One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

Its very possible that anything could have been installed on your computer by the remote attacker, including opening other backdoors and installing rootkits. While we can attempt to clean what we see in your logs, we can't guarantee that your computer will be completely in the clear since we have no way of knowing that has been done to the computer. Your computer could be completely compromised at this moment. It may be prudent to backup your information, reformat, and reinstall.

More information on Remote Access Trojans can be found here

I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.


Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall


If, however, you decide that the computer is not used for any sensitive work, or if you do not wish to reformat at this time, I can definitely help you clean your computer to the best of my abilities.

Should you have any questions, please feel free to ask.

Please let me know what you decide to do in your next post.

****************************

If you choose not to reformat at this time, please follow these instructions:



Open HijackThis, click Config, click Misc Tools
Click " Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, copy and paste the results in your next post.

****************************

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

In your next post, please include

• new hijackthis log
• c:\vundofix.txt
• uninstall list

VundoFix V4.2.84

Checking Java version...

Java version is 1.4.2.1

Java version is 1.4.2.3

Java version is 1.5.0.4

Java version is 1.5.0.6

Scan started at 3:56:30 PM 7/2/2006

Listing files found while scanning....

C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ssqrp.dll

C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll

VundoFix V4.2.84

Checking Java version...

Java version is 1.4.2.1

Java version is 1.4.2.3

Java version is 1.5.0.4

Java version is 1.5.0.6

Scan started at 3:57:11 PM 7/2/2006

Listing files found while scanning....

C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ssqrp.dll

C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll

VundoFix V4.2.84

Checking Java version...

Java version is 1.4.2.1

Java version is 1.4.2.3

Java version is 1.5.0.4

Java version is 1.5.0.6

Scan started at 3:58:20 PM 7/2/2006

Listing files found while scanning....

C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ssqrp.dll

C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\pmkhg.dll
Attempting to delete C:\Winnt\system32\pmkhg.dll
C:\Winnt\system32\pmkhg.dll Has been deleted!

Attempting to delete C:\Winnt\system32\ghkmp.ini
C:\Winnt\system32\ghkmp.ini Has been deleted!

Attempting to delete C:\Winnt\system32\ghkmp.bak1
C:\Winnt\system32\ghkmp.bak1 Has been deleted!

Attempting to delete C:\Winnt\system32\ghkmp.bak2
C:\Winnt\system32\ghkmp.bak2 Has been deleted!

Attempting to delete C:\Winnt\system32\ghkmp.ini2
C:\Winnt\system32\ghkmp.ini2 Has been deleted!

Attempting to delete C:\Winnt\system32\ghkmp.tmp
C:\Winnt\system32\ghkmp.tmp Has been deleted!

Attempting to delete C:\Winnt\system32\ssqrp.dll
C:\Winnt\system32\ssqrp.dll Could not be deleted.

