i have hjl

Question

my home page change to a searh page,popups, my email in ie has been damage, i have the ad-aware6, spybot and hijackthis. the first time this happen i thought i could just correct it with hijackthis on my own. i was wrong. i need help. Logfile of HijackThis v1.97.7Scan saved at 10:43:17 AM, on 6/24/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\WINDOWS\javaew32.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\System32\LXSUPMON.EXEC:\WINDOWS\System32\DSentry.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Creative\SBLive\Diagnostics\diagent.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\WINDOWS\ieyc32.exeC:\Program Files\Internet Explorer\iexplore.exeC:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://swzmy.dll/index.html#96676R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://swzmy.dll/index.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://swzmy.dll/index.html#96676R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {9CE283E7-669A-45BB-4625-1B2CC10B8B40} - C:\WINDOWS\msav.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [javaew32.exe] C:\WINDOWS\javaew32.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUNO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [diagent] 'C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe' startupO4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [THGuard] 'C:\Program Files\TrojanHunter 3.9\THGuard.exe'O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\mnyexpr.exe'O4 - Startup: PowerReg Scheduler V3.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: Real.com (HKLM)O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

pskelley · Answer

Hi and thanks for posting your log. I need to make you aware that many logs are being posted, and that we are all volunteers with families and real jobs. One of the experts needs to take a look at your log, and if you will be patient, they will do so as soon as possible. We work the logs in the order they come in. I also need to make you aware of this fact:

Please be aware only the following DellForum members were trained at
TomCoyote.com and SpywareInfo.com to help with Hijackthis logs: Texruss,
Baskar1234, Grinler, ChrisRLG, SpotCheckBilly, and pskelley. (If you are one of our classmates and not on this list email me for an addition to this list...we need all the help we can get *;-)

Also be aware of this:

Special Notice! Hijackthis is a powerful tool that edits the brains of Windows (the Registry). DO NOT FIX anything in the Hijackthis log screen without assistance from the experts! Most of the line items in the scanned log are normal for Windows operation. Hijackthis should identify the vast majority of your problems and enable us to help you clean them off your system.

Stay in this thread for continuity. Reply to this message.

Thanks,

Pskelley

tomthumb99 · Answer

i don't know if i should take out all the   res://swzmy.dll/index.html#96676 are what? the frist time i lost my email so this time i will wait for good advice.

tomthumb99 · Answer

Thanks for the fast post. I didn't hit the reply button like you suggested . I'am still learning how to get around this forum.

baskar1234 · Answer

Hello,

Run Hijackthis after closing all browser windows. Put a check mark on all these entries and FIX CHECKED button.

O2 - BHO: (no name) - {9CE283E7-669A-45BB-4625-1B2CC10B8B40} - C:\WINDOWS\msav.dll

O4 - HKLM\..\Run: [javaew32.exe] C:\WINDOWS\javaew32.exe

DO NOT FIX ANYTHING ELSE ESPECIALLY THE R0 AND R1 ENTRIES

Then download this program from the link below,.

http://tools.zerosrealm.com/AboutBuster.zip

Unzip it and run it.Hit ok button. Copy and paste the report it generates in a notepad file and save it.

Now run Hijackthis again. Fix the following entries.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://swzmy.dll/index.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://swzmy.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://swzmy.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\swzmy.dll/sp.html#96676

Restart , rescan with Hijackthis and post a fresh log. Also post the report of About:Buster you have saved.

baskar1234 · Answer

Hello,.

Run hijackthis and fix these entries.

O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/stop-sign_stp.cab

O4 - HKLM\..\Run: [EanthologyApp] "C:\Program Files\Common Files\eAcceleration\eanthology.exe" /b Startup
O4 - HKLM\..\Run: [eanth_system_patcher] C:\PROGRA~1\ACCELE~1\SYSTEM~1\sys_alert.exe /Startup
O4 - HKLM\..\Run: [WebScan] C:\Program Files\Acceleration Software\Anti-Virus\defscangui.exe -k
O4 - HKLM\..\Run: [javaew32.exe] C:\WINDOWS\javaew32.exe

Open taskmanager by pressing ctrl+alt+del keys simultaneously and in the processes tab,. look for

crrl.exe
javaew32.exe

Click on each item and hit END PROCESS button.

