HJT log

[simplejonny]

hey, this is my first time asking for help this way, but i've broken down.
i have a few issues and i'm not sure if they're all connected or not, but here they are...

i have a recurring virus that my windows will warn me of and my avg antivirus tells me is a trojan star page virus. the file is se.dll and is in doc+settings/admin/temp. cleaning my system with ad-aware, avg and cwshredder removes it, but it comes back.

i don't know if this file is connected to cws or not, but i do know i have a version of cws that could only be found by the newest update of cwshredder, and even when i do that, it comes back.

finally, two seperate items that i am concerned about:
1) avgamsvr.exe is using a LARGE amount of system memory when i look at my task manager. and
2) when i boot i am told i have an invalid boot.ini file and that the system will boot from winnt.

in my quest to rid myself of cws and whatever se.dll is i have followed the instructions laid out <a href="http://www.greyknight17.com/spyware.htm">here</a>, and on top of that have run my avg at least once in the last 24 hours. so here is my result from running hjt and the KRC hijack this analyzer in the hope that some of my questions can be answered. any help (with any of my problems if they are not all related) would be very greatly appreciated.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 7:30:05 PM, on 27/02/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\SVA Player\SVAPLAYER.EXE
C:\Program Files\LiveJournal\LiveJournal.exe
C:\Documents and Settings\Administrator\Desktop\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.livejournal.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINNT\System32\wucrtupd.exe -startup
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [SVAPlayer] C:\Program Files\SVA Player\SVAPLAYER.EXE
O4 - HKLM\..\Run: [DMASwitch] C:\Program Files\CyberLink\PowerDVD\CLDMA.EXE 1 1
O4 - HKLM\..\Run: [WordPerfect Office 1115] C:\Program Files\Common Files\Corel\Registration\EN\Registration.exe /title="WordPerfect Office 11" /date=040204 serial=WS11WTD-9999998-BHS
O4 - HKLM\..\Run: [hhnt] C:\WINNT\hhnt.exe
O4 - HKLM\..\Run: [TsH4G.exe] C:\documents and settings\administrator\local settings\temp\TsH4G.exe
O4 - HKLM\..\Run: [o7mg39l] mshwiz.exe
O4 - HKLM\..\Run: [Network Security Guard] C:\WINNT\System32\sg5e0ttrdy8v.exe
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe
O4 - HKCU\..\Run: [ntnt] C:\WINNT\ntnt.exe
O4 - HKCU\..\Run: [syor] C:\WINNT\system32\syor.exe
O4 - HKCU\..\Run: [64sy64] C:\WINNT\system32\64sy64.exe
O4 - HKCU\..\Run: [3264] C:\WINNT\system32\3264.exe
O4 - HKCU\..\Run: [or3264] C:\WINNT\system32\or3264.exe
O4 - HKCU\..\Run: [orPE3232PE] C:\WINNT\system32\orPE3232PE.exe
O4 - HKCU\..\Run: [s-nts-mshh] C:\WINNT\system32\s-nts-mshh.exe
O4 - HKCU\..\Run: [ors-] C:\WINNT\ors-.exe
O4 - HKCU\..\Run: [PEs-mssy] C:\WINNT\PEs-mssy.exe
O4 - HKCU\..\Run: [sysysy] C:\WINNT\sysysy.exe
O4 - HKCU\..\Run: [32hhhhnt] C:\WINNT\32hhhhnt.exe
O4 - HKCU\..\Run: [or32nt] C:\WINNT\system32\or32nt.exe
O4 - HKCU\..\Run: [or32] C:\WINNT\or32.exe
O4 - HKCU\..\Run: [orms3232ms] C:\WINNT\orms3232ms.exe
O4 - HKCU\..\Run: [ms32ornt32] C:\WINNT\ms32ornt32.exe
O4 - HKCU\..\Run: [s-SP] C:\WINNT\system32\s-SP.exe
O4 - HKCU\..\Run: [hh64sySP] C:\WINNT\hh64sySP.exe
O4 - HKCU\..\Run: [PEnt64] C:\WINNT\PEnt64.exe
O4 - HKCU\..\Run: [32hhororSP] C:\WINNT\system32\32hhororSP.exe
O4 - HKCU\..\Run: [hhnt] C:\WINNT\hhnt.exe
O4 - Startup: LiveJournal.lnk = C:\Program Files\LiveJournal\LiveJournal.exe
O8 - Extra context menu item: LimeShop Preferences - file://c:\Program Files\topMoxie\TEMP\limeshop_script.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Q8276112.exe
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...yiebio4023.cab
O19 - User stylesheet: (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\winnt\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (file missing)


End of KRC HijackThis Analyzer Log.
====================================================================

[palguy]

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p

Please be patient with me during this time.
__________________

...A Reflection On Spyware...

