It just happened overnight and it SUCKS. I really don't understand why people even make programs like this, it's sick. Anyway, I've used Spybot and Adaware a couple times and I still can't get of it. I keep getting pop ups that I'm at risk, my credit card information is being shared, download this file to get rid of it all, etc., but I don't trust any of those programs to use them. Roby (or anyone else), do you have any good links for me to do a system scan to see what I need to do to get rid of this crap...AGAIN?

Now, before I was able to post that, it asked me if I'm sure I want to share this "information" with the internet and that I should check it before I send it out. I've never gotten that before. And then this, too.

Try Microsoft Anti-Spyware, it works well

I just found a website - Spyware Warrior - that might be able to help.

Does anyone know how one can prevent spyware from finding itself on your computer? Besides the obvious like not downloading wierd files or following weird links from pop-ups. It seem that I'm always careful about where I go and what I do, but I still seem to get this crap over and over again. I really don't get it.

the important thing is to get the most up-to-date versions of AdAware (http://tinyurl.com/du0h)/Spybot (http://tinyurl.com/37t9f) and Microsoft Antispyware (http://tinyurl.com/7xrvg) and run them in SAFEMODE.

if you can download HijackThis (http://tinyurl.com/ysp9h), run a scan and post a log here and we'll see what you've got.

as for keeping stuff out... run all your antispware programs regularily and keep them up-to-date, and use SpywareBlaster (http://tinyurl.com/g1d9), Mike's Host's file (http://tinyurl.com/coye) and MS Antispyware to block known bad programs.

...And most importantly, PLEASE STOP USING INTERNET EXPLORER. Switch to Firefox - you have far less probs that way.

IE is full of holes and it's really easy for you to get hit with nasty spyware when you're on IE. If you use Firefox, it will be much better. There are devs constantly working to improve Firefox, so it's harder for you to get hit with bad spyware when you use Firefox.

...And most importantly, PLEASE STOP USING INTERNET EXPLORER. Switch to Firefox - you have far less probs that way.

IE is full of holes and it's really easy for you to get hit with nasty spyware when you're on IE. If you use Firefox, it will be much better. There are devs constantly working to improve Firefox, so it's harder for you to get hit with bad spyware when you use Firefox.
word.

^^ I've used Firefox before, but I don't really like it. Nothing major, but little things that Firefox has and doesn't have is annoying and hard to get used to. I could try and stay on a little longer, but I just don't find it as comfortable as IE.

So I dowloaded the Microsoft Antispyware software, and it ran a GREAT scan. Showed me everything I had and told me it got rid of it. But when I rebooted, I still have the little exclamtion points in my bottom toolbar (In the picture attached) that saying that my system is infected with spyware and that I should go to THEIR links to get anti-spyware software. Well, when I ran the Microsoft Application, one of THEIR anti-spyware programs was on there AS spyware...nice huh? I clicked on all the links Roby gave me and downloaded them all, ran them, and then rebooted, but I still think something is wrong. I also went to my favorites list to see if someone had replied to my post on the spyware boards yet, and I found a bunch of "new" favorites that I never put there in the first place. I hope they reply to me soon because this is one of the worst infections I've ever had. I think it's also time to venture over to Firefox permanently...if it gets rid of this crap, I guess I can get used to it. Though I'm not looking forward to resetting all my favorites all over again.

I think a move to Firefox is what I'm going to do. I scanned and I scanned and I scanned so much last night. And my computer said it got rid of everything, yet, when I restart right after, it says I STILL have infections. Theres this one peice of spywar (trojan.intell32) that Microsoft Antispyware program says I have, and it keeps removing it, yet it keeps coming back. And then this "PSGuard spyware remover" keeps installig on my computer after I constantly delete it...the spyware program roby told me to download keeps detecting it, removing it, but it keeps coming BACK. And I have no idea why....I still didn't get a responce on that other site with my log, but it's as if I can't even go online without any of this stupid crap reappearing again and again. Can you reccomend I download anything ELSE?! And maybe how to restart in safe mode (and come back from it) so I can scan that way? I went to my computers help menu, but the directions didn't work (IT says go to shut down then to pull down to "shut down in safe mode," but I only have Turn Off Computer, and nothing else. I know there's a way to do it because I've done it before, but I can't remember how.