Then Find and delete ,..Unhide all files and folders.

http://www.xtra.co.nz/help/0,,4155-1916458,00.html How to unhide file and folders

C:\Program Files\Common Files\eAcceleration\ - -FOLDER

C:\PROGRA~1\ACCELE~1\ -- FOLDER

C:\WINDOWS\javaew32.exe - FOLDER

C:\Program Files\Acceleration Software\ -- FOLDER

Then please run About :Buster again.

Now reboot, rescan with hijackthis and post a fresh log.

tomthumb99 · Answer

ok when i did everything this is what i got? when i frist got on the internet my hmpage was google. About:Buster Version 1.21Error Removing! : C:\WINDOWS\javaew32.exeRemoved! : C:\WINDOWS\mfccz32.exeRemoved! : C:\WINDOWS\acmshz.datRemoved! : C:\WINDOWS\agrabv.datRemoved! : C:\WINDOWS\ammfip.datRemoved! : C:\WINDOWS\asnwru.datRemoved! : C:\WINDOWS\bdfkma.datRemoved! : C:\WINDOWS\bkbrbu.datRemoved! : C:\WINDOWS\bopzzw.datRemoved! : C:\WINDOWS\budfah.datRemoved! : C:\WINDOWS\cfbmhf.datRemoved! : C:\WINDOWS\cjcxoc.datRemoved! : C:\WINDOWS\cpftuw.datRemoved! : C:\WINDOWS\dfobvo.datRemoved! : C:\WINDOWS\diujum.datRemoved! : C:\WINDOWS\djpxkp.datRemoved! : C:\WINDOWS\dnheme.datRemoved! : C:\WINDOWS\dpenma.datRemoved! : C:\WINDOWS\dxyarf.datRemoved! : C:\WINDOWS\eergic.datRemoved! : C:\WINDOWS\emauxw.datRemoved! : C:\WINDOWS\epdtzn.datRemoved! : C:\WINDOWS\erhrez.datRemoved! : C:\WINDOWS\euhgbb.datRemoved! : C:\WINDOWS\exlxii.datRemoved! : C:\WINDOWS\fadmvo.datRemoved! : C:\WINDOWS\fcaorg.datRemoved! : C:\WINDOWS\ftqgxj.datRemoved! : C:\WINDOWS\fxvlky.datRemoved! : C:\WINDOWS\gapwfm.datRemoved! : C:\WINDOWS\gekmws.datRemoved! : C:\WINDOWS\gklads.datRemoved! : C:\WINDOWS\glqhue.datRemoved! : C:\WINDOWS\gwkris.datRemoved! : C:\WINDOWS\gwrfns.datRemoved! : C:\WINDOWS\hajbiz.datRemoved! : C:\WINDOWS\harzqz.datRemoved! : C:\WINDOWS\hdkljw.datRemoved! : C:\WINDOWS\hhswuj.datRemoved! : C:\WINDOWS\hkmcs.datRemoved! : C:\WINDOWS\hlxdmp.datRemoved! : C:\WINDOWS\hnwwyz.datRemoved! : C:\WINDOWS\hygpul.datRemoved! : C:\WINDOWS\hzxblw.datRemoved! : C:\WINDOWS\ihcnvz.datRemoved! : C:\WINDOWS\imcwdg.datRemoved! : C:\WINDOWS\ioiegk.datRemoved! : C:\WINDOWS\ipuijy.datRemoved! : C:\WINDOWS\irkhed.datRemoved! : C:\WINDOWS\iwwjzv.datRemoved! : C:\WINDOWS\iyhby.datRemoved! : C:\WINDOWS\izrvoo.datRemoved! : C:\WINDOWS\jgoslz.datRemoved! : C:\WINDOWS\jhhutn.datRemoved! : C:\WINDOWS\jjmvi.datRemoved! : C:\WINDOWS\jkcshq.datRemoved! : C:\WINDOWS\jkpqyd.datRemoved! : C:\WINDOWS\jkqlhr.datRemoved! : C:\WINDOWS\jovzwc.datRemoved! : C:\WINDOWS\jrgsur.datRemoved! : C:\WINDOWS\jzoguc.datRemoved! : C:\WINDOWS\kcoizy.datRemoved! : C:\WINDOWS\kelqrt.datRemoved! : C:\WINDOWS\kexlqa.datRemoved! : C:\WINDOWS\kifzpp.datRemoved! : C:\WINDOWS\kjypgg.datRemoved! : C:\WINDOWS\kxxpiu.datRemoved! : C:\WINDOWS\kybthi.datRemoved! : C:\WINDOWS\lcfqez.datRemoved! : C:\WINDOWS\lcroox.datRemoved! : C:\WINDOWS\lfawsz.datRemoved