Help! Please peruse my logfile

Question

I have been trying for over a week to fix my computer.  I cannot access my Norton Antivirus except when in Safe Mode.  Also,  for 2 of the user accounts,  the display background is blank and constantly flashing.  It is fine for the other 2 user accounts.  When we log into the 2 problem user accounts, the selected display background appears but then disappears once the desktop icons appear on the screen. Here is my file:     Logfile of HijackThis v1.99.1 Scan saved at 3:12:41 AM, on 19/05/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Bell\Access Manager\app\TangoService.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ltmsg.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\System32\LXSUPMON.EXE C:\Program Files\Messenger Plus! 2\MsgPlus.exe C:\WINDOWS\VM_STI.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\picsvr\picsvr.exe C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\MSN Apps\Updater\01.02.0000.2693\en-ca\msnappau.exe C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50082 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = sympatico.ca R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R3 - URLSearchHook: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file) O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: FlashEnhancer Extender - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - c:\Program Files\Flen\flen.dll (file missing) O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0000.2693\en-xu\stmain.dll O2 - BHO: Flash Extender - {95795B67-BBAB-47d0-8A9F-069E8242C0E5} - c:\Program Files\Fen\fen.dll (file missing) O2 - BHO: (no name) - {A5F51B4E-C801-DD12-ABCB-73F44240E4EE} - C:\DOCUME~1\JENNIFER\APPLIC~1\ABOUTP~1\fordmpeg.exe (file missing) O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-ca\msntb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O2 - BHO: (no name) - {FE36EEE8-55DF-D94A-FDF2-681286957C22} - C:\DOCUME~1\DONNA\APPLIC~1\ABOUTP~1\fordmpeg.exe O3 - Toolbar: SuperBar - {9D0004B4-FD19-4B5E-8645-8E8A88AD507C} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll (file missing) O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-ca\msntb.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe' O4 - HKLM\..\Run: [NXEPZKUC] C:\WINDOWS\NXEPZKUC.exe O4 - HKLM\..\Run: [NXIT] C:\WINDOWS\NXIT.exe O4 - HKLM\..\Run: [NUB] C:\WINDOWS\NUB.exe O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [IPInSightLAN 01] 'C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe' -l O4 - HKLM\..\Run: [2 MULTI TOOL SECT] C:\Documents and Settings\All Users\Application Data\MAILDALE2MULTI\vcjunk.exe O4 - HKLM\..\Run: [DI2] 'C:\DOCUME~1\JENNIFER\LOCALS~1\Temp\27.exe\27.exe' O4 - HKLM\..\Run: [wb] C:\windows\system32\wb.exe O4 - HKLM\..\Run: [LpYtFXfF.exe] c:\windows\system32\LpYtFXfF.exe O4 - HKLM\..\Run: C:\windows\system32\A.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [Memo barb debug eq] C:\Documents and Settings\All Users\Application Data\curb cash memo barb\Hold hope.exe O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe O4 - HKLM\..\Run: [Themes Windows] C:\WINDOWS\system32\msbbinst.exe O4 - HKLM\..\Run: [FlnCPY] 'C:\Program Files\Common Files\Java\flncpy.exe' O4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe' O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe O4 - HKCU\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe' /WinStart O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe O4 - Global Startup: AOL 7.0 Tray Icon.lnk = C:\Program Files\AOL 7.0c\aoltray.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\JENNIFER\ICQ\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\JENNIFER\ICQ\ICQ\ICQ.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins
pchime.dll O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins
pchime.dll O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.exe O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate.exe O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://sympatico.zone.msn.com/binFramework/v10/ZIntro.cab32846.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} (CountSpies.SpyCounter) - http://www.sunbelt-software.com/dell/CounterSpy.CAB O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = H416.tjem.com O17 - HKLM\Software\..\Telephony: DomainName = H416.tjem.com O17 - HKLM\System\CCS\Services\Tcpip\..\{81E739E4-3F48-4436-A8EC-FD3761B1E668}: Domain = sympatico.ca O17 - HKLM\System\CCS\Services\Tcpip\..\{81E739E4-3F48-4436-A8EC-FD3761B1E668}: NameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = H416.tjem.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = H416.tjem.com O21 - SSODL: Access Explorer - {98DE6D45-AF05-47F8-9D3D-67BF2D15D29E} - C:\WINDOWS\system32\winsxmas.dll O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Bell\Access Manager\app\TangoService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

RKinner · Answer

Get a copy of winsockxpfix.exe before you do anything. This is just a safety
item in case you can't get on the internet afterwards. You don't run it until
afterwards and then only if you can't get back on the internet.
You just run it and things should work OK after it reboots your system.

http://www.iup.edu/house/resnet/winfix.shtm

Get DelDomain.inf from:

http://www.mvps.org/winhelp2002/restricted.htm and then right click on it and Install.

