Solved: Paytime.exe

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Hugewally

Thread Starter
Joined
Dec 27, 2005
Messages
7
Had paytime.exe breakin the computer. Norton Anti-virsus killed most of it. Now I think that all I'm left with is a desktop background that i can't change.

Already have Hijack This, Cleanup!, Killbox, ewido, drweb-cureit.exe, smitRem.exe. Have run them and killed somethings, but obviously not all.



Have run and posted below results from HJT, ewido & kaspersky.
_____________________________________
Logfile of HijackThis v1.99.1
Scan saved at 11:41:29 AM, on 12/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Common Files\Symantec Shared\ccApp.exe
F:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe
F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Logitech\MouseWare\system\em_exec.exe
F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
F:\WINDOWS\System32\ups.exe
F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
F:\Program Files\ISS\BlackICE\blackd.exe
F:\Program Files\ewido anti-malware\ewidoctrl.exe
F:\Program Files\ISS\BlackICE\blackice.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\spywarebegone\SpywareBeGone.exe
F:\Program Files\Common Files\ACD Systems\IDBSvr.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f320.mail.yahoo.com/ym/ShowFolder?rb=Inbox&reset=1&YY=93479&YN=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AWMON] "F:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [MediaFace Integration] F:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] F:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [Spyware Begone] "F:\Program Files\spywarebegone\SpywareBeGone.exe" -FastScan
O4 - Startup: Adobe Gamma.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlackICE PC Protection.lnk = F:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/117p/html/gtdownlr.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/HPISWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126990379734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127194961679
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: RapApp - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

_____________________________________
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 10:16:47 AM, 12/27/2005
+ Report-Checksum: 96E95C01
+ Scan result:
No infected objects found.
::Report End
______________________________________
KASPERSKY ON-LINE SCANNER REPORTKASPERSKY ON-LINE SCANNER REPORT
Tuesday, December 27, 2005 10:19:08
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build
2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 27/12/2005
Kaspersky Anti-Virus database records: 167706


Scan Settings
Scan using the following antivirus databaseextended
Scan Archivestrue
Scan Mail Basesfalse

Scan TargetMy Computer
A:\
D:\
E:\
F:\
G:\

Scan Statistics
Total number of scanned objects316796
Number of viruses found6
Number of infected objects96
Number of suspicious objects0
Duration of the scan process17963 sec

Infected Object NameVirus Name
F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076358.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076359.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076360.VBS
Infected: Email-Worm.VBS.Gedza

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076361.VBS
Infected: Email-Worm.VBS.Gedza

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076362.VBS
Infected: Email-Worm.VBS.Gedza

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076363.VBS
Infected: Email-Worm.VBS.Gedza

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076364.dll
Infected: Trojan-Spy.Win32.Small.dg

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076365.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076366.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076367.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076368.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076369.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076370.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076371.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076372.exe
Infected: Trojan.Win32.StartPage.adi

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076373.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076374.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076375.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076376.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076377.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076378.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076379.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076380.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076381.exe
Infected: Trojan.Win32.Crypt.e

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076382.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076383.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076384.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076385.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076386.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076387.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076388.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076389.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076390.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076391.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076392.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076393.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076394.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076395.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076396.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076397.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076398.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076399.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076400.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076401.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076402.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076403.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076404.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076405.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076406.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076407.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076408.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076409.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076410.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076411.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076412.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076413.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076414.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076415.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076416.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076417.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076418.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076419.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076420.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076421.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076422.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076423.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076424.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076425.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076426.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076427.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076428.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076429.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076430.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076431.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076432.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076433.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076434.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076435.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076436.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076437.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076438.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076439.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076440.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076441.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076442.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076443.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076444.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076445.exe
Infected: Email-Worm.Win32.VB.an

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076446.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076447.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076448.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076449.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076450.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076451.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076452.exe
Infected: Packed.Win32.Klone.b

F:\System Volume
Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076458.exe
Infected: Packed.Win32.Klone.b

Scan process completed.
 
Joined
Feb 15, 2004
Messages
12,302
Disable Adwatch

Please disable AdWatch, as it may hinder the removal of some entries.
To disable AdWatch:

right-click the AW icon in the sys tray and select "Unload Ad-Watch" and also
untick load adwatch at system start and automatic when you have finished clean
ing open adaware and click on the adwatch button and then reverse the settings


Also make sure ewido's security guard is also disabled as they can interfere with the fixes.


go here and uninstall Spyware Begone, delete its folder from F:\program files!



