Help!! About:Blank Attacking my PC

Question

here's my hijackthis log...I need help!   Logfile of HijackThis v1.99.1 Scan saved at 2:14:53 AM, on 8/10/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\CTsvcCDA.EXE c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe C:\WINDOWS\System32
vsvc32.exe C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Winamp\Winampa.exe C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe C:\Program Files\Dell\Support\Alert\bin\DAMon.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\WINDOWS\System32\Drivers\SAP\FD.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\BurnQuick\BQTray.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Palm\HOTSYNC.EXE C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\WINDOWS\TEMP\SWECBA.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe C:\WINDOWS\system32\smartdrv.exe C:\WINDOWS\system32\officescan.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ecproxy.endicott.edu:8080 O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file) O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file) O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file) O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file) O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file) O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file) O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe' O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindow O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [FD_SAP] C:\WINDOWS\System32\Drivers\SAP\FD.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exe O4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe' O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe' O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\system32unsrv32.exe O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\system32\susp.exe O4 - HKLM\..\RunOnce: [DELDIR0.EXE] 'C:\DOCUME~1\Jeff\LOCALS~1\Temp\DELDIR0.EXE' 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dll O12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: *.musicmatch.com O15 - Trusted Zone: *.musicmatch.com (HKLM) O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144894207267 O16 - DPF: {9E214F45-89C2-4DE3-94A9-530EB1D05F7E} - http://www.quest3d.com/Quest3D_WebInstall.cab O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.shockwave.com/content/bejeweled2/sis/popcaploader_v6.cab O20 - AppInit_DLLs:   C:\WINDOWS\system32\javaw.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing) O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe

betweenthepipes · Answer

I just ran fixwareout and the report log came as follows:

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
...

Microsoft (R) Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names...

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32

let me know on the hijackthis log.....

1972vet · Answer

Please follow the steps to remove older version Java components
1. Close any open programs you may have running, especially your web
browser
2. Click Start-->Control Panel
* For those just reading this thread, depending on your OS or configuration, you may have to click Start-->Settings-->Control Panel

3. Open Add or Remove Programs
* or, for those just reading this thread, if you have Windows 98 or Windows 2000, open Add/Remove Programs

4. Click once on any item listing Java Runtime Environment in the name
* Not every version of Java will begin with "Java" so be sure to read
each entry in the list
5. Click the Remove or Change/Remove button
6. Follow steps 4 and 5 as many times as necessary to remove all
versions of Java. ** If you are asked to reboot at any point during the uninstallations, please do so. Then go back to Add/Remove and continue with the removals.
7. Next, navigate to and delete:

C:\Program Files\ Java =this folder if found

8. Then go to this page.
* Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
* Click the "Download" button to the right.
* Check the box that says: "Accept License Agreement".
* The page will refresh.
* Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
* Close any programs you may have running - especially your web browser.
* Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
* Check any item with Java Runtime Environment (JRE or J2SE) in the name.
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each Java versions.
* Reboot your computer once all Java components are removed.
* Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.

Please download the KILLBOX, extract it to your desktop. DO NOTHING WITH IT YET.

Download Ewido anti-spyware to your desktop.
This is a 30 day free trial. At the end of the 30-day trial period the full version features (active guard, automatic updates...) will be deactivated and the program will become a feature-limited freeware version...You can still keep it and use it for "On Demand" scanning.

Double click the icon on the desktop to launch the set up program.
Select Change state to inactivate "Resident Shield" and "Automatic Updates". Right click on ewido in the system tray and uncheck "Start with Windows".
Once the setup is complete you will need to update the definition files.
On the main screen select the icon Update then click the Start Update button.
The update will start and a progress bar will show the updates being installed.
Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
Once in the Settings screen click on Recommended actions and then select Quarantine.
Under Reports
Select Automatically generate report after every scan
Un-Select Only if threats were found

Close ewido anti-spyware.

