Pop-up windows when searching internet

Question

While I search the Internet I constantly am getting windows that pop up over mine with different ads.  It's very annoying Can someone please help?     Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 4:22:08 PM, on 11/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\mrofinu77.exe C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\BitTorrent_DNA\dna.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\AOL 9.0\aoltray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\NETSCA~2\NETSCA~1\app\TangoManager.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\8V5MDXJ5\HiJackThis_v2[1].exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DC R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.my.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: (no name) - {00C0D9A5-EB06-4EF8-A10B-7ADA34F72D0A} - C:\WINDOWS\system32\jkhfc.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: {071acbd4-47b9-a0e8-db04-379900821df1} - {1fd12800-9973-40bd-8e0a-9b744dbca170} - C:\WINDOWS\system32\kekhsydr.dll O2 - BHO: (no name) - {4CB8F4B4-5F66-4D9E-BC3B-184596A58824} - C:\WINDOWS\system32\yayaayx.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [osCheck] 'C:\Program Files\Norton Internet Security\osCheck.exe' O4 - HKLM\..\Run: [Symantec PIF AlertEng] 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' /a /m 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll' O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] 'C:\Program Files\BitTorrent_DNA\dna.exe' O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194577771500 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194831219281 O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F0368A-02DB-4BEE-8088-A87BCFC03C5E}: NameServer = 205.188.146.145 O20 - Winlogon Notify: yayaayx - C:\WINDOWS\SYSTEM32\yayaayx.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 11505 bytes

Bugbatter · Answer

Welcome. Thank you for using Dell Community Forums. :)

I am reviewing your log.
In the meantime, you can help me by doing the following:

* If you have posted this log on another forum, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them are counter productive to restoring your PC to a healthy state.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log. Please do not do anything else until you get further instructions.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

* You are using a BETA version of HijackThis. Please see the instructions at the top of this board for downloading version 2.02. When you reply to my questions above, please post a log from that version so we can begin cleaning. Thanks.

Bugbatter · Answer

Your HijackThis is running out of your Temporary Internet Files.

From the top of the forum, here are the instructions for downloading the installer version:
http://www.dellcommunity.com/supportforums/board/message?board.id=si_hijack&thread.id=52014
Please install it.

After installing HijackThis, open HijackThis and click on the "Open the Misc Tools section" button.
Click on the "Open Uninstall Manager" button.
Click the "Save List" button. After you click the "Save List" button, you will be asked where to save the file. Select a place to save it. The list should open in notepad.
Copy and paste that list here.
Thanks :)

ash0417 · Answer

I have not posted in another forum.  I have not fixed anything with HiJackThis and I have removed all cracked software and file sharing programs.  Here is my new log from v2.0.2             Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:09:21 PM, on 11/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\mrofinu77.exe C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AOL 9.0\aoltray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\NETSCA~2\NETSCA~1\app\TangoManager.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Ashley\Local Settings\Temporary Internet Files\Content.IE5\ZQQBBUH0\HiJackThis[1].exe C:\WINDOWS\system32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DC R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.my.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: (no name) - {00C0D9A5-EB06-4EF8-A10B-7ADA34F72D0A} - C:\WINDOWS\system32\jkhfc.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: {071acbd4-47b9-a0e8-db04-379900821df1} - {1fd12800-9973-40bd-8e0a-9b744dbca170} - C:\WINDOWS\system32\kekhsydr.dll O2 - BHO: (no name) - {4CB8F4B4-5F66-4D9E-BC3B-184596A58824} - C:\WINDOWS\system32\yayaayx.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [osCheck] 'C:\Program Files\Norton Internet Security\osCheck.exe' O4 - HKLM\..\Run: [Symantec PIF AlertEng] 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' /a /m 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll' O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194577771500 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194831219281 O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F0368A-02DB-4BEE-8088-A87BCFC03C5E}: NameServer = 205.188.146.145 O20 - Winlogon Notify: yayaayx - C:\WINDOWS\SYSTEM32\yayaayx.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 11308 bytes

ash0417 · Answer

When I click on the save list nothing happens and hijack this disappears off my screen.

Bugbatter · Answer

That's odd, but we'll continue without it.
Please download the latest version of VundoFix.exe to your desktop. (If you have an earlier version, delete it and its old log here: C:\ vundofix.txt.)

