Yet41

I'm having lots of terrible problems with adware. I've had lots of popups for loadingwebsite.com and various other popups for spyware and adware removal. In addition, various programs continue to install themselves (such as virtual bouncer) and icons for online sites appear on my desktop. I can delete and uninstall them, but they eventually come back!

I've run spybot and ad-aware several times. They do find things (mostly ezula stuff), but removing them doesn't seem to help. I'm also running symantec virus scanner and it is constantly finding stuff for ezula and something called QoolAid (the file it finds is kapmjn.exe, for which I cannot find any info online). Below is my HijackThis log. By the way, I am running all of this in safe mode.

I appreciate any assistance!



Logfile of HijackThis v1.99.1
Scan saved at 2:35:05 PM, on 6/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\kapmjn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [tsvcin] C:\Documents and Settings\Administrator\n20050308.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [checkrun] c:\windows\system32\eliteami32.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\kapmjn.exe reg_run
O4 - HKCU\..\Run: [HP Mobile Printing] C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fA0FRjMFj] isi0_32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100977434301
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\cymaddin.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

sUBs

Hi and Welcome to TSF!

Here's what you can do....

Please subscribe to this thread so you'll be notified as soon as we post your fix. To do this, please click here. On the proceeding page, make sure Instant notification by email is selected, then click Add subscription.

In the meanwhile, I suggest that you stop using Interent Explorer until we've fully disinfected your machine. Please download & use an alternative browser like Firefox.

After reviewing your log I found a few items that requires our attention.
I just want to warn you up front that you've multiple infections here & we have a big fight ahead. So, please be prepared for this to take a couple of rounds. There's a fair bit of work to do & I require your assistance & patience.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

During the course of disinfection, I may ask you to fix a program that you wish to retain. Please post back to inform me.


Enable the viewing of Hidden files

Windows XP/2000

Go to My Computer > Tools > Folder Options > View tab & ensure that the following are enabled;

• Show hidden files and folders.
• Display the contents of system folders
• Uncheck the Hide protected operating system files option.

~~~~~~~~~~~~~~~

Download ETRemover_v130.zip & UNZIP the contents into a folder on Desktop.

1. From that folder, click on ETRemover_v130.exe
2. Click "About" >> "check for updates".
3. After it has updated itself, close that program. We'll run it later

Download & install CleanUp!. We'll run it later

Download KillBox v2.0.0.175 & save to desktop

Download rkfiles.zip and unzip the contents to a new folder on your desktop.

Download the remv3.zip at http://forums.skads.org/index.php?showtopic=80 (look for the attachment to download). Make a new folder on the root drive C:\ and unzip remv3.zip files into it.


~~~~~~~~~~~~~~~

Reboot to Safe Mode

1. Shut Windows down, and then turn off the computer.
2. Restart the computer. The computer begins processing a set of instructions known as the Basic Input/Output System (BIOS). What is displayed depends on the BIOS manufacturer. Some computers display a progress bar that refers to the word BIOS, while others may not display any indication that this process is happening.
3. As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard. Continue to do so until the
   Windows Advanced Options menu appears.
4. Using the arrow keys on the keyboard, scroll to and select the Safe mode menu item, and then press Enter.

~~~~~~~~~~~~~~~

Run ETRemover_v130.exe, then click the "Kill Elite Toolbar" button and wait until it finishes its work.

* Occasionally a DOS box may appear asking your permission to delete some files in temporary Windows directories. You must accept the deletion of these to be sure of properly removing the malware!


~~~~~~~~~~~~~~~

Go into HijackThis > Config > Misc.Tools > Open process manager. Select the following and click "Kill process"” for each one. Some entries may no longer exist. You must kill them one at a time.

C:\WINDOWS\system32\kapmjn.exe


~~~~~~~~~~~~~~~

Go to Windows Control Panel > Add/Remove Programs and uninstall the following programs:

AFA Internet Enhancement


~~~~~~~~~~~~~~~

Close all other windows & Run HiJackThis and click "Scan", then check(tick) the following, if present:

O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\system32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [C:\WINDOWS\VCMnet11.exe] C:\WINDOWS\VCMnet11.exe
O4 - HKLM\..\Run: [tsvcin] C:\Documents and Settings\Administrator\n20050308.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [checkrun] c:\windows\system32\eliteami32.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\kapmjn.exe reg_run
O4 - HKCU\..\Run: [fA0FRjMFj] isi0_32.exe
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\cymaddin.dll

