Winfixer Still a Problem Even After Running the Tool

Question

To All,   Got winfixer problem.  Ran the tool as described above, no luck. Would anyone care to look at my Hijackthis file and let me know what to kill?!  Any other ideas? Much thanks!   Logfile of HijackThis v1.99.1 Scan saved at 6:25:09 PM, on 10/18/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE C:\WINDOWS\System32
vsvc32.exe C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\SM1BG.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe C:\QUICKENW\QWDLLS.EXE C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Leverne\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\awvvu.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe' O4 - HKLM\..\Run: [Lexmark X1100 Series] 'C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe' O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Norton SystemWorks] 'C:\Program Files\Norton SystemWorks\cfgwiz.exe' /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
pjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
pjpi142.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll O15 - Trusted Zone: http://www.princetonreview.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409 O16 - DPF: {63FA0A10-5AA8-449F-9C5B-C8853F697405} - http://mediaplayer.walmart.com/installer/install.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{21DF0D50-820A-4C08-8405-5F5248B24B33}: NameServer = 192.168.1.1,68.58.160.5,68.58.160.6 O20 - Winlogon Notify: awvvu - C:\WINDOWS\system32\awvvu.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Leverne\Desktop\CWShredder.exe O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe     Message Edited by LukeHoward on 10-18-2005 05:26 PM

secured2k · Answer

I have created a removal tool. Please check the following link: http://forums.mcafeehelp.com/viewtopic.php?t=57049   Note: You may need to disable your AntiVirus first as it will prevent read access to the file if it is still running and blocking access to the file. My tool will remove the startup entries so it shouldn't be a problem.

LukeHoward · Answer

secre2k,  that didn't work. It gave me a blue screen with an error message.  Can you id the bad files on my HJT logbook and I kill them? Or does it take more than that to kill winfixer?  Thanks for any help.

secured2k · Answer

The blue screen fatal error is normal. I will be updating the forum description to indicate this. In order to get rid of the virus, the tool has to end a very important system process. Once the tool has done its work, the system will receive a STOP (blue screen) error and restart. This means the tool has already done its work. Check your Desktop for a file, VBG.TXT file with information about what was done.   Also, if it is coming back, you should scan your computer with an up-to-date antivirus while offline to get rid of the dropper program that may be reinstalling this trojan,

LukeHoward · Answer

secured2k,  thanks for the good info. I will give it a shot tonight after work.  When I rerun my NAV, you said to run it offline.  Would you clarify offline?  Run NAV in the safe mode?  Thanks, Luke

secured2k · Answer

When I said Offline, I meant 'when you are not connected to the internet'. This applies when in Safe Mode since networking components are not loaded, so scanning in Safe Mode is a good idea too.

secured2k · Answer

Please post the log file.

LukeHoward · Answer

secured2K, Still a no go. I run your file with NAV disabled and IE closed. I get the blue screen and the computer freezes. It does not restart. I do have a VGB file which reads the following:

[10/20/2005, 20:01:54] - Starting Process...
[10/20/2005, 20:01:54] - Looking for Browser Helper Object [MSEvents Object]
[10/20/2005, 20:01:54] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/20/2005, 20:01:54] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/20/2005, 20:01:54] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/20/2005, 20:01:54] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/20/2005, 20:01:54] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/20/2005, 20:01:54] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/20/2005, 20:01:54] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/20/2005, 20:01:54] - 5: {8DBF02DA-4360-4A7E-BEA1-347B87816327} - MSEvents Object
[10/20/2005, 20:01:54] - Found MSEvents Object!
[10/20/2005, 20:01:54] - File location: C:\WINDOWS\system32\awvvu.dll
[10/20/2005, 20:01:54] - Attempting to kill C:\WINDOWS\system32\awvvu.dll
[10/20/2005, 20:01:54] - Terminating Process: RUNDLL32.EXE

It looked like the C:\WINDOWS\system32\awvvu.dll was definitely a baddie, so I killed it thru HJT, but my problem WINFIXER is still there. Are there other files I should kill? Thanks for hanging with me on this. Very frutrating. I await your next suggestion!

Luke

secured2k · Answer

Run the tool again, please. Please save it to your desktop and run it from there instead of from Internet Explorer. Also, you want to try it in Safe Mode.

The log you posted shows it was not complete. It looks like your system may have blue screen crashed when the tool tried to kill RUNDLL32... this is BEFORE it can remove the virus files.

Message Edited by secured2k on 10-20-2005 07:44 PM

Message Edited by secured2k on 10-20-2005 07:53 PM

LukeHoward · Answer

secured2K, I did save it and run it from my desk top. Did it three times all with the same result. I am now running the latest Symantec virus removal 1.4 that was posted at the top of this forum. It is running right now.

Saw your edit above. Once the Symantec removal tool finishes, if that doesn't do it, I will rerun your tool in the safe mode.

Luke

Message Edited by LukeHoward on 10-20-2005 08:01 PM

secured2k · Answer

Post the complete VBG.TXT and an updated HJT log file.

