Hello i have been having some recent problems. My AVg anti-virus scanner found 3 virus: Belt.exe, actalert[1], and cln446.tmp but AVG couln't delete it nor fix it. Can anyone help? Logfile of HijackThis v1.97.7 Scan saved at 6:09:11 PM, on 2/24/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Apache Group\Apache\Apache.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Apache Group\Apache\Apache.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\ASUS\Probe\AsusProb.exe C:\Program Files\Kazaa Lite K++\KazaaLite.kpp C:\WINDOWS\mscomdx2.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\PROGRA~1\ESB\ESBUpdate.exe C:\Program Files\ClearSearch\Loader.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\System32\lyalwmtx.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\Program Files\Shareaza\Shareaza.exe C:\WINDOWS\SpecialOffers.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\ICQ\ICQ.exe C:\Program Files\E-Color\True Internet Color\TICIcon.exe C:\PROGRA~1\eZula\mmod.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\Program Files\Bargain Buddy\bin\bargains.exe C:\Program Files\Grisoft\AVG7\avgwb.dat C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Enrico and Malou\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.blazefind.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.blazefind.com/search_page.php R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\Program Files\ClearSearch\IE_ClrSch.DLL O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\bi.dll O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\Program Files\Lycos\Sidesearch\sidesearch1311.dll O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.107-big.dll O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.3.9.0\HbHostIE.dll O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRA~1\BARGAI~1\bin\apuc.dll O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem214.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: IE Search Bar - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [KAZAA] "C:\Program Files\Kazaa Lite K++\kpp.exe" "C:\Program Files\Kazaa Lite K++\KazaaLite.kpp" /SYSTRAY O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT O4 - HKLM\..\Run: [EanthologyApp] C:\PROGRA~1\COMMON~1\EACCEL~1\EANTHO~1.exe /b Startup O4 - HKLM\..\Run: [mscomdx2] C:\WINDOWS\mscomdx2.exe O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe -invisible O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [EasySearchBar] C:\PROGRA~1\ESB\ESBUpdate.exe O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe O4 - HKLM\..\Run: [lfmzrkcm] C:\WINDOWS\System32\lyalwmtx.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\\SmartDoctor.exe /start O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray O4 - HKCU\..\Run: [system] C:\WINDOWS\System32\antiv.exe O4 - HKCU\..\Run: [SpecialOffers] C:\WINDOWS\SpecialOffers.exe O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe O4 - HKCU\..\RunOnce: [ICQ] C:\Program Files\ICQ\ICQ.exe -trayboot O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: True Internet Color Icon.lnk = C:\Program Files\E-Color\True Internet Color\TICIcon.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar_en_2.0.107-big.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar_en_2.0.107-big.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar_en_2.0.107-big.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar_en_2.0.107-big.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar_en_2.0.107-big.dll/cmtrans.html O9 - Extra button: Sidesearch (HKLM) O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: ICQ Pro (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O9 - Extra button: EasySearchBar (HKLM) O9 - Extra 'Tools' menuitem: EasySearchBar (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/payload2.cab O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} (AxOOdlz Class) - http://defender.veloz.com/pub/download/oodlz_chs.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/flash.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {63C4C187-E23F-4A20-898C-62CAF22335F8} (WatchOCX.WatchX) - https://www.watchsatellite.tv/members/WatchOCX.CAB O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {8F24DE00-0D66-4F93-9405-3F21E97AEEA1} (TestingCtl Control) - http://esb.alcena.com/EasySearchBarInstaller.ocx O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000XP/bridge.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.273287037 O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx O16 - DPF: {BB0578ED-E672-4697-9663-EC5A0460B949} (SomaticCAB.Setup) - http://downloads.searchcentrix.com/install/somaticCAB.CAB O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://kr.pristontale.com/nprotect/nprotect/npx.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} (StarInstall Control) - http://install.stardialer.de/StarInstall.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

go to www.trendmicro.com, and use their free online housecall scan. be sure to check the box to scan your entire computer. you can then delete the viruses that it finds after your scan. if you like the program, you should dl the free trial of pc-cillin from cnet.com.

try rebooting in safemode and then running the antivirus, that might fix the problem, and/or run an online one that might also help

