Spyware, adware, and trojans on my machine...

Question

First post here.... I'm finally fed up with how my machine is operating and I'm attacking it head on. I'm currently running Norton and SpyDoctor. Spy Doctor seems to find many 'add ons' but when it comes time for removal it hangs and I have to restart my machine. I'm assuming that this is due the the junk on my machine. So I found this site, became a member, downloaded HiJackThis and ran it. So here's my log file. Any help would be greatly appreciated.   Logfile of HijackThis v1.99.1 Scan saved at 8:15:59 AM, on 8/30/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\Program Files\Spyware Doctor\sdhelp.exe C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exe C:\Program Files\Outlook Express\msimn.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html R3 - URLSearchHook: (no name) - - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [b0t3RTG6X] fasncode.exe O4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealOne Playerealplay.exe' /RunUPGToolCommandReBoot O4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /Q O4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstart O4 - Startup: PopKill.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dll O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} - http://www.alternatiff.com/install/00/alttiff.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - http://www.burj-al-arab.com/flashcab/ipix/ipixx.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136 O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} - http://community.webshots.com/html/WSPhotoUploader.CAB O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cab O16 - DPF: {F3F322B5-26EE-46EB-8D03-030ACA4D6167} - http://www.mpix.com/Customer/newocx/ImageUploader2.ocx O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - Winlogon Notify: FONTS - C:\WINDOWS\system32\kt02l7do1.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\ O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: Windows Services Configuration - Unknown owner - C:\WINDOWS\system32\lsvss.exe (file missing)     Again, any help you could give would be greatly appreciated.   Chris Nilluka

bamajim · Answer

chrisinbeav I am currently looking at your log and will have a reply soon. But as infections change could you please post a fresh Hijackthis log thanks bamajim Training at Malware Removal University

chrisinbeav · Answer

As requested here is my new, up to date, log:   Logfile of HijackThis v1.99.1Scan saved at 6:32:19 PM, on 9/1/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\fxssvc.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Java\jre1.5.0_05\bin\jucheck.exeC:\Program Files\Spyware Doctor\swdoctor.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exeC:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.htmlO2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dllO2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exeO4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exeO4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealOne Playerealplay.exe' /RunUPGToolCommandReBootO4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /QO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Startup: PopKill.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cabO16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cabO16 - DPF: {F3F322B5-26EE-46EB-8D03-030ACA4D6167} - http://www.mpix.com/Customer/newocx/ImageUploader2.ocxO20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\fpn8035ue.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe     Thanks again for your help. Chris

bamajim · Answer

chrisbeav Sorry for the delay You may want to print out these instructions for reference Please disable your Symantec Script Blocking from within your Norton so it does not interfere with anything during our fixes now or later. You can enable this whenever we have verified that your system is clean. To disable Norton AntiVirus Script Blocking: 1. Start Norton AntiVirus. If Norton AntiVirus is installed as part of Norton SystemWorks or Norton Internet Security, then start that program. 2. Click Options. If you see a menu, click Norton AntiVirus. 3. In the left pane, click Script Blocking. 4. In the right pane, uncheck Enable Script Blocking (recommended). 5. Click OK. Next Go here and Download Ewido Antimalware 4.0 ( 30 day free trial version) Save it to Your Desktop   Double Click Ewido-setup (It will create its own folder) Once the program starts You will be at the Status menu Under 'Your computers Security' Click change status on Resident shield to inactive Click Update now (next to last update) After the update loads Under Automatic updates Uncheck download and install updates automatically(recommended) (you can always select maual updates the next day) At the top toolbar Click Scanner Then the settings tab Under How to act? Set default action for detected malwareTo Quarantine Under how to scan All boxes should be checked Under Possibly unwanted software All boxes should be checked Under reports Select Automatically generate report after every scan Uncheck Only if threats were found Under what to scan Scan every file should be highlited Exit Ewido (Do Not run it yet) Next Copy and paste the following into NotePad (Not Wordpad) sc stop 'Windows Services Configuration'sc delete 'Windows Services Configuration' Click File ->> Save as ->>type in cmd.bat Under 'Save as type' Select ' all files' ->>Save it to your Desktop Close Notepad The cmd.bat file should now appear on your Desktop Double Click that file (It will appear that nothing has happened, but that's o.k.) Next Re run Hijackthis (scan only) and place checks beside the following entries O16 - DPF: {F3F322B5-26EE-46EB-8D03-030ACA4D6167} - http://www.mpix.com/Customer/newocx/ImageUploader2.ocxO20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\fpn8035ue.dllO23 - Service: MicroSoft Media Tools - Unknown owner - C:\WINDOWS\ Close all other open windows except Hijackthis and Select ' Fix Checked' If prompted to reboot your PC Select No and close Hijackthis Next Using Windows Explorer (Right click on 'Start,' select 'Explore,' and you will see the 'tree' of file folders in the left side of the window. Click on the '+' next to any folder name to expand its contents) Locate and delete the following file C:\WINDOWS\system32\fpn8035ue.dll Close Windows Explorer Next Reboot your PC into Safe Mode This can be done by Restart your PC, and after it starts, but before you see the Windows Splash screen Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices) Use your arrow keys and select Safe Mode and then Enter Run Ewido Click scanner Select Complete system scan Once the scan finishes Select Apply all actions (The items found will be quarantined) Click save report as (Another window will open) Save it to your desktop (By default It will be saved in the Ewido folder as) C:\Program Files\ewido anti-spyware 4.0\Reports Exit Ewido   Reboot your PC in Normal Mode Double click the report-scan txt. you saved to your desktop It will open in Notepad Copy and paste that report as a reply to this thread Do not run any other options untill instructed to do so Finally Re run Hijackthis and post a fresh hijackthis log Your reply should include your report_scan.txt from Ewido a fresh Hijackthis log Thanks bamajim   Graduate of Malware Removal University