LukeHoward · Answer

Here is the result of the symantec removal tool. However, once I opened IE, it came back. I will rerun both the symantec tool and your tool in the safe mode tomorrow. Too tired, going to bed now. Thanks again.

Symantec Trojan.Vundo Removal Tool 1.4.0
The process "iexplore.exe" might be affected by the threat. It has been suspended.
The process "winlogon.exe" contained a viral thread (00000660). The thread was terminated.
The process "winlogon.exe" contained a viral thread (00000664). The thread was terminated.
The process "winlogon.exe" contained a viral thread (0000066C). The thread was terminated.
The process "explorer.exe" contained a viral thread (0000022C). The thread was terminated.
The process "explorer.exe" contained a viral thread (00000230). The thread was terminated.
The process "iexplore.exe" might be affected by the threat. It has been terminated.

registry: HKEY_CLASSES_ROOT\MSEvents.MSEvents (key deleted)
registry: HKEY_CLASSES_ROOT\MSEvents.MSEvents.1 (key deleted)

Trojan.Vundo has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 91739
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral processes suspended: 1
The number of viral threads terminated: 5
The number of registry entries fixed: 2

LukeHoward · Answer

Do you mean the VGB log file?  Or the HJT log file?

secured2k · Answer

The VBG.TXT log files shows that the tool was run only once and that it was terminated after attempting to kill RUNDLL32.EXE.   Please run the tool again.

LukeHoward · Answer

VGB.txt is as follows: [10/20/2005, 20:01:54] - Starting Process...[10/20/2005, 20:01:54] - Looking for Browser Helper Object [MSEvents Object][10/20/2005, 20:01:54] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO[10/20/2005, 20:01:54] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class[10/20/2005, 20:01:54] - 3: {53707962-6F74-2D53-2644-206D7942484F} - [10/20/2005, 20:01:54] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.[10/20/2005, 20:01:54] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)[10/20/2005, 20:01:54] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.[10/20/2005, 20:01:54] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess[10/20/2005, 20:01:54] - 5: {8DBF02DA-4360-4A7E-BEA1-347B87816327} - MSEvents Object[10/20/2005, 20:01:54] - Found MSEvents Object![10/20/2005, 20:01:54] - File location: C:\WINDOWS\system32\awvvu.dll[10/20/2005, 20:01:54] - Attempting to kill C:\WINDOWS\system32\awvvu.dll[10/20/2005, 20:01:54] - Terminating Process: RUNDLL32.EXE   HJT log is as follows: Logfile of HijackThis v1.99.1Scan saved at 6:13:44 AM, on 10/21/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\CTsvcCDA.exeC:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exeC:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEC:\WINDOWS\System32
vsvc32.exeC:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\WINDOWS\System32\DSentry.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exeC:\Program Files\Lexmark X1100 Series\lxbkbmgr.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\SM1BG.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Lexmark X1100 Series\lxbkbmon.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Microsoft AntiSpyware\gcasDtServ.exeC:\Program Files\Dell Support\DSAgnt.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exeC:\QUICKENW\QWDLLS.EXEC:\Program Files\WinZip\WZQKPICK.EXEC:\unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywayR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywayR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywayR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\awvvu.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe'O4 - HKLM\..\Run: [Lexmark X1100 Series] 'C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe'O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXEO4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - HKCU\..\Run: [Norton SystemWorks] 'C:\Program Files\Norton SystemWorks\cfgwiz.exe' /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWizO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXEO4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exeO4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXEO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
pjpi142.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
pjpi142.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dllO15 - Trusted Zone: http://www.princetonreview.comO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {63FA0A10-5AA8-449F-9C5B-C8853F697405} - http://mediaplayer.walmart.com/installer/install.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{21DF0D50-820A-4C08-8405-5F5248B24B33}: NameServer = 192.168.1.1,68.58.160.5,68.58.160.6O20 - Winlogon Notify: awvvu - C:\WINDOWS\system32\awvvu.dllO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exeO23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Leverne\Desktop\CWShredder.exe (file missing)O23 - Service: GBPoll - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXEO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXEO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Thanks for doing this!

LukeHoward · Answer

Secured2K, I think we have success this time. What do you think about that blank #3 BHO line. Here is my VBG file:

[10/20/2005, 20:01:54] - Starting Process...
[10/20/2005, 20:01:54] - Looking for Browser Helper Object [MSEvents Object]
[10/20/2005, 20:01:54] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/20/2005, 20:01:54] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/20/2005, 20:01:54] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/20/2005, 20:01:54] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/20/2005, 20:01:54] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/20/2005, 20:01:54] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/20/2005, 20:01:54] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/20/2005, 20:01:54] - 5: {8DBF02DA-4360-4A7E-BEA1-347B87816327} - MSEvents Object
[10/20/2005, 20:01:54] - Found MSEvents Object!
[10/20/2005, 20:01:54] - File location: C:\WINDOWS\system32\awvvu.dll
[10/20/2005, 20:01:54] - Attempting to kill C:\WINDOWS\system32\awvvu.dll
[10/20/2005, 20:01:54] - Terminating Process: RUNDLL32.EXE