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files,
click YES
Once you click yes, your desktop will go blank as it starts removing
Vundo.
When completed, it will prompt that it will shutdown your computer,
click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt and a new
HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not
remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. ** If you get a warning about updating Java, do not do so until I can give you further instructions.

ash0417 · Answer

Vundo did not detect anything on my system.  Here is a new High Jack This log.       Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:13:30 PM, on 11/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\mrofinu77.exe C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AOL 9.0\aoltray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe C:\PROGRA~1\NETSCA~2\NETSCA~1\app\TangoManager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DC R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.my.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [osCheck] 'C:\Program Files\Norton Internet Security\osCheck.exe' O4 - HKLM\..\Run: [Symantec PIF AlertEng] 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' /a /m 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll' O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194577771500 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194831219281 O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F0368A-02DB-4BEE-8088-A87BCFC03C5E}: NameServer = 205.188.146.145 O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 9950 bytes

Bugbatter · Answer

The BHO's are gone. What other scans did you run besides VundoFix?

Bugbatter · Answer

Wow! You typed that out? That's a lot of work! Thanks :)

It is unusual that those BHO's would just disappear. We'll need to dig a little deeper.
1. Please download Combofix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the link is case sensitive
Save ComboFix to the desktop. **Note: It is important that it is saved directly to, and run from your desktop**

In the event you already have Combofix, please delete it as this is a new version.
* Close any open browsers. Disconnect from the internet.
* Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

2. Double click ComboFix.exe and follow the prompts.
You will temporarily lose the Desktop while the scan is running. Once the scan is done your Desktop will return to normal.

3. When finished, it will produce a log for you. Post that log in your next reply along with a fresh HijackThis log.

Notes:
* Do not mouseclick ComboFix's window while it's running. That may cause it to stall.
* ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
* Don't forget to enable your anti-virus before coming back online to post your logs.

Note: The above instructions have been created specifically for this user. If you are not this user, do NOT follow these directions.

ash0417 · Answer

I didn't run any other scans. I did However type out that list from the uninstall manager that I couldn't get to save. It's posted below. I wasn't sure if you still needed it.