Please boot into Safe mode:

Restart the computer and immediately begin tapping the F8 key (or F5 on some Dell machines).
Use the arrow keys to highlight Safe Mode and press the Enter key. Once in safe mode, continue with the instructions below:

Launch ewido anti-spyware by double-clicking the icon on your desktop.
Select the Scanner icon at the top, then the Scan tab then click on Complete System Scan.
ewido will now begin the scanning process, be patient this may take some time.
When prompted of an infection, please select Apply all actions

Once the scan is complete do the following:

Next select the Reports icon at the top.
Select the Save report as button in the lower left hand of the screen and save it to your Desktop.

Now close ewido anti-spyware.

Open killbox.exe.

First click on Tools>Delete Temp Files.
A box will open with a list of all user profiles.

Check the following boxes at a minimum for each profile by clicking on the drop down and checking the boxes that are enabled. Some will not apply and those boxes will not be available to check. Make sure you do this for all the profiles listed.

Temporary Internet Files
Temp Files
XP Prefetch

If you want to clean your cookies, history, and list of recent files run you may check those boxes as well.

Then, click on the Button titled "Delete Selected Temp Files".
Exit by clicking the Button titled "Exit(Save Settings)".

Once back into the main killbox program, check the box:

Delete on Reboot

Highlight all the entries in the quote box below and then copy them.

C:\WINDOWS\TEMP\SWECBA.EXE
C:\WINDOWS\system32\runsrv32.exe
C:\WINDOWS\system32\susp.exe
C:\DOCUME~1\Jeff\LOCALS~1\Temp\DELDIR0.EXE
C:\WINDOWS\system32\javaw.dll

Then in killbox click File>>Paste from Clipboard

At this point the "All Files" button should be enabled so you can click it.
Click the "All Files" button.

Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes.

A second message will ask to Reboot now? you will need to click No for now.
Note: Killbox will let you know if a file does not exist.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until you've completed the instructions below.

Run HijackThis again and check the following entries:
O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file)
O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file)
O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file)
O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file)
O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
O2 - BHO: office_pnl.office_panel - {B53455DB-5527-4041-AC41-F86E6947AA47} - C:\WINDOWS\system32\office_pnl.dll
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file)
O4 - HKLM\..\Run: C:\WINDOWS\system32\runsrv32.exe
O4 - HKLM\..\Run: C:\WINDOWS\system32\susp.exe
O4 - HKLM\..\RunOnce: "C:\DOCUME~1\Jeff\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O20 - AppInit_DLLs: C:\WINDOWS\system32\javaw.dll

Did you install WinPcap? If not, check the box next to this too:
O23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Reboot the computer and visit this site. Upload the file below indicated in Bold text for a free scan. Note the results so you can post that information back here.

C:\WINDOWS\system32\ smartdrv.exe

Please post back a new HijackThis log, the Ewido scan log, and the results from the VirusTotal scan. How is the computer running now?

betweenthepipes · Answer

First, I just want to thank you for your assistance.  I'm not back to normal (the reboot process takes FOREVER), but the pop-ups and home page problem have stopped.  Here's my hijack this log: Logfile of HijackThis v1.99.1Scan saved at 10:34:31 AM, on 8/11/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\WINDOWS\system32\devldr32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exec:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeC:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Trend Micro\OfficeScan Client	mlisten.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exeC:\WINDOWS\TEMP\YND00F.EXEC:\Program Files\Logitech\iTouch\iTouch.exeC:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\Program Files\Winamp\Winampa.exeC:\Program Files\Dell\Support\Alert\bin\DAMon.exeC:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\System32\Drivers\SAP\FD.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Java\jre1.5.0_08\bin\jusched.exeC:\Program Files\AIM95\aim.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exeC:\unzipped\hijackthis\HijackThis.exeC:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ecproxy.endicott.edu:8080O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dllO2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe'O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exeO4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindowO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [FD_SAP] C:\WINDOWS\System32\Drivers\SAP\FD.exeO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [BurnQuick Queue] C:\Program Files\BurnQuick\BQTray.exeO4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe'O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe'O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe'O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .fpx: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO12 - Plugin for .ivr: C:\Program Files\Internet Explorer\PLUGINS\NPRVRT32.dllO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exeO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1144894207267O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.shockwave.com/content/bejeweled2/sis/popcaploader_v6.cabO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeO23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exeO23 - Service: rpcapd - Unknown owner - %ProgramFiles%\WinPcappcapd.exe' -d -f '%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe

betweenthepipes · Answer

Here's the results of the Ewido virus scan (prior to the highjackthis fix and killbox step) ---------------------------------------------------------ewido anti-spyware - Scan Report---------------------------------------------------------  + Created at: 10:04:16 AM 8/11/2006  + Scan result:    HKLM\SOFTWARE\Alexa Internet -> Adware.Alexa : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\AlxTB.BHO -> Adware.Alexa : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\PopMenu.Menu -> Adware.Alexa : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\Popup.PopupKiller -> Adware.Alexa : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\Bridge.brdg -> Adware.BlazeFind : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\jao.jao -> Adware.BlazeFind : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\AppID\DailyToolbar.DLL -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\DailyToolbar.IEBand -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\DailyToolbar.SysMgr -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\IEToolbar.AffiliateCtl -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\DailyToolbar -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\NIX Solutions -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\NIX Solutions\DailyToolbar -> Adware.DailyToolbar : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\CLSID\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\Interface\{900FBC20-6AEE-4E05-ABA9-AC46E309C029} -> Adware.Generic : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\TypeLib\{8B076501-1D1B-4B26-9492-FDB8EEE00D7F} -> Adware.Generic : Cleaned with backup (quarantined).HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : Cleaned with backup (quarantined).HKU\S-1-5-21-914090876-4025279379-689279713-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B53455DB-5527-4041-AC41-F86E6947AA47} -> Adware.Generic : Cleaned with backup (quarantined).HKLM\SOFTWARE\RespondMiter -> Adware.VX2 : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Local Settings\Temp\!update.exe -> Downloader.PurityScan.cu : Cleaned with backup (quarantined).C:\WINDOWS\SYSTEM32\mncvhsyv.exe -> Downloader.Small.cjk : Cleaned with backup (quarantined).C:\WINDOWS\SYSTEM32\my_update.exe -> Downloader.VB.aeq : Cleaned with backup (quarantined).HKLM\SOFTWARE\Classes\CLSID\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : Cleaned with backup (quarantined).HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e52dedbb-d168-4bdb-b229-c48160800e81} -> Hijacker.Generic : Cleaned with backup (quarantined).HKU\S-1-5-21-914090876-4025279379-689279713-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : Cleaned with backup (quarantined).C:\WINDOWS\SYSTEM32\wokvzmdw.yxa -> Hijacker.Small.js : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@rotator.adjuggler[2].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@www.burstbeacon[1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Local Settings\Temp\Cookies\jeff@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@computershopper.com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wfkiejazabo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wfkiooczsbo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wfkismazcfp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wfliqoczkcp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wfliugcjklp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wgkicgcjofp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wgl4agdzwcq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wglyciazafo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wgmywodzclp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6whk4epcjsfp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6whkogkazklo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6whkywgajskp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6whlocjc5kep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjk4ejdzwhp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjk4sgajwdp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjkoqocjsko.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjl4qmdzwcp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjlicldzkdo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjlikmc5gep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjlocoazwbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjmykgczidp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjny-1sdzwb.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjnyagazocq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@e-2dj6wjnygmdjogo.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Local Settings\Temp\Cookies\jeff@a-1shz2prbmdj6wvny-1sez2pra2dj6wjkygnd5abpw-1dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Local Settings\Temp\Cookies\jeff@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmygnd5icow6dj6x9ny-1seq-2-2.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@ehg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@linksynergy[1].txt -> TrackingCookie.Linksynergy : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@data2.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Local Settings\Temp\Cookies\jeff@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@h.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@try.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).C:\Documents and Settings\Jeff\Cookies\jeff@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). ::Report end I am now running the virus total scan...I will let you know.  Please comment on what you see thus far... THANK YOU!!! JEFF

