my hijack this log

Question

Keep getting 'drivecleaner' and 'casino' redirects and pop-ups, my log is as follows:   Logfile of HijackThis v1.99.1 Scan saved at 14:00:44, on 05/08/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe C:\Program Files\iTunes\iTunesHelper.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exe C:\Program Files\Milestone\Milestone Surveillance\Server.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.frrojxecjfpavtijh.us/pn1ygsER4oOfR2hQr5PmwcCkOh5vPjQJrxVoLg2vfJWvY_WMUbTMil0baedpQ80A.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: (no name) - {820F7EFB-B98C-79CF-243C-8257FB30469A} - C:\DOCUME~1\BELIND~1\APPLIC~1\KEEPTW~1\phone soft.exe O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe' O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [Dell AIO Printer A920] 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe' O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [readme bait live noun] C:\Documents and Settings\All Users\Application Data\audio long readme bait\else bib.exe O4 - HKCU\..\Run: [memo mess] C:\DOCUME~1\BELIND~1\APPLIC~1\DRIVEC~1\Size Once.exe O4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized O4 - Startup: Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exe O4 - Startup: Shortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exe O4 - Startup: Shortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\bla.MHT!http://www.turkcode.com//chm.chm::/windllserv.exe O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cab O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab O16 - DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} (GGSecSign Class) - https://customs.hmrc.gov.uk/gg/GGSecSign.cab O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://10.1.1.10:1010/activex/AMC.cab O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol023.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33 O17 - HKLM\System\CS1\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33 O17 - HKLM\System\CS2\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe' -service (file missing)

Bugbatter · Answer

Welcome, bsly,

It looks as if you may have a couple of infections in there.

Download, install, and scan with Ad-Aware SE 1.06 Personal.
http://lavasoft.element5.com/support/download/

If you already have Ad-Aware SE, please configure it as indicated below. If you have a previous version of Ad-Aware, please uninstall your current version and install the newest version SE 1.06.

1) Run Ad-Aware, and click Check for updates now.

2) Select Configurations (click the Gear wheel at the top) as follows:

* General Button > Safety & Settings: Check (Green) all three.
* Tweak Button > Cleaning Engine > UNcheck "Always try to unload modules before deletion".

Click Proceed.

3) To start the scan, Click > "Scan Now" at left

* Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
* Select "Search for low-risk threats"
* Select "Perform full system scan"
* Click Next

4) When the scan has completed, select Next.

* In the Scanning Results window, select the "Critical Objects" tab.
* Right-click on the screen and choose "Select all objects"
* In the "Scan Summary" tab, check the box next to each additional "target family" you wish to remove.
* Click Next to remove the objects selected, and click OK to the prompt.
* Restart the computer.

Please do an online virus scan with Panda ActiveScan
http://www.pandasoftware.com/products/activescan.htm

You need to use Internet Explorer for this scan.

Once you get to the Panda site, scroll down a bit and click on Scan your PC
A new window will appear; click on Check Now!
A new window will appear; fill in the boxes (Country, State, email addy)
Click on Scan Now! >
If you have never used ActiveScan before, you will be prompted to install an ActiveX control ( asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
From " Select a device to scan...", choose " My Computer"
Allow the scan to run. It'll take a while.
When complete, click on " See Report", and then on " Save report"; save it to a convenient location.

Please go to your HijackThis which is here: C:\Program Files\Hijackthis\HijackThis.exe and rename HijackThis.exe to analyzer.exe
Please run a new scan so you can post the updated log in your next reply.

Go into the Config option when you start analyzer.exe (which is your renamed HijackThis), and then click on the Misc Tools button at the top.

You will then click on the button labeled "Generate StartupList Log" Once you click that button, the program will automatically open up a notepad filled with the Startup items from your computer. Copy and paste these entries into your next reply and submit it.

** To summarize what is needed:
1. Please post the report from Panda.. Simply open the text file, then copy/paste the content here.
2. Include a fresh analyzer (HJT) log
3. Finally please post your Startup List. Thanks!

You will need several replies because the forum software will take only a limited amount of text.

