Hey again, i downloaded and ran the programs you guys gave me (thanks again). i deleted around 50 spyware programs with spybot initially and now another 33 with spysweeper. the bazooka program still shows 2 programs (easydates and transponder)even after deleting close to 100 spycrap programs. but good eneough. everything looks good as far as i can tell. here is my new hijkack log and the results of the "winlogon" search results. once again thanks a lot guys. Mike Hallam. Logfile of HijackThis v1.97.7 Scan saved at 3:46:57 PM, on 12/18/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WFXSVC.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINDOWS\System32\wfxsnt40.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe C:\Program Files\Symantec\WinFax\WFXCTL32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Symantec\WinFax\WFXMOD32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Documents and Settings\Valued Customer\Local Settings\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.canada.com/sports/hockey/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.netscape.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.sony.com/vaiopeople O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: officejet 6100.lnk = ? O4 - Global Startup: Controller.LNK = C:\Program Files\Symantec\WinFax\WFXCTL32.exe O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople O16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab WINLOGON SEARCH with show hidden folders(typed manually) winlogon c:\windows\system32 WINLOGON.EXE-077DEB28 c:\WINDOWS\Prefetch WINLOGON.EXE-32C57D49 c:\WINDOWS\Prefetch WINLOGON c:\Windows\I386 winlogon c:\windows\ServicePakFiles\i386

0

Mike, You did a good job of cleaning things up. I don't see anything amiss, unless iceblue spots something. The winlogon entries that you show are the good guys. hth shep

0

once again thanks shep and ice, just when i think i know quite a bit about computers i always get a new problem to show me i really don't. have a good one, mike hallam.

0

That logs looks clean, Mike. And I keep finding the more I learn, the less I seem to know.... There always seems to be another question lurking...for instance...why are there two prefetch files in that log...<grins> That prefetch folder can be cleared out regularly without problem, any files will be replaced when needed.

0

shep/ice, I have same setup/system and problem as mike but my hijack log is a little different. I wonder if this is the culprit but I couldn't delete it (O2 - BHO: BabeIE). Anyway, here's my hijack log. Any help you cab provide is GREATLY appreciated. Thanks, Tom Logfile of HijackThis v1.97.7 Scan saved at 12:40:03 PM, on 12/25/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINNT\Explorer.exe C:\WINNT\System32\SK9910DM.exe C:\WINNT\GWMDMMSG.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\PROGRA~1\Save\Save.exe C:\WINNT\System32\P2P Networking\P2P Networking.exe C:\program files\altnet\points manager\points manager.exe C:\WINNT\System32\CTHELPER.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\webHancer\Programs\whSurvey.exe C:\WINNT\bsktmruf.exe C:\WINNT\msbb.exe C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe C:\WINNT\CMTGQ.exe C:\WINNT\CIPVF.exe C:\WINNT\GMTZDJQX.exe C:\WINNT\System32\rundll32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\ClockSync\Sync.exe C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogon.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe C:\PROGRA~1\COMMON~2\ADDRES~1\comwiz.exe C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe C:\Program Files\Voyetra\AudioStation 6\astnscsi.exe C:\WINNT\System32\CTsvcCDA.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINNT\System32\NMSSvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\System32\svchost.exe C:\WINNT\System32\MsPMSPSv.exe C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.find4u.net/sp.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.find4u.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.find4u.net/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.find4u.net/sp.htm O1 - Hosts: 66.250.130.132 thehun.net O1 - Hosts: 66.250.130.132 www.thehun.net O1 - Hosts: 66.250.130.132 thehun.com O1 - Hosts: 66.250.130.132 www.thehun.com O1 - Hosts: 66.250.130.132 worldsex.com O1 - Hosts: 66.250.130.132 www.worldsex.com O1 - Hosts: 66.250.130.132 sexocean.com O1 - Hosts: 66.250.130.132 www.sexocean.com O1 - Hosts: 66.250.130.132 easypic.com O1 - Hosts: 66.250.130.132 www.easypic.com O1 - Hosts: 66.250.130.132 free6.com O1 - Hosts: 66.250.130.132 www.free6.com O1 - Hosts: 66.250.130.132 al4a.com O1 - Hosts: 66.250.130.132 www.al4a.com O1 - Hosts: 66.250.130.132 thumbnailpost.com O1 - Hosts: 66.250.130.132 www.thumbnailpost.com O1 - Hosts: 66.250.130.132 drbizzaro.com O1 - Hosts: 66.250.130.132 www.drbizzaro.com O1 - Hosts: 66.250.130.132 hoes.com O1 - Hosts: 66.250.130.132 www.hoes.com O1 - Hosts: 66.250.130.132 absolut-series.com O1 - Hosts: 66.250.130.132 www.absolut-series.com O1 - Hosts: 66.250.130.132 elephantlist.com O1 - Hosts: 66.250.130.132 www.elephantlist.com O1 - Hosts: 66.250.130.132 ah-me.com O1 - Hosts: 66.250.130.132 www.ah-me.com O1 - Hosts: 66.250.130.131 msn.com O1 - Hosts: 66.250.130.131 www.msn.com O1 - Hosts: 66.250.130.131 search.msn.com O1 - Hosts: 66.250.130.131 auto.search.msn.com O1 - Hosts: 66.250.130.133 google.com O1 - Hosts: 66.250.130.133 www.google.com O1 - Hosts: 66.250.130.133 google.de O1 - Hosts: 66.250.130.133 www.google.de O1 - Hosts: 66.250.130.133 google.co.in O1 - Hosts: 66.250.130.133 www.google.co.in O1 - Hosts: 66.250.130.133 google.ca O1 - Hosts: 66.250.130.133 www.google.ca O1 - Hosts: 66.250.130.133 google.fr O1 - Hosts: 66.250.130.133 www.google.fr O1 - Hosts: 66.250.130.133 google.it O1 - Hosts: 66.250.130.133 www.google.it O1 - Hosts: 66.250.130.133 google.com.au O1 - Hosts: 66.250.130.133 www.google.com.au O1 - Hosts: 66.250.130.133 google.co.uk O1 - Hosts: 66.250.130.133 www.google.co.uk O1 - Hosts: 66.250.130.133 google.be O1 - Hosts: 66.250.130.133 www.google.be O1 - Hosts: 66.250.130.130 find4u.net O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Tom\Application Data\winlink\winlink.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {D8E25C53-9508-4f5c-9249-D98D438891D5} - C:\WINNT\System32\ssurf022.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check" O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s O4 - HKLM\..\Run: [CTHelper] CTHELPER.exe O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.exe O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe" O4 - HKLM\..\Run: [yluemhap] C:\WINNT\bsktmruf.exe O4 - HKLM\..\Run: [msbb] C:\WINNT\msbb.exe O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe O4 - HKLM\..\Run: [WinFavorites] c:\program files\winfavorites\WinFavorites.exe1 O4 - HKLM\..\Run: [SafeSurfingUpdate] C:\WINNT\System32\SSUpdate.exe O4 - HKLM\..\Run: [CMTGQ] C:\WINNT\CMTGQ.exe O4 - HKLM\..\Run: [CIPVF] C:\WINNT\CIPVF.exe O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe O4 - HKLM\..\Run: [GMTZDJQX] C:\WINNT\GMTZDJQX.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe /q O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Owner\Application Data\DownloadPlus.exe O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe O4 - Global Startup: winlogon.exe O8 - Extra context menu item: Add A Page Note - C:\Program Files\CommonName\AddressBar\createnote.htm O8 - Extra context menu item: Bookmark This Page - C:\Program Files\CommonName\AddressBar\createbookmark.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Email This Link - C:\Program Files\CommonName\AddressBar\emaillink.htm O8 - Extra context menu item: Search using CommonName - C:\Program Files\CommonName\AddressBar\navigate.htm O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O11 - Options group: [CommonName] CommonName O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://64.55.105.205/Java/cfs31229.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_99/QDow.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/abarth/us/win/QuickTimeInstaller.exe O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB

0

Gday Tom, Could I get you to Open a New Topic for this log? Do the following stuff and then paste the new log in a 'new topic'. Thanks. First – please download and run Spybot Search & Destroy; Spybot Search and Destroy http://www.safer-networking.org Short tutorial and download from here: http://tomcoyote.org/SPYBOT/ *check for updates*; and then scan, and fix all RED items that Spybot finds. Reboot when done. Then, >>> CWS Cool Web Search Removal Process Download and run a new update of CWShredder.exe from one of the following; CWShredder.exe http://www.spywareinfo.com/~merijn/junk/CWShredder.exe and click ‘Open’ click “Next”; (obtain a new version for each run; there is a recent update) The full story on CWS: New address: http://www.merijn.org/cwschronicles.html Make sure that you have the latest version of CWShredder, and that you click “Next” and don't just scan only.

0