* Click here to download smitRem.zip.


for W2k & XP

http://noahdfear.geekstogo.com/click counter/click.php?id=1




* Save the file to your desktop.
* Unzip smitRem.zip to extract the two files it contains.
* Do not do anything with it yet. You will run the RunThis.bat file later in safe mode.



*Download Cleanup from Here


http://www.stevengould.org/software/cleanup/download.html




* A window will open and choose SAVE, then DESKTOP as the destination.
* On your Desktop, click on Cleanup40.exe icon.
* Then, click RUN and place a checkmark beside "I Agree"
* Then click NEXT followed by START and OK.
* A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
* Click OK
* DO NOT RUN IT YET



* Download the trial version of Ewido Security Suite.


http://www.ewido.net/en/


* Install ewido.
* During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
* Launch ewido
* It will prompt you to update click the OK button and it will go to the main screen
* On the left side of the main screen click update
* Click on Start and let it update.
* DO NOT run a scan yet. You will do that later in safe mode.



* Click here for info on how to boot to safe mode if you don't already know how.


http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam



* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.


* Restart your computer into safe mode now. Perform the following steps in safe mode:


* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"


O4 - HKCU\..\Run: [Spyware Begone] "F:\Program Files\spywarebegone\SpywareBeGone.exe" -FastScan
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/117p/html/gtdownlr.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)



* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.



* Run Ewido:

* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop



* Run Cleanup:

* Click on the "Cleanup" button and let it run.
* Once its done, close the program.


* Go to Control Panel > Internet Options. Click on the Programs tab then
click the "Reset Web Settings" button. Click Apply then OK.



* Next go to Control Panel > Display. Click on the "Desktop" tab then click
the "Customize Desktop" button. Click on the "Web" tab. Under "Web Pages" you
should see an entry checked called something like "Security info" or similar.
If it is there, select that entry and click the "Delete" button. Click OK
then Apply and OK.


* Restart back into Windows normally now.



Run an online antivirus check from

http://www.kaspersky.com/virusscanner



* Run ActiveScan online virus scan here

http://www.pandasoftware.com/products/activescan.htm


When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
- Save the results from the scan!


post another hijack this log, the ewido and active scan logs and
the contents of smitfiles.txt from the smitRem folder
 

Hugewally

Thread Starter
Joined
Dec 27, 2005
Messages
7
Unloaded & disabled Ad-Watch.

Deleted SpywareBegone program and folder.

Installed and ran everything that was listed.

Still have the problem with the unchangeable desktop background.

Logfile of HijackThis v1.99.1
Scan saved at 2:27:31 PM, on 12/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f320.mail.yahoo.com/ym/ShowFolder?rb=Inbox&reset=1&YY=93479&YN=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [MediaFace Integration] F:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] F:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [Spyware Begone] "F:\Program Files\spywarebegone\SpywareBeGone.exe" -FastScan
O4 - Startup: Adobe Gamma.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlackICE PC Protection.lnk = F:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/117p/html/gtdownlr.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://ispe.sdc.hp.com/awebui/jsp/answerweb/applets/HPISWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126990379734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127194961679
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: RapApp - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
________________________________________
ewido anti-malware - Scan report

+ Created on: 3:37:47 PM, 12/27/2005
+ Report-Checksum: 566826B5
+ Scan result: No infected objects found.
::Report End

__________________________________________
smitRem © log file
version 2.8


by noahdfear

Microsoft Windows XP [Version 5.1.2600]
The current date is: Tue 12/27/2005
The current time is: 14:32:10.16

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

spyaxe uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 780 'explorer.exe'

Starting registry repairs

Deleting files

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN! :)
__________________________________________
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, December 27, 2005 18:55:21
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 27/12/2005
Kaspersky Anti-Virus database records: 167870
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: false

Scan Target - My Computer:
A:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 108219
Number of viruses found: 6
Number of infected objects: 96
Number of suspicious objects: 0
Duration of the scan process: 9311 sec