! : C:\WINDOWS\lidqhb.datRemoved! : C:\WINDOWS\lmsffh.datRemoved! : C:\WINDOWS\lpihdg.datRemoved! : C:\WINDOWS\lsgnbp.datRemoved! : C:\WINDOWS\luajkn.datRemoved! : C:\WINDOWS\lwobli.datRemoved! : C:\WINDOWS\lwwgze.datRemoved! : C:\WINDOWS\mflgxu.datRemoved! : C:\WINDOWS\miltfg.datRemoved! : C:\WINDOWS\miykcd.datRemoved! : C:\WINDOWS\mlywcw.datRemoved! : C:\WINDOWS\mmlpxs.datRemoved! : C:\WINDOWS\mmxsny.datRemoved! : C:\WINDOWS\mojow.datRemoved! : C:\WINDOWS\mtzjes.datRemoved! : C:\WINDOWS
mflpv.datRemoved! : C:\WINDOWS
xqhjy.datRemoved! : C:\WINDOWS
ydobj.datRemoved! : C:\WINDOWS
zzygp.datRemoved! : C:\WINDOWS\obdwtq.datRemoved! : C:\WINDOWS\ojwixc.datRemoved! : C:\WINDOWS\ooxnzb.datRemoved! : C:\WINDOWS\opnxsq.datRemoved! : C:\WINDOWS\opppae.datRemoved! : C:\WINDOWS\orukr.datRemoved! : C:\WINDOWS\oulsmi.datRemoved! : C:\WINDOWS\peoxgg.datRemoved! : C:\WINDOWS\pjaddf.datRemoved! : C:\WINDOWS\pmlajf.datRemoved! : C:\WINDOWS\ppxacc.datRemoved! : C:\WINDOWS\qawdln.datRemoved! : C:\WINDOWS\qbjfox.datRemoved! : C:\WINDOWS\qcqhjb.datRemoved! : C:\WINDOWS\qgzrbi.datRemoved! : C:\WINDOWS\qlgpe.datRemoved! : C:\WINDOWS\qmetwn.datRemoved! : C:\WINDOWS\qmhfki.datRemoved! : C:\WINDOWS\qrpjmi.datRemoved! : C:\WINDOWS\qruzzh.datRemoved! : C:\WINDOWS\qvywqv.datRemoved! : C:\WINDOWS\qxeowm.datRemoved! : C:\WINDOWS\qywozp.datRemoved! : C:\WINDOWSdfvlo.datRemoved! : C:\WINDOWSfjeei.datRemoved! : C:\WINDOWSfyols.datRemoved! : C:\WINDOWShjcly.datRemoved! : C:\WINDOWSmqqjj.datRemoved! : C:\WINDOWSonzoj.datRemoved! : C:\WINDOWStlkey.datRemoved! : C:\WINDOWSupcls.datRemoved! : C:\WINDOWSxktmu.datRemoved! : C:\WINDOWSxocet.datRemoved! : C:\WINDOWS\sgrlu.datRemoved! : C:\WINDOWS\sjsooo.datRemoved! : C:\WINDOWS\smbpcf.datRemoved! : C:\WINDOWS\smccje.datRemoved! : C:\WINDOWS\smhzaj.datRemoved! : C:\WINDOWS\smqblj.datRemoved! : C:\WINDOWS\syjtkc.datRemoved! : C:\WINDOWS	izyqa.datRemoved! : C:\WINDOWS	lokt.datRemoved! : C:\WINDOWS	ndpmp.datRemoved! : C:\WINDOWS	qqlyz.datRemoved! : C:\WINDOWS	sqmxl.datRemoved! : C:\WINDOWS	xjndq.datRemoved! : C:\WINDOWS	xtmol.datRemoved! : C:\WINDOWS\uifqyt.datRemoved! : C:\WINDOWS\upayyp.datRemoved! : C:\WINDOWS\uqwlyw.datRemoved! : C:\WINDOWS\utgfcc.datRemoved! : C:\WINDOWS\uykzgj.datRemoved! : C:\WINDOWS\veuifj.datRemoved! : C:\WINDOWS\vwbikr.datRemoved! : C:\WINDOWS\vwqbpj.datRemoved! : C:\WINDOWS\wajxem.datRemoved! : C:\WINDOWS\wgtjet.datRemoved! : C:\WINDOWS\winwds.datRemoved! : C:\WINDOWS\wqjcha.datRemoved! : C:\WINDOWS\wvwspm.datRemoved! : C:\WINDOWS\wxlhyg.datRemoved! : C:\WINDOWS\xfadwi.datRemoved! : C:\WINDOWS\xixgzl.datRemoved! : C:\WINDOWS\xtytxy.datRemoved! : C:\WINDOWS\ydzfyr.datRemoved! : C:\WINDOWS\yjmfza.datRemoved! : C:\WINDOWS\yrujnw.datRemoved! : C:\WINDOWS\yttzuh.datRemoved! : C:\WINDOWS\yztvus.datRemoved! : C:\WINDOWS\avhfb.dllRemoved! : C:\WINDOWS\d3dq.dllRemoved! : C:\WINDOWS\hvsec.dllRemoved! : C:\WINDOWS\System32\apiwj32.exeError Removing! : C:\WINDOWS\System32\crrl.exeRemoved! : C:\WINDOWS\System32\iebm32.exeRemoved! : C:\WINDOWS\System32\bmqbp.dllRemoved! : C:\WINDOWS\System32\kykxb.dllError Removing! : C:\WINDOWS\System32
