My computer was infected with numerous spyware this morning. I ended up getting rid of Deluxe Communications, and fast.exe. I've run adaware a few times now, and it says my system is clean, but I'm still getting popups from going to google.com. Can anyone give me a hand? 2.8c 800mhz fsb 2 gb 512x4 geil dual channel asus p4p800 se 60 gb ibm 7200 rpm 80 gb maxtor 7200 300 gb seagate 7200 thermaltake va3000 tsunami evga geforce 6800gs 256mb

It may take a little time and effort to to find the problem files. Looks like lately everyone gets about half way through the search scans and quit responding to their posts. Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Rename hijackthis.exe as that sometime helps locate the baddies. Go to start> search> files and folders> type in the top space "hijackthis.exe" without the quotes> click search> when it is found in the right pane (looks like a pile of dynamite)>right click on it> click rename> rename it "show.exe" without the quotes> click a blank space on the screen. Now run Hijack This and click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly. The following scan looks for a particular baddie named Smitrem. !!!!! Only run option #1 as running the other options on an uninfected computer will damage the desktop !!!!! Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/SmitfraudFix.zip Then extract the contents to your desktop. Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Logfile of HijackThis v1.99.1 Scan saved at 4:12:17 PM, on 10/5/2006 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\hidserv.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM+\AIM+.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\DOCUME~1\ADMINI~1\APPLIC~1\DOBE~1\spool32.exe C:\PROGRA~1\AIM95\aim.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\WINNT\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Hijackthis\show.exe O2 - BHO: (no name) - {73F9C2D7-2431-4D09-8971-FA2F262DEDDD} - C:\WINNT\system32\geeda.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\binpmcuv.dll O2 - BHO: (no name) - {85A8C2F2-534D-5ECD-4770-58F07CC8619D} - C:\WINNT\system32\ffpn.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DVD43] C:\Program Files\DVD Region+CSS Free\DVD43.exe /hidden O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [Abci] "C:\DOCUME~1\ADMINI~1\APPLIC~1\DOBE~1\spool32.exe" -vt ndrv O4 - Startup: Rainlendar (2).lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe O20 - Winlogon Notify: geeda - C:\WINNT\system32\geeda.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\QWxsZW4\command.exe (file missing) O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe (file missing) SmitFraudFix v2.105 Scan done at 16:13:40.23, Thu 10/05/2006 Run from C:\Documents and Settings\Administrator\Desktop\SmitfraudFix OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINNT\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vise.html" "SubscribedURL"="" "FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows NT\\saqyjy.html" "SubscribedURL"="" "FriendlyName"="" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End 2.8c 800mhz fsb 2 gb 512x4 geil dual channel asus p4p800 se 60 gb ibm 7200 rpm 80 gb maxtor 7200 300 gb seagate 7200 thermaltake va3000 tsunami evga geforce 6800gs 256mb

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install Ewido Security Suite We will need this later in safe mode Be sure to update Ewido Please download VundoFix.exe to your C:\. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer, click OK. Turn your computer back on. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Please post the log located at C:\vundofix.txt then continue with Combofix. Please download ComboFix to the Desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log then continue Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Reboot into safe mode Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {73F9C2D7-2431-4D09-8971-FA2F262DEDDD} - C:\WINNT\system32\geeda.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINNT\system32\binpmcuv.dll O2 - BHO: (no name) - {85A8C2F2-534D-5ECD-4770-58F07CC8619D} - C:\WINNT\system32\ffpn.dll O4 - HKCU\..\Run: [Abci] "C:\DOCUME~1\ADMINI~1\APPLIC~1\DOBE~1\spool32.exe" -vt ndrv O20 - Winlogon Notify: geeda - C:\WINNT\system32\geeda.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\QWxsZW4\command.exe (file missing) Exit Hijack This but remain in safe mode. Navigate to and delete these files if found: C:\WINNT\system32\geeda.dll C:\WINNT\system32\binpmcuv.dll C:\WINNT\system32\ffpn.dll C:\DOCUME~1\ADMINI~1\APPLIC~1\DOBE~1\spool32.exe C:\WINNT\QWxsZW4\command.exe Navigate to and delete this folder if found: C:\WINNT\QWxsZW4 Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run Ewido and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the ewido report on your desktop and a new Hijack This log please.

