I'd appreciate any help. Recently, I've been unable to run my spyware program through AVG. The program opens, sometimes for a few seconds, sometimes for a minute, then closes down. I can't get a complete scan. I ran a log in safe mode using HiJack This, and I need help figuring out what to get rid of. Can anyone help, please? Thanks! Gordon

Please post your Hijack This log.

Thanks a lot, I appreciate it- here's what I got in safe mode: Logfile of HijackThis v1.99.1 Scan saved at 6:10:16 PM, on 12/8/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\LEXBCES.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Creative\ShareDLL\CtNotify.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\nordsys.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Creative\ShareDLL\MediaDet.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\YAHOO!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\DOCUME~1\LORNEB~1\LOCALS~1\Temp\Rar$EX00.112\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/ O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [Dfm] C:\WINDOWS\System32\Lpr.exe O4 - HKLM\..\Run: [Log] C:\WINDOWS\System32\Mem.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet O4 - HKCU\..\Run: [Dfm] C:\WINDOWS\System32\Lpr.exe O4 - HKCU\..\Run: [Log] C:\WINDOWS\System32\Mem.exe O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.exe O9 - Extra button: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU) O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O14 - IERESET.INF: START_PAGE_URL=http://my.netzero.net/s/sp O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.dotphoto.com/XUpload.ocx O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

I ran the SmitFraudFix (in regular mode- did I need to do it in safe mode?) Here's what it gave me: SmitFraudFix v2.128 Scan done at 9:07:20.16, Sat 12/09/2006 Run from C:\Documents and Settings\Lorne Boni\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\alexaie.dll FOUND ! C:\WINDOWS\alxie328.dll FOUND ! C:\WINDOWS\alxtb1.dll FOUND ! C:\WINDOWS\about_spyware_bg.gif FOUND ! C:\WINDOWS\about_spyware_bottom.gif FOUND ! C:\WINDOWS\as.gif FOUND ! C:\WINDOWS\as_header.gif FOUND ! C:\WINDOWS\bg.gif FOUND ! C:\WINDOWS\box_1.gif FOUND ! C:\WINDOWS\box_2.gif FOUND ! C:\WINDOWS\box_3.gif FOUND ! C:\WINDOWS\button_buynow.gif FOUND ! C:\WINDOWS\button_freescan.gif FOUND ! C:\WINDOWS\close-bar.gif FOUND ! C:\WINDOWS\d3??.dll FOUND ! C:\WINDOWS\download_box.gif FOUND ! C:\WINDOWS\features.gif FOUND ! C:\WINDOWS\footer_back.gif FOUND ! C:\WINDOWS\footer_back.jpg FOUND ! C:\WINDOWS\header_1.gif FOUND ! C:\WINDOWS\header_2.gif FOUND ! C:\WINDOWS\header_3.gif FOUND ! C:\WINDOWS\header_4.gif FOUND ! C:\WINDOWS\infected.gif FOUND ! C:\WINDOWS\main_back.gif FOUND ! C:\WINDOWS\rf.gif FOUND ! C:\WINDOWS\rf_header.gif FOUND ! C:\WINDOWS\scan_btn.gif FOUND ! C:\WINDOWS\security-center-bg.gif FOUND ! C:\WINDOWS\security-center-logo.gif FOUND ! C:\WINDOWS\security_center_caption.gif FOUND ! C:\WINDOWS\sep_hor.gif FOUND ! C:\WINDOWS\sep_vert.gif FOUND ! C:\WINDOWS\spacer.gif FOUND ! C:\WINDOWS\spacer.gif' FOUND ! C:\WINDOWS\spyware-detected.gif FOUND ! C:\WINDOWS\star.gif FOUND ! C:\WINDOWS\star_gray.gif FOUND ! C:\WINDOWS\star_gray_small.gif FOUND ! C:\WINDOWS\star_small.gif FOUND ! C:\WINDOWS\ts.gif FOUND ! C:\WINDOWS\ts_header.gif FOUND ! C:\WINDOWS\v.gif FOUND ! C:\WINDOWS\warning_icon.gif FOUND ! C:\WINDOWS\warning-bar-ico.gif FOUND ! C:\WINDOWS\win_logo.gif FOUND ! C:\WINDOWS\x.gif FOUND ! C:\WINDOWS\yod.htm FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\dailytoolbar.dll FOUND ! C:\WINDOWS\system32\migicons.exe FOUND ! C:\WINDOWS\system32\oiso.bin FOUND ! C:\WINDOWS\system32\questmod.dll FOUND ! C:\WINDOWS\system32\thlwin32.dll FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lorne Boni »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Lorne Boni\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\LORNEB~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="C:\\WINDOWS\\warnhp.html" "SubscribedURL"="" "FriendlyName"="Warning homepage" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd" Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log. Post a new Hijack This log please.

