HiJack This LOG -- Need urgent help please, if possible

Question

I have this [what I think is] spyware program on my computer. It is a porn site/add that pops up every 15 minutes or so. Also, my homepage is constantly changed, there are links on my favorites list that I never put there. Also - everyone this porn thing pops up my AOL disconnects and it just screws everything up. Have tried AOL spyware remover as well as SpyBot. The icon goes away for about 15 minutes but then returns. Please help!!   Angela   REPORT: Logfile of HijackThis v1.99.1Scan saved at 2:28:38 AM, on 3/27/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\WINDOWS\System32\svchost.exeC:\PROGRA~1\Toolbar\TBPSSvc.exeC:\WINDOWS\wanmpsvc.exeC:\Program Files\Common Files\WinTools\WToolsS.exec:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\Toolbar\TBPS.exeC:\PROGRA~1\Toolbar\PIB.exeC:\Program Files\Common Files\WinTools\WToolsA.exeC:\Program Files\Common Files\WinTools\WSup.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\WINDOWS\System32\systime.exeC:\WINDOWS\msmsgr2.exeC:\Program Files\Media Access\MediaAccK.exeC:\WINDOWS\System32\systime.exeC:\Program Files\Media Access\MediaAccess.exeC:\Program Files\AIM\aim.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\America Online 9.0a\aoltray.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32	askmgr.exeC:\Program Files\America Online 9.0a\waol.exeC:\Program Files\America Online 9.0a\shellmon.exeC:\Program Files\Common Files\Aol\aoltpspd.exeC:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.phpR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.phpR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://213.159.117.134/index.phpO1 - Hosts: 127.0.0.3 www.greg-tut.comO1 - Hosts: 127.0.0.3 nylons*xy.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 www.nylons*xy.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 vparivalka.comO1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.comO1 - Hosts: 127.0.0.3 www.awmdabest.comO1 - Hosts: 127.0.0.3 www.s*xfiles.nu (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 awmdabest.comO1 - Hosts: 127.0.0.3 s*exfiles.nu (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 allforadult.comO1 - Hosts: 127.0.0.3 www.allforadult.comO1 - Hosts: 127.0.0.3 www.iframe.bizO1 - Hosts: 127.0.0.3 iframe.bizO1 - Hosts: 127.0.0.3 www.newiframe.bizO1 - Hosts: 127.0.0.3 newiframe.bizO1 - Hosts: 127.0.0.3 www.vesbiz.bizO1 - Hosts: 127.0.0.3 vesbiz.bizO1 - Hosts: 127.0.0.3 www.pizdato.bizO1 - Hosts: 127.0.0.3 pizdato.bizO1 - Hosts: 127.0.0.3 www.aaas*xypics.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 aaas*xypics.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 www.virgin-tgp.netO1 - Hosts: 127.0.0.3 virgin-tgp.netO1 - Hosts: 127.0.0.3 www.awmcash.bizO1 - Hosts: 127.0.0.3 awmcash.bizO1 - Hosts: 127.0.0.3 buldog-stats.comO1 - Hosts: 127.0.0.3 www.buldog-stats.comO1 - Hosts: 127.0.0.3 fregat.drocherway.comO1 - Hosts: 127.0.0.3 slutmania.bizO1 - Hosts: 127.0.0.3 www.slutmania.bizO1 - Hosts: 127.0.0.3 toolbarpartner.comO1 - Hosts: 127.0.0.3 www.toolbarpartner.comO1 - Hosts: 127.0.0.3 www.megapornix.comO1 - Hosts: 127.0.0.3 megapornix.comO1 - Hosts: 127.0.0.3 www.sp2fu*ked.biz (I added in the * b/c wouldn’t post with actual word)O1 - Hosts: 127.0.0.3 sp2fu*ked.biz (I added in the * b/c wouldn’t post with actual word)O1 - Hosts: 127.0.0.3 greg-tut.comO1 - Hosts: http://213.159.117.133/dkprogs/hosts.txtO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {0F9561D0-03B2-44a3-89A6-E95E417CBA25} - C:\WINDOWS\cerbmod.