VundoFix V6.2.0 Checking Java version... Java version is 1.5.0.4 Scan started at 11:05:51 PM 10/5/2006 Listing files found while scanning.... C:\WINNT\system32\wpxeiuox.exe C:\WINNT\system32\geeda.dll C:\WINNT\system32\adeeg.ini C:\WINNT\system32\adeeg.bak1 Beginning removal... Attempting to delete C:\WINNT\system32\wpxeiuox.exe C:\WINNT\system32\wpxeiuox.exe Has been deleted! Attempting to delete C:\WINNT\system32\geeda.dll C:\WINNT\system32\geeda.dll Could not be deleted. Attempting to delete C:\WINNT\system32\adeeg.ini C:\WINNT\system32\adeeg.ini Has been deleted! Attempting to delete C:\WINNT\system32\adeeg.bak1 C:\WINNT\system32\adeeg.bak1 Has been deleted! Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINNT\system32\geeda.dll C:\WINNT\system32\geeda.dll Has been deleted! Performing Repairs to the registry. Done! Administrator - Thu 10/05/2006 23:13:41.34 Service Pack 4 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Administrator\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINNT\system32\adrot-uninst.exe C:\WINNT\system32\adrotate.dll C:\WINNT\uninstall_nmon.vbs C:\Documents and Settings\Default User\Application Data\NetMon C:\WINNT\QWxsZW4 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\PPATCH~1 C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\SMANTE~1 C:\QooBox\Purity\Program Files\Common Files\PPATCH~1 C:\QooBox\Purity\WINNT\system32\RACLE~1 ((((((((((((((((((((((((((((((( Files Created from 2006-09-05 to 2006-10-05 )))))))))))))))))))))))))))))))))) 2006-10-05 23:10 1,492 --a------ C:\WINNTvundofix.reg 2006-10-05 23:03 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys 2006-10-05 22:57 88,064 --a------ C:\VundoFix.exe 2006-10-05 16:13 53,248 --a------ C:\WINNT\system32\Process.exe 2006-10-05 16:13 40,960 --a------ C:\WINNT\system32\swsc.exe 2006-10-05 16:13 288,417 --a------ C:\WINNT\system32\SrchSTS.exe 2006-10-05 16:13 135,168 --a------ C:\WINNT\system32\swreg.exe 2006-10-05 09:12 86,036 --a------ C:\WINNT\system32\binpmcuv.dll 2006-10-05 08:20 40,973 ---hs---- C:\WINNT\system32\rqrrstr.dll 2006-09-28 06:24 75,264 --a------ C:\WINNT\system32\nsb45.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-05 23:15 -------- d-a------ C:\Program Files\Common Files 2006-10-05 23:03 -------- d-------- C:\Program Files\Grisoft 2006-10-05 16:12 -------- d-------- C:\Program Files\Hijackthis 2006-10-05 10:18 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2006-10-05 10:17 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2006-10-05 10:17 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Help 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2006-10-05 10:02 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic 2006-10-05 10:00 -------- d-------- C:\Documents and Settings\Administrator\Application Data\ACD Systems 2006-10-05 09:46 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2006-10-05 09:40 -------- d-------- C:\Program Files\iTunes 2006-10-05 09:40 -------- d-------- C:\Program Files\AIM+ 2006-10-05 09:37 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft 2006-10-05 09:31 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Aim 2006-10-05 09:29 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2006-10-05 09:18 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-05 09:13 2 --a------ C:\WINNT\system32\wtstr.exe 2006-10-05 08:34 -------- d-------- C:\Program Files\Windows Media Player 2006-10-05 08:25 -------- d-------- C:\Program Files\Windows NT 2006-10-05 01:04 -------- d-------- C:\Program Files\Warcraft III 2006-10-03 21:48 -------- d-------- C:\Program Files\AIM95 2006-09-25 09:00 -------- d-------- C:\Program Files\ZyX 2006-07-15 14:04 98304 --a------ C:\WINNT\system32\CmdLineExt.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="\"C:\\Program Files\\AIM+\\AIM+.exe\" -cnetwait.odl" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" @="" "Abci"="\"C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\DOBE~1\\spool32.exe\" -vt ndrv" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "DVD43"="C:\\Program Files\\DVD Region+CSS Free\\DVD43.exe /hidden" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe" "zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit" "ntdll.dll"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000003 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vise.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows NT\\saqyjy.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,c0 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Microsoft Video Capture Controls"="wucaultz.exe" [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{93994DE8-8239-4655-B1D1-5F4E91300429}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=hex:95,00,00,00 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=hex:95,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: Thu 2006-10-05 23:15:36.14 ComboFix.txt AVG Anti-Spyware - Scan Report + Created at: 12:13:59 AM 10/6/2006 + Scan result: C:\Documents and Settings\All Users\Application Data\AutoSearch.dll -> Adware.AutoSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKLM\SOFTWARE\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-515967899-583907252-682003330-500\Software\DeluxeCommunications -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). HKU\S-1-5-21-515967899-583907252-682003330-500\Software\DeluxeCommunications\Internet Explorer -> Adware.DeluxeCommunications : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20060903-012524-696.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20061005-083843-611.dll -> Adware.PurityScan : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20061005-083843-696.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINNT\system32\rqrrstr.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Internet Files\Content.IE5\S1MNCTUB\popup[3].php -> Hijacker.Agent.a : Cleaned with backup (quarantined). C:\Program Files\Windows NT\saqyjy.html -> Hijacker.Small.jf : Cleaned with backup (quarantined). ::Report end 2.8c 800mhz fsb 2 gb 512x4 geil dual channel asus p4p800 se 60 gb ibm 7200 rpm 80 gb maxtor 7200 300 gb seagate 7200 thermaltake va3000 tsunami evga geforce 6800gs 256mb