Thanks for all the help with this (I did notice that I can only access this site through IE. I had switched to Firefox, it seems when I access sites about spyware, including this one, it shuts down). Also, after running SmitfraudFix in safe mode, when I rebooted in normal mode my desktop background had changed to a solid blue color, and the Microsoft Word icons looked different. To do the last step with the new HiJack This log, I had to go back into safe mode. It kept closing itself everytime I tried in regular mode. First, here's the SmitfraudFix log: SmitFraudFix v2.128 Scan done at 13:48:45.42, Sat 12/09/2006 Run from C:\Documents and Settings\Lorne Boni\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\alexaie.dll Deleted C:\WINDOWS\alxie328.dll Deleted C:\WINDOWS\alxtb1.dll Deleted C:\WINDOWS\about_spyware_bg.gif Deleted C:\WINDOWS\about_spyware_bottom.gif Deleted C:\WINDOWS\as.gif Deleted C:\WINDOWS\as_header.gif Deleted C:\WINDOWS\bg.gif Deleted C:\WINDOWS\box_1.gif Deleted C:\WINDOWS\box_2.gif Deleted C:\WINDOWS\box_3.gif Deleted C:\WINDOWS\button_buynow.gif Deleted C:\WINDOWS\button_freescan.gif Deleted C:\WINDOWS\close-bar.gif Deleted C:\WINDOWS\d3??.dll Deleted C:\WINDOWS\download_box.gif Deleted C:\WINDOWS\features.gif Deleted C:\WINDOWS\footer_back.gif Deleted C:\WINDOWS\footer_back.jpg Deleted C:\WINDOWS\header_1.gif Deleted C:\WINDOWS\header_2.gif Deleted C:\WINDOWS\header_3.gif Deleted C:\WINDOWS\header_4.gif Deleted C:\WINDOWS\infected.gif Deleted C:\WINDOWS\main_back.gif Deleted C:\WINDOWS\rf.gif Deleted C:\WINDOWS\rf_header.gif Deleted C:\WINDOWS\scan_btn.gif Deleted C:\WINDOWS\security-center-bg.gif Deleted C:\WINDOWS\security-center-logo.gif Deleted C:\WINDOWS\security_center_caption.gif Deleted C:\WINDOWS\sep_hor.gif Deleted C:\WINDOWS\sep_vert.gif Deleted C:\WINDOWS\spacer.gif Deleted C:\WINDOWS\spacer.gif' Deleted C:\WINDOWS\spyware-detected.gif Deleted C:\WINDOWS\star.gif Deleted C:\WINDOWS\star_gray.gif Deleted C:\WINDOWS\star_gray_small.gif Deleted C:\WINDOWS\star_small.gif Deleted C:\WINDOWS\ts.gif Deleted C:\WINDOWS\ts_header.gif Deleted C:\WINDOWS\v.gif Deleted C:\WINDOWS\warning_icon.gif Deleted C:\WINDOWS\warning-bar-ico.gif Deleted C:\WINDOWS\win_logo.gif Deleted C:\WINDOWS\x.gif Deleted C:\WINDOWS\yod.htm Deleted C:\WINDOWS\system32\dailytoolbar.dll Deleted C:\WINDOWS\system32\migicons.exe Deleted C:\WINDOWS\system32\oiso.bin Deleted C:\WINDOWS\system32\questmod.dll Deleted C:\WINDOWS\system32\thlwin32.dll Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End NEXT, HERE'S THE COMBOFIX.TXT LOG: ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Lorne Boni\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-09 to 2006-12-09 )))))))))))))))))))))))))))))))))) 2006-12-09 13:52 6,199 --a------ C:\Documents and Settings\Lorne Boni\CuSnVib.exe 2006-12-09 09:07 3,672 --a------ C:\WINDOWS\SYSTEM32\tmp.reg 2006-12-08 17:44 6,199 --a------ C:\Documents and Settings\Lorne Boni\.exe 2006-12-07 21:12 3,968 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\AvgAsCln.sys 2006-12-07 21:09 6,199 --a------ C:\Documents and Settings\Lorne Boni\Irf1nOD.exe 2006-12-03 22:12 6,199 --a------ C:\WINDOWS\SYSTEM32\igoblyns.exe 2006-12-02 01:57 6,199 --a------ C:\Documents and Settings\Lorne Boni\oabpH6w.exe 2006-11-28 18:33 6,199 --a------ C:\Documents and Settings\Lorne Boni\ua7OD64.exe 2006-11-28 08:32 6,199 --a------ C:\Documents and Settings\Lorne Boni\O05n5f8.exe 2006-11-28 08:32 128,567 --a------ C:\WINDOWS\SYSTEM32\ss.exe.exe 2006-11-26 19:10 6,199 --a------ C:\Documents and Settings\Lorne Boni\x12ag0f.exe 2006-11-26 10:54 6,199 --a------ C:\Documents and Settings\Lorne Boni\bO5R3Au.exe 2006-11-25 22:27 6,199 --a------ C:\WINDOWS\SYSTEM32\se.exe.exe 2006-11-25 22:27 6,199 --a------ C:\WINDOWS\SYSTEM32\jpLU731.exe 2006-11-25 22:27 54,327 --a------ C:\WINDOWS\SYSTEM32\google.png.exe 2006-11-25 22:27 15,927 --a------ C:\WINDOWS\SYSTEM32\w.exe.exe 2006-11-25 22:27 15,927 ---h----- C:\WINDOWS\SYSTEM32\nordsys.exe 2006-11-25 22:26 6,199 --a------ C:\WINDOWS\SYSTEM32\fukkfxkl.exe 2006-11-25 22:24 <DIR> d-------- C:\Program Files\iPod 2006-11-25 22:23 <DIR> d-------- C:\Program Files\iTunes 2006-11-25 22:21 <DIR> d--hs---- C:\Config.Msi 2006-11-25 22:20 <DIR> d-------- C:\Program Files\Apple Software Update (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-06 07:53 6276 --a------ C:\WINDOWS\SYSTEM32\bsoaimyg.exe 2006-09-19 15:43 109360 --a------ C:\WINDOWS\SYSTEM32\GEARAspi.