chrisinbeav · Answer

and now 'HiJackThis'   *********Please Note This log has been updated********** Logfile of HijackThis v1.99.1Scan saved at 9:20:38 PM, on 9/3/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Spyware Doctor\swdoctor.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\Spyware Doctor\sdhelp.exeC:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\fxssvc.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exeC:\WINDOWS\System32\wuauclt.exeC:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.htmlO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exeO4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exeO4 - HKLM\..\Run: [!ewido] 'C:\Program Files\ewido anti-spyware 4.0\ewido.exe' /minimizedO4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealOne Playerealplay.exe' /RunUPGToolCommandReBootO4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /QO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Startup: PopKill.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cabO16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cabO20 - Winlogon Notify: URL - C:\WINDOWS\system32\i642lgho164c.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe   Thanks again for all the help... Chris Message Edited by chrisinbeav on 09-03-200611:25 PM

chrisinbeav · Answer

Everything done as requested.... here's the two new logs...

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 7:26:57 PM 9/3/2006

+ Scan result:

HKU\S-1-5-21-1417001333-436374069-854245398-1004\Software\Microsoft\Internet Explorer\URLSearchHooks\{944864A5-3916-46E2-96A9-A2E84F3F1208} -> Adware.Accoona : Cleaned with backup (quarantined).
HKLM\SOFTWARE\mxtarget -> Adware.BetterInternet : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00062604.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00062722.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00062793.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\RECYCLER\NPROTECT\00062941.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINDOWS\system32\dusshlex.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINDOWS\system32\irencode.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINDOWS\system32\t2r80c9uef.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[652] C:\WINDOWS\system32\mwsap.dll -> Adware.Look2Me : Error during cleaning.
[740] C:\WINDOWS\system32\mwsap.dll -> Adware.Look2Me : Error during cleaning.
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\8Kchh.dll -> Adware.Midaddle : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\tEJE2jcA9.dll -> Adware.Midaddle : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\94.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\EHr66DpA.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\G.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\O9T3.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\4.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\KhT.dll -> Adware.Midadle : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\L.dll -> Adware.Midadle : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\temp.cab/IExploreSkins.exe -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\temp.cab/toolbar.dll -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\toolbar.dll -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~310396.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~325947.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~379413.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~380185.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~387818.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~460165.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~487927.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~748840.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~762014.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~782683.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~822989.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~916393.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~220763.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~223028.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~225797.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~225904.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~226996.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~228433.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~229496.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~229736.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~236714.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~289935.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~311304.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~348383.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~350116.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~378573.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~389972.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~424048.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~476244.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~504022.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~504884.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~510913.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~533421.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~604701.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~653677.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~718610.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~722638.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~730598.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~735481.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~736015.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~738513.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~738671.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~745760.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~759343.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~761423.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~762807.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~791782.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~791819.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~801214.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~814061.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~814370.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~818338.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~826372.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~829365.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~829897.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~832227.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~874367.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~883568.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~891273.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~897888.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~899362.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~909534.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~913290.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~919625.tmp -> Adware.Wintol : Cleaned with backup (quarantined).
C:\WINDOWS\srsxslh.dll -> Downloader.Lemmy.u : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\~443356.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\~511210.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Allison\Local Settings\Temp\~914193.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~423690.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Cheryl Nilluka\Local Settings\Temp\~938593.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~218123.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~240223.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~244258.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~386794.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~390684.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~485316.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~504639.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~722526.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~766330.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~832101.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~871904.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Local Settings\Temp\~880243.tmp -> Downloader.Wintool.a : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\WINDOWS\Temp\ICD1.tmp\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive1213.jar-4109dda-71f42698.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-304d7b5a-4174cd3b.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-5cc7f58d-4a180c2d.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jpg-fd91cf5-51c98a6d.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderms.jar-108db11d-1f5b1f4c.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-2f54230a-392bdf7e.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-2f54230a-6bccc919.zip/Dummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined).
C:\install.htm -> Not-A-Virus.Exploit.DialogArg : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@rotator.dex.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@thunderbolt.adjuggler[1].txt -> TrackingCookie.Adjuggler : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@www.belstat[2].txt -> TrackingCookie.Belstat : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Cookies\system@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@image.masterstats[1].txt -> TrackingCookie.Masterstats : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@ad.yieldmanager[3].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\Chris\Cookies\chris@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).