Actiontec USB/Ethernet Home DSL Modem
Adobe Acrobat-Reader 6.0.2 Update
Adobe Flash Player ActiveX
Adobe Reader 6.0.1
AOL(chose which version to remove)
AOL Connectivity Services
AOL You've Got Pictures Screensaver
AppCore
AutoCAD 2006-English
Autodesk DWF Viewer
AV
ccCommon
Conexant D110 MDC V.9x Modem
Dell Driver Reset Tool
Dell Media Experience
Dell Picture Studio v3.0
Dell Support 3.1
Dell Wireless WLAN Card
Digital Line Detect
Google Toolbar for Internet Explorer
Guitar Pro 5.2
HiJackThis 2.0.2
Hotfix for Windows Media Format 11 SDK(KB9293)
Hotfix for Windows Media Player 11(KB939683)
Hotfix for Windows XP(KB914440)
Hotfix for Windows XP(KB915865)
Hotfix for Windows XP(KB926239)
Intel(R) Graphics Media Accelerator Driver for Mobile
Intel(R) PRO Network Adapters and Drivers
Intel(R) ProSet for Wired Connections
Internal Network Card Power Management
Internet Explorer Default Page
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro Studio, Dell Edition
Java 2 Runtime Enviroment, SE v1.4.2_03
Learn2Player(uninstall only)
LiveUpdate 3.2(Symantec Corporation)
LiveUpdate Notice(Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix(KB928366)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Modem Helper
MSRedist
MSXML 4.0 SP@(KB936181)
MyWay Search Assistant
Netscape High Speed
NetWaiting
Norton Antivirus
Norton Confidential Browser Component
Norton Confidential Web Protection Component
Norton Ineternet Security
Norton Ineternet Security
Norton Ineternet Security
Norton Ineternet Security
Norton Ineternet Security(Symantec Corporation)
Norton Protection Center
Photo Click
PowerDVD 5.5
Quickset
Quicktime
Realplayer Basic
Samsung CamCorder Driver
Samsung video codec 1.1 uninstall
Security update for microsoft .NET framework 2.0(KB928365)
Security update for step by step interactive training(KB923723)
Security Update for windows internet explorer 7(KB938127)
Security Update for windows internet explorer 7(KB939653)
Security Update for Windows Media Player(KB911564)
Security Update for Windows Media Player 10(KB936782)
Security Update for Windows Media Player 11(KB936782)
Security Update for Windows Media Player 6.4(KB925398)
Security Update for Windows XP(KB890046)
Security Update for Windows XP(KB893756)
Security Update for Windows XP(KB896358)
Security Update for Windows XP(KB896423)
Security Update for Windows XP(KB896428)
Security Update for Windows XP(KB899587)
Security Update for Windows XP(KB899591)
Security Update for Windows XP(KB901017)
Security Update for Windows XP(KB902400)
Security Update for Windows XP(KB904706)
Security Update for Windows XP(KB905414)
Security Update for Windows XP(KB905749)
Security Update for Windows XP(KB908519)
Security Update for Windows XP(KB911562)
Security Update for Windows XP(KB911927)
Security Update for Windows XP(KB913580)
Security Update for Windows XP(KB914388)
Security Update for Windows XP(KB914389)
Security Update for Windows XP(KB917344)
Security Update for Windows XP(KB917953)
Security Update for Windows XP(KB918118)
Security Update for Windows XP(KB918439)
Security Update for Windows XP(KB919007)
Security Update for Windows XP(KB920213)
Security Update for Windows XP(KB920670)
Security Update for Windows XP(KB920683)
Security Update for Windows XP(KB920685)
Security Update for Windows XP(KB921503)
Security Update for Windows XP(KB922819)
Security Update for Windows XP(KB923191)
Security Update for Windows XP(KB923414)
Security Update for Windows XP(KB933689)
Security Update for Windows XP(KB923980)
Security Update for Windows XP(KB924270)
Security Update for Windows XP(KB924496)
Security Update for Windows XP(KB924467)
Security Update for Windows XP(KB925902)
Security Update for Windows XP(KB926255)
Security Update for Windows XP(KB926436)
Security Update for Windows XP(KB927779)
Security Update for Windows XP(KB927802)
Security Update for Windows XP(KB928255)
Security Update for Windows XP(KB928843)
Security Update for Windows XP(KB929123)
Security Update for Windows XP(KB930178)
Security Update for Windows XP(KB931261)
Security Update for Windows XP(KB931784)
Security Update for Windows XP(KB932168)
Security Update for Windows XP(KB933729)
Security Update for Windows XP(KB935839)
Security Update for Windows XP(KB935840)
Security Update for Windows XP(KB936021)
Security Update for Windows XP(KB938127)
Security Update for Windows XP(KB938829)
Security Update for Windows XP(KB939653)
Security Update for Windows XP(KB941802)
Sonic DLA
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Sony Vegas Movie Studio Platinum 8.0
SPBBC 32bit
Synaptics Pointing Device Driver
TuneUp Utilities 2007
Update for Windows XP(KB894391)
Update for Windows XP(KB898461)
Update for Windows XP(KB900485)
Update for Windows XP(KB904942)
Update for Windows XP(KB908531)
Update for Windows XP(KB910437)
Update for Windows XP(KB911280)
Update for Windows XP(KB916595)
Update for Windows XP(KB920872)
Update for Windows XP(KB922582)
Update for Windows XP(KB927891)
Update for Windows XP(KB930916)
Update for Windows XP(KB933360)
Update for Windows XP(KB936357)
Update for Windows XP(KB938828)
Viewpoint Media Player
WebCyberCoach 3.2 Dell
Windows Installer 3.1(KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix-KB885836
Windows XP Hotfix-KB886185
Windows XP Hotfix-KB888302
Windows XP Hotfix-KB890859
WinRAR archiver
WordPerfect Office 12

ash0417 · Answer

Sorry I think I got it now here is the combo fix log.

ComboFix 07-11-08.1 - Ashley 2007-11-12 23:05:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.128 [GMT -5:00]
Running from: C:\Documents and Settings\Ashley\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cfhkj.bak1
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\cfhkj.ini2
C:\WINDOWS\system32\cfhkj.tmp
C:\WINDOWS\system32\jkhfc.dll
C:\WINDOWS\system32\pac.txt

.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.