Click "Fix checked" for HJT to fix them


~~~~~~~~~~~~~~~

Using KillBox


Copy to clipboard, all the items below by highlighting them & pressing [CTRL]+[C] on your keyboard.

C:\WINDOWS\system32\PSof1.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\cfgmgr52.dll,DllRun
C:\WINDOWS\VCMnet11.exe
C:\Documents and Settings\Administrator\n20050308.EXE
C:\WINDOWS\system32\vidctrl\vidctrl.exe
c:\windows\system32\eliteami32.exe
C:\WINDOWS\system32\kapmjn.exe reg_run
C:\WINDOWS\system32\cymaddin.dll

• Start KillBox.
• Go to the File menu, and choose "Paste from Clipboard".
  Verify that you've done this properly by clicking the dropdown-arrow next to the "Full Path of File to Delete" field. The filenames you pasted will be found in there.
• Select "Delete on Reboot", "End Explorer Shell While Killing File" & "Unregister.dll Before Deleting" if it's not grayed out.
• Click the RED-and-white "Delete File" button.
• Click "Yes" at the 'Delete on Reboot' prompt. Click "NO" at the Pending Operations prompt.

* If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again.


~~~~~~~~~~~~~~~

Search for & delete ... using "Start>Search..." the following file(s), if present:

• isi0_32.exe

~~~~~~~~~~~~~~~

Run CleanUp!...Click "Yes" when asked to logoff.

Reboot your computer into Safe Mode AGAIN


~~~~~~~~~~~~~~~

Double click rkfiles.bat file to run it. It will scan for a while, so please be patient. Wait until the DOS window closes. Open the C:\log.txt it created and rename it log1.txt.

Now open the folder where you saved remv3.zip files and double click the rem.bat file and let it run. It will delete the files and remove the infection and then make a log of the files it finds. The log file will be C:\log.txt and bad1.txt

**Note** Each tool uses log.txt as it’s output file so make sure you save the entries from one tools log before running the other as it will overwrite the file if you don’t.