[10/21/2005, 18:14:03] - Starting Process...
[10/21/2005, 18:14:03] - Looking for Browser Helper Object [MSEvents Object]
[10/21/2005, 18:14:03] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/21/2005, 18:14:03] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/21/2005, 18:14:03] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/21/2005, 18:14:03] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/21/2005, 18:14:03] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/21/2005, 18:14:03] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/21/2005, 18:14:03] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/21/2005, 18:14:03] - 5: {8DBF02DA-4360-4A7E-BEA1-347B87816327} - MSEvents Object
[10/21/2005, 18:14:03] - Found MSEvents Object!
[10/21/2005, 18:14:03] - File location: C:\WINDOWS\system32\awvvu.dll
[10/21/2005, 18:14:03] - Attempting to kill C:\WINDOWS\system32\awvvu.dll
[10/21/2005, 18:14:03] - Terminating Process: RUNDLL32.EXE
[10/21/2005, 18:14:03] - Terminating Process: IEXPLORE.EXE
[10/21/2005, 18:14:04] - Disabling Automatic Shell Restart
[10/21/2005, 18:14:04] - Terminating Process: EXPLORER.EXE
[10/21/2005, 18:14:04] - Suspending the NT Session Manager System Service
[10/21/2005, 18:14:04] - Terminating Windows NT Logon/Logoff Manager
[10/21/2005, 18:14:05] - Re-enabling Automatic Shell Restart
[10/21/2005, 18:14:05] - Renaming C:\WINDOWS\system32\awvvu.dll -> C:\WINDOWS\system32\awvvu.dll.vir
[10/21/2005, 18:14:05] - File successfully renamed!
[10/21/2005, 18:14:05] - Removing Registry references to {8DBF02DA-4360-4A7E-BEA1-347B87816327}
[10/21/2005, 18:14:05] - Adding Internet Explorer Protection (Kill ActiveX) for {8DBF02DA-4360-4A7E-BEA1-347B87816327}
[10/21/2005, 18:14:05] - Removing Winlogon Notify Entry: awvvu
[10/21/2005, 18:14:05] - BHO list has been changed! Starting over...
[10/21/2005, 18:14:05] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/21/2005, 18:14:05] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/21/2005, 18:14:05] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/21/2005, 18:14:05] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/21/2005, 18:14:05] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/21/2005, 18:14:05] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/21/2005, 18:14:05] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/21/2005, 18:14:05] - 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper
[10/21/2005, 18:14:05] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[10/21/2005, 18:14:05] - Finished searching for [MSEvents Object]
[10/21/2005, 18:14:05] - Finishing up...
[10/21/2005, 18:14:05] - Enabling Automatic Reboot on STOP Error.
[10/21/2005, 18:14:05] - Attempting to Restart via STOP error (Blue Screen!)

[10/21/2005, 18:20:23] - Starting Process...
[10/21/2005, 18:20:23] - Looking for Browser Helper Object [MSEvents Object]
[10/21/2005, 18:20:23] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/21/2005, 18:20:23] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/21/2005, 18:20:23] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/21/2005, 18:20:23] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/21/2005, 18:20:23] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/21/2005, 18:20:23] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/21/2005, 18:20:23] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/21/2005, 18:20:23] - 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper
[10/21/2005, 18:20:23] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[10/21/2005, 18:20:23] - Finished searching for [MSEvents Object]
[10/21/2005, 18:20:23] - Nothing found! Exiting.

[10/21/2005, 18:24:57] - Starting Process...
[10/21/2005, 18:24:57] - Looking for Browser Helper Object [MSEvents Object]
[10/21/2005, 18:24:57] - 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} - Yahoo! Companion BHO
[10/21/2005, 18:24:57] - 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - AcroIEHlprObj Class
[10/21/2005, 18:24:57] - 3: {53707962-6F74-2D53-2644-206D7942484F} -
[10/21/2005, 18:24:57] - WARNING: 3: {53707962-6F74-2D53-2644-206D7942484F} - BHO Name is blank.
[10/21/2005, 18:24:57] - Checking for WinLogon Notify reference. (File: C:\Program Files\Spybot - Search & Destroy\SDHelper.dll)
[10/21/2005, 18:24:57] - Couldn't find SDHelper in Winlogon Notify. Ignoring {53707962-6F74-2D53-2644-206D7942484F}.
[10/21/2005, 18:24:57] - 4: {5CA3D70E-1895-11CF-8E15-001234567890} - DriveLetterAccess
[10/21/2005, 18:24:57] - 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper
[10/21/2005, 18:24:57] - 6: {BDF3E430-B101-42AD-A544-FADC6B084872} - CNavExtBho Class
[10/21/2005, 18:24:57] - Finished searching for [MSEvents Object]
[10/21/2005, 18:24:57] - Nothing found! Exiting.

What do you think?

Message Edited by LukeHoward on 10-21-2005 05:29 PM

Virus & Spyware

Winfixer Still a Problem Even After Running the Tool

Was this post helpful?