Performing Repairs to the registry.
Done!
Adobe Acrobat - Reader 6.0.2 Update
Adobe Download Manager 1.2 (Remove Only)
Adobe Reader 6.0.1
AVG Free Edition
Broadcom Management Programs
Crystal Reports 9
Diskeeper Professional Edition
Easy Access Button Support
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hotfix for MDAC 2.80 (KB911562)
HP Image Zone 4.2
hp LaserJet 1010 Series
HP Officejet 7300 series
HP PSC & OfficeJet 4.2
HP Software Update
IIS UrlScan Tool 2.0 (Uninstall)
Intel(R) Extreme Graphics 2 Driver
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_01
Java 2 Runtime Environment, SE v1.4.2_03
LiveReg (Symantec Corporation)
LiveUpdate 2.5 (Symantec Corporation)
MasterCook Deluxe
Media Access
Microangelo 2.1
MICROS RES Universal Credit Card Driver
MICROS res3000 Prerequisites
MICROS res3000 v3.2
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB886906)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Office 2000 Professional
Microsoft VGX Q833989
Microsoft Windows Journal Viewer
Microsoft XML Parser and SDK
MopUPS Express
Mozilla Firefox (1.5.0.4)
QuickTime
Security Update for Windows 2000 (KB904706)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
SmartUSB56 Voice Modem
SoundMAX
Spybot - Search & Destroy 1.4
Symantec pcAnywhere
U.S. Robotics V.92 Voice Host Int
Update Rollup 1 for Windows 2000 SP4
Windows 2000 Hotfix - KB842773
Windows 2000 Hotfix - KB867282
Windows 2000 Hotfix - KB887797
Windows 2000 Hotfix - KB889293
Windows 2000 Hotfix - KB890046
Windows 2000 Hotfix - KB890923
Windows 2000 Hotfix - KB893756
Windows 2000 Hotfix - KB896358
Windows 2000 Hotfix - KB896422
Windows 2000 Hotfix - KB896423
Windows 2000 Hotfix - KB896424
Windows 2000 Hotfix - KB897715
Windows 2000 Hotfix - KB899587
Windows 2000 Hotfix - KB899589
Windows 2000 Hotfix - KB900725
Windows 2000 Hotfix - KB901017
Windows 2000 Hotfix - KB901214
Windows 2000 Hotfix - KB902400
Windows 2000 Hotfix - KB905414
Windows 2000 Hotfix - KB905495
Windows 2000 Hotfix - KB905749
Windows 2000 Hotfix - KB905915
Windows 2000 Hotfix - KB908519
Windows 2000 Hotfix - KB908523
Windows 2000 Hotfix - KB908531
Windows 2000 Hotfix - KB911280
Windows 2000 Hotfix - KB911567
Windows 2000 Hotfix - KB912812
Windows 2000 Hotfix - KB912919
Windows 2000 Hotfix - KB913580
Windows 2000 Hotfix - KB914389
Windows 2000 Hotfix - KB916281
Windows 2000 Hotfix - KB917736
Windows 2000 Hotfix - KB917953
Windows 2000 Hotfix (SP5) Q818043
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Player Hotfix [See Q828026 for more information]
Windows Media Player system update (9 Series)
WinZip