::Report end

bamajim · Answer

chrisinbeav

Well done :smileyhappy:

Please download Look2Me-Destroyer.exe to your desktop.

Close all windows before continuing.
Double-click Look2Me-Destroyer.exe to run it.
Put a check next to Run this program as a task.
You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
Once it's done scanning, click the Remove L2M button.
You will receive a Done Scanning message, click OK.
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
Your computer will then shutdown.
Turn your computer back on.

Re run Hijackthis and post a fresh Hijackthis log

your reply should include

Look2Me-Destroyer.txt
a new HiJackThis log.

thanks bamajim Graduate of Malware Removal University

chrisinbeav · Answer

Things didn't run quite as explained there, but something did happen.   I downloaded L2M, clicked on it (all open windows were closed), I clicked on to 'Run as a task'. Now here is where things went .... differently.. Nothing ever came back up, at all, ever. However, Windows did do a restart on it's own. When Windows came back up my Desktop now looked like XP again. I assumed this was due to a Windows update. I'm not sure what happened there. So I tried to run L2M again. Exact same thing. Nothing ever comes back up and asks me to 'Scan'. It appears that I am still getting pop ups. I'm assuming I must have done something wrong, I'm just not sure what. So here is my newest 'HiJackThis' log.... Logfile of HijackThis v1.99.1Scan saved at 8:54:19 AM, on 9/4/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\fxssvc.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Spyware Doctor\swdoctor.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exeC:\WINDOWS\System32\WgaTray.exeC:\WINDOWS\System32\wuauclt.exeC:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.htmlO2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dllO2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exeO4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exeO4 - HKLM\..\Run: [!ewido] 'C:\Program Files\ewido anti-spyware 4.0\ewido.exe' /minimizedO4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealOne Playerealplay.exe' /RunUPGToolCommandReBootO4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /QO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Startup: PopKill.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cabO16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cabO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Thanks again Chris

chrisinbeav · Answer

Okay so right after I submited my last message I tried L2M again. This time it worked.(Go figure) So here is the text from L2M: Look2Me-Destroyer V1.0.12 Scanning for infected files.....Scan started at 9/4/2006 9:07:02 AM Infected! C:\WINDOWS\system32\dnpm0171e.dllInfected! C:\RECYCLER\NPROTECT\00063626.dllInfected! C:\WINDOWS\system32\cSpesnpn.dllInfected! C:\WINDOWS\system32\dnpm0171e.dllInfected! C:\WINDOWS\system32\f20o0cd3ef0.dllInfected! C:\WINDOWS\system32\fdsapi.dllInfected! C:\WINDOWS\system32\kgdno1.dllInfected! C:\WINDOWS\system32\q4rqle951h.dll Attempting to delete infected files... Attempting to delete: C:\WINDOWS\system32\dnpm0171e.dllC:\WINDOWS\system32\dnpm0171e.dll Deleted successfully! Attempting to delete: C:\RECYCLER\NPROTECT\00063626.dllC:\RECYCLER\NPROTECT\00063626.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\cSpesnpn.dllC:\WINDOWS\system32\cSpesnpn.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\dnpm0171e.dllC:\WINDOWS\system32\dnpm0171e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\f20o0cd3ef0.dllC:\WINDOWS\system32\f20o0cd3ef0.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\fdsapi.dllC:\WINDOWS\system32\fdsapi.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\kgdno1.dllC:\WINDOWS\system32\kgdno1.dll Deleted successfully! Attempting to delete: C:\WINDOWS\system32\q4rqle951h.dllC:\WINDOWS\system32\q4rqle951h.dll Deleted successfully! Making registry repairs. Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved '{AEE81236-D360-4310-A4FC-05933ACE85C3}'HKCR\Clsid\{AEE81236-D360-4310-A4FC-05933ACE85C3} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved '{E72BE0AC-59FD-4C1C-A249-98E6113B8CD1}'HKCR\Clsid\{E72BE0AC-59FD-4C1C-A249-98E6113B8CD1} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved '{7A4F2678-75EA-467F-B596-2A6F9B7A0DF8}'HKCR\Clsid\{7A4F2678-75EA-467F-B596-2A6F9B7A0DF8} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved '{9EA263C5-FA35-4EDC-BFE7-CEDB551F4AF0}'HKCR\Clsid\{9EA263C5-FA35-4EDC-BFE7-CEDB551F4AF0} Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Administrators - Succeeded And here's my new HJT log: Logfile of HijackThis v1.99.1Scan saved at 9:27:53 AM, on 9/4/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Java\jre1.5.0_05\bin\jusched.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Spyware Doctor\swdoctor.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Nikon\PictureProject\NkbMonitor.exeC:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEC:\Program Files\Spyware Doctor\sdhelp.exeC:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\fxssvc.exeC:\WINDOWS\System32\WgaTray.exeC:\WINDOWS\System32\wuauclt.exeC:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.htmlO2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dllO2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dllO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exeO4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exeO4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exeO4 - HKLM\..\Run: [!ewido] 'C:\Program Files\ewido anti-spyware 4.0\ewido.exe' /minimizedO4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealOne Playerealplay.exe' /RunUPGToolCommandReBootO4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /QO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Startup: PopKill.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dllO9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cabO16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cabO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXEO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Thanks again Chris