2007-11-12 23:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 21:10 d-------- C:\VundoFix Backups
2007-11-12 18:56 d-------- C:\Program Files\Trend Micro
2007-11-12 17:56 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 14:38 d-------- C:\Documents and Settings\Ashley\Application Data\WholeSecurity
2007-11-12 14:08 d-------- C:\Program Files\Printer's Apprentice 7.5
2007-11-12 14:08 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2007-11-12 12:25 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-11-12 12:24 d-------- C:\Program Files\TuneUp Utilities 2007
2007-11-12 12:24 d-------- C:\Documents and Settings\Ashley\Application Data\TuneUp Software
2007-11-12 12:24 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-11-12 12:23 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 10:12 81,472 --a------ C:\WINDOWS\system32\kekhsydr.dll
2007-11-11 21:43 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-11-11 21:43 5,504 --a------ C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-11 21:41 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-11 21:41 53,760 --a------ C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-11 21:40 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-11 21:40 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-11-11 21:39 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-11 21:37 290,816 --a------ C:\WINDOWS\Uninstall.exe
2007-11-11 21:37 75,648 --a------ C:\WINDOWS\system32\drivers\CamAv.sys
2007-11-11 21:37 57,344 --a------ C:\WINDOWS\HAJEInstall.dll
2007-11-11 21:35 700,416 --a------ C:\WINDOWS\system32\mcs_cor1.dll
2007-11-11 21:35 245,760 --a------ C:\WINDOWS\system32\mcs_cor2.dll
2007-11-11 21:35 147,456 --a------ C:\WINDOWS\system32\mcs_vfw.dll
2007-11-11 21:01 35,840 --a------ C:\WINDOWS\mrofinu77.exe
2007-11-11 21:00 36,352 --a------ C:\WINDOWS\system32\yayaayx.dll
2007-11-11 17:25 d-------- C:\Program Files\AnswerWorks 4.0
2007-11-11 17:20 d-------- C:\Program Files\AutoCAD 2006
2007-11-11 17:20 d-------- C:\Documents and Settings\Ashley\Application Data\Autodesk
2007-11-11 17:20 d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2007-11-11 17:18 d-------- C:\Program Files\Common Files\Autodesk Shared
2007-11-11 17:18 d-------- C:\Program Files\Autodesk
2007-11-11 02:53 d-------- C:\Documents and Settings\All Users\Application Data\Musicnotes
2007-11-11 01:31 d-------- C:\Program Files\MusicLab
2007-11-09 23:45 d-------- C:\Documents and Settings\Ashley\Application Data\AdobeUM
2007-11-09 23:44 d-------- C:\Program Files\Common Files\Adobe
2007-11-09 20:18 d-------- C:\Program Files\Guitar Pro 5
2007-11-09 19:31 d-------- C:\Program Files\Windows Media Connect 2
2007-11-09 19:30 d-------- C:\WINDOWS\system32\LogFiles
2007-11-09 19:30 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-11-09 16:00 d-------- C:\Program Files\WWW File Share Pro
2007-11-09 15:52 d-------- C:\Program Files\Google
2007-11-09 15:52 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-09 03:36 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-11-09 02:55 d-------- C:\Temp\abW9
2007-11-09 02:55 d-------- C:\Temp
2007-11-09 02:35 d-------- C:\WINDOWS\Sun
2007-11-09 01:57 d-------- C:\Documents and Settings\Ashley\Application Data\BitTorrent
2007-11-09 01:00 d-------- C:\Documents and Settings\Ashley\Application Data\Sony
2007-11-09 01:00 d-------- C:\Documents and Settings\Ashley\Application Data\Publish Providers
2007-11-09 00:52 d-------- C:\Program Files\Vstplugins
2007-11-09 00:52 d-------- C:\Program Files\Sony
2007-11-09 00:52 d-------- C:\Documents and Settings\All Users\Application Data\Sony
2007-11-09 00:07 d-------- C:\Program Files\Sony Setup
2007-11-09 00:07 d-------- C:\Documents and Settings\Ashley\Application Data\Sony Setup
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\You've Got Pictures Screensaver
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\Jasc Software Inc
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\Gtek
2007-11-08 22:46 d-------- C:\Program Files\MSXML 4.0
2007-11-08 22:35 582,656 --a------ C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-08 22:12 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-08 22:10 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-11-08 22:02 d--hs---- C:\Documents and Settings\Ashley\UserData
2007-11-08 21:50 d--h----- C:\WINDOWS\PIF
2007-11-08 21:40 d-------- C:\Program Files\Norton Internet Security
2007-11-08 21:39 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-08 21:39 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-08 21:38 d-------- C:\Program Files\Symantec
2007-11-08 21:38 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-08 21:37 d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-08 21:30 d-------- C:\Program Files\Netscape High Speed
2007-11-08 21:29 d-------- C:\Program Files\Netscape Internet Service
2007-11-08 21:29 d-------- C:\Program Files\Actiontec
2007-11-08 21:29 86,016 --a------ C:\WINDOWS\aeirem.exe
2007-11-08 21:29 50,236 --a------ C:\WINDOWS\system32\drivers\VVBUSUSB.SYS
2007-11-08 21:29 45,056 --a------ C:\WINDOWS\aeirmpca.exe
2007-11-08 21:29 40,832 --a------ C:\WINDOWS\system32\drivers\enetnt.sys
2007-11-08 21:29 34,560 --a------ C:\WINDOWS\system32\drivers\VVBETH.SYS
2007-11-08 21:13 d-------- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\You've Got Pictures Screensaver
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Jasc Software Inc
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\You've Got Pictures Screensaver
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\McAfee.com Personal Firewall
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\Jasc Software Inc
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\Gtek
2007-10-30 20:55 625,032 --a------ C:\WINDOWS\system32\SymNeti.dll
2007-10-30 20:55 242,056 --a------ C:\WINDOWS\system32\SymRedir.dll
2007-10-30 20:55 191,536 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 20:55 145,968 --a------ C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 20:55 39,856 --a------ C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 20:55 37,936 --a------ C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 20:55 35,120 --a------ C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 20:55 27,696 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 20:55 12,848 --a------ C:\WINDOWS\system32\drivers\symdns.sys

