HighjackThis Log- PLZ Help

Question

My computer has been running slow and I have been getting messages saying I have viruses but when I run anti virus software they dont go away. One that I got was for "taskmon" but I ran a HJT scan and cleaned that when I saw it. He is what my log looks like now. Let me know if you can help. Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:59 AM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.live.com/?mkt=en-us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll (file missing)
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users\Documents\Settings\bot.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 5864 bytes

bamajim · Answer

Jcarp85

1. Please download the Killbox.

- C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
  C:\Documents and Settings\All Users\Documents\Settings\bot.dll
1)Save it to the desktop
2) Rt Click->>Extract all->.Extract it to your Desktop
3) Double Click Killbox.exe to run it
4)Select " Delete on Reboot", and then select "All files".
5) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

6) Return to Killbox, go to the File menu, and choose " Paste from Clipboard".
7) Click the red-and-white " Delete File" button. Click " Yes" at the Delete on Reboot prompt.

2. Rerun Hijackthis (scan only) and place checks beside the following entries

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe
O2 - BHO: (no name) - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users\Documents\Settings\bot.dll

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Jcarp85 · Answer

My computer will not let me right click the file, nothing happens.  I use firefox and when I try and open it through the firefox download file it will let me open but it says that it is blocking me from extracting for the safety of my computer.

Jcarp85 · Answer

I downloaded a different Killbox that I didnt have to unzip and followed your directions. Here is my new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:39:06 PM, on 2/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.live.com/?mkt=en-us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll (file missing)
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 5135 bytes

bamajim · Answer

Jcarp85

1. Your log does show you are running 2 Antivirus programs: AVG and McAfee.

Running 2 Antivirus programs is never a good idea.
Since they both do the same job, running 2 can cause conflicts, system slowdowns, and may even allow some malware to slip by.
I recommend that you unistall one of them through Add or Remove Programs.

2. Run an online virus scan called Kaspersky from HERE.

1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. When the scan is complete Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.