Logfile of HijackThis v1.99.1
Scan saved at 4:10:26 PM, on 7/2/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Winnt\System32\smss.exe
C:\Winnt\system32\winlogon.exe
C:\Winnt\system32\services.exe
C:\Winnt\system32\lsass.exe
C:\Winnt\system32\svchost.exe
C:\Winnt\system32\spoolsv.exe
C:\Micros\RES\PS\Bin\3700d.exe
c:\cpqapps\Aclient\Aclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Micros\RES\PS\Bin\DbUpdateServer.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINNT\system32\svchost.exe
C:\Micros\COMMON\Bin\CALSrv.exe
C:\Micros\COMMON\Bin\DSM.exe
C:\Program Files\Chloride Power\MopUPS Express\upsxpres.exe
C:\Winnt\system32\regsvc.exe
C:\winnt\system32\dllcache\etc\MSSvc.EXE
C:\winnt\system32\dllcache\etc\runbatch.exe
C:\Winnt\system32\MSTask.exe
C:\Winnt\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Micros\RES\PS\Bin\ConnAdvisor.exe
C:\Micros\RES\PS\Bin\MDSHTTPService.exe
C:\Winnt\system32\stisvc.exe
C:\Micros\COMMON\Bin\CMS.exe
C:\MICROS\COMMON\Bin\RunDBMS.exe
C:\Winnt\System32\WBEM\WinMgmt.exe
C:\winnt\system32\dhcp\svchost.exe
C:\Winnt\system32\svchost.exe
C:\Winnt\system32\inetsrv\inetinfo.exe
C:\Winnt\Explorer.EXE
C:\Micros\RES\PS\Bin\ResSIMDB.exe
C:\Micros\COMMON\Bin\CMSC.exe
C:\Winnt\system32\msdtc.exe
C:\Winnt\system32\mqsvc.exe
C:\Winnt\system32\igfxtray.exe
C:\Winnt\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\program files\chloride power\mopups express\mopxpres.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\MICROS\res\ps\Bin\resdbs.exe
C:\Winnt\system32\locator.exe
C:\Winnt\system32\HPZipm12.exe
C:\MICROS\DATABASE\SYBASE\Adaptive Server Anywhere 6.0\Win32\dbsrv6.exe
C:\Micros\RES\PS\Bin\CPanel.exe
C:\WINNT\Microsoft.NET\Framework\v1.0.3705\aspnet_wp.exe
C:\Micros\Res\Ps\bin\OPS.exe
C:\Micros\Res\Ps\bin\PControl.exe
C:\MICROS\COMMON\Bin\AutoSeqServ.exe
C:\Micros\Res\Ps\bin\CCS.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/yme/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=%windir%\system32\Userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\Winnt\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Winnt\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [MopUPS Express] c:\program files\chloride power\mopups express\mopxpres.exe -t
O4 - HKLM\..\Run: [winapildr] c:\windows\drivers\ias\f uck.bat
O4 - HKLM\..\Run: [NAV Live Update] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\~2.EXE
O4 - HKLM\..\Run: [Windows Explorer] Explorer .exe
O4 - HKLM\..\Run: [System Service] service.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\RunServices: [Windows Explorer] Explorer .exe
O4 - HKLM\..\RunServices: [System Service] service.exe
O4 - HKCU\..\Run: [LTM2] C:\Winnt\litmus\SVCHOST32.exe
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140453192593
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144550489968
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/sysprotect.com/scanner/pages/scanner/SysProtectScannerInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CC298ED-18B0-4499-861E-9DF710605329}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O20 - Winlogon Notify: CLSID - C:\Winnt\
O20 - Winlogon Notify: igfxcui - C:\Winnt\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: PCANotify - C:\Winnt\SYSTEM32\PCANotify.dll
O23 - Service: MICROS 3700 System (3700d) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\3700d.exe
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - c:\cpqapps\Aclient\Aclient.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: MICROS Caller ID Service (CISERVICE) - MICROS Systems, Inc. - C:\Micros\RES\GSS\Bin\CIService.exe
O23 - Service: MICROS DB Update Service (DbUpdateServer) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\DbUpdateServer.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\Winnt\System32\dmadmin.exe
O23 - Service: MICROS Backup Server - MICROS Systems, Inc. - C:\MICROS\res\ps\Bin\resbsm.exe
O23 - Service: MICROS CAL Service - Unknown owner - C:\Micros\COMMON\Bin\CALSrv.exe
O23 - Service: MICROS Database Service - MICROS Systems, Inc. - C:\MICROS\res\ps\Bin\resdbs.exe
O23 - Service: MICROS Distributed Service Manager - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\DSM.exe
O23 - Service: MICROS Cash Management COM Server (MicrosCashManagementComServer) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\CMSC.exe
O23 - Service: MICROS Secure Desktop (MicrosDesk) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\MicrosDsk.exe
O23 - Service: MICROS TMS Interface (MICROSTMSInterface) - MICROS Systems, Inc. - C:\Micros\Res\Ps\Bin\TMSinterface.exe
O23 - Service: MopUPS Express - Chloride Power - C:\Program Files\Chloride Power\MopUPS Express\upsxpres.exe
O23 - Service: MSSvc ntsysvers (ntsysvers) - Unknown owner - C:\winnt\system32\dllcache\etc\MSSvc.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\Winnt\system32\HPZipm12.exe
O23 - Service: MSSvc runbatch (runbatch) - Unknown owner - C:\winnt\system32\dllcache\etc\MSSvc.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: sqlHP-23328310961 (SQLANYs_sqlHP-23328310961) - Sybase, Inc. - C:\MICROS\DATABASE\SYBASE\Adaptive Server Anywhere 6.0\Win32\dbsrv6.exe
O23 - Service: sqlPOSSERVER (SQLANYs_sqlPOSSERVER) - Sybase, Inc. - C:\MICROS\DATABASE\SYBASE\Adaptive Server Anywhere 6.0\Win32\dbsrv6.exe
O23 - Service: MICROS Connection Advisor (srvConnAdvisor) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\ConnAdvisor.exe
O23 - Service: MICROS MDS HTTP Service (srvMDSHTTPService) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\MDSHTTPService.exe
O23 - Service: MICROS Cash Management (svcCashManager) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\CMS.exe
O23 - Service: TskScheduler - Unknown owner - C:\Winnt\taskshed.exe (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\winnt\system32\dhcp\svchost.exe" -service "SecurityTypes=None" "PortNumber=10200" "HTTPPortNumber=10201" "AlwaysShared=1 (file missing)

I can't format my drive as of now, but I followed the steps you posted and sent the required information. I hope this works. Let me know if there is anything else I can do and thank you for all your help.

