my son inadvertently downoaded a Trojan. I am having the hardest time getting rid of it. I have run AdAware and Spybot. Here is the Hijack This log. Can somebody help me, please??? What do I need to delete and how do I go about doing it? I'm not a novice to computers, but this one really has me pulling out my hair. Thanks! Logfile of HijackThis v1.97.7 Scan saved at 10:35:47 PM, on 12/11/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\NMSSvc.exe C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\PROMon.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Support.com\bin\tgcmd.exe C:\WINDOWS\xtglzrih.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Kyle\Application Data\DownloadPlus.exe C:\Program Files\Greetings Workshop\GWREMIND.exe C:\PROGRA~1\COMMON~2\ADDRES~1\comwiz.exe C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Program Files\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.blazefind.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.blazefind.com/search_page.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O2 - BHO: (no name) - {77087C3B-0B4D-3A29-9F74-8DD7DEDBAEB5} - C:\WINDOWS\system32\xaqmsgon.dll O2 - BHO: (no name) - {AC6B0AB9-396B-A21D-7D4C-CCA4BA44CC8F} - C:\WINDOWS\system32\dgbqbkpb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {D8E25C53-9508-4f5c-9249-D98D438891D5} - C:\WINDOWS\System32\ssurf022.dll O2 - BHO: Curtains for Windows Popup Filter - {E59C1919-DD0F-42FC-B39B-52F54384F781} - C:\Program Files\Comcast Cable Communications\Security Manager\app\AuthBHO.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [Launcher] "C:\Program Files\KFH\cl\launcher.exe" /P O4 - HKLM\..\Run: [SearchEnhancement] "C:\Program Files\scbar\v1\scbar.exe" /U O4 - HKLM\..\Run: [npxorynw] C:\WINDOWS\xtglzrih.exe O4 - HKLM\..\Run: [WinFavorites] c:\program files\winfavorites\WinFavorites.exe1 O4 - HKLM\..\Run: [] c:\WINDOWS\System32\ O4 - HKLM\..\Run: [nvid] C:\WINDOWS\System32\ofncos.exe O4 - HKLM\..\Run: [SafeSurfingUpdate] C:\WINDOWS\System32\SSUpdate.exe O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [] c:\WINDOWS\System32\ O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Kyle\Application Data\DownloadPlus.exe O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Try a system restore first. Start/Programs/Accessories/System tools/System restore If that doesn't work. Then download and run Trojan Hunter. It's a trial version. But it may at least help you identify the Trojan so that you may remove it manually. It can be found here: http://www.misec.net/ Good Luck.

Download mIRC www.mirc.com Connect to DALNET by typing in the Status window: /server irc.dal.net 6667 And then join the channel #nohack by typing in the Status Window: /join #nohack They will help you there. Zvonarek

The moderator is likely to delete your post very soon. Please go to http://www.computing.net/windowsxp/wwwboard/forum/87147.html and follow the instructions. Note - your post should have been in the Security & Virus sub-forum Good luck V...

Hi sharona, Open the task manager and end process on the following: C:\WINDOWS\xtglzrih.exe C:\PROGRA~1\COMMON~2\ADDRES~1\comwiz.exe Next, Run HijackThis again and place a check in the box next to the following items. Doublecheck so as to be sure not to miss one. Next, close all browser Windows, and have HT 'fix checked'. You Must restart your computer in safe mode when you're done. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.blazefind.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.blazefind.com/search_page.php R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O2 - BHO: (no name) - {77087C3B-0B4D-3A29-9F74-8DD7DEDBAEB5} - C:\WINDOWS\system32\xaqmsgon.dll O2 - BHO: (no name) - {AC6B0AB9-396B-A21D-7D4C-CCA4BA44CC8F} - C:\WINDOWS\system32\dgbqbkpb.dll O2 - BHO: (no name) - {D8E25C53-9508-4f5c-9249-D98D438891D5} - C:\WINDOWS\System32\ssurf022.dll O4 - HKLM\..\Run: [SearchEnhancement] "C:\Program Files\scbar\v1\scbar.exe" /U O4 - HKLM\..\Run: [npxorynw] C:\WINDOWS\xtglzrih.exe O4 - HKLM\..\Run: [WinFavorites] c:\program files\winfavorites\WinFavorites.exe1 O4 - HKLM\..\Run: [] c:\WINDOWS\System32\ O4 - HKLM\..\Run: [nvid] C:\WINDOWS\System32\ofncos.exe O4 - HKLM\..\Run: [SafeSurfingUpdate] C:\WINDOWS\System32\SSUpdate.exe O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe O4 - HKCU\..\Run: [] c:\WINDOWS\System32\ O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Kyle\Application Data\DownloadPlus.exe Once in safe mode delete the following: C:\WINDOWS\xtglzrih.exe C:\WINDOWS\System32\ofncos.exe C:\WINDOWS\System32\SSUpdate.exe C:\WINDOWS\Belt.exe C:\Program Files\scbar folder. C:\Program Files\winfavorites folder. C:\Program Files\CommonName folder.

Check thread # 7986 in the Security and virus forum for sprcific instructions to get rid of this.

Thank you, everyone, so much for your help. I'm sorry I posted this in the wrong forum. This is my first time to visit the site and I was not really thinking. You iknow you can get when you're frustrated beyond belief! Thanks again! Sharon