bamajim · Answer

chrisinbeav

Sorry you had trouble running the program the first time, but it looks like it did it's job

Before we proceed can you give me an update on how your pc is running?

And I see you have earthlink, are you on dial up?

thanks bamajim Graduate of Malware Removal University

chrisinbeav · Answer

PC seems to be running good. Infact better than it has in quite a while. My machine is still a little slow starting up but I guess that's okay. No more pop ups since the repair. Even my media player seems to be running better. It used to play kind of choppy. I think we're there. I appreciate all your help and expertice! Thanks again   Chris Nilluka

bamajim · Answer

chrisinbeav

Please stay with me for another post or 2 please, I want to give you some info to keep you from getting re infected.:smileyhappy:

So are you on dial up?

thanks bamajim Graduate of Malware Removal University

chrisinbeav · Answer

I am on Earthlink DSL...

bamajim · Answer

chrisinbeav

Your Log is Clean from malware
I appreciate your patience in working through this.

Now that your log is clean

First Go HERE Download and install SP2 (Service Pack 2)

You currently have SP1(Service Pack 1) which is known to have some critical security issues
It is a rather large download about 2 hours on DSL, or it can be ordered on CD for free from the same site (with a small shipping charge about 4$)
It is critical to get this, it is part of the reason your PC became infected

There are some final notes:
Disable and Enable System Restore.

Now that your system is clean, lets create a clean System Restore point
the instructions are here

Update Your Java

Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-1_5_0_08-windows-i586-p to install the newest version.

Make your Internet Explorer more secure
This can be done by following these simple instructions:

Open Internet Explorer click Tools->> Options.
Click Security tab
Click once on the Internet icon so it becomes highlighted.
Click Custom Level.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click OK.
If it prompts you to save the settings, press Yes.
Next press Apply and then OK to exit the Internet Properties page

Update your Anti Virus Software

Use and maintain a Firewall such as ZoneAlarm

The Windows Firewall is good at blocking incoming threats, but not outgoing threats such as "Backdoor Trojans"
Some others are
Sygate
And
Sunbelt personal
All of which are free

Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Documents and Files and a regular basis
To a disc or a USB key, not your Hardrive

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

Thanks bamajim Graduate of Malware Removal University

chrisinbeav · Answer

Bad news....

For some reason I can't install SP2. I get about half way through and I get an error stating,"Access Denied".

So I lookded through the install log and saved a couple sections. Any ideas would be appreciated.