Please remove these entries from Add/Remove Programs in the Control Panel(if present):

J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_01
Java 2 Runtime Environment, SE v1.4.2_03

Please note any other programs that you dont recognize in that list in your next response


First download ewido anti-spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program

1. 
   
2. Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
3. Once the setup is complete you will need run ewido and update the definition files.
4. On the main screen select the icon "Update" then select the "Update now" link.
5. Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
6. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
7. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
8. Under "Reports"
9. Select "Automatically generate report after every scan"
10. Un-Select "Only if threats were found"
11. Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
    1. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
    2. IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
       
    3. Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
    4. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
    5. ewido will now begin the scanning process, be patient this may take a little time.
    6. Once the scan is complete do the following:
       
    7. If you have any infections you will prompted, then select "Apply all actions"
    8. Next select the "Reports" icon at the top.
    9. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
    10. Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.
    11. Please go HERE to run Panda's ActiveScan
        • Once you are on the Panda site click the Scan your PC button
        • A new window will open...click the Check Now button
        • Enter your Country
        • Enter your State/Province
        • Enter your e-mail address and click send
        • Select either Home User or Company
        • Click the big Scan Now button
        • If it wants to install an ActiveX component allow it
        • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
        • When download is complete, click on My Computer to start the scan
        • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
        in your next post, please include
        • new hijackthis log
        • ewido log
        • panda log

