skelley23

 

What antivirus program are you running and what other protection devices aare you running?

 

I have already updated to SP2.  Any ideas?  I have already tried to run HiJack This and cannot even get to a screen with a scan button.  All I get is an empty folder created, and a shortcut that I can't open.

I was told to run Ad Aware SE occasionally and my company loaded some anti-virus software on the laptop.  I'm not sure what it is, but it's not something I recognize like Norton, McAfee, etc.  I recently ran the Ad Aware and quarantined everything it listed.  I also, updated my Windows Packet to service pack 2.  I later read another discussion where it recommended updating an earlier service pack before service pack 2.  I hope this information helps.  I can leave more detailed information when I am working on the laptop, if I can ever get online with it again.  It took six tries last time, before I could get through the registry problems.

 

Thanks

skelley23

 

If you have SP1 (service pack 1) and your PC is infected, I do not recommend that you try to install SP2 it will make it very difficult to remove the infection if you overlay it.

 

I am adding the information about dopwnloading and running Hijackthis:

 

Go Here And download HijackThis

Save it in a convenient permanent folder such as C:\\HJT\\, double click HijackThis.exe, and hit "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, Ctrl-A to Select All, and copy its contents.

 

Information about creating the folder

Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C:
then right click and select New then Folder and name it HJT.

If you are unable to connect to the internet with the problem PC. Thne download it to a working PC and transfer it to the problem CP by way of CD or USB key. Once the log file is generated, transfer it (the txt. log) back to the working PC and upload it as a reply to this thread. Ther is no danger of cross infection using the process outlined above

 

I tried to run the VCleaner on Safe Mode, but I cannot start because it is a different password and I don't have administrator access.  So I ran it straight from opening it and it said there were 70 processes running, but didn't find any viruses.  I still cannot run HiJackThis.  Not sure what to do other than drink, because I don't have the patience for this.  The computer is winning.  I will try any other ideas you might have.  Thanks.

I downloaded HiJackThis again, and it opened and I ran a scan.  Here it is:

 