Here's the first log:

2006-09-05 07:42:47 636 53c Handler Install completed with 0x80070005.
2006-09-05 07:42:47 636 b18 Handler FATAL: UH: 0x80070005: InstallOrUninstallThread failed
2006-09-05 07:42:47 636 b18 Handler   : WARNING: Install completed: result type = 0x0, installer error = True, error = 0x80070005, disabled until reboot = Yes, reboot required = No
2006-09-05 07:42:47 636 b18 Handler FATAL: UH: 0x8024200b: HandleSingleUpdate failed
2006-09-05 07:42:47 636 b18 Handler :::::::::
2006-09-05 07:42:47 636 b18 Handler :: END :: Handler: Windows Patch Install
2006-09-05 07:42:47 636 b18 Handler :::::::::::::
2006-09-05 07:42:47 948 d50 AU >>## RESUMED ## AU: Installing update [UpdateId = {7477AF62-8F9B-4F32-9DAF-7AB452E52396}]
2006-09-05 07:42:47 948 d50 AU   # WARNING: Install failed, error = 0x80070005
2006-09-05 07:42:48 948 4b4 Agent *********
2006-09-05 07:42:48 948 4b4 Agent ** END ** Agent: Installing updates [CallerId = AutomaticUpdates]
2006-09-05 07:42:48 948 4b4 Agent *************
2006-09-05 07:42:48 948 4b4 AU   # Install call complete for all calls, reboot required = Yes
2006-09-05 07:42:48 948 4b4 AU #########
2006-09-05 07:42:48 948 4b4 AU ## END ## AU: Installing updates [CallId = {83A377DB-113F-4F62-B295-948FC4C20F6E}]
2006-09-05 07:42:48 948 4b4 AU #############
2006-09-05 07:42:52 948 bf4 AU AU setting client response for sessionId 0x0 to 'Complete'
2006-09-05 07:42:52 948 bf4 AU AU setting pending client directive to 'Install Approval'
2006-09-05 07:42:52 948 18c AU #############
2006-09-05 07:42:52 948 18c AU ## START ## AU: Search for updates
2006-09-05 07:42:52 948 18c AU #########
2006-09-05 07:42:52 948 18c AU <<## SUBMITTED ## AU: Search for updates [CallId = {E5E9C588-590A-466C-8C6D-83EE7C9FA4E5}]
2006-09-05 07:42:52 948 fe0 AU AU got client choice 'Reboot later' from sessionId 0x0
2006-09-05 07:42:52 948 fe0 AU AU setting pending client directive to 'Reboot Pending'
2006-09-05 07:42:52 948 fe0 AU Changing existing AU client directive from 'Install Approval' to 'Reboot Pending', session id = 0x0
2006-09-05 07:42:52 948 4b4 Agent *************
2006-09-05 07:42:52 948 4b4 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2006-09-05 07:42:52 948 4b4 Agent *********
2006-09-05 07:42:52 948 bf4 AU AU setting client response for sessionId 0x0 to 'Complete'
2006-09-05 07:42:52 3584 e04 AUClnt AU client got new directive = 'Reboot Pending', serviceId = {7971F918-A847-4430-9279-4A52D1EFE18D}, return = 0x00000000
2006-09-05 07:42:52 948 914 AU AU setting client response for sessionId 0x0 to 'Pending'

Here's the second log:

845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x2
845.786: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.077: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x2
846.357: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.357: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.357: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.357: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
846.357: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
847.379: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
847.379: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
847.379: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
847.379: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x2
847.379: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x0
848.130: PruneCatalogsFromHotfixes:RegQueryValueEx Failed: 0x2
848.130: Num Ticks for Copying files : 373928
848.150: DoRegistryUpdates:SetupInstallFromInfSection Failed for ProductInstall.GlobalRegistryChanges.Install error: 0x5
848.150: INF_REGISTRY Failed
848.150: DoInstallation:DoRegistryUpdates failed
859.266: Unregistration of sprecovr successful
859.506: Access is denied.
872.124: Message displayed to the user: Access is denied.
872.124: User Input: OK
872.154: Service Pack 2 installation did not complete.

Select 'OK' to undo the changes that have been made.
873.516: Message displayed to the user: Service Pack 2 installation did not complete.

Select 'OK' to undo the changes that have been made.
873.516: User Input: OK

Here's a new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:57:18 AM, on 9/5/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Documents and Settings\Chris\Start Menu\Programs\Startup\PopKill.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [DeskMateAutoUpdate] C:\PROGRA~1\DESKMA~1\DeskMateAutoUpdate.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: PopKill.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142996194057
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1142998728136
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.mpix.com/Customer/Uploading/activex/ImageUploader3.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Thanks again for any help.

Chris

bamajim · Answer

chrisinbeav

Sorry to hear that

Couple of things:

Do you still have Norton Scriptblocking turned off? If not please do so.

Next Go Here and see if you are able to get SP1A

Just choose your language and Select the go button. See if you are able to install that Service pack.

Reply with the results.

Next Do you have your Operating System disk that came with your PC?

bamajim Graduate of Malware Removal University

Virus & Spyware

Spyware, adware, and trojans on my machine...

Was this post helpful?