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dllO2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dllO2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dllO2 - BHO: (no name) - {A78860C8-EE1A-46DF-A97F-E3E6D433E80B} - C:\WINDOWS\SYSTEM32\21c.dllO2 - BHO: (no name) - {BAFCA86F-43D7-3D0F-8928-4AE679FB59C5} - C:\WINDOWS\System32\pdeqabxh.dllO2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765723548} - C:\WINDOWS\System32\wer3548.dllO2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS\Downloaded Program Files\SbCIe028.dllO2 - BHO: (no name) - {F3084F37-AE87-8F05-D71B-FC1D863510CE} - C:\WINDOWS\System32\xwktaj.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero	oolbar.dllO3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dllO3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar	oolbar.dllO4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exeO4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exeO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exeO4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [AOL Spyware Protection] 'C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe'O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\System32\systime.exeO4 - HKLM\..\Run: [_Cat4] C:\WINDOWS\msmsgr2.exeO4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exeO4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exeO4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /bootO4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /bootO4 - HKCU\..\Run: [SysTime] C:\WINDOWS\System32\systime.exeO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /backgroundO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\Downloaded Program Files\SbCIe028.dllO9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exeO9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO15 - Trusted Zone: *.blazefind.com (HKLM)O15 - Trusted Zone: *.clickspring.net (HKLM)O15 - Trusted Zone: *.flingstone.com (HKLM)O15 - Trusted Zone: *.mt-download.com (HKLM)O15 - Trusted Zone: *.my-internet.info (HKLM)O15 - Trusted Zone: *.searchbarcash.com (HKLM)O15 - Trusted Zone: *.searchmiracle.com (HKLM)O15 - Trusted Zone: *.skoobidoo.com (HKLM)O15 - Trusted Zone: *.slotch.com (HKLM)O15 - Trusted Zone: *.slotchbar.com (HKLM)O15 - Trusted Zone: *.windupdates.com (HKLM)O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)O15 - Trusted Zone: *.ysbweb.com (HKLM)O15 - Trusted IP range: 67.19.178.84 (HKLM)O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k22675/sb028.cabO16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cabO16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:
osuch.mht!http://www.awmdabest.com/bltd/1884.chm::/file.exeO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c8.cabO16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cabO16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.brightstreet.com/cif/download/bin/actxcab.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{1FB27EEF-0921-4595-BAED-925B49E00D74}: NameServer = 205.188.146.145O17 - HKLM\System\CS1\Services\Tcpip\..\{1FB27EEF-0921-4595-BAED-925B49E00D74}: NameServer = 205.188.146.145O18 - Protocol: relatedlinks - {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} - (no file)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeO23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\aolserv.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exeO23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exeO23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exeO23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exeO23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