Download the Hoster from:

www.funkytoad.com/download/hoster.zip

Unpack to your desktop and run it. Select the Restore Orignal Hosts button.

Get Pocket Killbox

http://www.bleepingcomputer.com/files/killbox.php

and unpack it to your desktop.

Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet.

Download LSPFix

http://www.cexx.org/lspfix.htm

and unzip to your desktop. But don't run it yet.

Download and run the gaobot removal tool:

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html

Restart and boot into Safe Mode by tapping the F8 key when you see the PC maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.

Run HijackThis and check the box in front of each and then Fix Checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50082
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - {CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
O2 - BHO: FlashEnhancer Extender - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - c:\Program Files\Flen\flen.dll (file missing)
O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll (file missing)
O2 - BHO: Flash Extender - {95795B67-BBAB-47d0-8A9F-069E8242C0E5} - c:\Program Files\Fen\fen.dll (file missing)
O2 - BHO: (no name) - {A5F51B4E-C801-DD12-ABCB-73F44240E4EE} - C:\DOCUME~1\JENNIFER\APPLIC~1\ABOUTP~1\fordmpeg.exe (file missing)
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll
O2 - BHO: (no name) - {FE36EEE8-55DF-D94A-FDF2-681286957C22} - C:\DOCUME~1\DONNA\APPLIC~1\ABOUTP~1\fordmpeg.exe
O3 - Toolbar: SuperBar - {9D0004B4-FD19-4B5E-8645-8E8A88AD507C} - C:\Program Files\_SUPERBAR\_SUPERBAR.dll (file missing)
O4 - HKLM\..\Run: [NXEPZKUC] C:\WINDOWS\NXEPZKUC.exe
O4 - HKLM\..\Run: [NXIT] C:\WINDOWS\NXIT.exe
O4 - HKLM\..\Run: [NUB] C:\WINDOWS\NUB.exe
O4 - HKLM\..\Run: [2 MULTI TOOL SECT] C:\Documents and Settings\All Users\Application Data\MAILDALE2MULTI\vcjunk.exe
O4 - HKLM\..\Run: [DI2] "C:\DOCUME~1\JENNIFER\LOCALS~1\Temp\27.exe\27.exe"
O4 - HKLM\..\Run: [wb] C:\windows\system32\wb.exe
O4 - HKLM\..\Run: [LpYtFXfF.exe] c:\windows\system32\LpYtFXfF.exe
O4 - HKLM\..\Run: C:\windows\system32\A.exe
O4 - HKLM\..\Run: [Memo barb debug eq] C:\Documents and Settings\All Users\Application Data\curb cash memo barb\Hold hope.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [Themes Windows] C:\WINDOWS\system32\msbbinst.exe
O4 - HKLM\..\Run: [FlnCPY] "C:\Program Files\Common Files\Java\flncpy.exe"
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.exe
O21 - SSODL: Access Explorer - {98DE6D45-AF05-47F8-9D3D-67BF2D15D29E} - C:\WINDOWS\system32\winsxmas.dll

Wait 60 seconds and repeat the scan. Did anything come back? IF so
leave HijackThis up and right click on the clock and select Task Manager. Then
Processes. Find Explorer.exe, right click on it and select End Process. The
desktop will disappear but HijackThis should still be there. IF you don't see
it switch to Applications in Task Manager and highlight it there then press
Switch To or just double click on it. Check and Fix Checked the above again.
Restart Explorer by Task Manager, File, New Task(Run), explorer.exe, OK.

Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.