Copy and post the results of the Kaspersky Online scan

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Jcarp85 · Answer

I think that you got most of it but i am still getting one virus message and the Kasperky run found some viruses and infections. I really appreciate all your help.  Here is the log: -------------------------------------------------------------------------------  KASPERSKY ONLINE SCANNER REPORT  Wednesday, February 20, 2008 12:11:27 PM  Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)  Kaspersky Online Scanner version: 5.0.98.0  Kaspersky Anti-Virus database last update: 20/02/2008  Kaspersky Anti-Virus database records: 573775 ------------------------------------------------------------------------------- Scan Settings:     Scan using the following antivirus database: extended     Scan Archives: true     Scan Mail Bases: true Scan Target - My Computer:     A:\     C:\     D:\ Scan Statistics:     Total number of scanned objects: 62650     Number of viruses found: 2     Number of infected objects: 3     Number of suspicious objects: 0     Duration of the scan process: 01:11:09 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_DHNBM251.log    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_DHNBM251.log    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080220_Time-103547500_EnterceptExceptions.dat    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080220_Time-103547500_EnterceptRules.dat    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt    Object is locked    skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Microsoft\Templates\Normal.dot    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Microsoft\Word\AutoRecovery save of Normal.as$    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\cert8.db    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\history.dat    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\key3.db    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\parent.lock    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\search.sqlite    Object is locked    skipped C:\Documents and Settings\Jeff\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\urlclassifier2.sqlite    Object is locked    skipped C:\Documents and Settings\Jeff\Cookies\INDEX.DAT    Object is locked    skipped C:\Documents and Settings\Jeff\Desktop\Position Paper - Sp 08.doc    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\Cache\_CACHE_001_    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\Cache\_CACHE_002_    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\Cache\_CACHE_003_    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Application Data\Mozilla\Firefox\Profiles\eeh36yvs.default\Cache\_CACHE_MAP_    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\History\History.IE5\INDEX.DAT    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\History\History.IE5\MSHist012008022020080221\index.dat    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\NAILogs\UpdaterUI_DHNBM251.log    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~DF18EF.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~DF4B64.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~DF62DF.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~DFD621.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~WRF0195.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temp\~WRS1551.tmp    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat    Object is locked    skipped C:\Documents and Settings\Jeff\Local Settings\Temporary Internet Files\Content.IE5\index.dat    Object is locked    skipped C:\Documents and Settings\Jeff\My Documents\COM\Gender_Paper1.doc    Object is locked    skipped C:\Documents and Settings\Jeff
tuser.dat    Object is locked    skipped C:\Documents and Settings\Jeff
tuser.dat.LOG    Object is locked    skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT    Object is locked    skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT    Object is locked    skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT    Object is locked    skipped C:\Documents and Settings\LocalService\NTUSER.DAT    Object is locked    skipped C:\Documents and Settings\LocalService
tuser.dat.LOG    Object is locked    skipped C:\Documents and Settings\NetworkService\Cookies\index.dat    Object is locked    skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat    Object is locked    skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG    Object is locked    skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat    Object is locked    skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat    Object is locked    skipped C:\Documents and Settings\NetworkService\NTUSER.DAT    Object is locked    skipped C:\Documents and Settings\NetworkService
tuser.dat.LOG    Object is locked    skipped C:\Program Files\TrustyHound-TB	oolbar.dll    Infected: not-a-virus:AdWare.Win32.Eztracks.a    skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1149\change.log    Object is locked    skipped C:\WINDOWS\Debug\PASSWD.LOG    Object is locked    skipped C:\WINDOWS\SchedLgU.Txt    Object is locked    skipped C:\WINDOWS\SoftwareDistribution\EventCache\{D57C3399-E1B8-4267-B726-9A454844B918}.bin    Object is locked    skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log    Object is locked    skipped C:\WINDOWS\srvwrgzvbf.exe/data0002    Infected: not-a-virus:AdWare.Win32.PurityScan.es    skipped C:\WINDOWS\srvwrgzvbf.exe    NSIS: infected - 1    skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log    Object is locked    skipped C:\WINDOWS\SYSTEM32\CatRoot2	mp.edb    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM    Object is locked    skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG    Object is locked    skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA    Object is locked    skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP    Object is locked    skipped C:\WINDOWS\WindowsUpdate.log    Object is locked    skipped Scan process completed.

bamajim · Answer

Jcarp85 1. Rerun Killbox   C:\WINDOWS\srvwrgzvbf.exeC:\Program Files\TrustyHound-TB	oolbar.dll 1) Double Click Killbox.exe to run it 2)Select ' Delete on Reboot', and then select 'All files'. 3) Copy the file names below to the clipboard by highlighting them and pressing Control-C: 4) Return to Killbox, go to the File menu, and choose ' Paste from Clipboard'. 5) Click the red-and-white ' Delete File' button.  Click ' Yes' at the Delete on Reboot prompt. 2. Rerun Killbox Again At the main window Select Tools ->> Delete Temp Files At the next window uncheck XP Prefetch Leave the other boxes checked Select ' Delete Selected Temp Files' Allow the tool to run. When it is finished (You will know that it is finished because the checks will disappear from the location boxes) Select ' Exit' Then Select ' Exit' again to close Killbox 3. Rerun Hijackthis and post a fresh Hijackthis log. And in your reply tell me how your PC is running now Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

Jcarp85 · Answer

It seems to be running better. I havent got any virus warnings or anything. I really apppreciate all of your help. Here is my latest HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:09:52 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\mcshield.exe
C:\Program Files\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SealedMedia\sealmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.live.com/?mkt=en-us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Cox Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - C:\Program Files\Cox\Applications\App\PopupBHO01.dll (file missing)
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 5119 bytes

Jcarp85 · Answer

There are some things that have been wrong with my computer for a while that I havent been able to fix that maybe you can help with.

- Whern I press Control Alt Delete my task manager does not have any options or a close box. Every time I press Control alt delete I just keep getting more uncloseable task manager boxes

- When I go into control panel I cannot go into my firewall setting for an "unspecified reason"

Any help is appreciated.

bamajim · Answer

jcarp85

Hmmm. Let's take the task manager problem first.

Open task manager. Then with your mouse pointer on the blank border of Taskmanger, Left double click the blank border and see if the tabs ab close button return. Reply with the results.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"