Logfile of HijackThis v1.99.1
Scan saved at 7:49:55 PM, on 11/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\Program Files\CA\SharedComponents\CAM\bin\cam.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\LogWatNT.exe
C:\Program Files\Network ICE\BlackICE\RapApp.exe
C:\Program Files\CA\Unicenter Remote Control\rcHost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\Program Files\Network ICE\BlackICE\vpatch.exe
C:\WINDOWS\UMCSTUB.EXE
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINDOWS\System32\1XConfig.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\SxpInst\sxplog32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Logitech\iTouch\kbdtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Scripts\Launcher.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\WINDOWS\mmputt.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\windows\system32\oodsrego.exe
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\WinTools\WSup.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\PSCastor\PSCastor.exe
C:\WINDOWS\System32\owinppem.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Documents and Settings\9803232\Start Menu\Programs\Startup\nsnotify.exe
C:\Program Files\MSN Apps\Updater\01.05.0000.1009\en-us\msnappau.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Sony Handheld\palm.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [DelCache] C:\Scripts\DELCACHE.EXE
O4 - HKLM\..\Run: [TermEvent] C:\Windows\system32\TermEvt.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [CA-AMAgent] C:\TNGAM\AGENT\amagent.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Sxplog] C:\SxpInst\sxpstub.exe
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [DellReports] C:\SCRIPTS\delrpt.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AXA_Connect] C:\Scripts\Launcher.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Java Stabilization] C:\SCRIPTS\JavaCheck.exe
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [PTRGMYGK] rundll32.exe ptmg1v.dll,DllRunMain
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cmonitor] C:\Program Files\SystemDoctor 2006 Free\startupmon.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [mmcrat06] C:\WINDOWS\mmputt.exe
O4 - HKLM\..\Run: [{12-2F-F7-76-ZN}] C:\windows\system32\oodsrego.exe ELT001
O4 - HKLM\..\Run: [win3210-660525194] C:\WINDOWS\win3210-660525194.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\owinppem.exe ELT001
O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe"
O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [Piro] C:\Documents and Settings\9803232\Application Data\arsp.exe
O4 - HKCU\..\Run: [Dylxhnet] C:\WINDOWS\System32\arpa.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: nsnotify.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\owinppem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AxaLicense.lnk = C:\Scripts\AxaLicense.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O12 - Plugin for .asf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.adsextend.net
O15 - Trusted Zone: http://edox.axa-advisors.com
O15 - Trusted Zone: http://www.axadistributors.com
O15 - Trusted Zone: http://alerts.axaonline.com
O15 - Trusted Zone: http://preprod.axaonline.com
O15 - Trusted Zone: http://snwtiwp1.axaonline.com
O15 - Trusted Zone: http://test.axaonline.com
O15 - Trusted Zone: http://wtiwebopt.axaonline.com
O15 - Trusted Zone: http://www.axaonline.com
O15 - Trusted Zone: http://www.comcast.net
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: csessbi1.equitable.com
O15 - Trusted Zone: http://csessbi1.equitable.com
O15 - Trusted Zone: http://edox.equitable.com
O15 - Trusted Zone: mpgint.equitable.com
O15 - Trusted Zone: http://mpgpln.equitable.com
O15 - Trusted Zone: mpgtrn.equitable.com
O15 - Trusted Zone: http://srsprod.equitable.com
O15 - Trusted Zone: http://srsprod.equitable.com
O15 - Trusted Zone: http://axa.financialcampus.com
O15 - Trusted Zone: http://axa-advisors.financialcampus.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: w4.iscorp.com
O15 - Trusted Zone: http://w4.iscorp.com
O15 - Trusted Zone: http://www.macnamee.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: http://apps.mony.com
O15 - Trusted Zone: http://advtools.morningstar.com
O15 - Trusted Zone: http://apps.questerra.com
O15 - Trusted Zone: http://www.questerra.com
O15 - Trusted Zone: http://www.seagullsw.com
O15 - Trusted Zone: http://www.smartmoney.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: http://*.snj1afsap33
O15 - Trusted Zone: http://*.sny1afsapdev18
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: www.visualwebcaster.com
O15 - Trusted Zone: http://www.visualwebcaster.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: http://edox.axa-advisors.com (HKLM)
O15 - Trusted Zone: http://preprod.axaonline.com (HKLM)
O15 - Trusted Zone: http://snwtiwp1.axaonline.com (HKLM)
O15 - Trusted Zone: http://test.axaonline.com (HKLM)
O15 - Trusted Zone: http://wtiwebopt.axaonline.com (HKLM)
O15 - Trusted Zone: http://www.axaonline.com (HKLM)
O15 - Trusted Zone: http://www.comcast.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: http://edox.equitable.com (HKLM)
O15 - Trusted Zone: mpgint.equitable.com (HKLM)
O15 - Trusted Zone: http://mpgpln.equitable.com (HKLM)
O15 - Trusted Zone: mpgtrn.equitable.com (HKLM)
O15 - Trusted Zone: http://axa.financialcampus.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: http://www.macnamee.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: http://advtools.morningstar.com (HKLM)
O15 - Trusted Zone: http://apps.questerra.com (HKLM)
O15 - Trusted Zone: http://www.questerra.com (HKLM)
O15 - Trusted Zone: http://www.smartmoney.com (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: http://*.snj1afsap33 (HKLM)
O15 - Trusted Zone: http://*.sny1afsapdev18 (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted IP range: http://141.191.182.8
>Break

Log Continued:

 

