Need help with pop ups, malware, etc.

Mike,

Trendmicro.com found one malware and deleted it. It was TROJ_Narrator.A.

Here is the Log from FindIt.

---------------- FindNarrator NT-2K-XP ----------------
 
Warning! This utility will find legitimate files in addition to malware. 
Do not remove anything unless you are sure you know what you're doing.
 
***** Operating System *****
 
Microsoft Windows XP Professional 5.1 Service Pack 2 (Build 2600)
 
********* Date/Time ********
 
Thursday, February 10, 2005 (2/10/2005)
6:54 PM, Eastern Standard Time
 
*********** Path ***********
 
FindNarrator.bat is running from: C:\Documents and Settings\Robin\Local Settings\Temporary Internet Files\Content.IE5\8TMN0XQR\FindIt%20NT-2K-XP[1]\FindIt NT-2K-XP
 
---------------- Strings.exe Qoologic Results ----------------
 
 
---------------- Strings.exe Aspack Results ----------------
 
C:\WINDOWS\system32\ntdll.dll: .aspack
 
---------------- Active Setup Installed Components ----------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\0c260cc8-7b05-4934-b105-64529215f094

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
 
---------------- Context Menu Handlers ----------------
REGEDIT4

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mnmxst]
@="{272a166e-59ad-4afe-86aa-6a7dadfb35fa}"

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files]
@="{750fdf0e-2a26-11d1-a3ea-080036587f03}"

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With]
@="{09799AFB-AD67-11d1-ABCD-00C04FC30936}"

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu]
@="{A470F8CF-A1E8-4f65-8335-227475AA5C46}"

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu]
@="{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}]
@="Start Menu Pin"

---------------- Run Key ----------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"IAAnotif"="C:\\Program Files\\Intel\\Intel Application Accelerator\\iaanotif.exe"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe"
"CTDVDDet"="C:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE"
"CTHelper"="CTHELPER.EXE"
"AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"

---------------- FindNarrator NT-2K-XP ----------------

Mike,

Here they are from Norton's Log Viewer:

,Threat category: AdwareSource: C:\WINDOWS\ZServ.dll,Description: The file C:\WINDOWS\ZServ.dll is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/msexreg.exe,Description: The compressed file C:/WINDOWS/system32/msexreg.exe within C:\WINDOWS\system32\netut80ex.vxd is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/javexulm.vxd,Description: The compressed file C:/WINDOWS/system32/javexulm.vxd within C:\WINDOWS\system32\netut80ex.vxd is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/exul.exe,Description: The compressed file C:/WINDOWS/system32/exul.exe within C:\WINDOWS\system32\netut80ex.vxd is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/mqexdlm.srg,Description: The compressed file C:/WINDOWS/system32/mqexdlm.srg within C:\WINDOWS\system32\netut80ex.vxd is a Adware threat.
,Threat category: AdwareSource: C:/Program Files/BullsEye Network/bin/adx.exe,Description: The compressed file C:/Program Files/BullsEye Network/bin/adx.exe within C:\WINDOWS\system32\mac80ex.idf is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/exdl.exe,Description: The compressed file C:/WINDOWS/system32/exdl.exe within C:\WINDOWS\system32\netut80ex.vxd is a Adware threat.
,Threat category: AdwareSource: C:/Program Files/NaviSearch/bin/nls.exe,Description: The compressed file C:/Program Files/NaviSearch/bin/nls.exe within C:\WINDOWS\system32\javex80.vxd is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/msbe.dll,Description: The compressed file C:/WINDOWS/system32/msbe.dll within C:\WINDOWS\system32\mac80ex.idf is a Adware threat.
,Threat category: AdwareSource: C:/Program Files/BullsEye Network/bin/bargains.exe,Description: The compressed file C:/Program Files/BullsEye Network/bin/bargains.exe within C:\WINDOWS\system32\mac80ex.idf is a Adware threat.
,Threat category: AdwareSource: C:/Program Files/BullsEye Network/bin/adv.exe,Description: The compressed file C:/Program Files/BullsEye Network/bin/adv.exe within C:\WINDOWS\system32\mac80ex.idf is a Adware threat.
,Threat category: AdwareSource: C:/WINDOWS/system32/nvms.dll,Description: The compressed file C:/WINDOWS/system32/nvms.dll within C:\WINDOWS\system32\javex80.vxd is a Adware threat.

Robin,

Let's first try this: Reboot your system into "Safe Mode", then re-run Norton's and see if those files can be deleted. If that doesn't work, let try and delete them manually...

C:\WINDOWS\system32\mac80ex.idf
C:\WINDOWS\system32\javex80.vxd
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\ZServ.dll

Mike,

I ran Norton in Safe Mode and it wouldn't let me delete any of those files. It still gave me only two options, to Exclude or Skip the files when running NAV again. So, I manually deleted the files and then ran Norton again. It is still picking up those same files. It seems like there is no way to get rid of them. Here is the new Norton AV log. Would it be better if I did a full reformat of the hard drive? I don't have many programs installed, so I won't be losing anything, and it would be worth it to get rid of this stuff.