Spammed

[neoyanderson]

hey, I've been recently getting alot of spam and whenever i run the SpyBot and the Ad Aware it detects tons of stuff. But whenever I delete it, new ones come up all the time even when my internet activity is minimal. Here's my HijackLog. Please help

Logfile of HijackThis v1.97.7
Scan saved at 9:18:48 PM, on 9/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\iexplorer.exe
C:\WINDOWS\System32\winhelpsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\System32\explorer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AIM\aim.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\WINDOWS\System32\LiacT2W.exe
C:\WINDOWS\System32\Hcj2s6.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Yuuji\Desktop\HijackThis.exe
C:\Program Files\Web_Rebates\WebRebates0.exe

R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Microsoft Services] explorer.exe
O4 - HKLM\..\Run: [Internet Explorer] iexplorer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nTHroy] C:\documents and settings\yuuji\local settings\temp\nTHroy.exe
O4 - HKLM\..\Run: [fD] C:\documents and settings\yuuji\local settings\temp\fD.exe
O4 - HKLM\..\Run: [4PG772L3EPSJQ3] C:\WINDOWS\System32\Bdka1zT9.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Ix] C:\documents and settings\yuuji\local settings\temp\Ix.exe
O4 - HKLM\..\Run: [FN7] C:\documents and settings\yuuji\local settings\temp\FN7.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [dZMlvj] C:\documents and settings\yuuji\local settings\temp\dZMlvj.exe
O4 - HKLM\..\RunServices: [Windows Help Service] winhelpsv.exe
O4 - HKLM\..\RunServices: [Microsoft Services] explorer.exe
O4 - HKLM\..\RunServices: [Internet Explorer] iexplorer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Internet Explorer] iexplorer.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKLM\..\RunOnce: [Internet Explorer] iexplorer.exe
O4 - HKCU\..\RunOnce: [Internet Explorer] iexplorer.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O9 - Extra button: AIM (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...dded9202b0f3:b114d662836ab26b48b51cac40aff495
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

 

[Cheeseball81]

I think the Webrebates0.exe is a backdoor trojan
You might wanna try running CWShredder (http://www.majorgeeks.com/download4086.html)
And SpyBot Search & Destory
(http://www.safer-networking.org/en/index.html)