Post the contents of both the log.txt and log1.txt in your next post


~~~~~~~~~~~~~~~


Reboot to Normal Mode.

Run a new HijackThis scan. Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in your next reply.

In your next post, please include:

• Copy of KRC HijackThis Analyzer log
• Remv3 & rkfiles logs

Yet41

I have completed every step. It is worth noting that in addition to still receiving pop-ups, I'm getting an error after logging on. The error is from RUNDLL and the message is " An exception occurred while trying to run ""C:\WINDOWS\system32\wCssl.dll",DllGetVersion" "

Here are the logs you asked for. Also note that bad1.txt was blank.

Thank you very much!


====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 6/3/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 8:43:16 PM, on 6/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [HP Mobile Printing] C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100977434301
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\en6ul1j91.dll
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


End of KRC HijackThis Analyzer Log.
====================================================================






C:\Documents and Settings\Administrator\Desktop\RKfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213

Files Found in all users startup Folder............
------------------------
Files Found in all users windows Folder............
------------------------
C:\WINDOWS\icont.exe: UPX!
Finished
bye








The batch is run from -- C:\remv3

Files Found.................
----------------------------------------

Files Not deleted.................
----------------------------------------

Merging registry entries
-----------------------------------------------------------------
The Registry Entries Found...
-----------------------------------------------------------------


Other bad files to be Manually deleted.. Please note that this might also list legit Files, be careful while deleting
-----------------------------------------------------------------
Volume in drive C has no label.
Volume Serial Number is 7BA8-BD8C

Directory of C:\WINDOWS\system32

msi.dll
Finished

jgvernonco

Greetings,

Download KillBox http://www.greyknight17.com/spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - choose NO when it asks if you want to reboot):

C:\WINDOWS\system32\en6ul1j91.dll

Now, find that dll in your system 32 folder and delete it.

Reboot.

Please empty any Quarantine folder in your antivirus program and purge all recovery items in the Spybot program (if you use it) before running this tool.

Download the Mwav virus checker at http://www.mwti.net/antivirus/mwav.asp (Use Link 3)

1. Save it to a folder.
2. Reboot into Safe Mode.
3. Double click the Mwav.exe file. This is a stand alone tool and NOT just a virus checker......so it won't install anything.
4. Select all local drives, scan all files, and press SCAN. When it is completed, anything found will be displayed in the lower pane.
5. In the Virus Log Information Pane......
Left click and highlight all the information in the Lower pane --- Use &CTRL C &on your keyboard to copy everything found in the lower pane and save it to a notepad file
*Note* If prompted that a virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning. We are not going to use this to remove anything...but to ID the bad files.

Once you copy that to a Notepad file...highlight the text and copy it here.

Yet41

I looked for C:\WINDOWS\system32\en6ul1j91.dll but it wasn't there. I still had Killbox do its thing. Here's the log from mwav. I cleared the quarantines but for some reason a quarantined virus still showed up from Symantec.

Thank you as always!




File C:\WINDOWS\system32\guard.tmp tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\guard.tmp tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1bdd1c37-7b13-790c-8266-422470b28b88}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1ccc1e32-5212-7e00-8569-402d78b18c82}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5EDB03AF-0341-4e96-9E9B-3171522E4BAF}" refers to invalid object "c:\Program Files\Fla\fla.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6edda8cd-2906-4a90-b122-cc36b8f3de86}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{82993a43-5261-a844-c3dd-e86a70905372}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{c155710a-d7f2-41e0-b5df-d8a907ac2b88}" refers to invalid object "C:\WINDOWS\system32\rksnw.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79304-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79305-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79306-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79307-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

File C:\WINDOWS\icont.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.

File C:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.

File C:\WINDOWS\system32\btnetw3_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nsh3.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.

File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe tagged as "not-a-virus:AdWare.MediaTickets.n". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\avalanche.jar-452050e9-1e06afc0.zip tagged as not-a-virus:Garbage.Java.FormURLToy. No Action Taken.

File C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe tagged as "not-a-virus:AdWare.MediaTickets.n". Action Taken: No Action Taken.

File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08D80000.VBN infected by "Trojan-Downloader.Win32.Agent.jt" Virus! Action Taken: No Action Taken.

File C:\WINDOWS\icont.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.

File C:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.

File C:\WINDOWS\system32\btnetw3_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nsh3.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.

MicroBell

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log and another mwav log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Yet41

Things seem to be running pretty smoothly now. I haven't had a popup since running l2mfix.exe. Below are the logs from l2mfix, mwav, and hjt (with analyzer).

Thank you much!



L2Mfix 1.03

Running From:
C:\Documents and Settings\Administrator\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Administrator\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Administrator\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1952 'explorer.exe'
Killing PID 1952 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 2012 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\fplq0335e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jkpl400.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mtcertui.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\fplq0335e.dll
Successfully Deleted: C:\WINDOWS\system32\fplq0335e.dll
deleting: C:\WINDOWS\system32\jkpl400.dll
Successfully Deleted: C:\WINDOWS\system32\jkpl400.dll
deleting: C:\WINDOWS\system32\mtcertui.dll
Successfully Deleted: C:\WINDOWS\system32\mtcertui.dll


Zipping up files for submission:
adding: fplq0335e.dll (104 bytes security) (deflated 5%)
adding: jkpl400.dll (104 bytes security) (deflated 5%)
adding: mtcertui.dll (104 bytes security) (deflated 5%)
adding: clear.reg (104 bytes security) (deflated 37%)
adding: echo.reg (104 bytes security) (deflated 10%)
adding: direct.txt (104 bytes security) (stored 0%)
adding: lo2.txt (104 bytes security) (deflated 76%)
adding: readme.txt (104 bytes security) (deflated 49%)
adding: test.txt (104 bytes security) (deflated 48%)
adding: test2.txt (104 bytes security) (deflated 18%)
adding: test3.txt (104 bytes security) (deflated 18%)
adding: test5.txt (104 bytes security) (deflated 18%)
adding: xfind.txt (104 bytes security) (deflated 43%)
adding: backregs/7E6B71C9-13ED-463C-B47C-773330CC1BBE.reg (104 bytes security) (deflated 70%)
adding: backregs/F473B43F-B7BF-4528-ACB0-E47642A7010C.reg (104 bytes security) (deflated 70%)
adding: backregs/shell.reg (104 bytes security) (deflated 74%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: fplq0335e.dll
deleting local copy: jkpl400.dll
deleting local copy: mtcertui.dll

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\fplq0335e.dll
C:\WINDOWS\system32\jkpl400.dll
C:\WINDOWS\system32\mtcertui.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F473B43F-B7BF-4528-ACB0-E47642A7010C}"=-
"{7E6B71C9-13ED-463C-B47C-773330CC1BBE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{F473B43F-B7BF-4528-ACB0-E47642A7010C}]
[-HKEY_CLASSES_ROOT\CLSID\{7E6B71C9-13ED-463C-B47C-773330CC1BBE}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************