Run lspfix and:

1. check "I know what i'm doing".
2. click on (highlight) each occurance of the following, one at a time:

flsmngr.dll

3. then click ">>", which should move it to the right pane.
4. (double-check, and make sure that only the above files are in the 'Remove'pane.)
5. click "Finish >>"

Run Killbox and check Delete on Reboot then in the box where it says: Full Path of File to Delete, Type orcopy/Paste:

C:\Documents and Settings\All Users\Application Data\MAILDALE2MULTI then check Deltree and hit the Red button.
Agree that you want to delete it but do not let it reboot yet.

Repeat for:

C:\Documents and Settings\All Users\Application Data\curb cash memo barb
c:\Program Files\Flen
C:\Program Files\CxtPls
C:\DOCUME~1\JENNIFER\APPLIC~1\ABOUTP~1
C:\DOCUME~1\DONNA\APPLIC~1\ABOUTP~1\
C:\Program Files\_SUPERBAR
C:\PROGRA~1\COMMON~1\WinTools
c:\Program Files\Fen
C:\WINDOWS\system32\picsvr
C:\DOCUME~1\JENNIFER\LOCALS~1\Temp\27.exe (it may not find this one if ccleaner worked.)
C:\WINDOWS\system32\winsxmas.dll -- This last one will not have a Deltree button and you can let it reboot this time.

Reboot into regular mode and again install deldomain.inf and run hoster as before
just to make sure.

Run another HijackThis log and post it as a reply. Let's
see how we did.

Ron

befuddled1 · Answer

Hi I performed all of the steps and I can now access all of my programs.  I am still encountering the problem with the display.  The user account where the problem originated cannot access the Background selection in the Desktop tab of the Display part of the Control Panel.  When the virus attacked, this user account lost the Desktop and Appearance tabs in Display.  I found the registry setting for these tabs and enabled them.  That is as far as I got. Thanks for your help. Here is my latest logfile: Logfile of HijackThis v1.99.1Scan saved at 10:46:57 AM, on 21/05/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Bell\Access Manager\app\TangoService.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\ltmsg.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\WINDOWS\System32\LXSUPMON.EXEC:\Program Files\Messenger Plus! 2\MsgPlus.exeC:\WINDOWS\VM_STI.EXEC:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exeC:\Program Files\Java\jre1.5.0_02\bin\jusched.exeC:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\MSN Apps\Updater\01.02.0000.2693\en-ca\msnappau.exeC:\WINDOWS\system32undll32.exeC:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.ca/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)O2 - BHO: FlashEnhancer Ext - {5EDB03AF-0341-4e96-9E9B-3171522E4BAF} - c:\Program Files\Fla\fla.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0000.2693\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-ca\msntb.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-ca\msntb.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exeO4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUNO4 - HKLM\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe'O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301PO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [IPInSightLAN 01] 'C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPClient.exe' -lO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\Program Files\Visual Networks\Visual IP InSight\Sympatico Consumer\IPMon32.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [FlaCPY] 'C:\Program Files\Common Files\Java\flacpy.exe'O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exeO4 - HKCU\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe' /WinStartO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHookO4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exeO4 - Global Startup: AOL 7.0 Tray Icon.lnk = C:\Program Files\AOL 7.0c\aoltray.exeO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\JENNIFER\ICQ\ICQ\ICQ.exeO9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Documents and Settings\JENNIFER\ICQ\ICQ\ICQ.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins
pchime.dllO12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins
pchime.dllO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exeO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exeO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cabO16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate.exeO16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://sympatico.zone.msn.com/binFramework/v10/ZIntro.cab32846.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} (CountSpies.SpyCounter) - http://www.sunbelt-software.com/dell/CounterSpy.CABO16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cabO16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cabO16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = H416.tjem.comO17 - HKLM\Software\..\Telephony: DomainName = H416.tjem.comO17 - HKLM\System\CCS\Services\Tcpip\..\{81E739E4-3F48-4436-A8EC-FD3761B1E668}: Domain = sympatico.caO17 - HKLM\System\CCS\Services\Tcpip\..\{81E739E4-3F48-4436-A8EC-FD3761B1E668}: NameServer = 192.168.2.1O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = H416.tjem.comO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = H416.tjem.comO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exeO23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Bell\Access Manager\app\TangoService.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Virus & Spyware

Help! Please peruse my logfile

Was this post helpful?