Also...when I run the scan, it always says I have two less items detected than the number by the signatures. (In the attached picture) And I'm concerned about it. I'm now on Firefox only and will only open IE to get my links to my favorites, but I'm convinced everytime I just open it, I open a portal to let more and more of this damn spyware come in. I'm at the point where I want to just chuck this thing out the window. I don't know what to do anymore.

Oh, and I can't even get on AIM to talk to anyone about help (I have a friend who also helps me a lot), so this is just getting more frustrated by the minute.

And here's my HijackThis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 12:10:28, on 2005-09-11
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\msole32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/

QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.

com/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/

MsnMessengerSetupDownloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Some of this MAY be overkill, but it shouldn't miss anything:

Download CCleaner at http://www.ccleaner.com/ccdownload.asp and install it, but do not run it yet.

Download Nailfix Utility at http://www.noidea.us/easyfile/file.php?dow...050711214630636 Save it to your desktop. Do NOT run it yet.

Download smitRem.zip at http://noahdfear.geekstogo.com/click%20cou.../click.php?id=1 and save the file to your desktop.
Unzip the file to it's own folder on the desktop.

Download the trial version of Ewido Security Suite at http://www.ewido.net/en/download/ and read the Ewido setup instructions at http://rstones12.geekstogo.com/ewidosetup.htm. Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Download CoolwebShredder at http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe
run it and click on the "fix ->" button - if it finds anything, run the tool again in safemode.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Once in Safe Mode, double-click on nailfix.exe.
Click 'Next' in the setup, then make sure 'Run Nailfix' is checked and click 'Finish'.
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

C:\WINDOWS\System32\msole32.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000
R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52.../mickey/us/win/

O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll

Open the smitRem folder and double click on the RunThis.bat file to start the tool. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish.

Uninstall these from the Add/Remove panel if found:

PSGuard
MyWebSearch

Delete these if found:

C:\Program Files\MyWebSearch\
C:\WINDOWS\Nail.exe
C:\WINDOWS\wupdt.exe
C:\WINDOWS\System32\yaemu.exe
c:\windows\system32\cphrxsm.exe
C:\PROGRA~1\Toolbar\
c:\windows\system32\krxjphfci.exe
C:\WINDOWS\system32\msmsgs.exe
C:\WINDOWS\system32\intell32.exe
C:\Program Files\PSGuard\
EGDACCESS_1061.dll

The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log

Open Ad-aware and do a full scan. Remove all it finds.

Run Ewido:

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* While the scan is in progress you will be prompted to clean files, click OK
* When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop.

Close Ewido.

Next go to Control Panel->Display->Desktop->Customize Desktop->Web-> Uncheck 'Security Info' if present.

Now run CCleaner.

1. Uncheck 'Cookies' under 'Internet Explorer'.
2. If running Firefox: click on the 'Applications' tab and uncheck 'Cookies' under 'Firefox'.
3. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Reboot back into Windows and go to http://www.pandasoftware.com/activescan/co...n_principal.htm to do a full system scan. Make sure the autoclean box is checked. Save the scan log and post it along with a new HijackThis log, the contents of the smitfiles.txt log and the Ewido log

you may also want to try the 30-day trial version of the a-squared trojan removal tool: http://www.emsisoft.com/en/software/download/


a couple of sites with important info (incuding manual removal instructions):

http://www.spyware-removal-guideline.com/psguard-removal
http://www.greatis.com/appdata/d/_/_sysdir__intell32.exe_Removal.htm

I've been trying to post this....but I keep having this window closed. Over and over again. Microsoft Antispyware keeps giving me warning every MINUTE that Trojan.Intell and the PSGuard keep trying to install, I select the 'remove' option, yet PSGuard KEEPS installing and I have to keep deleting it from the Add/Remove Programs in the Control Panel. Every time I delete it...I think the situation is every WORSE after doing all that. It's not your fault, I just don't know what the hell I'm doing wrong. I did everthing you told me to do, in that exact order, and in Safemode...and everything keeps screwing up. Anyway, here are my logs.