Log from mwav:


File C:\Documents and Settings\Administrator\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\Process.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1bdd1c37-7b13-790c-8266-422470b28b88}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1ccc1e32-5212-7e00-8569-402d78b18c82}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5EDB03AF-0341-4e96-9E9B-3171522E4BAF}" refers to invalid object "c:\Program Files\Fla\fla.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6edda8cd-2906-4a90-b122-cc36b8f3de86}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{82993a43-5261-a844-c3dd-e86a70905372}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{c155710a-d7f2-41e0-b5df-d8a907ac2b88}" refers to invalid object "C:\WINDOWS\system32\rksnw.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79304-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79305-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79306-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79307-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

File C:\WINDOWS\icont.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.

File C:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.

File C:\WINDOWS\system32\btnetw3_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nsh3.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.

File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe tagged as "not-a-virus:AdWare.MediaTickets.n". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4cdin9c0.default\Cache\35897D89d01 tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

File C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\avalanche.jar-452050e9-1e06afc0.zip tagged as not-a-virus:Garbage.Java.FormURLToy. No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\Process.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

File C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe tagged as "not-a-virus:AdWare.MediaTickets.n". Action Taken: No Action Taken.

File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08D80000.VBN infected by "Trojan-Downloader.Win32.Agent.jt" Virus! Action Taken: No Action Taken.

File C:\RECYCLER\S-1-5-21-1061524178-2551108048-4016785435-500\Dc1.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

File C:\WINDOWS\icont.exe tagged as "not-a-virus:AdWare.AdURL.c". Action Taken: No Action Taken.

File C:\WINDOWS\system32\bsva-egihsg52.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.

File C:\WINDOWS\system32\btnetw3_venturahot_246765.exe tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nsh3.dll tagged as "not-a-virus:AdWare.ToolBar.HotSearchBar.i". Action Taken: No Action Taken.

File C:\WINDOWS\system32\weirdontheweb_ventura.exe tagged as "not-a-virus:AdWare.WeirWeb.b". Action Taken: No Action Taken.





====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 6/3/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 7:11:59 PM, on 6/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
C:\Program Files\saar\elat.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKCU\..\Run: [HP Mobile Printing] C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
O4 - HKCU\..\Run: [Lerm] C:\Program Files\saar\elat.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100977434301
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


End of KRC HijackThis Analyzer Log.
====================================================================

jgvernonco

Greetings,

Download KillBox http://www.greyknight17.com/spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. For each of the following files below, check the box that says 'Unregister .dll Before Deleting' if it's not grayed out. Copy and paste each of the following into KillBox (hitting the X button for each file - choose NO when it asks if you want to reboot):

C:\WINDOWS\icont.exe
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\btnetw3_venturahot_246765.exe
C:\WINDOWS\system32\nsh3.dl
C:\WINDOWS\system32\weirdontheweb_ventura.exe

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe

C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4cdin9c0.default\Cac he\35897D89d01

C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ava lanche.jar-452050e9-1e06afc0.zip

C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\XKYZB8VC\OiUninstaller[1].exe

C:\RECYCLER\S-1-5-21-1061524178-2551108048-4016785435-500\Dc1.exe

C:\WINDOWS\icont.exe

C:\WINDOWS\system32\bsva-egihsg52.exe

C:\WINDOWS\system32\btnetw3_venturahot_246765.exe

C:\WINDOWS\system32\nsh3.dll

C:\WINDOWS\system32\weirdontheweb_ventura.exe

Reboot.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknight17.com/spy/Cleanup.exe ) and install it. Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Please give us a new mwave log and a new HJT log.

Thanks!

Yet41

Okay, I did everything. Here are my logs

Thank you!



Mwav:

File C:\Documents and Settings\Administrator\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\Process.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\DS3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1bdd1c37-7b13-790c-8266-422470b28b88}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{1ccc1e32-5212-7e00-8569-402d78b18c82}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{5EDB03AF-0341-4e96-9E9B-3171522E4BAF}" refers to invalid object "c:\Program Files\Fla\fla.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{6edda8cd-2906-4a90-b122-cc36b8f3de86}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{82993a43-5261-a844-c3dd-e86a70905372}" refers to invalid object "C:\WINDOWS\inscdm\qsbgfxhind.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9ADE0443-2AB2-4B23-A3F8-AC520773DE12}" refers to invalid object "C:\WINDOWS\system32\nsh3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BC54B24C-5A97-4C19-9181-8B8A05B2E931}" refers to invalid object "C:\WINDOWS\system32\nsh3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{BD9584EF-C28C-4F6D-8D49-0CEE3C0E442F}" refers to invalid object "C:\WINDOWS\system32\nsh3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{c155710a-d7f2-41e0-b5df-d8a907ac2b88}" refers to invalid object "C:\WINDOWS\system32\rksnw.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{C7888681-1A83-4C14-B9A5-95F91240B44F}" refers to invalid object "C:\WINDOWS\system32\nsh3.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79304-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79305-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79306-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{E0D79307-84BE-11CE-9641-444553540000}" refers to invalid object "D:\CD_VOL3\WINZIP\WINZIP~5\WZSHLSTB.DLL". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.

Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\avalanche.jar-452050e9-1e06afc0.zip tagged as not-a-virus:Garbage.Java.FormURLToy. No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ab". Action Taken: No Action Taken.

File C:\Documents and Settings\Administrator\Desktop\l2mfix\Process.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.

File C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08D80000.VBN infected by "Trojan-Downloader.Win32.Agent.jt" Virus! Action Taken: No Action Taken.





====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 6/3/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 1:15:45 AM, on 6/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
C:\Program Files\saar\elat.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKCU\..\Run: [HP Mobile Printing] C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
O4 - HKCU\..\Run: [Lerm] C:\Program Files\saar\elat.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100977434301
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


End of KRC HijackThis Analyzer Log.
====================================================================

sUBs

We have finish using the L2Mfix utility. Please delete the folder - L2Mfix located on your Desktop.

Start Firefox & go to Tools>Options>Privacy - Click on the "Clear All" button & then click "OK". This will clear Firefox's cache of all the malware found in there.

I see no anti-virus application installed on this machine. An anti-virus application is your first line of defense against infections. Without one you leave your computer completely vulnerable to every virus, spyware program, trojan and piece of malware that is floating around out there today. I urge you to install an anti-virus program as quickly as possible. Here are 3 free programs that are available for home use:

• AVG Anti-Virus
• Avast Home Edition
• BitDefender Free Edition v7