Infected Object Name - Virus Name
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076358.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076359.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076360.VBS Infected: Email-Worm.VBS.Gedza
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076361.VBS Infected: Email-Worm.VBS.Gedza
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076362.VBS Infected: Email-Worm.VBS.Gedza
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076363.VBS Infected: Email-Worm.VBS.Gedza
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076364.dll Infected: Trojan-Spy.Win32.Small.dg
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076365.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076366.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076367.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076368.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076369.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076370.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076371.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076372.exe Infected: Trojan.Win32.StartPage.adi
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076373.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076374.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076375.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076376.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076377.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076378.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076379.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076380.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076381.exe Infected: Trojan.Win32.Crypt.e
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076382.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076383.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076384.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076385.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076386.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076387.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076388.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076389.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076390.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076391.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076392.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076393.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076394.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076395.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076396.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076397.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076398.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076399.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076400.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076401.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076402.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076403.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076404.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076405.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076406.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076407.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076408.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076409.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076410.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076411.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076412.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076413.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076414.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076415.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076416.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076417.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076418.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076419.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076420.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076421.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076422.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076423.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076424.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076425.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076426.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076427.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076428.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076429.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076430.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076431.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076432.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076433.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076434.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076435.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076436.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076437.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076438.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076439.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076440.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076441.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076442.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076443.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076444.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076445.exe Infected: Email-Worm.Win32.VB.an
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076446.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076447.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076448.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076449.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076450.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076451.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076452.exe Infected: Packed.Win32.Klone.b
F:\System Volume Information\_restore{9461A339-F3A1-415A-8BEF-13BC2BACDE25}\RP163\A0076458.exe Infected: Packed.Win32.Klone.b

Scan process completed.
______________________________________

Panda software scan

No viruses or other malicious software have been found!

_______________________________________
 
Joined
Feb 15, 2004
Messages
12,302
was that hijack this ran in safe mode, if so run another from normal mode!


have hijack this fix these entries close all progsa nd browsers and click FIX!


O4 - HKCU\..\Run: [Spyware Begone] "F:\Program Files\spywarebegone\SpywareBeGone.exe" -FastScan
O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://ispe.sdc.hp.com/awebui/jsp/an...WebManager.CAB
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://ispe.sdc.hp.com/awebui/jsp/an...WebManager.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)




go to this site and download these tools and once you get both
adaware Se 1.6 and spybot, update both of them.

Set adaware to do a full system scan and deselect, "search for neglible risk
entries". Click next to start the scan. Delete everything adaware finds.

reboot and now run spybot

Spybot: Search and destroy.

Delete what spybot finds marked in red. After updating spybot hit the
immunize button.

reboot again


With CWshredder close all browsers and programmes and select the FIX button.



Go here and download Microsoft Antispyware Beta. First in the top menu click
File then Check for updates to download the definitons updates.

After updating look in the right side of the main window under "Run Quick
Scan Now" and click Spyware scan options. In that window put a tick by Run a
full system scan and then put a check by all three options below that then
click Run Scan now.

When the scan is finished, let it fix anything that it finds (have it
quarantine the items that have that option rather than delete just in case.
It is a beta program and there may be false positives)

Restart your computer.


All tools can be downloaded at the link below and found on that page!


. Microsoft® Windows AntiSpyware
. Trend micro CWShredder
. SpyBot search and destroy
. AdAware SE personal


http://www.majorgeeks.com/downloads31.html



post another log
 

Hugewally

Thread Starter
Joined
Dec 27, 2005
Messages
7
Yes, the above HJT was in safe mode.

Re-ran HJT in normal start-up and only one of the Hewlett-Packard strings was present. Checked it and clicked Fix.

Updated and ran Ad-Aware full scan with "neglible risk entries" deselected - Nothing detected/found.

Re-booted to normal mode.

Updated and ran Spybot: Search and destroy - Nothing detected/found.

Re-booted to normal mode.

Ran CWshredder - Nothing detected/found.

Re-booted to normal mode.

Updated, configured and ran MS Antispyware Beta program - Nothing detected/found.

Re-booted to normal mode.

Ran HJT again - results below.