Mr. Incredible: No matter how many times you save the world, it always manages to get back in jeopardy again. Sometimes I just want it to stay saved! You know, for a little bit? I feel like the maid; "I just cleaned up this mess! Can we keep it clean for... for ten minutes!"

...greyknight17 DOT com...

[simplejonny]

hey palguy, thanks for the welcome.
i am so thankful for your help and am patiently waiting your response.

[palguy]

I have put together a response and am awaiting approval from an analyst. I will post as soon as I get it.

[palguy]

Hello simplejonny and welcome to TSF

Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions.

I noticed you are running two anti-virus programs at the same time. They may be conflicting with each other and you should decide which you want to run and uninstall the other one.

If you have a fast internet connection (Broadband), run an online scan at Trend Micro or RAV Antivirus.
Please select the “autoclean” option when using Trend Micro.

To turn off System Restore Click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives". Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link don't work) and install it. Do not run yet.

Download CWShredder and click on 'Fix' (it will automatically fix anything it finds for you). If it asks if you want to delete a certain random file, choose No and post that filename here.

Please download Ad-aware SE and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Also go here to get the plug-in for fixing VX2 variants. To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner. Then click Run Tool and OK to start it. If it's clean, it will say Status System Clean. Otherwise, you will have to click on the Clean button to remove the VX2 infection. Also make sure to customize the settings in Ad-aware for better scan results. Run the scan and fix everything that it finds.

Download and install Spybot S&D if you don't have it already. Run Spybot and click on the 'Search for Updates' button. Install any updates that are available. Next click on the 'Check for Problems' button. Let it run the scan. If it finds something, check all those in RED and hit the Fix Selected Problems button. Exit Spybot. If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix and install it over the current Spybot installation.


Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

Go into Hijack This->Config->Misc. Tools->Open process manager. Select the following and click “Kill process” for each one (You must kill them one at a time).

C:\Program Files\SVA Player\SVAPLAYER.EXE

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:

SVA Player
topMoxie

Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O4 - HKLM\..\Run: [SVAPlayer] C:\Program Files\SVA Player\SVAPLAYER.EXE
O4 - HKLM\..\Run: [hhnt] C:\WINNT\hhnt.exe
O4 - HKLM\..\Run: [TsH4G.exe] C:\documents and settings\administrator\local settings\temp\TsH4G.exe
O4 - HKLM\..\Run: [o7mg39l] mshwiz.exe
O4 - HKLM\..\Run: [Network Security Guard] C:\WINNT\System32\sg5e0ttrdy8v.exe
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe
O4 - HKCU\..\Run: [ntnt] C:\WINNT\ntnt.exe
O4 - HKCU\..\Run: [syor] C:\WINNT\system32\syor.exe
O4 - HKCU\..\Run: [64sy64] C:\WINNT\system32\64sy64.exe
O4 - HKCU\..\Run: [3264] C:\WINNT\system32\3264.exe
O4 - HKCU\..\Run: [or3264] C:\WINNT\system32\or3264.exe
O4 - HKCU\..\Run: [orPE3232PE] C:\WINNT\system32\orPE3232PE.exe
O4 - HKCU\..\Run: [s-nts-mshh] C:\WINNT\system32\s-nts-mshh.exe
O4 - HKCU\..\Run: [ors-] C:\WINNT\ors-.exe
O4 - HKCU\..\Run: [PEs-mssy] C:\WINNT\PEs-mssy.exe
O4 - HKCU\..\Run: [sysysy] C:\WINNT\sysysy.exe
O4 - HKCU\..\Run: [32hhhhnt] C:\WINNT\32hhhhnt.exe
O4 - HKCU\..\Run: [or32nt] C:\WINNT\system32\or32nt.exe
O4 - HKCU\..\Run: [or32] C:\WINNT\or32.exe
O4 - HKCU\..\Run: [orms3232ms] C:\WINNT\orms3232ms.exe
O4 - HKCU\..\Run: [ms32ornt32] C:\WINNT\ms32ornt32.exe
O4 - HKCU\..\Run: [s-SP] C:\WINNT\system32\s-SP.exe
O4 - HKCU\..\Run: [hh64sySP] C:\WINNT\hh64sySP.exe
O4 - HKCU\..\Run: [PEnt64] C:\WINNT\PEnt64.exe
O4 - HKCU\..\Run: [32hhororSP] C:\WINNT\system32\32hhororSP.exe
O4 - HKCU\..\Run: [hhnt] C:\WINNT\hhnt.exe
O8 - Extra context menu item: LimeShop Preferences - file://c:\Program Files\topMoxie\TEMP\limeshop_script.htm
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Q8276112.exe
O19 - User stylesheet: (file missing)


