Can you help us?

[marchants]

We have recently obtained some sort of virus that has caused our internet to stop working and it had created various pop-up ads as well as changed the homepage from msn.com to another domain (I was not present and do not know the name of the website it directed to). When Ad-Aware is used, no results show up, and when SpyDoctor is used, a trojan horse is brought up with the highest threat linking to the website "startsearch.net"
...This is the HiJackThis log of that computer (running on XP)

Logfile of HijackThis v1.99.1
Scan saved at 4:11:31 PM, on 2/7/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\System32\nvctrl.exe
C:\WINDOWS\System32\mssearchnet.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: HomepageBHO - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\System32\hp1A16.tmp
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SecurityToolbar - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - C:\Program Files\Security Toolbar\Security Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[sUBs]

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.


* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * *


Download & install - CleanUp.exe (not recommended for WinXP64)

Download & extract it to it's own folder - smitRem.exe

Download and install Ewido Security Suite

• When installing, under "Additional Options",
  • uncheck - Install background guard
• Have Ewido update itself & then exit the program.

If you are having problems with the updater, you can use this link to manually update Ewido


'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order.


* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *


HijackThis is able to create backups whenever if fixes any entry. These are stored in a subfolder called backups. As such, we advise against placing the program in any temporary folders. Please create a new directory, C:\Program Files\HijackThis\, and re-locate the program & it's associate files there.


Do a HijackThis scan & place a check next to these items and select "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/14...2/cpbrkpie.cab


* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * *


1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the option to run Windows in Safe Mode.


* * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * *


If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools -> Folder Options -> View tab.

• Tick - 'Show hidden files and folder'
• Untick - 'Hide file extensions for known types'
• Untick - 'Hide protected operating system files'
• Click Yes to confirm & then click OK

Search and delete the following file:

• windir32.exe

* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * *


Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider initially to Standard CleanUp!
3. Uncheck the following:

• Delete Newsgroup cache
• Delete Newsgroup Subscriptions
• Scan local drives for temporary files

4. Click OK
5. Press the CleanUp! button to start the program.
6. Do NOT reboot/logoff if prompted.

* CleanUp! will not create any backups!!

* * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * *


Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


* * * *


Next go to Control Panel click Display>Desktop>Customize Desktop>Website
Under the 'Web pages' box, Uncheck everything present.


* * * * *

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

• Click Scanner
• Click Complete System Scan to begin scanning.
• Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

• "Perform action on all infections"
• .Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.


* * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * *


Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan


* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * *


In your next post, please include fresh copies of:

• HiJackThis log
• Online scan
• Smitfiles.txt
• Ewido's log

Let us know if any problems persist.

[marchants]

Okay, I followed your manual to the clossest extent I could. The problem I encountered was: updating the programs.
I was unable to connect that computer to the internet through the whole process, and after doing every step recommended, still have no internet access.
Here is my latest log off of the Windows XP computer... my main goal is to restore the internet, so that I may update any virusware and spyware programs I have.

Logfile of HijackThis v1.99.1
Scan saved at 10:30:47 AM, on 2/11/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
c:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Thank you for all your help!

[marchants]

any help is appreciated

[sUBs]

Please show me the following logs:

# Smitfiles.txt
# Ewido's log

[marchants]

Sorry, the Ewido log can't be done because it makes you update in order to use it, and I cannot update it. However, I do have the Cleanup log below:

CleanUp! started on 02/11/06 19:07:17.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - deleted
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\67CNBPGT\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\M9G31RSY\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\MME08FXB\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SPUJ0T6N\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\045ZQN33\coUA[1].css - deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\045ZQN33\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0M2XANUP\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12IGKFGH\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2TE9ARGL\Uabrand[1].gif - deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\2TE9ARGL\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\7FJGIJOH\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\BVJH8Z4O\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\FUJJGLUN\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HK69TE3K\coUAprint[1].css - deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\HK69TE3K\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IP0Z2Q83\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M7C57FU0\CAAF89Q7.HTM - deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\M7C57FU0\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\MD6XOPQZ\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ND9MGIJ6\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ORORU7CF\shared[1].js - deleted
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ORORU7CF\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\OTARCDQV\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\VQ3V8GUV\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WLY30NAP\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006021120060212\index.dat currently in use. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012006021120060212\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Local Settings\History\History.IE5\ - cannot be deleted. Will be deleted when Windows is restarted.
C:\Documents and Settings\Owner\Recent\2.11.06 Log.txt.lnk - deleted
C:\Documents and Settings\Owner\Recent\3½ Floppy (A).lnk - deleted
C:\Documents and Settings\Owner\Recent\HiJackThis.lnk - deleted
C:\Documents and Settings\Owner\Recent\hijackthis.log (2).lnk - deleted
C:\Documents and Settings\Owner\Recent\hijackthis.log.lnk - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\DIO3.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\DIO4.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\DIO5.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\DIO6.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMT1B.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMT1C.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMT1D.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMT1E.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMT1F.dtd - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMTA.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMTB.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\IMTC.xml - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\jusched.log - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\pcf1.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\pcf2.tmp - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\hijackthis.log - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\ - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\hijackthis.log - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\ - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe - deleted
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc1.exe - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc2.exe - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc3.exe - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc4.txt - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc5.lnk - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc7.zip - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\INFO2 - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\AAServerManagerHelp.chm - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\Getting Started With AA Server Manager.pdf - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\Getting Started With the AASM Remote Control Utility.pdf - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default Internet Server.dat - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default Internet Server.html - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default LAN Server.dat - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default LAN Server.html - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default Tournament Server.dat - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AA Default Tournament Server.html - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\AASMMiniLogo.JPG - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\CALLogo.JPG - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\CYBERATHLETE AMATEUR LEAGUE.dat - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\Cyberathlete Amateur League.html - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\Instructions.html - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\LeagueInfo\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc8\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\KnightOnline\log.klg - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\KnightOnline\HackShield\supdate.log - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\KnightOnline\HackShield\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\KnightOnline\TEMP\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\KnightOnline\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\Dc9\ - deleted
c:\Recycler\S-1-5-21-2347786304-3535283993-2015212290-1003\ - cannot be deleted. Will be deleted when Windows is restarted.
d:\Recycled\INFO2 - deleted
'Typed URLs' (Internet Explorer) - removed from the registry.
'Typed URLs' (MSN) - removed from the registry.
'Run MRU' list - removed from the registry.
'Doc Find Spec MRU' list - unable to delete from the registry.
'FindComputerMRU' list - unable to delete from the registry.
CleanUp! recovered 24.3 MB of disk space from 58 files.
CleanUp! finished on 02/11/06 19:07:56.

Sorry this is making it more difficult.

[sUBs]

Please downlaod & run Ewiod's manual updater - http://www.ewido.net/en/download/updates/
You should be able to use Ewido after that.

Reboot to Safe Mode to run these two programs.


Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


* * * *


Next go to Control Panel click Display>Desktop>Customize Desktop>Website
Under the 'Web pages' box, Uncheck everything present.


* * * * *

Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

• Click Scanner
• Click Complete System Scan to begin scanning.
• Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

• "Perform action on all infections"
• .Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete.


I need both Ewido's log & the log produced after running SmitRem - C:\Smitfiles.txt

[marchants]

Alright, we managed to get the manual update transferred via CD-R to the XP computer (infected one). I performed the steps given in the last post and hae both logs below.
Our internet is still down though. Any other computer works except for it...
Hopefully you still have a few tricks up your sleeve.

smitRem © log file
version 2.8

by noahdfear

Microsoft Windows XP [Version 5.1.2600]
The current date is: Sun 02/12/2006
The current time is: 9:54:54.81

Running from
C:\Program Files\SmitRem\smitRem
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key

PSGuard.com key not present!

checking for WinHound.com key

WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 724 'explorer.exe'

Starting registry repairs

Registry repairs complete
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN! :)
HKLM\SOFTWARE\Microsoft\InternetExplorer\Main\ins->Adware.WebRebates:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-1990c1af-539fec27.class->Trojan.ClassLoader.Dummy.d:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-3c8ab4ad-55fa1076.class->Trojan.ClassLoader.Dummy.d:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-6639c09c-31746f3b.class->Trojan.ClassLoader.Dummy.d:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-ceb84cd-3c3525cb.class->Trojan.ClassLoader.Dummy.d:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv778.jar-f303a81-199ff9e7.zip/Matrix.class->Downloader.OpenStream.c:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-2ef406b5.zip/Worker.class->Trojan.ClassLoader.u:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-2ef406b5.zip/javautil.zip->Downloader.Small.bkq:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-2ef406b5.zip/javautil.zip/bot.exe->Downloader.Small.bmk:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-56977119.zip/Worker.class->Trojan.ClassLoader.u:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-56977119.zip/javautil.zip->Downloader.Small.bkq:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-247a9c26-56977119.zip/javautil.zip/bot.exe->Downloader.Small.bmk:Errorduringcleaning

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-116c51df.zip/Worker.class->Trojan.ClassLoader.u:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-116c51df.zip/javautil.zip/bot.exe->Downloader.Small.bmk:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-7a87f537.zip/NudeBox.class->Trojan.ClassLoader.u:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-7a87f537.zip/Worker.class->Trojan.ClassLoader.u:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-7a87f537.zip/javautil.zip->Downloader.Small.bqu:Cleanedwithoutbackup

C:\DocumentsandSettings\Owner\ApplicationData\Sun\Java\Deployment\cache\javapi\v1.0\jar\menu.jr-47610a46-7a87f537.zip/javautil.zip/bot.exe->Downloader.Small.bmk:Cleanedwithoutbackup

C:\ProgramFiles\HiJackThis\backups\backup-20060207-201939-205.dll->Adware.Coupons:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1098557770.ssb/C:\WINDOWS\system32\stcloader.exe->Trojan.SecondThought.av:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1098557770.ssb/C:\WINDOWS\pmv.exe->Adware.180Solutions:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099840585.ssb/C:\WINDOWS\dhbrwsr.exe->Adware.DealHelper:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099840585.ssb/C:\ProgramFiles\AutoUpdate\AutoUpdate.exe->Downloader.Apropo.g:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099840585.ssb/C:\ProgramFiles\BullsEyeNetwork\bin\bargains.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099840585.ssb/C:\ProgramFiles\CashBack\bin\cashback.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099840585.ssb/C:\ProgramFiles\NaviSearch\bin\nls.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\conscorr.cab/conscorr.exe->Downloader.Stubby.c:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\conscorr.exe->Downloader.Stubby.c:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\djtopr1150.exe->Adware.WebRebates:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\ln_reco.exe->Adware.BetterInternet:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI1C58.tmp\wupdt.exe->Downloader.Intexp.a:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI352D.tmp\polall1r.cab/polall1r.exe->Downloader.Agent.ae:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI537F.tmp\localNrd.cab/localNRD.dll->Adware.BiSpy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI537F.tmp\localNrd.cab/preInsln.exe->Adware.BiSpy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI537F.tmp\localNrd.cab/polall1l.exe->Downloader.Agent.ae:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\DocumentsandSettings\Owner\LocalSettings\Temp\THI537F.tmp\preInsln.exe->Adware.BiSpy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\CashBack\bin\cb.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\CashBack\bin\flash.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\TVMedia\Tvm.exe->Adware.TotalVelocity:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\TVMedia\TvmBho.dll->Adware.TotalVelocity:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\TVMedia\TvmCore.dll->Adware.TotalVelocity:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\ProgramFiles\WebOffer\apev.exe->Adware.EZula:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\conscorr.exe->Downloader.Stubby.c:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\dhp.dll->Adware.DealHelper:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\dhsvr.exe->Adware.DealHelper:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\dhupdt.exe->Adware.DealHelper:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\localNRD.dll->Adware.BiSpy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\preInsln.exe->Adware.BiSpy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\SWLAD1.dll->Adware.VirtualBouncer:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\SWLAD2.dll->Adware.VirtualBouncer:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\systb.dll->Adware.ImiBar:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\system32\PopOops.dll->Adware.VirtualBouncer:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\system32\PopOops2.dll->Adware.VirtualBouncer:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\system32\saiehook.dll->Adware.180Solutions:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099842344.ssb/C:\WINDOWS\wupdt.exe->Downloader.Intexp.a:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099846001.ssb/C:\ProgramFiles\BullsEyeNetwork\bin\bargains.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099846001.ssb/C:\ProgramFiles\CashBack\bin\cashback.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\ProgramFiles\interMute\SpySubtract\Backup\CleanSession-1099846001.ssb/C:\ProgramFiles\NaviSearch\bin\nls.exe->Adware.BargainBuddy:Cleanedwithoutbackup

C:\WINDOWS\e.exe->Dropper.Small.lx:Cleanedwithoutbackup

C:\WINDOWS\system32\bpkr.exe->Logger.Perfloger.l:Cleanedwithoutbackup

[marchants]

Awaiting any assistance (bump)...
Thank you Tech Support!!!

[marchants]

awaiting further assistance

[sUBs]

Please be reminded that you're not supposed to bump your post unless 24 hours has passed without a reply. We work the logs from the back up & the unneccessary bumps would cause your thread to be bumped to the front where it will be ignored.

Please post a fresh HIjackthis log.

[marchants]

here is our latest hijackthis log, and nothing has changed since the uploading of the ewido and cleanup logs.

Any help with getting my internet/infection-free up is appreciated!

Logfile of HijackThis v1.99.1
Scan saved at 5:58:33 PM, on 2/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\System32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HiJackThis\HijackThis.exe

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Sorry about the bumping.

[marchants]

bumping- 25 hours have passed.

[sUBs]

To be honest, there isn't anything in your logs that may internet connectivity. Please tell me how you connect to the internet. Is it thru dial up, cable or broadband? Directly through a modem or a router? Haveyou done any diagnostic checks on your network connections?

Please try this.. Download & RUN WinsockFix.zip - Unzip & Run

If you have a corrupted LSP chain, this should fix it. Let me know how that went

[marchants]

AHAH! Our internet has come back online! I ran the program you suggested and tempered around for a bit. It turns out ZoneAlarm is somehow blocking it. If it is shut down then my internet works again, but my settings were not changed on it. We have now switched to Filseclab Firewall found at download.com and it seems to allow the internet connection through. Thank you sUBS for all of your hard work!