Logfile of HijackThis v1.99.1
Scan saved at 10:04:19 PM, on 12/27/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Common Files\Symantec Shared\ccApp.exe
F:\Program Files\ISS\BlackICE\blackd.exe
F:\WINDOWS\Mixer.exe
F:\WINDOWS\Mixer.exe
F:\Program Files\ewido anti-malware\ewidoctrl.exe
F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
F:\Program Files\Logitech\MouseWare\system\em_exec.exe
F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
F:\WINDOWS\System32\ups.exe
F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
F:\Program Files\Microsoft AntiSpyware\gcasServ.exe
F:\Program Files\ISS\BlackICE\blackice.exe
F:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
F:\WINDOWS\system32\wuauclt.exe
F:\Program Files\Common Files\ACD Systems\IDBSvr.exe
F:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f320.mail.yahoo.com/ym/ShowFolder?rb=Inbox&reset=1&YY=98099&YN=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [MediaFace Integration] F:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "F:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] F:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - Startup: Adobe Gamma.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlackICE PC Protection.lnk = F:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126990379734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127194961679
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: RapApp - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
_______________________________________________

Still have the same problem with the non-changable desktop background.
 
Joined
Feb 15, 2004
Messages
12,302
clean log.

what do you mean by desktop, is it you can't change to Xp theme ? Or your desktop os locked?

Try these fixes !


download Luna.zip.


http://castlecops.com/zx/flrman1/luna.zip

Download it and unzip it to extract the luna.msstyles file
it contains. Copy the luna.msstyles file to the C:\WINDOWS\Resources\Themes\Luna folder.

Restart your machine and go to Display Properties and you should be able to
choose the XP theme again.


or try this if that's not the problem!


Go to Display properties and click the desktop tab.

Click the Customize Desktop Button.

Click the Web tab and remove the checkmark from the the Lock Desktop Items
box.
Apply.
Apply and Exit Display properties.

In display Properties > Desktop
Choose a new background color and picture. Apply.

Close Display properties. If you need to, click the desktop and press F5 to
refresh.



you should now turn off system restore to flush out the bad restore points and
then re-enable it and make a new clean restore point.


How to turn off system restore

http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam


http://support.microsoft.com/default.aspx?scid=kb;[LN];310405


here's some free tools to keep you from getting infected in the future.


to stop reinfection get these two tools, spywareguard and spywareblaster
from


http://www.javacoolsoftware.com/downloads.html


get the hosts file from here.



http://www.mvps.org/winhelp2002/hosts.htm



put it into :


Windows XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98\ME = C:\WINDOWS



ie-spyad.Puts over 5000 sites in your restricted zone so you'll be protected

when you visit innocent-looking sites that aren't actually innocent at all.

https://netfiles.uiuc.edu/ehowes/www/resource.htm



http://www.winpatrol.com/winpatrol.html



Use spybot's immunize button and use spywareblaster' enable
protection once you update it. you can put spybot's hosts file into
your own and lock it.



I would also suggest switching to Mozilla's firefox browser, it's safer, has
a built in pop up blocker, blocks cookies and adds. Mozilla Thunderbird is also a good
e-mail client.

http://www.mozilla.org/


Read here to see how to tighten your security:

http://forums.techguy.org/t208517.html


A good overall guide for firewalls, anti-virus, and anti-trojans as well as
regular spyware cleaners.

http://www.firewallguide.com/anti-trojan.htm



you can mark your own thread solved through thread tools at the top of
the page.
 

Hugewally

Thread Starter
Joined
Dec 27, 2005
Messages
7
you can mark your own thread solved through thread tools at the top of the page.
I would, except I still have the problem... lol

what do you mean by desktop, is it you can't change to Xp theme ? Or your desktop os locked?
I can change the themes all day long. What I can't change is the desktop background. Desktop>right-click>properties>left-click>Display Properties>

All of the other tabs (Themes/Screen Saver/Apperance/Settings) work fine.

Pressing F5 has no effect.

The problem is at the Desktop Tab. Cannot select any of the listed background pictures. Can't scroll through them. The browse & position button/options are grayed out. All i can do is either select the color (for the desktop icon/shortcuts text background) and Customize Desktop (and OK/Cancel & Apply if needed). Sitting at the bottom of the list of background pictures that I should be able to select is an internet page labeled "desktop". At least I think its an internet page as is has the MS IE logo (blue e) next to it.

Customize Desktop>General all works ok. I have checks in the boxes for My Documents/My Computer/My Network Places. Internet Explorer and Run Desktop Cleanup Wizard are unchecked.

Customize Desktop>General>Web appears to be ok too. Unchecked are My Current Home Page & Lock desktop items. These have not been affected since the problem started and even checking them together of seperatly has no affect on not being able to change the desktop background.