ethj.dllRemoved! : C:\WINDOWS\System32\swzmy.dllRemoved! : C:\WINDOWS\System32\djkya.datRemoved! : C:\WINDOWS\System32\gship.datRemoved! : C:\WINDOWS\System32\pabvt.datRemoved! : C:\WINDOWS\System32\wrrva.datRemoved! : C:\WINDOWS\System32\wvvuv.datRemoved! : C:\WINDOWS\System32\xsoam.datRemoved! : C:\WINDOWS\System32\ysojg.datAttempted Clean Of Temp folder.Removed LEGACY___NS_Service_3 KeyRemoved Uninstall Key (HSA)Removed Uninstall Key (SE)Removed Uninstall Key (SW)Pages Reset... Done!         Logfile of HijackThis v1.97.7Scan saved at 2:00:09 PM, on 6/25/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\system32\crrl.exeC:\WINDOWS\javaew32.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\System32\LXSUPMON.EXEC:\WINDOWS\System32\DSentry.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Creative\SBLive\Diagnostics\diagent.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Common Files\eAcceleration\eanthology.exeC:\SPYBOT\HijackThis.exeC:\PROGRA~1\ACCELE~1\SYSTEM~1\sys_alert.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Acceleration Software\Anti-Virus\defscangui.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Microsoft Money\System\mnyexpr.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.comR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.comR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%sF2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exeO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {B0BAA0D3-B86E-A237-D6EA-D5428A8C6CBC} - C:\WINDOWS\adduh32.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUNO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [diagent] 'C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe' startupO4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [THGuard] 'C:\Program Files\TrojanHunter 3.9\THGuard.exe'O4 - HKLM\..\Run: [EanthologyApp] 'C:\Program Files\Common Files\eAcceleration\eanthology.exe' /b StartupO4 - HKLM\..\Run: [eanth_system_patcher] C:\PROGRA~1\ACCELE~1\SYSTEM~1\sys_alert.exe /StartupO4 - HKLM\..\Run: [WebScan] C:\Program Files\Acceleration Software\Anti-Virus\defscangui.exe -kO4 - HKLM\..\Run: [javaew32.exe] C:\WINDOWS\javaew32.exeO4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\mnyexpr.exe'O4 - Startup: PowerReg Scheduler V3.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra 'Tools' menuitem: Block This Page (HKLM)O9 - Extra button: Research (HKLM)O9 - Extra button: Real.com (HKLM)O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/stop-sign_stp.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