ash0417 · Answer

Here is the log from Combofix.

ComboFix 07-11-08.1 - Ashley 2007-11-12 23:05:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.128 [GMT -5:00]
Running from: C:\Documents and Settings\Ashley\Desktop\ComboFix.exe
* Created a new restore point
.
Unable to gain System Privileges
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\cfhkj.bak1
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\cfhkj.ini2
C:\WINDOWS\system32\cfhkj.tmp
C:\WINDOWS\system32\jkhfc.dll
C:\WINDOWS\system32\pac.txt
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-12 23:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 21:10

d-------- C:\VundoFix Backups
2007-11-12 18:56 d-------- C:\Program Files\Trend Micro
2007-11-12 17:56 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 14:38 d-------- C:\Documents and Settings\Ashley\Application Data\WholeSecurity
2007-11-12 14:08 d-------- C:\Program Files\Printer's Apprentice 7.5
2007-11-12 14:08 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2007-11-12 12:25 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-11-12 12:24 d-------- C:\Program Files\TuneUp Utilities 2007
2007-11-12 12:24 d-------- C:\Documents and Settings\Ashley\Application Data\TuneUp Software
2007-11-12 12:24 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-11-12 12:23 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 10:12 81,472 --a------ C:\WINDOWS\system32\kekhsydr.dll
2007-11-11 21:43 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2007-11-11 21:43 5,504 --a------ C:\WINDOWS\system32\dllcache\mstee.sys
2007-11-11 21:41 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2007-11-11 21:41 53,760 --a------ C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2007-11-11 21:40 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-11-11 21:40 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-11-11 21:39 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-11 21:37 290,816 --a------ C:\WINDOWS\Uninstall.exe
2007-11-11 21:37 75,648 --a------ C:\WINDOWS\system32\drivers\CamAv.sys
2007-11-11 21:37 57,344 --a------ C:\WINDOWS\HAJEInstall.dll
2007-11-11 21:35 700,416 --a------ C:\WINDOWS\system32\mcs_cor1.dll
2007-11-11 21:35 245,760 --a------ C:\WINDOWS\system32\mcs_cor2.dll
2007-11-11 21:35 147,456 --a------ C:\WINDOWS\system32\mcs_vfw.dll
2007-11-11 21:01 35,840 --a------ C:\WINDOWS\mrofinu77.exe
2007-11-11 21:00 36,352 --a------ C:\WINDOWS\system32\yayaayx.dll
2007-11-11 17:25 d-------- C:\Program Files\AnswerWorks 4.0
2007-11-11 17:20 d-------- C:\Program Files\AutoCAD 2006
2007-11-11 17:20 d-------- C:\Documents and Settings\Ashley\Application Data\Autodesk
2007-11-11 17:20 d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2007-11-11 17:18 d-------- C:\Program Files\Common Files\Autodesk Shared
2007-11-11 17:18 d-------- C:\Program Files\Autodesk
2007-11-11 02:53 d-------- C:\Documents and Settings\All Users\Application Data\Musicnotes
2007-11-11 01:31 d-------- C:\Program Files\MusicLab
2007-11-09 23:45 d-------- C:\Documents and Settings\Ashley\Application Data\AdobeUM
2007-11-09 23:44 d-------- C:\Program Files\Common Files\Adobe
2007-11-09 20:18 d-------- C:\Program Files\Guitar Pro 5
2007-11-09 19:31 d-------- C:\Program Files\Windows Media Connect 2
2007-11-09 19:30 d-------- C:\WINDOWS\system32\LogFiles
2007-11-09 19:30 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-11-09 16:00 d-------- C:\Program Files\WWW File Share Pro
2007-11-09 15:52 d-------- C:\Program Files\Google
2007-11-09 15:52 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-09 03:36 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2007-11-09 02:55 d-------- C:\Temp\abW9
2007-11-09 02:55 d-------- C:\Temp
2007-11-09 02:35 d-------- C:\WINDOWS\Sun
2007-11-09 01:57 d-------- C:\Documents and Settings\Ashley\Application Data\BitTorrent
2007-11-09 01:00 d-------- C:\Documents and Settings\Ashley\Application Data\Sony
2007-11-09 01:00 d-------- C:\Documents and Settings\Ashley\Application Data\Publish Providers