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Yahoo! Pager"="\"C:\\PROGRA~1\\YAHOO!\\MESSEN~1\\ypager.exe\" -quiet" "Dfm"="C:\\WINDOWS\\System32\\Lpr.exe" "Log"="C:\\WINDOWS\\System32\\Mem.exe" "Nord"="C:\\WINDOWS\\System32\\nordsys.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SystemTray"="SysTray.Exe" "Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.exe" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP" "AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe" "Dfm"="C:\\WINDOWS\\System32\\Lpr.exe" "Log"="C:\\WINDOWS\\System32\\Mem.exe" "Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe" "HP Software Update"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\"" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "SpywareTerminator"="\"C:\\Program Files\\Spyware Terminator\\SpywareTerminatorShield.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "Nord"="C:\\WINDOWS\\System32\\nordsys.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000005 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 "CDRAutoRun"=hex:00,00,00,00 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 "CDRAutoRun"=dword:00000000 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 "CDRAutoRun"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "Speed racer"="C:\\Program Files\\Creative\\PlayCenter\\CTSRReg.exe" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.exe" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "LexStart"="lexstart.exe" "SHPC32"="shpc32.exe" "GW Port Controller"="C:\\PROGRA~1\\SAMSUNG\\SMARTHRU\\PORTCT95.exe" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM32\\qttask.exe\" -atboottime" "AVG_CC"="C:\\PROGRA~1\\GRISOFT\\AVG6\\avgcc32.exe /STARTUP" "P2P NETWORKING"="C:\\WINDOWS\\SYSTEM\\P2P NETWORKING\\P2P NETWORKING.exe /AUTOSTART" "updmgr"="C:\\Program Files\\Common files\\updmgr\\updmgr.exe" "AltnetPointsManager"="c:\\program files\\altnet\\points manager\\points manager.exe -s" "CMESys"="\"C:\\PROGRAM FILES\\COMMON FILES\\CMEII\\CMESYS.EXE\"" "WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe" "Microsoft Works Update Detection"="C:\\Program Files\\Microsoft Works\\WkDetect.exe" "wcmdmgr"="C:\\WINDOWS\\wt\\updater\\wcmdmgrl.exe -launch" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Tune-up Application Start.job C:\WINDOWS\tasks\PCHealth Scheduler for Data Collection.job C:\WINDOWS\tasks\Uninstall Expiration Reminder.job C:\WINDOWS\tasks\AppleSoftwareUpdate.job Completion time: 06-12-09 13:58:52.23 C:\ComboFix.txt ... 06-12-09 13:58 AND THE NEW HIJACK THIS LOG: Logfile of HijackThis v1.99.1 Scan saved at 2:10:17 PM, on 12/9/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\LORNEB~1\LOCALS~1\Temp\Rar$EX00.822\HijackThis.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [Dfm] C:\WINDOWS\System32\Lpr.exe O4 - HKLM\..\Run: [Log] C:\WINDOWS\System32\Mem.exe O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe" -quiet O4 - HKCU\..\Run: [Dfm] C:\WINDOWS\System32\Lpr.exe O4 - HKCU\..\Run: [Log] C:\WINDOWS\System32\Mem.exe O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.exe O9 - Extra button: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {94447078-FBCB-476A-91A4-9872507EDF63} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU) O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll O14 - IERESET.INF: START_PAGE_URL=http://my.netzero.net/s/sp O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windows... O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.dotphoto.com/XUpload.ocx O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)