Logfile of HijackThis v1.99.1
Scan saved at 12:44:42 AM, on 7/3/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.
Running processes:
C:\Winnt\System32\smss.exe
C:\Winnt\system32\winlogon.exe
C:\Winnt\system32\services.exe
C:\Winnt\system32\lsass.exe
C:\Winnt\system32\svchost.exe
C:\Winnt\system32\spoolsv.exe
C:\Micros\RES\PS\Bin\3700d.exe
c:\cpqapps\Aclient\Aclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Micros\RES\PS\Bin\DbUpdateServer.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINNT\system32\svchost.exe
C:\Micros\COMMON\Bin\CALSrv.exe
C:\Micros\COMMON\Bin\DSM.exe
C:\Program Files\Chloride Power\MopUPS Express\upsxpres.exe
C:\Winnt\system32\regsvc.exe
C:\Winnt\system32\MSTask.exe
C:\Winnt\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Micros\RES\PS\Bin\ConnAdvisor.exe
C:\Micros\RES\PS\Bin\MDSHTTPService.exe
C:\Winnt\system32\stisvc.exe
C:\Micros\COMMON\Bin\CMS.exe
C:\Winnt\Explorer.EXE
C:\Winnt\System32\WBEM\WinMgmt.exe
C:\winnt\system32\dhcp\svchost.exe
C:\Winnt\system32\svchost.exe
C:\Winnt\system32\inetsrv\inetinfo.exe
C:\Micros\COMMON\Bin\CMSC.exe
C:\Winnt\system32\msdtc.exe
C:\Winnt\system32\mqsvc.exe
C:\Winnt\system32\igfxtray.exe
C:\Winnt\system32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\program files\chloride power\mopups express\mopxpres.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\MICROS\res\ps\Bin\resdbs.exe
C:\Winnt\system32\locator.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Winnt\system32\HPZipm12.exe
C:\Micros\RES\PS\Bin\CPanel.exe
C:\Micros\RES\PS\Bin\ResSIMDB.exe
C:\Winnt\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Local Settings\Temp\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/yme/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=%windir%\system32\Userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\Winnt\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Winnt\system32\hkcmd.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [MopUPS Express] c:\program files\chloride power\mopups express\mopxpres.exe -t
O4 - HKLM\..\Run: [winapildr] c:\windows\drivers\ias\f uck.bat
O4 - HKLM\..\Run: [NAV Live Update] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\~2.EXE
O4 - HKLM\..\Run: [Windows Explorer] Explorer .exe
O4 - HKLM\..\Run: [System Service] service.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\RunServices: [Windows Explorer] Explorer .exe
O4 - HKLM\..\RunServices: [System Service] service.exe
O4 - HKCU\..\Run: [LTM2] C:\Winnt\litmus\SVCHOST32.exe
O4 - Startup: Forget Me Not Reminders.lnk = C:\CACARD\FMREMIND.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140453192593
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144550489968
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/sysprotect.com/scanner/pages/scanner/SysProtectScannerInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CC298ED-18B0-4499-861E-9DF710605329}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C231B26-BA25-4632-B1A7-E8679370EF28}: NameServer = 204.117.214.10,199.2.252.10
O20 - Winlogon Notify: CLSID - C:\Winnt\
O20 - Winlogon Notify: igfxcui - C:\Winnt\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: PCANotify - C:\Winnt\SYSTEM32\PCANotify.dll
O23 - Service: MICROS 3700 System (3700d) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\3700d.exe
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - c:\cpqapps\Aclient\Aclient.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: MICROS Caller ID Service (CISERVICE) - MICROS Systems, Inc. - C:\Micros\RES\GSS\Bin\CIService.exe
O23 - Service: MICROS DB Update Service (DbUpdateServer) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\DbUpdateServer.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\Winnt\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: MICROS Backup Server - MICROS Systems, Inc. - C:\MICROS\res\ps\Bin\resbsm.exe
O23 - Service: MICROS CAL Service - Unknown owner - C:\Micros\COMMON\Bin\CALSrv.exe
O23 - Service: MICROS Database Service - MICROS Systems, Inc. - C:\MICROS\res\ps\Bin\resdbs.exe
O23 - Service: MICROS Distributed Service Manager - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\DSM.exe
O23 - Service: MICROS Cash Management COM Server (MicrosCashManagementComServer) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\CMSC.exe
O23 - Service: MICROS Secure Desktop (MicrosDesk) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\MicrosDsk.exe
O23 - Service: MICROS TMS Interface (MICROSTMSInterface) - MICROS Systems, Inc. - C:\Micros\Res\Ps\Bin\TMSinterface.exe
O23 - Service: MopUPS Express - Chloride Power - C:\Program Files\Chloride Power\MopUPS Express\upsxpres.exe
O23 - Service: MSSvc ntsysvers (ntsysvers) - Unknown owner - C:\winnt\system32\dllcache\etc\MSSvc.EXE (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\Winnt\system32\HPZipm12.exe
O23 - Service: MSSvc runbatch (runbatch) - Unknown owner - C:\winnt\system32\dllcache\etc\MSSvc.EXE (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: sqlHP-23328310961 (SQLANYs_sqlHP-23328310961) - Sybase, Inc. - C:\MICROS\DATABASE\SYBASE\Adaptive Server Anywhere 6.0\Win32\dbsrv6.exe
O23 - Service: sqlPOSSERVER (SQLANYs_sqlPOSSERVER) - Sybase, Inc. - C:\MICROS\DATABASE\SYBASE\Adaptive Server Anywhere 6.0\Win32\dbsrv6.exe
O23 - Service: MICROS Connection Advisor (srvConnAdvisor) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\ConnAdvisor.exe
O23 - Service: MICROS MDS HTTP Service (srvMDSHTTPService) - MICROS Systems, Inc. - C:\Micros\RES\PS\Bin\MDSHTTPService.exe
O23 - Service: MICROS Cash Management (svcCashManager) - MICROS Systems, Inc. - C:\Micros\COMMON\Bin\CMS.exe
O23 - Service: TskScheduler - Unknown owner - C:\Winnt\taskshed.exe (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\winnt\system32\dhcp\svchost.exe" -service "SecurityTypes=None" "PortNumber=10200" "HTTPPortNumber=10201" "AlwaysShared=1 (file missing)