No matter what we do, I can't place a picture as my desktop background. Even with having a picture displayed in any program and selecting 'display as background' doesn't work. When i do that, the screen flickers like it normally would when changing the background, but the plain blue screen i have remains. Logging off the computer, I see whatever picture I have selected as the current background flash on the screen momentarily before shutdown.

On other thing I've noticed. When I go Desktop>right-click>properties>left-click>Display Properties and the Display Properties window opens up on the Theme tab, in the sample window, the background starts off as what i currently have as the desktop background - plain dark blue (which i can't change). After about one second, that color changes to white (but only in the sample window. Keep in mind that inside the sample window is also a sample Active Window box, but that doesn't change at all, just the sample background around it. The sample window background will change to whatever color i use from the Desktop tab.

Latest HJT...

Logfile of HijackThis v1.99.1
Scan saved at 11:54:55 AM, on 12/28/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Common Files\Symantec Shared\ccApp.exe
F:\WINDOWS\Mixer.exe
F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe
F:\Program Files\Microsoft AntiSpyware\gcasServ.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\ISS\BlackICE\blackice.exe
F:\Program Files\Logitech\MouseWare\system\em_exec.exe
F:\Program Files\ISS\BlackICE\blackd.exe
F:\Program Files\ewido anti-malware\ewidoctrl.exe
F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
F:\WINDOWS\System32\ups.exe
F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
F:\WINDOWS\system32\ntvdm.exe
F:\PROGRA~1\BILLPS~1\WINPAT~1\WINPAT~1.EXE
F:\WINDOWS\Explorer.EXE
F:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.f320.mail.yahoo.com/ym/ShowFolder?rb=Inbox&reset=1&YY=98099&YN=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.rr.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Roadrunner
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [MediaFace Integration] F:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [FineReader7NewsReaderPro] "F:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "F:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinPatrol] F:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [SpybotSnD] "F:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [SBAutoUpdate] "F:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Norton SystemWorks] F:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - Startup: Adobe Gamma.lnk = F:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlackICE PC Protection.lnk = F:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.rr.com
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126990379734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127194961679
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Adobe LM Service - Adobe Systems - F:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: GhostStartService - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: RapApp - Internet Security Systems, Inc. - F:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

This is what my Display Properties looks like...
www.ninechat.com/accounts/mike/images/denied.jpg
 

Hugewally

Thread Starter
Joined
Dec 27, 2005
Messages
7
Problem solved by using the steps on page 2 from the Solved: Cant get rid of virus thread. http://forums.techguy.org/security/425496-solved-cant-get-rid-virus.html

Downloaded, installed and ran Cleandesktop and that took care of the remaining problem. Only problem i had with Cleandesktop was it wouldn't automatically install/extract to the listed folder. I had to manually create the new folder for it and run winzip to extract it to that folder. After that it was open the folder and follow the instructions in the quote below...

Download and save Cleandesktop to your computer from this link: http://www.thespykiller.co.uk/files/cleandesktop.exe and double click on the cleandesktop.exe

It will automatically extract to c:\desktopclean where it needs to be to run and will automatically run the cleandesktop.vbs script

If it doesn't open then go to c:\desktopclean and double click on the cleandesktop.vbs Do not run any other file from there please unless asked to

If you have script blocking enabled you will get a warning about a malicious script wanting to run. Please allow this script to run. It is not malicious.

If you get a message when you first run it "Can not find script file "blah blah blah" then don't worry just doubleclick the cleandesktop.vbs script again you sometimes get that message when a script blocker blocks the script

It will then kill Explorer. You will lose your taskbar and desktop. It will repair the registry entries returning your normal desktop and context menu functions.

It will restart Explorer.

Once you have performed the big cleanup, each of the other Users on the System needs to be signed in to clean up their desktop and regain the right click.

I have included another vbs to do this. It is named Other Profiles Regfix.vbs

Have each User sign in and run Other Profiles Regfix.vbs
Open C:\ (Go to Start>Run and type C: Press enter) and Open the c:\desktopclean folder. Double click on Other Profiles Regfix.vbs

Explorer will be ended and that user's active desktop registry entries will be repaired. Explorer will be restarted.

To restore the desktop to whatever picture you normally have right click on a blank part of desktop & select properties/desktop & select your prefered picture press apply & then ok to exit and then press F5

You will need to do this step for every user account.
Life is good again! :D

Many thanks to you guys for all the help!!! (y) (y) (y)
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top