tomthumb99 · Answer

i tried to delete  C:\Program Files\Common Files\eAcceleration\ - -FOLDER but it has an error msg overwrite protected are something like that. So how do you delete it.

tomthumb99 · Answer

I have a new trojen javaew32.$$$ that was from my norton antivirus when i got on the internet.   So i finally uninstalled & delete Acceleration Software hope this helps.   About:Buster Version 1.21Removed! : C:\WINDOWS\msfc.exeRemoved! : C:\WINDOWS\sdkda.exeRemoved! : C:\WINDOWS\dvebd.dllRemoved! : C:\WINDOWS\System32\addeh32.exeRemoved! : C:\WINDOWS\System32\atlbv32.exeRemoved! : C:\WINDOWS\System32\cror.exeRemoved! : C:\WINDOWS\System32\crrl.exeRemoved! : C:\WINDOWS\System32\d3xr32.exeAttempted Clean Of Temp folder.Removed LEGACY___NS_Service_3 KeyRemoved __NS_Service_3 KeyRemoved Uninstall Key (HSA)Removed Uninstall Key (SE)Removed Uninstall Key (SW)Pages Reset... Done!     Logfile of HijackThis v1.97.7Scan saved at 4:49:07 PM, on 6/25/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\System32\alg.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\syscr.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\WINDOWS\System32\LXSUPMON.EXEC:\WINDOWS\System32\DSentry.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\system32
ethj.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Creative\SBLive\Diagnostics\diagent.exeC:\SPYBOT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.comF2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exeO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {B0BAA0D3-B86E-A237-D6EA-D5428A8C6CBC} - C:\WINDOWS\adduh32.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUNO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [diagent] 'C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe' startupO4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [THGuard] 'C:\Program Files\TrojanHunter 3.9\THGuard.exe'O4 - HKLM\..\Run: [nethj.exe] C:\WINDOWS\system32
ethj.exeO4 - HKLM\..\Run: [ipnw.exe] C:\WINDOWS\system32\ipnw.exeO4 - HKLM\..\Run: [mfcse.exe] C:\WINDOWS\system32\mfcse.exeO4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\mnyexpr.exe'O4 - Startup: PowerReg Scheduler V3.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra 'Tools' menuitem: Block This Page (HKLM)O9 - Extra button: Research (HKLM)O9 - Extra button: Real.com (HKLM)O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

baskar1234 · Answer

Hello, Please post a fresh Hijackthis log after rescanning with HIjackthis. Also, can you please find these files , zip them and email it to baskar1234 AT rediffmail.com C:\WINDOWS\system32
ethj.exe C:\WINDOWS\system32\ipnw.exe C:\WINDOWS\system32\mfcse.exe These files may be hidden.Be sure to unhide all files and folders. http://www.xtra.co.nz/help/0,,4155-1916458,00.html How to unhide file and folders Regards, Baskar .

Virus & Spyware

i have hjl

Was this post helpful?