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 00:10:54, on 2005-09-12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\msole32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\intell32.exe
C:\Program Files\Microsoft AntiSpyware\gcasServAlert.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Ewido

---------------------------------------------------------
ewido security suite - Startup report
---------------------------------------------------------

+ Created on: 22:18:50, 2005-09-11
+ Report-Checksum: 8AF4EFBB

Reg\HKLM\Run ATIModeChange Ati2mdxx.exe
Reg\HKLM\Run ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Reg\HKLM\Run MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
Reg\HKLM\Run Display Settings C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
Reg\HKLM\Run QT4HPOT C:\Program Files\HPQ\One-Touch\OneTouch.EXE
Reg\HKLM\Run SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
Reg\HKLM\Run SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Reg\HKLM\Run HPHUPD05 c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
Reg\HKLM\Run HP Software Update "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
Reg\HKLM\Run HPHmon05 C:\WINDOWS\System32\hphmon05.exe
Reg\HKLM\Run RoxioDragToDisc "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
Reg\HKLM\Run RoxioEngineUtility "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
Reg\HKLM\Run CARPService carpserv.exe
Reg\HKLM\Run WMC_AutoUpdate
Reg\HKLM\Run TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Reg\HKLM\Run HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Reg\HKLM\Run HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
Reg\HKLM\Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
Reg\HKLM\Run RegSvr32 C:\WINDOWS\System32\msmsgs.exe
Reg\HKLM\Run gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
Reg\HKLM\Run MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
Reg\HKCU\Run Weather C:\Program Files\AWS\WeatherBug\Weather.exe 1
Reg\HKCU\Run CTFMON.EXE C:\WINDOWS\System32\CTFMON.EXE
Reg\HKCU\Run Skype "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
Reg\HKCU\Run MsnMsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Shell\CommonStartup hp psc 1000 series.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
Shell\CommonStartup hpoddt01.exe.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk

---------------------------------------------------------
ewido security suite - Process report
---------------------------------------------------------

+ Created on: 22:18:59, 2005-09-11
+ Report-Checksum: 544A9FCE

0: System Process
4: System Process
156: \SystemRoot\System32\smss.exe
204: \??\C:\WINDOWS\system32\csrss.exe
228: \??\C:\WINDOWS\system32\winlogon.exe
272: C:\WINDOWS\system32\services.exe
284: C:\WINDOWS\system32\lsass.exe
464: C:\WINDOWS\system32\svchost.exe
496: C:\WINDOWS\system32\svchost.exe
704: C:\WINDOWS\Explorer.EXE
940: C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\SecuritySuite.exe

NailFix, SmitRem, and pandasoftware, I couldn't get those because the links didn't work.

I've been trying to post this....but I keep having this window closed. Over and over again. Microsoft Antispyware keeps giving me warning every MINUTE that Trojan.Intell and the PSGuard keep trying to install, I select the 'remove' option, yet PSGuard KEEPS installing and I have to keep deleting it from the Add/Remove Programs in the Control Panel. Every time I delete it...I think the situation is every WORSE after doing all that. It's not your fault, I just don't know what the hell I'm doing wrong. I did everthing you told me to do, in that exact order, and in Safemode...and everything keeps screwing up. Anyway, here are my logs.

.......