zbestwun2001 · Answer

PeachAngie65, Welcome..... First of all I would like you to download CWShredder.exe to your desktop and install it. 1. Click ' Check For Update' ( If an update isn't available, skip to step #4.) 2. Click ' Click here to Download the upate'. 3. When the new version has been downloaded, click ' Save'. 4. Click ' Fix ->' Run HiJackThis then: 1. Click 'Config...' 2. Click 'Misc Tools' 3. Click 'Open Process manager' Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following C:\PROGRA~1\Toolbar\TBPSSvc.exeC:\Program Files\Common Files\WinTools\WToolsS.exeC:\PROGRA~1\Toolbar\TBPS.exeC:\PROGRA~1\Toolbar\PIB.exeC:\Program Files\Common Files\WinTools\WToolsA.exeC:\Program Files\Common Files\WinTools\WSup.exeC:\WINDOWS\System32\systime.exeC:\WINDOWS\msmsgr2.exeC:\WINDOWS\System32\systime.exeC:\Program Files\Media Access\MediaAccess.exe Now double-check and make sure that only those item(s) above are highlighted, then click ' Kill process'. Now, click ' Refresh', check again, and repeat this step if any remain. Open HJT this and tick these entries if present: C:\PROGRA~1\Toolbar\TBPSSvc.exeC:\Program Files\Common Files\WinTools\WToolsS.exeC:\PROGRA~1\Toolbar\TBPS.exeC:\PROGRA~1\Toolbar\PIB.exeC:\Program Files\Common Files\WinTools\WToolsA.exeC:\Program Files\Common Files\WinTools\WSup.exeC:\WINDOWS\System32\systime.exeC:\WINDOWS\msmsgr2.exeC:\WINDOWS\System32\systime.exeC:\Program Files\Media Access\MediaAccess.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.phpR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.phpR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://213.159.117.134/index.phpO1 - Hosts: 127.0.0.3 www.greg-tut.comO1 - Hosts: 127.0.0.3 nylons*xy.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 www.nylons*xy.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 vparivalka.comO1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.comO1 - Hosts: 127.0.0.3 www.awmdabest.comO1 - Hosts: 127.0.0.3 www.s*xfiles.nu (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 awmdabest.comO1 - Hosts: 127.0.0.3 s*exfiles.nu (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 allforadult.comO1 - Hosts: 127.0.0.3 www.allforadult.comO1 - Hosts: 127.0.0.3 www.iframe.bizO1 - Hosts: 127.0.0.3 iframe.bizO1 - Hosts: 127.0.0.3 www.newiframe.bizO1 - Hosts: 127.0.0.3 newiframe.bizO1 - Hosts: 127.0.0.3 www.vesbiz.bizO1 - Hosts: 127.0.0.3 vesbiz.bizO1 - Hosts: 127.0.0.3 www.pizdato.bizO1 - Hosts: 127.0.0.3 pizdato.bizO1 - Hosts: 127.0.0.3 www.aaas*xypics.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 aaas*xypics.com (Had to replace the e b/c wouldn’t post actual word)O1 - Hosts: 127.0.0.3 www.virgin-tgp.netO1 - Hosts: 127.0.0.3 virgin-tgp.netO1 - Hosts: 127.0.0.3 www.awmcash.bizO1 - Hosts: 127.0.0.3 awmcash.bizO1 - Hosts: 127.0.0.3 buldog-stats.comO1 - Hosts: 127.0.0.3 www.buldog-stats.comO1 - Hosts: 127.0.0.3 fregat.drocherway.comO1 - Hosts: 127.0.0.3 slutmania.bizO1 - Hosts: 127.0.0.3 www.slutmania.bizO1 - Hosts: 127.0.0.3 toolbarpartner.comO1 - Hosts: 127.0.0.3 www.toolbarpartner.comO1 - Hosts: 127.0.0.3 www.megapornix.comO1 - Hosts: 127.0.0.3 megapornix.comO1 - Hosts: 127.0.0.3 www.sp2fu*ked.biz (I added in the * b/c wouldn’t post with actual word)O1 - Hosts: 127.0.0.3 sp2fu*ked.biz (I added in the * b/c wouldn’t post with actual word)O1 - Hosts: 127.0.0.3 greg-tut.comO1 - Hosts: http://213.159.117.133/dkprogs/hosts.txtC:\Program Files\America Online 9.0a\shellmon.exeO4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exeO4 - HKLM\..\Run: [SysTime] C:\WINDOWS\System32\systime.exeO4 - HKLM\..\Run: [_Cat4] C:\WINDOWS\msmsgr2.exeO4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exeO4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exeO4 - HKLM\..\RunOnce: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe /bootO4 - HKLM\..\RunOnce: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe /bootO4 - HKCU\..\Run: [SysTime] C:\WINDOWS\System32\systime.exeO15 - Trusted Zone: *.blazefind.com (HKLM)O15 - Trusted Zone: *.clickspring.net (HKLM)O15 - Trusted Zone: *.flingstone.com (HKLM)O15 - Trusted Zone: *.mt-download.com (HKLM)O15 - Trusted Zone: *.my-internet.info (HKLM)O15 - Trusted Zone: *.searchbarcash.com (HKLM)O15 - Trusted Zone: *.searchmiracle.com (HKLM)O15 - Trusted Zone: *.skoobidoo.com (HKLM)O15 - Trusted Zone: *.slotch.com (HKLM)O15 - Trusted Zone: *.slotchbar.com (HKLM)O15 - Trusted Zone: *.windupdates.com (HKLM)O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)O15 - Trusted Zone: *.ysbweb.com (HKLM)O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cabO16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k22675/sb028.cabO16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:
osuch.mht!http://www.awmdabest.com/bltd/1884.chm::/file.exeO16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c8.cabO18 - Protocol: relatedlinks - {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} - (no file)O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exeO23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe With all applicatiions closed except the HJT program hit the FIX button. Delete the following folders/files if present: C:\PROGRA~1\Toolbar\TBPSSvc.exeC:\Program Files\Common Files\WinTools\WToolsS.exeC:\PROGRA~1\Toolbar\TBPS.exeC:\PROGRA~1\Toolbar\PIB.exeC:\Program Files\Common Files\WinTools\WToolsA.exeC:\Program Files\Common Files\WinTools\WSup.exeC:\WINDOWS\System32\systime.exeC:\WINDOWS\msmsgr2.exeC:\WINDOWS\System32\systime.exeC:\Program Files\Media Access\MediaAccess.exe Reboot, rescan and repost a new log and see if it's operating better. Steve

Virus & Spyware

HiJack This LOG -- Need urgent help please, if possible

Was this post helpful?