betweenthepipes · Answer

Total Virus Scan Results: STATUS: FINISHED Complete scanning result of 'smartdrv.exe', received in VirusTotal at 08.11.2006, 16:35:14 (CET). AntivirusVersionUpdateResultAntiVirn-no virus foundAuthentiumn-no virus foundAvastn-no virus foundAVGn-no virus foundBitDefendern-no virus foundCAT-QuickHealn-no virus foundClamAVn-no virus foundDrWebn-no virus foundeTrust-InoculateITn-no virus foundeTrust-Vetn-no virus foundEwidon-no virus foundFortinetn-no virus foundF-Protn-no virus foundF-Prot4n-no virus foundIkarusn-no virus foundKasperskyn-no virus foundMcAfeen-no virus foundMicrosoftn-no virus foundNOD32v2n-no virus foundNormann-no virus foundPandan-no virus foundSophosn-no virus foundSymantecn-no virus foundTheHackern-no virus foundUNAn-no virus foundVBA32n-no virus foundVirusBustern-no virus found Aditional InformationFile size: 0 bytesMD5: d41d8cd98f00b204e9800998ecf8427eSHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709   LET ME KNOW!!! JEFF

1972vet · Answer

The log looks much better.

One problem I notice though...and unrelated to malware, is that you are running two antivirus scanners (and perhaps two firewalls). You actually reduce your level of protection when you do that, and run the risk of data loss from a system crash that the instability can cause. Please decide which to keep and unintall the other. This can also contribute to your slow reboot. I also suspect a cluttered disk. When was the last time you ran a cleanup and defrag?

Let's clean up a bit using a free disk cleaning utility:
Download and scan with CCleaner
1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbarfree Basic version instead of the Standard Build.

2. Before first use, select Options > Advanced and UNCHECK " Only delete files in Windows Temp folder older than 48 hours"

3. Then select the items you wish to clean up.

In the Windows Tab:
Clean all entries in the "Internet Explorer" section. *Note*
Checking "Cookies" will remove problem spyware cookies and help to speed up other spyware/adware/malware scans.
This will mean however, the next time you click on a web page where you have signed in before, you will have to re-enter your user I.D. and password.

Clean all the entries in the "Windows Explorer" section.
Clean all entries in the "System" section.
Clean all entries in the "Advanced" section.
Clean any others that you choose.

In the Applications Tab:
Clean all in the Firefox/Mozilla section if you use it.
Clean all in the Opera section if you use it.
Clean Sun Java in the Internet Section.
Clean any others that you choose.

4. Click the " Run Cleaner" button.
5. A pop up box will appear advising this process will permanently delete files from your system.
6. Click " OK" and it will scan and clean your system.
7. Click " exit" when done.

This is new:
C:\WINDOWS\TEMP\YND00F.EXE

If it still exists after running CCleaner, then right click on your task bar at the bottom of your screen and select Task Manager.
Click the Processes tab, then click on the "Image Name" header to alphabetize the list. Look for the file name YND00F.EXE. If present, click on it to highlight it then click the End Process button at the bottom of the Task Manager window. Close the Task Manager.

Next, please navigate to:
C:\WINDOWS\TEMP\YND00F.EXE
and delete the flie YND00F.EXE

Reboot the computer.

Do you use a proxy server? If not, run HijackThis again and check the box next to this one:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ecproxy.endicott.edu:8080

Close all windows except for HijackThis then click "Fix Checked".
Reboot and post a new HijackThis log. How's the computer running now?

Virus & Spyware

Help!! About:Blank Attacking my PC

Was this post helpful?