Please remember to close all other windows, including browsers then click Fix checked.

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\Program Files\SVA Player
c:\Program Files\topMoxie
C:\WINNT\hhnt.exe
C:\documents and settings\administrator\local settings\temp\TsH4G.exe
C:\WINNT\System32\sg5e0ttrdy8v.exe
C:\WINNT\system32\winmm64.exe
C:\WINNT\ntnt.exe
C:\WINNT\system32\syor.exe
C:\WINNT\system32\64sy64.exe
C:\WINNT\system32\3264.exe
C:\WINNT\system32\or3264.exe
C:\WINNT\system32\orPE3232PE.exe
C:\WINNT\system32\s-nts-mshh.exe
C:\WINNT\ors-.exe
C:\WINNT\PEs-mssy.exe
C:\WINNT\sysysy.exe
C:\WINNT\32hhhhnt.exe
C:\WINNT\system32\or32nt.exe
C:\WINNT\or32.exe
C:\WINNT\orms3232ms.exe
C:\WINNT\ms32ornt32.exe
C:\WINNT\system32\s-SP.exe
C:\WINNT\hh64sySP.exe
C:\WINNT\PEnt64.exe
C:\WINNT\system32\32hhororSP.exe
mshwiz.exe--->You will need to search for and delete this file

Run CleanUp! now and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Reboot into Normal Mode and run new HijackThis scan. If there were some entries that didn't show up in Safe Mode, you may check and fix those that appear now in normal mode (if you do that, make sure to run a new scan again). Save the log file and run KRC HijackThis Analyzer in the same folder to get the result.txt log. Just post the contents of the result.txt file in the forum.

[simplejonny]

thanks for all your help palguy!
i just finished doing everything you said and there were a few little things i noted along the way that i thought i'd tell you about.
-first things first, i wasn't paying full attention at first (i just woke up and no coffee yet) and i ran cleanup! at the beginning, i hope that isn't a problem.
-i could not uninstall my norton anti-virus, any tips on that?
- i couldn't get either of the online virus checkers to run. rav will only do files selected and trend micro wouldn't run on my firefox and when i tried to run it in ie it kept shutting down.
-svaplayer wasn't running when i booted in safe mode and went to end the process.
-svaplayer/topmoxie were not in the add/remove
- all files in the list to be deleted at the end were not present. i assume this is a good thing, but just thought i would note it.

so yeah, these were just things that stuck out to me along the way, thought you might be able to give an explanation or know if these signal problems or not. i'm off to post my other result as a new topic. i hope everything worked out!

thanks again!

[simplejonny]

hello, with <a/ href="http://www.techsupportforum.com/showthread.php?t=41222?the help of palguy</a> i just, hopefully, cleaned up my computer, so i am posting my new hjt results here for analyzing. i hope i'm clean!
thanks for all the help!