---------------------------------------------------------

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:18:16 AM 7/3/2006

+ Scan result:



C:\Program Files\Media Access -> Adware.MediaAccess : Cleaned with backup (quarantined).
C:\Program Files\Media Access\Info.txt -> Adware.MediaAccess : Cleaned with backup (quarantined).
C:\WINNT\system32\70tovmto.ini -> Adware.Sahat : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\AppID\{4F5E5D72-C915-4f3b-908B-527D064B0FAA} -> Adware.SysProtect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{EF130E77-0A34-4365-BFB7-218FD3DDCD5F} -> Adware.SysProtect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\Interface\{02946FD1-2D99-46E6-A790-3A089714EDD9} -> Adware.SysProtect : Cleaned with backup (quarantined).
HKLM\SOFTWARE\SysProtect -> Adware.SysProtect : Cleaned with backup (quarantined).
HKU\S-1-5-21-601155972-2956927354-1974191561-500\Software\SysProtect -> Adware.SysProtect : Cleaned with backup (quarantined).
C:\WINNT\system32\ssqrp.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINNT\Temp\temp.fr65DD\MediaAccC.dll -> Adware.WinAD : Cleaned with backup (quarantined).
C:\WINNT\Temp\temp.fr77D2\MediaAccK.exe -> Adware.WinAD : Cleaned with backup (quarantined).
C:\WINNT\Temp\temp.frDF3A\MediaAccess.exe -> Adware.WinAD : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\MediaAccess.Installer -> Adware.WinAd : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\MediaAccess.Installer\CLSID -> Adware.WinAd : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\MediaAccess.Installer\CurVer -> Adware.WinAd : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Media Access -> Adware.WinAD : Cleaned with backup (quarantined).
C:\WINNT\system32\dllcache\etc\h.exe -> Backdoor.Hupigon.hk : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD1.tmp\USYP_0001_N76M2004NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD10.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD3.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD4.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD5.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD6.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD7.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD8.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temp\ICD9.tmp\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DQ3GTU7\SysProtectScannerInstall[1].cab/USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\0DQ3GTU7\SysProtectScannerInstall[1].exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.10\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.11\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.12\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.13\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.14\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.15\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.16\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.17\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.18\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.19\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.1\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.1\USYP_0001_N76M2004NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.2\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.2\USYP_0001_N76M2004NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.3\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.4\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.5\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.6\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.7\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.8\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.9\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\USYP_0001_N76M1005NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\USYP_0001_N76M2004NetInstaller.exe -> Downloader.Small : Cleaned with backup (quarantined).
C:\WINNT\system32\dhcp\spoolsvc.exe -> Not-A-Virus.HackTool.Win32.Clearlog : Cleaned with backup (quarantined).
C:\WINNT\system32\dllcache\etc\spoolsvc.exe -> Not-A-Virus.HackTool.Win32.Clearlog : Cleaned with backup (quarantined).
C:\WINNT\Temp\psexec.exe -> Not-A-Virus.NetTool.Win32.RemoteStartProcess.a : Cleaned with backup (quarantined).
:mozilla.12:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.13:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\WINNT\Temp\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.31:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup (quarantined).
:mozilla.132:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
:mozilla.133:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup (quarantined).
:mozilla.150:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
:mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
:mozilla.47:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).
:mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.23:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.25:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
:mozilla.156:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
:mozilla.157:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined).
:mozilla.32:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.33:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.34:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.35:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
:mozilla.100:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.101:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
:mozilla.102:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
C:\WINNT\Temp\Cookies\administrator@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
:mozilla.53:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.54:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.55:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup (quarantined).
:mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.29:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
:mozilla.114:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
:mozilla.115:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.116:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
:mozilla.137:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\WINNT\Temp\Cookies\administrator@login.tracking101[1].txt -> TrackingCookie.Tracking101 : Cleaned with backup (quarantined).
:mozilla.120:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.121:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.122:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.123:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.124:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.125:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup (quarantined).
:mozilla.126:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup (quarantined).
:mozilla.127:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.128:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.135:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\Documents and Settings\Administrator\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\WINNT\Temp\Cookies\administrator@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\USYP_0001_N69M1703NetInstaller.exe -> Trojan.Fakealert : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe -> Trojan.Patched.B : Cleaned with backup (quarantined).