O16 - DPF: {17898480-17DF-4E0A-8248-B2A6E647B245} (Siebel Option Pack for IE 7.0.5) - https://wtiwebopt.axaonline.com/fins/14705/applets/SiebelOptionPack.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
O16 - DPF: {3B74F448-B418-40E7-AB9A-1DCCC344B09C} (Siebel Option Pack for IE 7.0.5) - https://wtiwebopt.axaonline.com/fins/14703/applets/SiebelOptionPack.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/activex/promocache/3138302D2D2D.exe
O16 - DPF: {44260C54-2BC1-4E3B-B312-3F0277544C8D} (Siebel Option Pack for IE 7.0.5) - https://wtiwebopt.axaonline.com/fins/14308/applets/SiebelOptionPack.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/13a4a7428a0aeb93d923/netzip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1161988686168
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161988663595
O16 - DPF: {7A4907E8-E06E-4008-BB9F-48980D9D9A75} (Siebel Option Pack for IE 7.0.5) - https://wtiwebopt.axaonline.com/fins/14701/applets/SiebelOptionPack.cab
O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - http://awbeta.net-nucleus.com/FIX/WinATS.cab
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} - http://57.69.22.141/main/Install/en/US/CentraDownloader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BAB3E70B-A847-4A88-ACFC-778FCCC00287} (CActSetupObj Object) - http://www.odysseusmarketing.com/actsetup.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {DBFF771D-3F92-4C70-9978-508738536F38} (CSConn Class) - https://wtiwebopt.axaonline.com/fins/14308/applets/csagent.cab
O16 - DPF: {E4C29FDC-F547-4219-ACFD-571F2A7A564A} (WebCamTest Class) - http://awbeta.net-nucleus.com/CABUPDATES/winwcd.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = axa-advisors.axa-financial.intraxa
O17 - HKLM\Software\..\Telephony: DomainName = axa-advisors.axa-financial.intraxa
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = axa-advisors.axa-financial.intraxa
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = equitable.com,axa-advisors.axa-financial.intraxa,axa-advisors.com,axa-financial.com,axa-na.com,elas.com,na.axa-tech.intraxa,axafinancialsvc.axa-financial.intraxa,axa-financial.intraxa
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = equitable.com,axa-advisors.axa-financial.intraxa,axa-advisors.com,axa-financial.com,axa-na.com,elas.com,na.axa-tech.intraxa,axafinancialsvc.axa-financial.intraxa,axa-financial.intraxa
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5021} - C:\PROGRA~1\NETEXC~1.0\FlowHook.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Asset Management Agent (AmoAgent) - Computer Associates International, Inc. - C:\WINDOWS\UMCSTUB.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Unicenter Message Queuing Server (CA-MessageQueuing) - Computer Associates International, Inc. - C:\Program Files\CA\SharedComponents\CAM\bin\cam.exe
O23 - Service: CA-License Client (CA_LIC_CLNT) - Unknown owner - C:\WINDOWS\Lic98Rmt.exe
O23 - Service: CA-License Server (CA_LIC_SRVR) - Unknown owner - C:\WINDOWS\Lic98RmtD.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DM Primer (DMPrimer) - Unknown owner - C:\Program Files\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe" -DMPRIMER_SERVICE_: (file missing)
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINDOWS\LogWatNT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Unicenter Remote Control Host (rcHost) - Computer Associates International, Inc. - C:\Program Files\CA\Unicenter Remote Control\rcHost.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: Unicenter Software Delivery (SDService) - Computer Associates International, Inc. - C:\TNGSD\BIN\SDSERV.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