Go to start > controlpanel > software > add/remove programs and uninstall next if present: Oin Yazzle by Oin YazzleActiveX By OIN Purityscan by Oin Snowballwars by Oin Cowabanga by OIN or anything similar with Oin in it. If OIN not listed, download and run this uninstaller OiUninstaller.exe Reboot when done! Really important! Next, please download Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. Save it to your desktop. Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINNT\system32\rqrrstr.dll C:\WINNT\system32\nsb45.dll C:\WINNT\system32\wtstr.exe C:\Program Files\Windows NT\saqyjy.html Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Abci"=- [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. Post a new Hijack This log and a new combofix log please.

Logfile of HijackThis v1.99.1 Scan saved at 8:24:47 AM, on 10/6/2006 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\hidserv.exe C:\WINNT\system32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Logitech\iTouch\iTouch.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM+\AIM+.exe C:\PROGRA~1\AIM95\aim.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\WINNT\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\WINNT\system32\cmd.exe C:\Program Files\Hijackthis\show.exe Administrator - Fri 10/06/2006 8:21:18.64 Service Pack 4 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Administrator\Desktop\spyware adaware" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINNT\system32\adrot-uninst.exe C:\WINNT\system32\adrotate.dll C:\WINNT\uninstall_nmon.vbs C:\Documents and Settings\Default User\Application Data\NetMon C:\WINNT\QWxsZW4 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\PPATCH~1 C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\SMANTE~1 C:\QooBox\Purity\Program Files\Common Files\PPATCH~1 C:\QooBox\Purity\WINNT\system32\RACLE~1 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\PPATCH~1 C:\QooBox\Purity\Documents and Settings\Administrator\My Documents\SMANTE~1 C:\QooBox\Purity\Program Files\Common Files\PPATCH~1 C:\QooBox\Purity\WINNT\system32\RACLE~1 ((((((((((((((((((((((((((((((( Files Created from 2006-09-05 to 2006-10-05 )))))))))))))))))))))))))))))))))) 2006-10-06 08:08 310,280 --a------ C:\system.exe 2006-10-05 23:15 358 --a------ C:\Combo.bat (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-05 23:20 -------- d-------- C:\Program Files\Hijackthis 2006-10-05 23:15 -------- d-a------ C:\Program Files\Common Files 2006-10-05 23:03 -------- d-------- C:\Program Files\Grisoft 2006-10-05 10:18 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft 2006-10-05 10:17 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2006-10-05 10:17 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Help 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2006-10-05 10:16 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2006-10-05 10:02 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic 2006-10-05 10:00 -------- d-------- C:\Documents and Settings\Administrator\Application Data\ACD Systems 2006-10-05 09:46 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2006-10-05 09:40 -------- d-------- C:\Program Files\iTunes 2006-10-05 09:40 -------- d-------- C:\Program Files\AIM+ 2006-10-05 09:37 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Lavasoft 2006-10-05 09:31 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Aim 2006-10-05 09:29 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2006-10-05 09:18 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-05 08:34 -------- d-------- C:\Program Files\Windows Media Player 2006-10-05 08:25 -------- d-------- C:\Program Files\Windows NT 2006-10-05 01:04 -------- d-------- C:\Program Files\Warcraft III 2006-10-03 21:48 -------- d-------- C:\Program Files\AIM95 2006-09-25 09:00 -------- d-------- C:\Program Files\ZyX 2006-07-15 14:04 98304 --a------ C:\WINNT\system32\CmdLineExt.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="\"C:\\Program Files\\AIM+\\AIM+.exe\" -cnetwait.odl" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "DVD43"="C:\\Program Files\\DVD Region+CSS Free\\DVD43.exe /hidden" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe" "zBrowser Launcher"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe" "NvCplDaemon"="RUNDLL32.EXE C:\\WINNT\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit" "ntdll.dll"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000003 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\Program Files\\ComPlus Applications\\vise.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="C:\\Program Files\\Windows NT\\saqyjy.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,c0 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Microsoft Video Capture Controls"="wucaultz.exe" [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{93994DE8-8239-4655-B1D1-5F4E91300429}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=hex:95,00,00,00 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=hex:95,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Completion time: Fri 2006-10-06 8:22:57.01 ComboFix.txt 2.8c 800mhz fsb 2 gb 512x4 geil dual channel asus p4p800 se 60 gb ibm 7200 rpm 80 gb maxtor 7200 300 gb seagate 7200 thermaltake va3000 tsunami evga geforce 6800gs 256mb