2007-11-09 00:52 d-------- C:\Program Files\Vstplugins
2007-11-09 00:52 d-------- C:\Program Files\Sony
2007-11-09 00:52 d-------- C:\Documents and Settings\All Users\Application Data\Sony
2007-11-09 00:07 d-------- C:\Program Files\Sony Setup
2007-11-09 00:07 d-------- C:\Documents and Settings\Ashley\Application Data\Sony Setup
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\You've Got Pictures Screensaver
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\Jasc Software Inc
2007-11-08 23:53 d-------- C:\Documents and Settings\Jay\Application Data\Gtek
2007-11-08 22:46 d-------- C:\Program Files\MSXML 4.0
2007-11-08 22:35 582,656 --a------ C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-08 22:12 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-08 22:10 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-11-08 22:02 d--hs---- C:\Documents and Settings\Ashley\UserData
2007-11-08 21:50 d--h----- C:\WINDOWS\PIF
2007-11-08 21:40 d-------- C:\Program Files\Norton Internet Security
2007-11-08 21:39 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-08 21:39 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2007-11-08 21:38 d-------- C:\Program Files\Symantec
2007-11-08 21:38 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-08 21:37 d-------- C:\Program Files\Common Files\Symantec Shared
2007-11-08 21:30 d-------- C:\Program Files\Netscape High Speed
2007-11-08 21:29 d-------- C:\Program Files\Netscape Internet Service
2007-11-08 21:29 d-------- C:\Program Files\Actiontec
2007-11-08 21:29 86,016 --a------ C:\WINDOWS\aeirem.exe
2007-11-08 21:29 50,236 --a------ C:\WINDOWS\system32\drivers\VVBUSUSB.SYS
2007-11-08 21:29 45,056 --a------ C:\WINDOWS\aeirmpca.exe
2007-11-08 21:29 40,832 --a------ C:\WINDOWS\system32\drivers\enetnt.sys
2007-11-08 21:29 34,560 --a------ C:\WINDOWS\system32\drivers\VVBETH.SYS
2007-11-08 21:13 d-------- C:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\You've Got Pictures Screensaver
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Jasc Software Inc
2007-11-08 05:59 d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\You've Got Pictures Screensaver
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\McAfee.com Personal Firewall
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\Jasc Software Inc
2007-11-08 05:59 d-------- C:\Documents and Settings\Ashley\Application Data\Gtek
2007-10-30 20:55 625,032 --a------ C:\WINDOWS\system32\SymNeti.dll
2007-10-30 20:55 242,056 --a------ C:\WINDOWS\system32\SymRedir.dll
2007-10-30 20:55 191,536 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
2007-10-30 20:55 145,968 --a------ C:\WINDOWS\system32\drivers\symfw.sys
2007-10-30 20:55 39,856 --a------ C:\WINDOWS\system32\drivers\symids.sys
2007-10-30 20:55 37,936 --a------ C:\WINDOWS\system32\drivers\symndisv.sys
2007-10-30 20:55 35,120 --a------ C:\WINDOWS\system32\drivers\symndis.sys
2007-10-30 20:55 27,696 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
2007-10-30 20:55 12,848 --a------ C:\WINDOWS\system32\drivers\symdns.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-09 02:57 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-11-09 02:57 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-09 02:56 --------- d-----w C:\Program Files\Dell Support
2007-11-09 02:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-09 02:14 --------- d-----w C:\Documents and Settings\All Users\Application

ash0417 · Answer

I am having trouble posting my logs.  Can you tell me what I may be doing wrong?

ash0417 · Answer

ComboFix 07-11-08.1 - Ashley 2007-11-12 23:05:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.128 [GMT -5:00]
Running from: C:\Documents and Settings\Ashley\Desktop\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cfhkj.bak1
C:\WINDOWS\system32\cfhkj.ini
C:\WINDOWS\system32\cfhkj.ini2
C:\WINDOWS\system32\cfhkj.tmp
C:\WINDOWS\system32\jkhfc.dll
C:\WINDOWS\system32\pac.txt

.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.