Message Edited by Bugbatter on 08-06-200611:17 AM

bsly · Answer

Thanks for that, will run it later in the week and post the results

Bugbatter · Answer

Okay. Thanks for letting me know. :)

bsly · Answer

Panda report:

Incident Status Location

Adware:Adware/Lop                                                               Not disinfected               c:\docume~1\belind~1\applic~1\drivec~1\sizeon~1.exe
Adware:adware/superspider                                                       Not disinfected               c:\windows\system32\d2kpax.exe
Dialer:dialer.avv                                                               Not disinfected               c:\program files\pl.exe
Potentially unwanted tool:application/winfixer2005                              Not disinfected               c:\windows\downloaded program files\UDC6_0001_D10M2905NetInstaller.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\All Users\Application Data\audio long readme bait\else bib.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\All Users\Application Data\audio long readme bait\Grim send.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\All Users\Application Data\audio long readme bait\phone book.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\All Users\Application Data\audio long readme bait\typesite.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\DOWNLOADSCRMOREACTIVE.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\mqpkokah.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\pdxwrzzh.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\qrszatbi.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\Size Once.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\thkorrog.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\tray site slow.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Application Data\DriveChicBalm\vgmxcjid.exe
Spyware:Cookie/888                                                              Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@888[1].txt
Spyware:Cookie/888                                                              Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@888[2].txt
Spyware:Cookie/YieldManager                                                     Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@ad.yieldmanager[1].txt
Spyware:Cookie/Cassava                                                          Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@cassava[1].txt
Spyware:Cookie/Com.com                                                          Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@com[1].txt
Spyware:Cookie/DriveCleaner                                                     Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@stats.drivecleaner[1].txt
Spyware:Cookie/myaffiliateprogram                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@www.myaffiliateprogram[2].txt
Spyware:Cookie/Zedo                                                             Not disinfected               C:\Documents and Settings\Belinda Sly\Cookies\belinda sly@zedo[1].txt
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\e0418b7f.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\eb1c837d.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\sta2B.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\sta52.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\staA.exe
Adware:Adware/Lop                                                               Not disinfected               C:\Documents and Settings\Belinda Sly\Local Settings\Temp\staB.exe

bsly · Answer

Start-up list: StartupList report, 11/08/2006, 14:48:53StartupList version: 1.52.2Started from : C:\Program Files\Hijackthis\analyzer.EXEDetected: Windows XP SP2 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)* Using default options================================================== Running processes: C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Skype\Phone\Skype.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Hijackthis\analyzer.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup:[C:\Documents and Settings\Belinda Sly\Start Menu\Programs\Startup]Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeShortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeShortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exe Shell folders Common Startup:[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXENkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\Run IgfxTray = C:\WINDOWS\system32\igfxtray.exeHotKeysCmds = C:\WINDOWS\system32\hkcmd.exeIntelMeM = C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exedla = C:\WINDOWS\system32\dla	fswctrl.exeStorageGuard = 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rDVDSentry = C:\WINDOWS\System32\DSentry.execcApp = 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'ccRegVfy = 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERDell AIO Printer A920 = 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumeriTunesHelper = 'C:\Program Files\iTunes\iTunesHelper.exe'QuickTime Task = 'C:\Program Files\QuickTime\qttask.exe' -atboottimereadme bait live noun = C:\Documents and Settings\All Users\Application Data\audio long readme bait\else bib.exe -------------------------------------------------- Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Run Sonic RecordNow! =memo mess = C:\DOCUME~1\BELIND~1\APPLIC~1\DRIVEC~1\Size Once.exeSkype = 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\ssflwbox.scrdrivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - C:\WINDOWS\system32\dla	fswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}(no name) - C:\DOCUME~1\BELIND~1\APPLIC~1\KEEPTW~1\phone soft.exe (file missing) - {820F7EFB-B98C-79CF-243C-8257FB30469A}NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} -------------------------------------------------- Enumerating Task Scheduler jobs: 0AF3D5D28AF0F8C6.jobNorton AntiVirus - Scan my computer.jobSymantec NetDetect.job -------------------------------------------------- Enumerating Download Program Files: [RegUserCfgUI Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\yregucfg.dllCODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cab [{2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6}]CODEBASE = http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab [GGSecSign Class]InProcServer32 = C:\WINDOWS\system32\GGSecsig.dllCODEBASE = https://customs.hmrc.gov.uk/gg/GGSecSign.cab [AxisMediaControl Class]InProcServer32 = C:\Program Files\Axis Communications\AXIS Media Control\AxisMediaControl.dllCODEBASE = http://10.1.1.10:1010/activex/AMC.cab [ActiveScan Installer Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dllCODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab [Shockwave Flash Object]InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocxCODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [webhelper Class]InProcServer32 = C:\Program Files\Internet Explorer\BTOW Shared Files\btwebcontrol.dllCODEBASE = http://register.btinternet.com/templates/btwebcontrol023.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll --------------------------------------------------End of report, 7,523 bytesReport generated in 0.047 seconds Command line options:  /verbose  - to add additional info on each section  /complete - to include empty sections and unsuspicious data  /full     - to include several rarely-important sections  /force9x  - to include Win9x-only startups even if running on WinNT  /forcent  - to include WinNT-only startups even if running on Win9x  /forceall - to include all Win9x and WinNT startups, regardless of platform  /history  - to list version history only