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 12:05:54 PM, on 28/02/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\LiveJournal\LiveJournal.exe
C:\Documents and Settings\Administrator\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.livejournal.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINNT\System32\wucrtupd.exe -startup
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [DMASwitch] C:\Program Files\CyberLink\PowerDVD\CLDMA.EXE 1 1
O4 - HKLM\..\Run: [WordPerfect Office 1115] C:\Program Files\Common Files\Corel\Registration\EN\Registration.exe /title="WordPerfect Office 11" /date=040204 serial=WS11WTD-9999998-BHS
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe
O4 - Startup: LiveJournal.lnk = C:\Program Files\LiveJournal\LiveJournal.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...yiebio4023.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\winnt\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (file missing)


End of KRC HijackThis Analyzer Log.
====================================================================

[POADB]

TBH jonny, this should have been posted in your original thread. The thread that my fellow apprentice, palguy was working on.

As an apprentice, he gains credit and achievements for his work everytime he successfully resolves a log problem. As palguy was the apprentice working your log, palguy should be the person who gives your computer the green flag. (should it be clean)

Copy and paste your new log into your original thread for palguy to look at. A mod will close and rmeove this thread in due course.

G'luck

[palguy]

Hi simplejonny,

I will look at your most recent log and get back with you as soon as possible.

Palguy

[palguy]

Hello simplejonny,

Still a trio of bad guys here.

Run a HijackThis Scan and remove these three entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe

Delete the following file:
C:\WINNT\system32\winmm64.exe


Run CleanUp again and empty your recycle bin.

Try the online scan and uninstalling Norton again after the suggested fixes and post a new HijackThis log in this thread. Update me on any problems you continue to have at that point.

[simplejonny]

hey palguy,
sorry about my mistake there, i just wasn't sure where i was supposed to be posting.

okay, so here's what i've just done.
i ran hjt again. some of the other files you had me delete before were back, so i got rid of them, along with the new three you told me to.

i looked for the winmm64.exe file to no avail. the closest thing i've got is winmm.dll

i ran cleanup.

i still can't get rid of nav, i get a fatal error when i try. and again, when i try to run trendmicro it won't run on my firefox and it crashes my ie (which i haven't used in a long time until now).

se.dll is still popping up as an active virus on my computer so i'm going to manually delete it for now.

even between my first scan and delete to when i just scanned for this new logfile, basically all of the about:blank elements that you had me delete had come back again, so i deleted them again and then quickly did this new log.

and here is my new logfile.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 7:38:55 PM, on 28/02/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\LiveJournal\LiveJournal.exe
C:\Documents and Settings\Administrator\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.livejournal.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: (no name) - {DF6FB898-7EC1-44DF-969D-03B16D8F2ECC} - C:\winnt\System32\lebhmi.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINNT\System32\wucrtupd.exe -startup
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [DMASwitch] C:\Program Files\CyberLink\PowerDVD\CLDMA.EXE 1 1
O4 - HKLM\..\Run: [WordPerfect Office 1115] C:\Program Files\Common Files\Corel\Registration\EN\Registration.exe /title="WordPerfect Office 11" /date=040204 serial=WS11WTD-9999998-BHS
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Startup: LiveJournal.lnk = C:\Program Files\LiveJournal\LiveJournal.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...yiebio4023.cab
O18 - Filter: text/html - {36F3D2B0-9C3B-44FC-A1C5-881B42CFE1B7} - C:\winnt\System32\lebhmi.dll
O18 - Filter: text/plain - {36F3D2B0-9C3B-44FC-A1C5-881B42CFE1B7} - C:\winnt\System32\lebhmi.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\winnt\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (file missing)


End of KRC HijackThis Analyzer Log.
====================================================================

[palguy]

Hello simplejonny,

It appears you have a stubborn one here. Let's try this.

Download FixAgent and unzip it. Run FixAgent.exe. It should fix something. If nothing is fixed, skip to the next step for the HijackThis fixes. If something is found, also download home_missing_114 and unzip it. Run the Home winkey missing batch file. Remember: ONLY run home_missing_114 if FixAgent found something.


Run HijackThis and fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/sp.html
O2 - BHO: (no name) - {DF6FB898-7EC1-44DF-969D-03B16D8F2ECC} - C:\winnt\System32\lebhmi.dll
O18 - Filter: text/html - {36F3D2B0-9C3B-44FC-A1C5-881B42CFE1B7} - C:\winnt\System32\lebhmi.dll
O18 - Filter: text/plain - {36F3D2B0-9C3B-44FC-A1C5-881B42CFE1B7} - C:\winnt\System32\lebhmi.dll

Delete this file:

C:\winnt\System32\lebhmi.dll

Download StartDreck

Unzip to its own folder and start the program:
Press 'Config'
Press 'mark all'

Uncheck the following boxes only:
System/Running Process -> List Modules
System/Drivers -> NT Services
System/Drivers -> NT Kernel- and FS-drivers
Press 'OK'

Press 'Save' and select the location to save the log file (default is the same folder as the application)

Post the log in this thread.

Right click on this link and choose Save As. Save it somewhere. Now run that program and do a search for these (search and save them separately):

HOSFS.SAM
SUCHOST.EXE

Save the file and post the contents in the forum.

Run a new HijackThis scan, save it, post a copy of it along with the above requested information.

[simplejonny]

hey palguy,
sheesh, i feel like this is a war or something!

okay, i ran fixagent, it fixed something.
when i ran home_missing it just repeatedly said "'Reg' is not recognized as an internal or external command, operable program or batch file." until i closed the window.

i got rid of the entries and booted into safe mode to delete the file.

here is my start dreck log
StartDreck (build 2.1.7 public stable) - 2005-03-01 @ 12:15:30 (GMT -05:00)
Platform: Windows 2000 (Win NT 5.0.2195 Service Pack 2)
Internet Explorer: 6.0.2800.1106
Logged in as Jonny at SIMPLEJONNY

»Registry
»Run Keys
»Current User
»Run
*TheQube=
*MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
*SuperAdBlocker=C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
»RunOnce
»Default User
»Run
*internat.exe=internat.exe
*AVG7_Run=C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE
»RunOnce
*^SetupICWDesktop=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
»Local Machine
»Run
*Synchronization Manager=mobsync.exe /logon
*CriticalUpdate=C:\WINNT\System32\wucrtupd.exe -startup
*UpdReg=C:\WINNT\Updreg.exe
*PrinTray=C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
*LoadQM=loadqm.exe
*NeroCheck=C:\WINNT\system32\NeroCheck.exe
*NAV Agent=C:\PROGRA~1\NORTON~1\navapw32.exe
*DMASwitch=C:\Program Files\CyberLink\PowerDVD\CLDMA.EXE 1 1
*CamMonitor=C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
*Share-to-Web Namespace Daemon=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
*IntelliType="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
*POINTER=point32.exe
*QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
*WordPerfect Office 1115=C:\Program Files\Common Files\Corel\Registration\EN\Registration.exe /title="WordPerfect Office 11" /date=040204 serial=WS11WTD-9999998-BHS
*NAV CfgWiz=C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
*TkBellExe="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
*AVG7_CC=C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
*AVG7_EMC=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
+OptionalComponents
+MSFS
*Installed=1
+MAPI
*Installed=1
*NoChange=1
+MAPI
*Installed=1
*NoChange=1
»RunOnce
»RunServices
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»File Associations (CR)
+.bat
*batfile="%1" %*
+.com
*comfile="%1" %*
+.disabled
*SpybotSD.DisabledFile="C:\Program Files\Spybot - Search & Destroy\blindman.exe" "%1"
+.exe
*exefile="%1" %*
+.hta
*htafile=C:\WINNT\System32\mshta.exe "%1" %*
+.htm
*FirefoxHTML=C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -url "%1"
+.html
*FirefoxHTML=C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -url "%1"
+.js
*JSFile=C:\WINNT\System32\WScript.exe "%1" %*
+.jse
*JSEFile=C:\WINNT\System32\WScript.exe "%1" %*
+.pif
*piffile="%1" %*
+.reg
*regfile=regedit.exe "%1"
+.scr
*scrfile="%1" /S
+.txt
*txtfile=%SystemRoot%\system32\NOTEPAD.EXE %1
+.vbs
*VBSFile=C:\WINNT\System32\WScript.exe "%1" %*
+.vbe
*VBEFile=C:\WINNT\System32\WScript.exe "%1" %*
+.wsh
*WSHFile=C:\WINNT\System32\WScript.exe "%1" %*
+.wsf
*WSFFile=C:\WINNT\System32\WScript.exe "%1" %*
+.lnk
`lnkfile= [key or value does not exist]
»Active Setup (LM)
+Browser Customizations/>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS
*StubPath=RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
+Microsoft Outlook Express 6/{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
*StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
+NetMeeting 3.01/{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
+EnableRevocation/{6A5110B5-E14B-4268-A065-EF89FF33C325}
*StubPath=regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll
+Microsoft Windows Media Player/{6BF52A52-394A-11d3-B153-00C04F79FAA6}
*StubPath=rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub
+Address Book 5/{7790769C-0471-11d2-AF11-00C04FA35D02}
*StubPath="%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
+Windows Desktop Update/{89820200-ECBD-11cf-8B85-00AA005B4340}
*StubPath=regsvr32.exe /s /n /i:U shell32.dll
+Internet Explorer 6/{89820200-ECBD-11cf-8B85-00AA005B4383}
*StubPath=%SystemRoot%\System32\ie4uinit.exe
+CRLUpdate/{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}
*StubPath=%SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl
»Browser Helper Objects (LM)
»Internet Explorer
»Current User
*Default_Page_URL=http://www.msn.com
*Local Page=C:\WINNT\System32\blank.htm
*Start Page=http://www.google.com
*Window Title=Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
*CustomizeSearch=http://ie.search.msn.com
+SearchUrl
*provider=yaho
»Default User
*Default_Search_URL=http://ie.search.msn.com
*Search Bar=http://s-redirect.com/?a=2&b=hc
*Search Page=http://s-redirect.com/?a=2&b=hc
*SearchAssistant=http://s-redirect.com/?a=2&b=hc
+SearchUrl
*SearchUrl=http://s-redirect.com/?a=2&b=hc
»Local Machine
*Default_Page_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
*Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
*Local Page=%SystemRoot%\system32\blank.htm
*Search Bar=res://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll/sp.html
*Start Page=http://www.google.com
*CustomizeSearch=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
*SearchAssistant=http://www.google.com
+SearchUrl
»ShellServiceObjectDelayLoad (LM)
*Network.ConnectionTray={7007ACCF-3202-11D1-AAD2-00805FC1270E}
`InprocServer32=C:\WINNT\system32\NETSHELL.dll
*WebCheck={E6FB5E20-DE35-11CF-9C87-00AA005127ED}
`InprocServer32=%SystemRoot%\System32\webcheck.dll
*SysTray={35CEC8A3-2BE6-11D2-8773-92E220524153}
`InprocServer32=stobject.dll
»Special NT Values
»Current User
*Load=
*Run=
*Programs=com exe bat pif cmd
*SHELL=
»Default User
*Load=
*Run=
*Programs=com exe bat pif cmd
*SHELL=
»Local Machine
*AppInit_DLLs=
*SHELL=Explorer.exe
*Userinit=C:\WINNT\system32\userinit.exe,
»Files
»Autostart Folders
»Current User
*C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\LiveJournal.lnk
»Default User
»Local Machine
*C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
»INI-Files
»WIN.INI\[windows]
*LOAD=
*RUN=
»SYSTEM.INI\[boot]
*SHELL=Explorer.exe
»Text Files
*C:\msdos.sys
*C:\config.sys
*C:\winnt\System32\config.nt
`dos=high, umb
`device=%SystemRoot%\system32\himem.sys
`files=40
*C:\autoexec.bat
*C:\winnt\System32\autoexec.nt
`@echo off
`lh %SystemRoot%\system32\mscdexnt.exe
`lh %SystemRoot%\system32\redir
`lh %SystemRoot%\system32\dosx
`lh %SystemRoot%\system32\nw16
`lh %SystemRoot%\system32\vwipxspx
*C:\winnt\wininit.ini
`[Rename]
`NUL=C:\WINNT\System32\bdeinsta2.dll
`C:\PROGRA~1\EXECUT~1\DISKEE~2\tl32v20.dll=C:\PROGRA~1\EXECUT~1\DISKEE~2\TL32V2~1.DLL
*C:\winnt\System32\drivers\etc\hosts
`127.0.0.1 localhost
»Program Files
*C:\ntldr
*C:\ntdetect.com
*C:\io.sys
*C:\winnt\System32\win.com
*C:\winnt\explorer.exe
»%PATH% Companion Files
+C:\winnt\System32\dfrgfat.exe
*C:\Program Files\Executive Software\DiskeeperLite\DfrgFAT.exe
+C:\winnt\System32\dfrgntfs.exe
*C:\Program Files\Executive Software\DiskeeperLite\DfrgNTFS.exe
+C:\winnt\System32\notepad.exe
*C:\winnt\notepad.exe
+C:\winnt\System32\taskman.exe
*C:\winnt\TASKMAN.EXE
+C:\winnt\System32\winhlp32.exe
*C:\winnt\winhlp32.exe
»System/Drivers
»Running Processes
+0=<idle>
+8=<system>
+152=\SystemRoot\System32\smss.exe
+176=\??\C:\winnt\system32\csrss.exe
+196=\??\C:\winnt\system32\winlogon.exe
+224=C:\winnt\system32\services.exe
+236=C:\winnt\system32\lsass.exe
+404=C:\winnt\system32\svchost.exe
+444=C:\WINNT\system32\LEXBCES.EXE
+472=C:\winnt\system32\spoolsv.exe
+500=C:\WINNT\system32\LEXPPS.EXE
+536=C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
+556=C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
+584=C:\WINNT\System32\CTsvcCDA.EXE
+596=C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
+612=C:\WINNT\System32\svchost.exe
+628=C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
+748=C:\winnt\system32\regsvc.exe
+760=C:\winnt\system32\MSTask.exe
+788=C:\winnt\system32\stisvc.exe
+880=C:\winnt\System32\WBEM\WinMgmt.exe
+716=C:\WINNT\System32\mspmspsv.exe
+972=C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
+1164=C:\winnt\Explorer.EXE
+1184=C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
+1420=C:\winnt\System32\devldr32.exe
+1008=C:\winnt\loadqm.exe
+1016=C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
+1412=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
+984=C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
+1396=C:\Program Files\Microsoft Hardware\Mouse\point32.exe
+1380=C:\Program Files\Common Files\Real\Update_OB\realsched.exe
+352=C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
+1372=C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
+1436=C:\Program Files\MSN Messenger\MsnMsgr.Exe
+1484=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
+1536=C:\Program Files\LiveJournal\LiveJournal.exe
+1488=C:\winnt\system32\NOTEPAD.EXE
+1112=C:\Documents and Settings\Administrator\Desktop\HJT\sd\StartDreck.exe
»VMM32Files (LM)
»%System%\VMM32
»%System%\IOSUBSYS
»Application specific
»MS Office 97/8.0 STARTUP-PATH
»Current User
»Default User
»Local Machine
»ICQ NetDetect
»Current User
»Default User


neither of the other two files showed up in the regsearch.

when i ran hijack this again one of the offending entries had reappeared, so i deleted it. i realize now that maybe i shouldn't have, as it might affect figuring things out, but i had already done it before i thought... so sorry if that is a problem.

here is the new log.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 12:20:59 PM, on 01/03/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\LiveJournal\LiveJournal.exe
C:\Documents and Settings\Administrator\Desktop\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.livejournal.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Rogers Hi-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINNT\System32\wucrtupd.exe -startup
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [DMASwitch] C:\Program Files\CyberLink\PowerDVD\CLDMA.EXE 1 1
O4 - HKLM\..\Run: [WordPerfect Office 1115] C:\Program Files\Common Files\Corel\Registration\EN\Registration.exe /title="WordPerfect Office 11" /date=040204 serial=WS11WTD-9999998-BHS
O4 - Startup: LiveJournal.lnk = C:\Program Files\LiveJournal\LiveJournal.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...yiebio4023.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\winnt\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE (file missing)


End of KRC HijackThis Analyzer Log.
====================================================================

thanks so much!

[greyknight17]

Go to Start->Run and type in regedit and hit OK. Go to Edit->Find and type in these two:

HOSFS.SAM
SUCHOST.EXE

Anything for them there?

[simplejonny]

nope, nothing.

[greyknight17]

OK, give us a new HijackThis and StartDreck log again.

[simplejonny]

woah, sorry, i didn't notice this last response until just now. i assumed that my response of nothing being there was a good thing because since then i have not had any of the same problems anymore. i can still repost if you think it would be a good idea, but i think that the problem may just be solved.

thanks so much!