2007-11-12 23:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 21:10 d-------- C:\VundoFix Backups
2007-11-12 18:56 d-------- C:\Program Files\Trend Micro
2007-11-12 17:56 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 14:38 d-------- C:\Documents and Settings\Ashley\Application Data\WholeSecurity
2007-11-12 14:08 d-------- C:\Program Files\Printer's Apprentice 7.5
2007-11-12 14:08 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2007-11-12 12:25 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-11-12 12:24 d-------- C:\Program Files\TuneUp Utilities 2007
2007-11-12 12:24 d-------- C:\Documents and Settings\Ashley\Application Data\TuneUp Software
2007-11-12 12:24 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2007-11-12 12:23 d-------- C:\Program Files\Common Files\Wise Installation Wizard

ash0417 · Answer

Here is my new HiJackThis log.     Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:28:44 PM, on 11/12/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell Support\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AOL 9.0\aoltray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32
otepad.exe C:\PROGRA~1\NETSCA~2\NETSCA~1\app\TangoManager.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.my.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://v4.windowsupdate.microsoft.com/ R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: {071acbd4-47b9-a0e8-db04-379900821df1} - {1fd12800-9973-40bd-8e0a-9b744dbca170} - C:\WINDOWS\system32\kekhsydr.dll O2 - BHO: (no name) - {4CB8F4B4-5F66-4D9E-BC3B-184596A58824} - C:\WINDOWS\system32\yayaayx.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [osCheck] 'C:\Program Files\Norton Internet Security\osCheck.exe' O4 - HKLM\..\Run: [Symantec PIF AlertEng] 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' /a /m 'C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll' O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194577771500 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194831219281 O17 - HKLM\System\CCS\Services\Tcpip\..\{E3F0368A-02DB-4BEE-8088-A87BCFC03C5E}: NameServer = 205.188.146.145 O20 - Winlogon Notify: yayaayx - C:\WINDOWS\SYSTEM32\yayaayx.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Netscape Internet Service\Netscape High Speed Internet\app\TangoService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 10629 bytes

