44.236.200 Aavc.com
    O1 - Hosts: 207.44.236.200 www.Aavc.com
    O1 - Hosts: 207.44.236.200 Acjp.com
    O1 - Hosts: 207.44.236.200 www.Acjp.com
    O1 - Hosts: 207.44.236.200 Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 www.Amazingautossearch.com
    O1 - Hosts: 207.44.236.200 Ebch.com
    O1 - Hosts: 207.44.236.200 www.Ebch.com
    O1 - Hosts: 207.44.236.200 Ebdv.com
    O1 - Hosts: 207.44.236.200 www.Ebdv.com
    O1 - Hosts: 207.44.236.200 Ebdw.com
    O1 - Hosts: 207.44.236.200 www.Ebdw.com
    O1 - Hosts: 207.44.236.200 Ebjp.com
    O1 - Hosts: 207.44.236.200 www.Ebjp.com
    O1 - Hosts: 207.44.236.200 Ebkn.com
    O1 - Hosts: 207.44.236.200 www.Ebkn.com
    O1 - Hosts: 207.44.236.200 Ebky.com
    O1 - Hosts: 207.44.236.200 www.Ebky.com
    O1 - Hosts: 207.44.236.200 Eblv.com
    O1 - Hosts: 207.44.236.200 www.Eblv.com
    O1 - Hosts: 207.44.236.200 Ebvr.com
    O1 - Hosts: 207.44.236.200 www.Ebvr.com
    O1 - Hosts: 207.44.236.200 Ecmh.com
    O1 - Hosts: 207.44.236.200 www.Ecmh.com
    O1 - Hosts: 207.44.236.200 Ecwz.com
    O1 - Hosts: 207.44.236.200 www.Ecwz.com
    O1 - Hosts: 207.44.236.200 Ecyb.com
    O1 - Hosts: 207.44.236.200 www.Ecyb.com
    O1 - Hosts: 207.44.236.200 Eduy.com
    O1 - Hosts: 207.44.236.200 www.Eduy.com
    O1 - Hosts: 207.44.236.200 Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 www.Errorfreesearch.com
    O1 - Hosts: 207.44.236.200 Ibmx.com
    O1 - Hosts: 207.44.236.200 www.Ibmx.com
    O1 - Hosts: 207.44.236.200 Icwb.com
    O1 - Hosts: 207.44.236.200 www.Icwb.com
    O1 - Hosts: 207.44.236.200 Icwo.com
    O1 - Hosts: 207.44.236.200 www.Icwo.com
    O1 - Hosts: 207.44.236.200 Icwp.com
    O1 - Hosts: 207.44.236.200 www.Icwp.com
    O1 - Hosts: 207.44.236.200 Iddh.com
    O1 - Hosts: 207.44.236.200 www.Iddh.com
    O1 - Hosts: 207.44.236.200 Idhh.com
    O1 - Hosts: 207.44.236.200 www.Idhh.com
    O1 - Hosts: 207.44.236.200 Ifiz.com
    O1 - Hosts: 207.44.236.200 www.Ifiz.com
    O1 - Hosts: 207.44.236.200 Ifsearch.com
    O1 - Hosts: 207.44.236.200 www.Ifsearch.com
    O1 - Hosts: 207.44.236.200 Iguu.com
    O1 - Hosts: 207.44.236.200 www.Iguu.com
    O1 - Hosts: 207.44.236.200 Isearchhere.com
    O1 - Hosts: 207.44.236.200 www.Isearchhere.com
    O1 - Hosts: 207.44.236.200 Iwantosearch.com
    O1 - Hosts: 207.44.236.200 www.Iwantosearch.com
    O1 - Hosts: 207.44.236.200 Ohyea.org
    O1 - Hosts: 207.44.236.200 www.Ohyea.org
    O1 - Hosts: 207.44.236.200 Opensearch.org
    O1 - Hosts: 207.44.236.200 www.Opensearch.org
    O1 - Hosts: 207.44.236.200 Samz.com
    O1 - Hosts: 207.44.236.200 www.Samz.com
    O1 - Hosts: 207.44.236.200 Saoe.com
    O1 - Hosts: 207.44.236.200 www.Saoe.com
    O1 - Hosts: 207.44.236.200 Sbjr.com
    O1 - Hosts: 207.44.236.200 www.Sbjr.com
    O1 - Hosts: 207.44.236.200 Sbnl.com
    O1 - Hosts: 207.44.236.200 www.Sbnl.com
    O1 - Hosts: 207.44.236.200 Sbnt.com
    O1 - Hosts: 207.44.236.200 www.Sbnt.com
    O1 - Hosts: 207.44.236.200 Scbm.com
    O1 - Hosts: 207.44.236.200 www.Scbm.com
    O1 - Hosts: 207.44.236.200 Sckr.com
    O1 - Hosts: 207.44.236.200 www.Sckr.com
    O1 - Hosts: 207.44.236.200 Scrk.com
    O1 - Hosts: 207.44.236.200 www.Scrk.com
    O1 - Hosts: 207.44.236.200 Sdry.com
    O1 - Hosts: 207.44.236.200 www.Sdry.com
    O1 - Hosts: 207.44.236.200 Searchbee.net
    O1 - Hosts: 207.44.236.200 www.Searchbee.net
    O1 - Hosts: 207.44.236.200 Searchhotsex.com
    O1 - Hosts: 207.44.236.200 www.Searchhotsex.com
    O1 - Hosts: 207.44.236.200 Seld.com
    O1 - Hosts: 207.44.236.200 www.Seld.com
    O1 - Hosts: 207.44.236.200 Sfux.com
    O1 - Hosts: 207.44.236.200 www.Sfux.com
    O1 - Hosts: 207.44.236.200 Sipo.com
    O1 - Hosts: 207.44.236.200 www.Sipo.com
    O1 - Hosts: 207.44.236.200 Smds.com
    O1 - Hosts: 207.44.236.200 www.Smds.com
    O1 - Hosts: 207.44.236.200 Srib.com
    O1 - Hosts: 207.44.236.200 www.Srib.com
    O1 - Hosts: 207.44.236.200 Srox.com
    O1 - Hosts: 207.44.236.200 www.Srox.com
    O1 - Hosts: 207.44.236.200 Srsf.com
    O1 - Hosts: 207.44.236.200 www.Srsf.com
    O1 - Hosts: 207.44.236.200 Ssaw.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKLM\..\RunOnce: [RebootAfterUninstallingFreedom] C:\WINDOWS\system32\runonce.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe


    Logfile of HijackThis v1.99.1
    Scan saved at 01:19:33, on 14/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\mbssm32.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    c:\windows\system32\mbsrm32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKLM\..\RunOnce: [RebootAfterUninstallingFreedom] C:\WINDOWS\system32\runonce.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
     
  9. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    You may want to print this or save it to notepad as we will go to safe mode.

    Fix these with HiJackThis – mark them, close IE, click fix checked

    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe

    O4 - HKLM\..\RunOnce: [RebootAfterUninstallingFreedom] C:\WINDOWS\system32\runonce.exe

    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)

    DownLoad http://www.downloads.subratam.org/KillBox.zip or
    http://www.thespykiller.co.uk/files/killbox.exe

    Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

    Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

    C:\WINDOWS\system32\mbssm32.exe

    Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

    START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

    Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

    Not all temp files will delete and that is normal
    Empty the recycle bin
    Boot and post a new hijack log from normal NOT safe mode

    Please give feedback on what worked/didn’t work and the current status of your system
     
  10. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Logfile of HijackThis v1.99.1
    Scan saved at 02:05:13, on 14/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Common Files\Teknum Systems\updsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe


    All files were deleted. All instructions worked. System seems fine. System Alert messages have disappeared.
     
  11. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    This is still there - fix it and make sure that file is gone

    O4 - HKLM\..\Run: [mbssm32] C:\WINDOWS\system32\mbssm32.exe
     
  12. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Logfile of HijackThis v1.99.1
    Scan saved at 19:21:00, on 14/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

    Fixed. Seems to have gone this time. Am I in the clear now???
     
  13. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    I missed one

    Fix these with HiJackThis – mark them, close IE, click fix checked

    O23 - Service: bits4p(bits4p) (bits4p) - Unknown owner - C:\WINDOWS\system32\bitsprx4.exe (file missing)

    Click Start > Run > and type in:

    services.msc

    Click OK.

    In the services window find this exact name

    bits4p(bits4p)

    Rightclick and choose "Properties". Beside "Startup Type" in the dropdown menu select "Disabled". On the "General" tab under "Service Status" click the "Stop" button to stop the service. Click Apply then OK. File-Exit the Services utility.
    ===================
    Clean [​IMG]
    If you feel its is fixed mark it solved via Thread Tools above

    Turn off restore points, boot, turn them back on – here’s how

    http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam
     
  14. Villa

    Villa Thread Starter

    Joined:
    Feb 13, 2007
    Messages:
    15
    Logfile of HijackThis v1.99.1
    Scan saved at 19:48:51, on 14/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    C:\Program Files\palmOne\Hotsync.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10.*.*.*;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Broadbandadvisor.exe] "C:\Program Files\Virgin Broadband\advisor\Broadbandadvisor.exe" /AUTORUN
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
    O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
    O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.virgin.net/
    O16 - DPF: {1230CB21-C88D-11CF-0000-000000000000} - http://www.browserupdate.co.uk/cabs/ukca0030/ukca0030.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151504415281
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

    It has gone. Don't understand how or why but thanks for all your help. Brilliant. Should i delete 'hoster, smitfraud and killbox' files from desktop??? I will keep Superanti spyware and hijack this just in case!
     
  15. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Hoster and smitfraud yes - killbox is a nice little utility I'd keep
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/543804

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice