Hello- Some type of spyware is in my computer and I can't get rid of it. It redirects my homepage to res://gxkgh.dll/index.html#96676. Popups are now appearing. I have run Spybot, Adaware, NAV and CWshredder. I have run Hijack This and fixed search and start pages, etc with "gxkgh" in it - but they come back when I restart IE. Wondering about BHO: (no name) - {D30E97DE-8322-41D2-604F-4B7E5C0AECE3} - C:\WINDOWS\mfcgo. and 04 startup item sdkbm32.exe. But, not sure - really not very knowledgeable on this - but, trying. Could someone please help me figure this out. Thank you so much. -BarbB

Hi Barb, Yes, Both of those entries are malware files. Fix those with HijackThis along with any R0 - R1 entries that have returned and reboot. After rebooting delete sdkbm32.exe. If you still have problems after fixing those entries, run HijackThis and post the log in a reply.

Thanks Tom - Did what you said. It's now creating new R0-R1 entries, another BHO and I don't know what else. I appreciate your help - please guide me more. Thanks. Here is the most recent Hijack This log: Logfile of HijackThis v1.97.7 Scan saved at 4:40:00 PM, on 6/16/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\winwy.exe C:\WINDOWS\Explorer.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\crdb32.exe C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\QUICKENW\QWDLLS.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Barb & Chris\Local Settings\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://rgfbu.dll/index.html#96676 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://rgfbu.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://rgfbu.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {E2D55238-7996-454E-F46E-882598D7B86A} - C:\WINDOWS\system32\crxi.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [crdb32.exe] C:\WINDOWS\system32\crdb32.exe O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe O4 - HKLM\..\RunOnce: [crho.exe] C:\WINDOWS\system32\crho.exe O4 - HKLM\..\RunOnce: [winwy.exe] C:\WINDOWS\winwy.exe O4 - HKLM\..\RunOnce: [d3dr.exe] C:\WINDOWS\system32\d3dr.exe O4 - HKLM\..\RunOnce: [atlnx32.exe] C:\WINDOWS\system32\atlnx32.exe O4 - HKLM\..\RunOnce: [ipap.exe] C:\WINDOWS\ipap.exe O4 - HKLM\..\RunOnce: [mfctq.exe] C:\WINDOWS\mfctq.exe O4 - HKLM\..\RunOnce: [appot32.exe] C:\WINDOWS\system32\appot32.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: ATI TV (HKLM) O9 - Extra button: Research (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://WWW.SOYATA.COM O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {323C9B9A-DB6C-42CE-A706-314535FD8EAF} (FTUploader Control) - http://www.fototime.com/ftweb/activeX/WebUploadControl.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37985.3572916667 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Hi Barb, 1. Before you start using HijackThis move hijackthis.exe to a folder of itīs own. The program creates backups in the folder it is in. In a Temp folder they easily disappear. 2. Restart the computer in safe mode, run HT again and check the following items. Doublecheck so as to be sure not to miss one, then click 'fix checked'. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://rgfbu.dll/index.html#96676 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://rgfbu.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://rgfbu.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rgfbu.dll/sp.html#96676 O2 - BHO: (no name) - {E2D55238-7996-454E-F46E-882598D7B86A} - C:\WINDOWS\system32\crxi.dll O4 - HKLM\..\Run: [crdb32.exe] C:\WINDOWS\system32\crdb32.exe O4 - HKLM\..\RunOnce: [crho.exe] C:\WINDOWS\system32\crho.exe O4 - HKLM\..\RunOnce: [winwy.exe] C:\WINDOWS\winwy.exe O4 - HKLM\..\RunOnce: [d3dr.exe] C:\WINDOWS\system32\d3dr.exe O4 - HKLM\..\RunOnce: [atlnx32.exe] C:\WINDOWS\system32\atlnx32.exe O4 - HKLM\..\RunOnce: [ipap.exe] C:\WINDOWS\ipap.exe O4 - HKLM\..\RunOnce: [mfctq.exe] C:\WINDOWS\mfctq.exe O4 - HKLM\..\RunOnce: [appot32.exe] C:\WINDOWS\system32\appot32.exe O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab After fixing with HijackThis, delete the following: C:\WINDOWS\system32\crdb32.exe C:\WINDOWS\system32\crho.exe C:\WINDOWS\winwy.exe C:\WINDOWS\system32\d3dr.exe C:\WINDOWS\system32\atlnx32.exe C:\WINDOWS\ipap.exe C:\WINDOWS\mfctq.exe C:\WINDOWS\system32\appot32.exe 3. Reboot to Windows and run another Hijack scan and post the new log.

Hi Tom- Thank you. I did as you said. Looks like another BHO and a few more 04 Run Once items are still there. 04 items were there while I was doing your suggested cleanup. New BHO appgq32 appeared after cleanup. FYI- noticed that every time I open Outlook Express or Internet Explorer a window pops up saying it's reconfiguring Microsoft Office Basic 2003. I try to hit cancel if I can, but it runs fast. I iamagine this is a result/part of the problem. Here is the lates Log: Logfile of HijackThis v1.97.7 Scan saved at 8:27:58 AM, on 6/17/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\sdkjt32.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe C:\WINDOWS\system32\ntnb.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\QUICKENW\QWDLLS.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Barb & Chris\Desktop\hijack\HijackThis.exe O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {A3C660FF-DEAB-ECF0-02FE-C8DC9874C708} - C:\WINDOWS\appgq32.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [ntnb.exe] C:\WINDOWS\system32\ntnb.exe O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe O4 - HKLM\..\RunOnce: [sdkjt32.exe] C:\WINDOWS\sdkjt32.exe O4 - HKLM\..\RunOnce: [iphe.exe] C:\WINDOWS\system32\iphe.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: ATI TV (HKLM) O9 - Extra button: Research (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://WWW.SOYATA.COM O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {323C9B9A-DB6C-42CE-A706-314535FD8EAF} (FTUploader Control) - http://www.fototime.com/ftweb/activeX/WebUploadControl.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37985.3572916667 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Hi Barb, Try this: 1. Make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders". Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for "sdkjt32.exe" & "ntnb.exe". If you find the files, click on them, and then click End Process => Exit the Task Manager. 2. Next, go to Start->Run and type "Services.msc" (without quotes) then hit OK. Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Now hit Apply and then OK and close any open windows. 3. Run HijackThis, click on "Scan" and then place a check mark in the following boxes, And click on "Fix Checked": O2 - BHO: (no name) - {A3C660FF-DEAB-ECF0-02FE-C8DC9874C708} - C:\WINDOWS\appgq32.dll O4 - HKLM\..\Run: [ntnb.exe] C:\WINDOWS\system32\ntnb.exe O4 - HKLM\..\RunOnce: [sdkjt32.exe] C:\WINDOWS\sdkjt32.exe O4 - HKLM\..\RunOnce: [iphe.exe] C:\WINDOWS\system32\iphe.exe 4. Reboot into Safe Mode and delete the following files: C:\WINDOWS\system32\ntnb.exe C:\WINDOWS\sdkjt32.exe C:\WINDOWS\system32\iphe.exe 5. Go to Start => Run and type in "regedit" (without quotes) and press "Enter". One the registry opens, Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\__NS_Service_3 If __NS_Service_3 exists , right click on it and choose delete from the menu. Still in the registry, navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY___NS_Service_3 If LEGACY___NS_Service_3 exists then right click on it and choose delete from the menu. Exit regedit and reboot in Normal Mode. 6. Run HiJackThis again and post a new log in this thread.

Hi Barb, If you have rebooted the machine since you posted the last HT log, the files I listed may not exist. HomeSearch files usually morph (change names) everytime the machine is rebooted. If you have any problems identifying the HomeSearch files, (You seem to be able to identify them) run a HT scan and post the log. Do not reboot or shutdown the machine until after I reply.. (It's my day off so I should reply right away)