ash0417 · Answer

((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-09 02:57 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-11-09 02:57 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-11-09 02:56 --------- d-----w C:\Program Files\Dell Support 2007-11-09 02:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-09 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com 2007-10-31 01:24 12,963 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat 2007-10-31 01:24 1,358 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf 2007-09-18 20:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 20:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 20:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-18 20:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 20:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 20:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-18 20:43 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys 2007-09-18 20:43 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys 2007-09-18 20:43 278,576 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys 2007-08-22 12:55 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 12:55 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 12:55 1,498,112 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 12:55 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 12:55 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-20 21:34 3,584,512 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 10:04 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 10:04 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 10:04 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 10:04 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 10:04 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 10:04 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 10:04 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 10:04 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 10:04 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 10:04 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 10:04 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 10:04 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 10:04 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 10:04 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 10:04 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 10:04 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 10:04 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 10:04 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 10:04 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 10:04 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 10:04 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 10:04 1,152,000 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:21 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:20 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-08-14 00:54 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll 2007-08-14 00:54 413,696 ------w C:\WINDOWS\system32\dllcache\vbscript.dll 2007-08-14 00:54 33,792 ----a-w C:\WINDOWS\system32\dllcache\custsat.dll 2007-08-14 00:54 191,488 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-14 00:54 156,160 ----a-w C:\WINDOWS\system32\msls31.dll 2007-08-14 00:54 156,160 ------w C:\WINDOWS\system32\dllcache\msls31.dll 2007-08-14 00:45 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll 2007-08-14 00:45 78,336 ------w C:\WINDOWS\system32\dllcache\ieencode.dll 2007-08-14 00:44 69,120 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-14 00:44 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll 2007-08-14 00:44 40,960 ------w C:\WINDOWS\system32\dllcache\licmgr10.dll 2007-08-14 00:42 17,408 ------w C:\WINDOWS\system32\dllcache\corpol.dll 2007-08-14 00:39 92,672 ------w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-14 00:39 71,680 ----a-w C:\WINDOWS\system32\admparse.dll 2007-08-14 00:39 71,680 ------w C:\WINDOWS\system32\dllcache\admparse.dll 2007-08-14 00:39 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll 2007-08-14 00:39 55,296 ------w C:\WINDOWS\system32\dllcache\iesetup.dll 2007-08-14 00:38 491,520 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll 2007-08-14 00:36 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-14 00:36 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll 2007-08-14 00:36 36,352 ------w C:\WINDOWS\system32\dllcache\imgutil.dll 2007-08-14 00:35 346,624 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-14 00:32 45,568 ----a-w C:\WINDOWS\system32\mshta.exe 2007-08-14 00:32 45,568 ------w C:\WINDOWS\system32\dllcache\mshta.exe 2007-08-14 00:18 60,416 ------w C:\WINDOWS\system32\dllcache\hmmapi.dll 2007-08-14 00:01 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll 2007-08-14 00:01 48,128 ------w C:\WINDOWS\system32\dllcache\mshtmler.dll . (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1fd12800-9973-40bd-8e0a-9b744dbca170}] 2007-11-12 10:12 81472 --a------ C:\WINDOWS\system32\kekhsydr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}] 2007-11-11 21:00 36352 --a------ C:\WINDOWS\system32\yayaayx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'igfxtray'='C:\WINDOWS\system32\igfxtray.exe' [2005-07-19 23:09] 'igfxhkcmd'='C:\WINDOWS\system32\hkcmd.exe' [2005-07-19 23:06] 'igfxpers'='C:\WINDOWS\system32\igfxpers.exe' [2005-07-19 23:10] 'SunJavaUpdateSched'='C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe' [2003-11-19 17:48] 'SynTPLpr'='C:\Program Files\Synaptics\SynTP\SynTPLpr.exe' [2004-05-13 10:23] 'SynTPEnh'='C:\Program Files\Synaptics\SynTP\SynTPEnh.exe' [2004-05-14 00:35] 'PRONoMgrWired'='C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe' [2004-12-09 13:58] 'Dell QuickSet'='C:\Program Files\Dell\QuickSet\quickset.exe' [2005-03-04 11:26] 'Dell Wireless Manager UI'='C:\WINDOWS\system32\WLTRAY' [] 'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2005-02-23 16:19] 'RealTray'='C:\Program Files\Real\RealPlayer\RealPlay.exe' [2005-10-19 22:36] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2005-10-19 22:36] 'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2004-12-06 01:05] 'ISUSPM Startup'='C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe' [2004-07-27 16:50] 'ISUSScheduler'='C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' [2004-07-27 16:50] 'DMXLauncher'='C:\Program Files\Dell\Media Experience\DMXLauncher.exe' [2005-01-27 01:02] 'ccApp'='C:\Program Files\Common Files\Symantec Shared\ccApp.exe' [2007-01-10 00:59] 'osCheck'='C:\Program Files\Norton Internet Security\osCheck.exe' [2007-01-14 02:11] 'Symantec PIF AlertEng'='C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe' [2007-03-12 19:30] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DellSupport'='C:\Program Files\Dell Support\DSAgnt.exe' [2005-05-15 02:04] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 05:00] 'swg'='C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2007-11-12 17:34] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ AOL 9.0 Tray Icon.lnk - C:\Program Files\AOL 9.0\aoltray.exe [2005-10-19 22:36:03] AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 08:18:22] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-19 22:35:17] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}'= C:\WINDOWS\system32\yayaayx.dll [2007-11-11 21:00 36352] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\yayaayx] yayaayx.dll 2007-11-11 21:00 36352 C:\WINDOWS\system32\yayaayx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] 'Authentication Packages'= msv1_0 C:\WINDOWS\system32\jkhfc.dll R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs R3 ENETNT5;Efficient Networks, tango Access PPPoE WAN Miniport;C:\WINDOWS\system32\DRIVERS\enetnt.sys S3 CamAv;SAMSUNG Video Capture;C:\WINDOWS\system32\Drivers\CamAv.sys S3 ENDETECT;ENDETECT;\??\C:\PROGRA~1\NETSCA~2\NETSCA~1\app\ENDETECT.SYS S3 NTSTPL1;NTSTPL1;\??\C:\PROGRA~1\NETSCA~2\NETSCA~1\app\NTSTPL1.SYS S3 RAWESR;RAWESR;\??\C:\PROGRA~1\NETSCA~2\NETSCA~1\app\RAWESR.SYS S3 TAPBIND;TAPBIND;\??\C:\PROGRA~1\NETSCA~2\NETSCA~1\app\TAPBIND1.SYS HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs UxTuneUp *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder '2007-11-12 17:26:06 C:\WINDOWS\Tasks\1-Click Maintenance.job' - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe '2007-11-13 01:55:59 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Ashley.job' - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-12 23:24:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-12 23:26:31 - machine was rebooted .  --- E O F ---

Virus & Spyware

Pop-up windows when searching internet

Was this post helpful?