~~~~~~~~~~~~~~~

Start HiJackThis & go to Config>Misc Tools>Open process manager.
Select the following and click "Kill process"” one at a time. Some entries may no longer exist.

• C:\Program Files\saar\elat.exe

~~~~~~~~~~~~~~~

Run a scan with HiJackThis & select(tick) the following & click "Fix checked" :

O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKCU\..\Run: [Lerm] C:\Program Files\saar\elat.exe


~~~~~~~~~~~~~~~

1. Run KillBox. Paste the following locations into KillBox one at a time :
   • C:\program files\tvs\tvs_b.exe
     C:\Program Files\saar\elat.exe
2. Checkmark the following boxes :
   • Delete on Reboot
   • End Explorer Shell While Killing File
   • Unregister DLL (If available)
3. Click the RED X button and
   • Answer "YES" when asked to confirm file deletion
   • Answer "NO" when prompted to reboot now
4. Proceed with the next file by repeating the above steps.
5. Once you get to the last entry, click "YES" when prompted to reboot.

~~~~~~~~~~~~~~~

After your computer has rebooted, Locate and delete the following folder(s), if present:

• C:\program files\tvs\
  C:\Program Files\saar\

Run Cleanup! - Answer "Yes" when asked to logoff.


Do an online scan at one of the following sites:

• Panda
• BitDefender
• Trend Micro
• RAV Antivirus
• McAfee

Take note the names and locations of any file it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan


Reboot Again & Run a new scan with HiJackThis. Save the log file and run KRC HiJackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in your next reply.

In your next post, please include:

• Copy of KRC HiJackThis Analyzer log
• List of files that online scans failed to disinfect

Please provide details of any problems you encountered whilst performing the above steps.

Yet41

I've been running Symantec AntiVirus with auto protect. I have followed all of your instructions and used Panda (with Symantec auto protect off). It found no problems. I've had no more pop-ups and I hope everything is finally off. Please let me know if you think anything else needs removed.

I appreciate everybody's help!


====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 6/3/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 6:37:41 PM, on 6/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
C:\AdwareStuff\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKCU\..\Run: [HP Mobile Printing] C:\Program Files\Hewlett-Packard\HP Mobile Printing\HPBMOBIL.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1100977434301
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


End of KRC HijackThis Analyzer Log.
====================================================================

MicroBell

Your log is clean. Any more issues? IF not...you should be set. Please disable system restore and then re-enable it. This will clear the infection out of the restore folder.

Please read through the spyware prevention section on how to protect yourself from spyware/adware Here and use the recommend programs and methods to protect yourself!