kebos Hi! Should have posted this in seurity/virus forum but I spent an hour on this log...and hope you see it before it gets deleted... (also supposed to use ad-aware or spybot) Anyhow... Lots of work to do.... First look in add/remove programs (in control panel) and remove the following programs if listed: iesearchbar Hotbar Bargin buddy EanthologyApp....may not be exactly that name.... Internet optimizer ezula Lycos or lycos sidesearch Most will need internet connection to uninstall Reboot when prompted. Place hijackthis in its own folder on your desktop...it makes backups and will clutter your desktop with a ton of files. Do this while OFFLINE Start hijackthis and check the following to fix: (some may no longer be there) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.blazefind.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.blazefind.com/search_page.php R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\Program Files\ClearSearch\IE_ClrSch.DLL O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\bi.dll O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\Program Files\Lycos\Sidesearch\sidesearch1311.dll O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\Program Files\Hotbar\bin\4.3.9.0\HbHostIE.dll O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRA~1\BARGAI~1\bin\apuc.dll O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem214.dll O3 - Toolbar: IE Search Bar - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O4 - HKLM\..\Run: [EanthologyApp] C:\PROGRA~1\COMMON~1\EACCEL~1\EANTHO~1.exe /b Startup O4 - HKLM\..\Run: [mscomdx2] C:\WINDOWS\mscomdx2.exe O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe -invisible O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [EasySearchBar] C:\PROGRA~1\ESB\ESBUpdate.exe O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe O4 - HKLM\..\Run: [lfmzrkcm] C:\WINDOWS\System32\lyalwmtx.exe O4 - HKCU\..\Run: [system] C:\WINDOWS\System32\antiv.exe O4 - HKCU\..\Run: [SpecialOffers] C:\WINDOWS\SpecialOffers.exe O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe O9 - Extra button: Sidesearch (HKLM) O9 - Extra button: EasySearchBar (HKLM) O9 - Extra 'Tools' menuitem: EasySearchBar (HKLM) O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/payload2.cab O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} (AxOOdlz Class) - http://defender.veloz.com/pub/download/oodlz_chs.cab O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FIX19105/flash.cab O16 - DPF: {8F24DE00-0D66-4F93-9405-3F21E97AEEA1} (TestingCtl Control) - http://esb.alcena.com/EasySearchBarInstaller.ocx O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000XP/bridge.cab O16 - DPF: {BB0578ED-E672-4697-9663-EC5A0460B949} (SomaticCAB.Setup) - http://downloads.searchcentrix.com/install/somaticCAB.CAB O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} (StarInstall Control) - http://install.stardialer.de/StarInstall.ocx Close all open windows except hijack and click "fix checked" Reboot the computer to SAFE mode and delete th following files/folders c:\windows\mscomdx2.exe <-rename to mscomdx2.old (I can't find info on this file, I want to be able to restore it if needed) c:\windows\specialoffers.exe <- file c:\windows\system32\spoolsvv.exe <- file (Note the spelling!...spoolsv.exe is valid) c:\windows\system32\lyalwmtx.exe <-file c:\windows\system32\antiv.exe <-file c:\program files\clearsearch <- folder c:\program files\lycos <-folder c:\program files\iesearchbar <-folder c:\program files\hotbar <-folder c:\program files\bargin buddy <-folder c:\program files\eAcceleration <-folder c:\program files\internet optimizer <- folder c:\program files\exula <-folder Reboot the computer to regular windows. Download the following: Ad-aware Spybot Spywareblaster Spyware is for prevention...once installed, update, click "select all", click "protect from selected items" Spybot and ad-aware are cleaners (free). Once installed check for and install all updates. Run their scans (seperately) and let them remove all found items...there will be many. Reboot after each scan. I dont see actalert[1] or belt.exe running They are likely in system volume information\_RESTORE\big long number\another number.exe That is your system restore folder, windows locks it out from any programs modifying it including antivirus. The only way to remove infected files from there is to shut off system restore, reboot, rescan...if all clean...turn on system restore. How? 1. Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK. How to Turn On and Turn Off System Restore in Windows XP http://support.microsoft.com/default.aspx?...kb;en-us;310405 I like to wait till I am all done fixing the computer before turning off system restore...that will delete all restore points along with the virus. So If something really bad goes wrong while doing any repairs...you have no restore points. The virus cannot escape from there unless you actually use restore. You have a bargeload of spyware/downloaderware etc. but no "serious" virus. Once you have done all that...Hopefully the post is not deleted...(for posting log in wrong forum etc) Might as well post fresh log to see if there is anything missed. There is still a few things left to do but we want things running properly first. ____________________________________ I never give up!

Woah! Thank you for your time in helping me. I tried it all and it worked! thank you so much!!!

I have the same problems and I noticed that I also have the eZula stuff that Kebos had. But I can neither access the control panel nor the add/remove programs. How am I supposed to fix it?

Kebos Glad it worked out ok. For now leave the file I told you to rename until you know for sure all is working ok. The file sitting where it is...renamed cannot do anything bad but is easy to restore if needed. I would still like to see a new log...just to make sure we got it all. First log was quite nasty...I may have missed something risking re-infection. As for other things to do... 1. Make sure you have all your windows and IE updates...install all criticals listed. 2. Spybot adds further protection against malware downloads and hijacks. Start spybot (advanced mode) Click "immunize" (red icon) Click ok at the prompt Click the immunize button at bottom of spybot window. Scroll down that window and under "permanantly running bad download blocker for IE" Click install. If you don't use the hosts file or don't know what I am talking about...also check "lock hosts file read-only as protecton against hijackers" 3. Download Spywareguard...that program will watch in the background your home and search pages for changes made by you or hijacker. It will alert you with popup allowing you to accept the change or fix it. SpywareGuard 4. If you havn't already...turn on xp's firewall (or dowload one of your choice) Xp's firewall works good but only monitors/stops incomming traffic. A 3rd party firewall such as zone alarm, kerio, etc will monitor both incomming and outgoing traffic. Monitoring outgoing traffic is important...it can alert you if a strange program wants internet access ( Giving you a clue you may have some malware) To turn on xp's firewall Click start Point to settings Point to network connections Right click your internet connection Click Properties Click advanced Checkmark "protect my computer.....from the internet" Click apply Click ok 5. Remember to check regularly for updates for all your protection software. Good luck! _____________________________ I never give up!