Logfile of HijackThis v1.99.1
Scan saved at 5:47:59 PM, on 11/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Network ICE\BlackICE\blackd.exe
C:\Program Files\CA\SharedComponents\CAM\bin\cam.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\CA\SharedComponents\DesktopCommonServices\DMPrimer\dmprimer.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\WINDOWS\LogWatNT.exe
C:\Program Files\Network ICE\BlackICE\RapApp.exe
C:\Program Files\CA\Unicenter Remote Control\rcHost.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\TNGSD\BIN\SDSERV.EXE
C:\Program Files\Network ICE\BlackICE\vpatch.exe
C:\WINDOWS\UMCSTUB.EXE
C:\TNGSD\BIN\TRIGGAG.EXE
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\System32\1XConfig.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\SxpInst\sxplog32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Scripts\Launcher.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Logitech\iTouch\kbdtray.exe
C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\WINDOWS\mmputt.exe
C:\PROGRA~1\NovaStor\NOVABA~1\NSENGINE.exe
C:\windows\system32\oodsrego.exe
C:\WINDOWS\System32\owinppem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe
C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\WinTools\WSup.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\PSCastor\PSCastor.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Documents and Settings\9803232\Start Menu\Programs\Startup\nsnotify.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Apps\Updater\01.05.0000.1009\en-us\msnappau.exe
C:\H.exe\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [DelCache] C:\Scripts\DELCACHE.EXE
O4 - HKLM\..\Run: [TermEvent] C:\Windows\system32\TermEvt.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [CA-AMAgent] C:\TNGAM\AGENT\amagent.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Sxplog] C:\SxpInst\sxpstub.exe
O4 - HKLM\..\Run: [SDJobCheck] triggusr.exe
O4 - HKLM\..\Run: [DellReports] C:\SCRIPTS\delrpt.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [AXA_Connect] C:\Scripts\Launcher.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Java Stabilization] C:\SCRIPTS\JavaCheck.exe
O4 - HKLM\..\Run: [NovaBackup 7 Tray Control] "C:\Program Files\NovaStor\NovaBACKUP\NbkCtrl.exe"
O4 - HKLM\..\Run: [PTRGMYGK] rundll32.exe ptmg1v.dll,DllRunMain
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cmonitor] C:\Program Files\SystemDoctor 2006 Free\startupmon.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [mmcrat06] C:\WINDOWS\mmputt.exe
O4 - HKLM\..\Run: [{12-2F-F7-76-ZN}] C:\windows\system32\oodsrego.exe ELT001
O4 - HKLM\..\Run: [win3210-660525194] C:\WINDOWS\win3210-660525194.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\System32\owinppem.exe ELT001
O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcsdr.exe"
O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner 2006 Free\udcpas.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [Piro] C:\Documents and Settings\9803232\Application Data\arsp.exe
O4 - HKCU\..\Run: [Dylxhnet] C:\WINDOWS\System32\arpa.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [PSCastor] "C:\Program Files\PSCastor\PSCastor.exe"
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: nsnotify.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\owinppem.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AxaLicense.lnk = C:\Scripts\AxaLicense.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O10 - Unknown file in Winsock LSP: c:\program files\network ice\blackice\ibe\icelsp_8.0.614.0.dll
O12 - Plugin for .asf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.adsextend.net
O15 - Trusted Zone: http://edox.axa-advisors.com
O15 - Trusted Zone: http://www.axadistributors.com
O15 - Trusted Zone: http://alerts.axaonline.com
O15 - Trusted Zone: http://preprod.axaonline.com
O15 - Trusted Zone: http://snwtiwp1.axaonline.com
O15 - Trusted Zone: http://test.axaonline.com
O15 - Trusted Zone: http://wtiwebopt.axaonline.com
O15 - Trusted Zone: http://www.axaonline.com
O15 - Trusted Zone: http://www.comcast.net
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: csessbi1.equitable.com
O15 - Trusted Zone: http://csessbi1.equitable.com
O15 - Trusted Zone: http://edox.equitable.com
O15 - Trusted Zone: mpgint.equitable.com
O15 - Trusted Zone: http://mpgpln.equitable.com
O15 - Trusted Zone: mpgtrn.equitable.com
O15 - Trusted Zone: http://srsprod.equitable.com
O15 - Trusted Zone: http://srsprod.equitable.com
O15 - Trusted Zone: http://axa.financialcampus.com
O15 - Trusted Zone: http://axa-advisors.financialcampus.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: w4.iscorp.com
O15 - Trusted Zone: http://w4.iscorp.com
O15 - Trusted Zone: http://www.macnamee.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: http://apps.mony.com
O15 - Trusted Zone: http://advtools.morningstar.com
O15 - Trusted Zone: http://apps.questerra.com
O15 - Trusted Zone: http://www.questerra.com
O15 - Trusted Zone: http://www.seagullsw.com
O15 - Trusted Zone: http://www.smartmoney.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: http://*.snj1afsap33
O15 - Trusted Zone: http://*.sny1afsapdev18
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: www.visualwebcaster.com
O15 - Trusted Zone: http://www.visualwebcaster.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: http://edox.axa-advisors.com (HKLM)
O15 - Trusted Zone: http://preprod.axaonline.com (HKLM)
O15 - Trusted Zone: http://snwtiwp1.axaonline.com (HKLM)
O15 - Trusted Zone: http://test.axaonline.com (HKLM)
O15 - Trusted Zone: http://wtiwebopt.axaonline.com (HKLM)
O15 - Trusted Zone: http://www.axaonline.com (HKLM)
O15 - Trusted Zone: http://www.comcast.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: http://edox.equitable.com (HKLM)
O15 - Trusted Zone: mpgint.equitable.com (HKLM)
O15 - Trusted Zone: http://mpgpln.equitable.com (HKLM)
O15 - Trusted Zone: mpgtrn.equitable.com (HKLM)
O15 - Trusted Zone: http://axa.financialcampus.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: http://www.macnamee.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: http://advtools.morningstar.com (HKLM)
O15 - Trusted Zone: http://apps.questerra.com (HKLM)
O15 - Trusted Zone: http://www.questerra.com (HKLM)
O15 - Trusted Zone: http://www.smartmoney.com (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: http://*.snj1afsap33 (HKLM)
O15 - Trusted Zone: http://*.sny1afsapdev18 (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted IP range: http://141.191.182.8