::Report end
ncident Status Location

Potentially unwanted tool:application/sysprotect Not disinfected c:\winnt\system32\drivers\sscan.sys
Adware:adware/wupd Not disinfected Windows Registry
Adware:adware/dyfuca Not disinfected Windows Registry
Spyware:spyware/virtumonde Not disinfected Windows Registry
Adware:adware/ncase Not disinfected Windows Registry
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\pulemost.default\cookies.txt[.go.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
Virus:W32/Gaobot.batch Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\r.bat
Virus:W32/Sdbot.BUV.worm Disinfected C:\MSsrvs32.exe
Potentially unwanted tool:Application/ServUBased.A Not disinfected C:\WINNT\system32\dllcache\etc\runbatch.exe
Spyware:Cookie/Belnk Not disinfected C:\WINNT\Temp\Cookies\administrator@belnk[1].txt
Spyware:Cookie/WinFixer Not disinfected C:\WINNT\Temp\Cookies\administrator@winfixer[2].txt

I couldn't start Ewido in safe mode so here is the report after running it in normal mode. Thank you for your help.

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.
Save it to your desktop.

Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat. Please save it on your desktop.

Quote:@echo off
sc stop TskScheduler
sc delete TskScheduler
exit
Double click FixServices.bat. A window will open and close. This is normal.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below (if present).

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/yme/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/yme/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: c:\windows\drivers\ias\f uck.bat
O4 - HKLM\..\Run: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\~2.EXE
O4 - HKLM\..\Run: Explorer .exe
O4 - HKLM\..\Run: service.exe
O4 - HKLM\..\Run: C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\RunServices: Explorer .exe
O4 - HKLM\..\RunServices: service.exe
O4 - HKCU\..\Run: C:\Winnt\litmus\SVCHOST32.exe
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/sysprotect.com/scanner/pages/scanner/SysProtectScannerInstall.cab
O20 - Winlogon Notify: CLSID - C:\Winnt\
O23 - Service: TskScheduler - Unknown owner - C:\Winnt\taskshed.exe (file missing)

Now close all windows other than HiJackThis, then click Fix Checked. close HijackThis.

• Please double-click Killbox.exe to run it.
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• 
  c:\winnt\system32\drivers\sscan.sys
  C:\Documents and Settings\Administrator\Local Settings\Temp\r.bat
  C:\MSsrvs32.exe
  C:\WINNT\system32\dllcache\etc\runbatch.exe
  C:\Winnt\litmus\SVCHOST32.exe
  C:\Winnt\taskshed.exe
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\~2.EXE
  c:\windows\drivers\ias\f uck.bat
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• 
  
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

After reboot

We need to do a search. Start | Search | For Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:

service.exe
If any of these files are found please delete them.

We need to do a search. Start | Search | For Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:

Explorer .exe notice that there is a space after Explorer and before the .
If any of these files are found please delete them. IMPORTANT!: Do not delete the legitimate Explorer.exe which resides in C:\WinNT\

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.
  

If you use Firefox browser

• Click Firefox at the top and choose: Select AllClick the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser

• Click Opera at the top and choose: Select AllClick the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program.For Technical Support, double-click the e-mail address located at the bottom of each menu.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• 
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:

• Extended (if available otherwise Standard)

• Scan Options:

• Scan ArchivesScan Mail Bases
  

• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.
• 
  In your next post, please include
  • new hijackthis log
  • kaspersky log

  Message Edited by agrarianmonk on 07-03-200606:38 AM

  Message Edited by agrarianmonk on 07-03-200606:38 AM

I am on the wrong board, but can not find anything concerning Crystal Report Viewers. I have to get on secure site for certain reports that use Crystal Viewer Reports. I use Windows XP Home Edition and IE 6.0.
When Crystal Viewer loads I get this message needing IE 4.0 and Windows 98. How can I work around this problem?