bsly · Answer

HJT Log: Logfile of HijackThis v1.99.1Scan saved at 14:47:58, on 11/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Skype\Phone\Skype.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Hijackthis\analyzer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.eyaqcbwfhiolini.net/pn1ygsER4oOfR2hQr5PmwcCkOh5vPjQJrxVoLg2vfJUf5zHo7KRuW10baedpQ80A.jspR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: (no name) - {820F7EFB-B98C-79CF-243C-8257FB30469A} - C:\DOCUME~1\BELIND~1\APPLIC~1\KEEPTW~1\phone soft.exe (file missing)O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Dell AIO Printer A920] 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [readme bait live noun] C:\Documents and Settings\All Users\Application Data\audio long readme bait\else bib.exeO4 - HKCU\..\Run: [memo mess] C:\DOCUME~1\BELIND~1\APPLIC~1\DRIVEC~1\Size Once.exeO4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimizedO4 - Startup: Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeO4 - Startup: Shortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeO4 - Startup: Shortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cabO16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cabO16 - DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} (GGSecSign Class) - https://customs.hmrc.gov.uk/gg/GGSecSign.cabO16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://10.1.1.10:1010/activex/AMC.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol023.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS1\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS2\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe' -service (file missing)

Bugbatter · Answer

We're getting there....

Do you know what this is, and did you install it?
C:\Program Files\Milestone\Milestone Surveillance

Configure to show all files/folders:
Go to Start>Search and at the top select Tools>Folder Options
Select the View tab
Display the contents of system folders
Show hidden files and folders
Uncheck: Hide protected operating system files
Click on Apply.
Next go to the side of the Search box and select All files and folders. Go down to More advanced options.
Be sure the first three boxes are selected:
Search System folders
Search Hidden Files and folders
Search SubFolders

Boot into Safmode.
Turn on the computer.
Immediately begin tapping the F8 key
Use the arrow keys to highlight Safe Mode and press the Enter key.

Please launch HjackThis and place a checkmark next to these;
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.eyaqcbwfhiolini.net/pn1ygsER4oOfR2hQr5PmwcCkOh5vPjQJrxVoLg2vfJUf5zHo7KRuW10baedpQ80A.jsp
O2 - BHO: (no name) - {820F7EFB-B98C-79CF-243C-8257FB30469A} - C:\DOCUME~1\BELIND~1\APPLIC~1\KEEPTW~1\phone soft.exe (file missing)
O4 - HKLM\..\Run: [readme bait live noun] C:\Documents and Settings\All Users\Application Data\audio long readme bait\else bib.exe
O4 - HKCU\..\Run: [memo mess] C:\DOCUME~1\BELIND~1\APPLIC~1\DRIVEC~1\Size Once.exe
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab

Delete the following specified files/folders if they still exist:
C:\Documents and Settings\All Users\Application Data\ audio long readme bait --FOLDER
C:\Documents and Settings\Belinda Sly\Application Data\ DriveChicBalm\ --FOLDER

c:\windows\system32\ d2kpax.exe --file
c:\program files\ pl.exe --file
c:\windows\downloaded program files\ UDC6_0001_D10M2905NetInstaller.exe --file
c:\windows\tasks\ 0AF3D5D28AF0F8C6.job --file

Reboot normally.

Go back and rehide files:
Go to Start>Search and at the top select Tools>Folder Options
Select the View tab
Display the contents of system folders
Show hidden files and folders
Check: Hide protected operating system files
Click on Apply.

Download and scan each user profile with CCleaner:
http://www.ccleaner.com/downloadbuilds.asp
** Select to download the BASIC version.
1. Before first use, select Options > Advanced and UNCHECK
" Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer"
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the " Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click " OK" and it will scan and clean your system.
6. Click " exit" when done.
REBOOT.

Please post another HijackThis log and StartupList so we can see if we were successful. Let me know if you are still having DriveCleaner problems. This infection can migrate from one user to another, so please let me know how many user accounts you have on there. Thanks.

bsly · Answer

Thanks for that, will post the reports later on today.

I believe the Milestone software is something to do with the digital cameras that are used for surveillance; was installed by the camera engineer.

There is only one user on this pc.

bsly · Answer

Startuplist: StartupList report, 12/08/2006, 14:01:18StartupList version: 1.52.2Started from : C:\Program Files\Hijackthis\analyzer.EXEDetected: Windows XP SP2 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)* Using default options================================================== Running processes: C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Hijackthis\analyzer.exeC:\Program Files\Messenger\msmsgs.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup:[C:\Documents and Settings\Belinda Sly\Start Menu\Programs\Startup]Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeShortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeShortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exe Shell folders Common Startup:[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXENkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\Run IgfxTray = C:\WINDOWS\system32\igfxtray.exeHotKeysCmds = C:\WINDOWS\system32\hkcmd.exeIntelMeM = C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exedla = C:\WINDOWS\system32\dla	fswctrl.exeStorageGuard = 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rDVDSentry = C:\WINDOWS\System32\DSentry.execcApp = 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'ccRegVfy = 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERDell AIO Printer A920 = 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumeriTunesHelper = 'C:\Program Files\iTunes\iTunesHelper.exe'QuickTime Task = 'C:\Program Files\QuickTime\qttask.exe' -atboottime -------------------------------------------------- Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Run Sonic RecordNow! =Skype = 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\ssflwbox.scrdrivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - C:\WINDOWS\system32\dla	fswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} -------------------------------------------------- Enumerating Task Scheduler jobs: 0AF3D5D28AF0F8C6.jobNorton AntiVirus - Scan my computer.jobSymantec NetDetect.job -------------------------------------------------- Enumerating Download Program Files: [RegUserCfgUI Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\yregucfg.dllCODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cab [GGSecSign Class]InProcServer32 = C:\WINDOWS\system32\GGSecsig.dllCODEBASE = https://customs.hmrc.gov.uk/gg/GGSecSign.cab [AxisMediaControl Class]InProcServer32 = C:\Program Files\Axis Communications\AXIS Media Control\AxisMediaControl.dllCODEBASE = http://10.1.1.10:1010/activex/AMC.cab [ActiveScan Installer Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dllCODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab [Shockwave Flash Object]InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocxCODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [webhelper Class]InProcServer32 = C:\Program Files\Internet Explorer\BTOW Shared Files\btwebcontrol.dllCODEBASE = http://register.btinternet.com/templates/btwebcontrol023.cab -------------------------------------------------- Enumerating Windows NT logon/logoff scripts:*No scripts set to run* Windows NT checkdisk command:BootExecute = autocheck autochk * Windows NT 'Wininit.ini':PendingFileRenameOperations: C:\DOCUME~1\BELIND~1\LOCALS~1\Temp\~nsu.tmp\Au_.exe|||L -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll --------------------------------------------------End of report, 7,371 bytesReport generated in 0.047 seconds Command line options:  /verbose  - to add additional info on each section  /complete - to include empty sections and unsuspicious data  /full     - to include several rarely-important sections  /force9x  - to include Win9x-only startups even if running on WinNT  /forcent  - to include WinNT-only startups even if running on Win9x  /forceall - to include all Win9x and WinNT startups, regardless of platform  /history  - to list version history only

bsly · Answer

Hijack this log: Logfile of HijackThis v1.99.1Scan saved at 14:02:04, on 12/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Hijackthis\analyzer.exeC:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hostsO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Dell AIO Printer A920] 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimizedO4 - Startup: Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeO4 - Startup: Shortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeO4 - Startup: Shortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cabO16 - DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} (GGSecSign Class) - https://customs.hmrc.gov.uk/gg/GGSecSign.cabO16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://10.1.1.10:1010/activex/AMC.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol023.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS1\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS2\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O20 - Winlogon Notify: igfxcui - igfxsrvc.dll (file missing)O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe' -service (file missing)

Bugbatter · Answer

Almost, but we'll have to bring out a bigger tool for that one file.

Please download the Killbox by Option^Explicit.

If not available, here is an alternate link for the download:
Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download
Save it to your Desktop.

Please disable your Symantec Script Blocking from within your Norton so it does not interfere with anything during our fixes now or later. You can enable this whenever we have verified that your system is clean.
To disable Norton AntiVirus Script Blocking:
1. Start Norton AntiVirus.
If Norton AntiVirus is installed as part of Norton SystemWorks or Norton Internet Security, then start that program.
2. Click Options.
If you see a menu, click Norton AntiVirus.
3. In the left pane, click Script Blocking.
4. In the right pane, uncheck Enable Script Blocking (recommended).
5. Click OK.

Please double-click Killbox.exe to run it.
Select: Delete on Reboot

Click on the Single File button.

Please copy the file path below to the clipboard by highlighting it it and pressing CTRL + C (or, after highlighting, right-click and choose copy):

c:\windows\tasks\0AF3D5D28AF0F8C6.job

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button.
Click Yes at the Delete on Reboot prompt.
Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message.).

If your computer does not restart automatically, please restart it manually into normal mode.

[Note: Killbox makes backups of all deleted files & folders in a folder called C:\!killbox ]
If Killbox tells you any files are missing don't worry but make a note and let us know in your next reply.

Please post yet another Hijackthis log and Startup List. Please let me know if your redirect and pop-up problem is gone.

bsly · Answer

Hi Bugbatter ... have followed all your instructions to the rule and everything appears to be running fine and no sign of the pop-ups. Posted below are the two reports, hopefully showing an all clear. Thanks very much for your very helpful advice, all I have to do now is convince the owner to switch to a mac! Logfile of HijackThis v1.99.1Scan saved at 11:20:19, on 19/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Hijackthis\analyzer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/uk/enu/gen/default.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Dell AIO Printer A920] 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [Skype] 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimizedO4 - Startup: Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeO4 - Startup: Shortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeO4 - Startup: Shortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cabO16 - DPF: {2D9F7B63-EC7C-43FF-A41D-6E9EC984A5B9} (GGSecSign Class) - https://customs.hmrc.gov.uk/gg/GGSecSign.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155388082562O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://10.1.1.10:1010/activex/AMC.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cabO16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol023.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS1\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O17 - HKLM\System\CS2\Services\Tcpip\..\{2C5A009D-95FA-417B-B858-65BD88BFE789}: NameServer = 213.130.128.32,213.130.128.33O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe' -service (file missing) StartupList report, 19/08/2006, 11:21:35StartupList version: 1.52.2Started from : C:\Program Files\Hijackthis\analyzer.EXEDetected: Windows XP SP2 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)* Using default options================================================== Running processes: C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeC:\Program Files\Milestone\Milestone Surveillance\Server.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Hijackthis\analyzer.exe -------------------------------------------------- Listing of startup folders: Shell folders Startup:[C:\Documents and Settings\Belinda Sly\Start Menu\Programs\Startup]Monitor.lnk = C:\Program Files\Milestone\Milestone Surveillance\Monitor.exeShortcut to HttpSrv.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\HttpSrv.exeShortcut to Server.exe.lnk = C:\Program Files\Milestone\Milestone Surveillance\Server.exe Shell folders Common Startup:[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXENkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\Run IgfxTray = C:\WINDOWS\system32\igfxtray.exeHotKeysCmds = C:\WINDOWS\system32\hkcmd.exeIntelMeM = C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exedla = C:\WINDOWS\system32\dla	fswctrl.exeStorageGuard = 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rDVDSentry = C:\WINDOWS\System32\DSentry.execcApp = 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'ccRegVfy = 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe'RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERDell AIO Printer A920 = 'C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe'Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumeriTunesHelper = 'C:\Program Files\iTunes\iTunesHelper.exe'QuickTime Task = 'C:\Program Files\QuickTime\qttask.exe' -atboottime -------------------------------------------------- Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Run Sonic RecordNow! =Skype = 'C:\Program Files\Skype\Phone\Skype.exe' /nosplash /minimized -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\ssflwbox.scrdrivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - C:\WINDOWS\system32\dla	fswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890}NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} -------------------------------------------------- Enumerating Task Scheduler jobs: Norton AntiVirus - Scan my computer.jobSymantec NetDetect.job -------------------------------------------------- Enumerating Download Program Files: [RegUserCfgUI Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\yregucfg.dllCODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/controls/yregucfg/2004_10_11_1/yregucfg.cab [GGSecSign Class]InProcServer32 = C:\WINDOWS\system32\GGSecsig.dllCODEBASE = https://customs.hmrc.gov.uk/gg/GGSecSign.cab [MUWebControl Class]InProcServer32 = C:\WINDOWS\system32\muweb.dllCODEBASE = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155388082562 [AxisMediaControl Class]InProcServer32 = C:\Program Files\Axis Communications\AXIS Media Control\AxisMediaControl.dllCODEBASE = http://10.1.1.10:1010/activex/AMC.cab [ActiveScan Installer Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dllCODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab [Shockwave Flash Object]InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocxCODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [webhelper Class]InProcServer32 = C:\Program Files\Internet Explorer\BTOW Shared Files\btwebcontrol.dllCODEBASE = http://register.btinternet.com/templates/btwebcontrol023.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll --------------------------------------------------End of report, 7,321 bytesReport generated in 0.031 seconds Command line options:  /verbose  - to add additional info on each section  /complete - to include empty sections and unsuspicious data  /full     - to include several rarely-important sections  /force9x  - to include Win9x-only startups even if running on WinNT  /forcent  - to include WinNT-only startups even if running on Win9x  /forceall - to include all Win9x and WinNT startups, regardless of platform  /history  - to list version history only

Bugbatter · Answer

That looks much better. :)

There is just a bit more to do.

Run Disk Cleanup in each user's profile:
Click "Start > Programs > Accessories > System Tools > Disk Cleanup"
Please make sure the following are checked:
-- Downloaded Program Files
-- Temporary Internet Files
-- Recycle Bin
-- Temporary Files
Click "OK" and Disk Cleanup will delete those files for you.

Please follow these steps to remove older version Java components:

1. Close any open programs you may have running, especially your web
browser
2. Click Start > Control Panel
* Depending on your OS or configuration, you may have to click Start
>Settings > Control Panel
3. Open Add or Remove Programs
* If you have Windows 98 or Windows 2000, open Add/Remove
Programs
4. Click once on any item listing Java Runtime Environment in the name
* Not every version of Java will begin with "Java" so be sure to read
each entry in the list
5. Click the Remove or Change/Remove button
6. Follow steps 4 and 5 as many times as necessary to remove all
versions of Java. ** If at any time during the uninstallations, you are asked to reboot, do so. Then return to Add/Remove and continue removing any other versions of Java until all components of Java have been removed.
7. Delete the Java folder in Program Files.
8. Proceed with reinstalling Java. You will need to use Internet Explorer for this.
Go to Sun Java and click the link to download the Windows (Offline Installation) package: Save it, do not run it.

When the download is complete, close the browser and install it.

Reboot.

Please post a HijackThis log for final review. Thanks.:)

Virus & Spyware

my hijack this log

Was this post helpful?