NailFix, SmitRem, and pandasoftware, I couldn't get those because the links didn't work.
yeah, i guess those links have expired, it is still in there big time - try again with these links:

http://www.spywareedge.net/nf/nailfix.exe
http://www.spywareaid.com/index.php?file=s...22&softtype=exe

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

http://www.google.com/url?sa=t&ct=res&cd=2&url=http%3A//www.pandasoftware.com/activescan/activescan.asp%3FLanguage%3D2%26Country%3D63%26Partner%3D1%26Ref%3DEN-PR-AS-107&ei=BmYlQ42ENcT0iQHN-9CYAQ

just follow the same instructions again, you NEED to run nailfix.exe in safemode to get rid of this - if CWshredder doesn't find anything you dont need to run it again.

it is also VERY important to make sure that you can see hidden files (http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/hiddenfiles.mspx) and MANUALLY delete all the files and folders that I listed WHEN YOU ARE IN SAFEMODE. if you leave pretty much ANY of that stuff, it will just restore it after the next boot

It just happened overnight and it SUCKS. I really don't understand why people even make programs like this, it's sick. Anyway, I've used Spybot and Adaware a couple times and I still can't get of it. I keep getting pop ups that I'm at risk, my credit card information is being shared, download this file to get rid of it all, etc., but I don't trust any of those programs to use them. Roby (or anyone else), do you have any good links for me to do a system scan to see what I need to do to get rid of this crap...AGAIN?


JW, Do you have AOL? If so, avoid any AOL spyware removing programs. I ran one, and it made my windows crash completely.

roby,

thanks again. I got eveyrhting downloaded. Although that second link you posted....all that came up in the window was "Nice Try." uhhhhhh...

Dr. John Becker,

I had a free AOL trial, but it was only for 3 months. I never ran any scans by them and I don't have AOL anymore. Thanks, though.

am I supposed to be getting that?

At the library now. Just thought I'd let you know that my computer died. The system32 file was somehow "damaged" so that I can't even start Windows, or so it tells me when I start my computer. I tried reinstalling it with the XP CD, but my computer keeps giving me error message and nothing will work. So Monday, it's going to the shop to be completely redone. And I lost everything...wonderful. Thank you SO much you ****ing spyware/virus/worm distributors. I really appreciate having to shell loads of cash for something that YOU did to my PC. I hope you burn in hell.

Roby, thank you SO much for bearing with me through all of this. Unfortunately, the outcome of this turned out to be the worst case scenario, but alas, we're not all lucky enough to beat this **** and avoid it from eating away at our systems. But I appreciate all the help you gave me and having to deal with my problems all the time. I greatly appreciate your time and patience.

There are three great anti-spyware programs I use each week and all work great for me! Here they are:


HouseCall by TrendMicro. No need to download software. It will let you know how many spyware programs as well as 'Trojan Horses' and other malicious items that could infect your computer. Recommend scan at least once a week.

HouseCall by Trend Micro:
http://housecall.trendmicro.com

--

Norton Anti-Virus/Symantec. You can purchase the latest edition (2005) or order it online for an annual subscription fee and you'll get the latest updates each week and lets you know if a virus(es) have been found.

Symantec's website:
http://www.symantec.com

--

StompSoft Spyware X-Terminator. I downloaded the 2005 version a few months ago and it does a pretty good job finding spyware. The 2004 version worked pretty good as well (that version emits a siren type sound letting you know spyware has been found). You'll also get frequent updates.

StompSoft Spyware X-Terminator:
http://www.stompsoft.com/spywarexterminator.html

You can either purchase a subscription online or at a local computer store.

Sorry that this happened to you and with the products mentioned above your computer will be healthier than ever before! (or if you plan on getting a new computer in the near future). Note: the other two services scans for computer viruses. :)

Hope all this helps!! :)

roby,

thanks again. I got eveyrhting downloaded. Although that second link you posted....all that came up in the window was "Nice Try." uhhhhhh...

man, I am sorry that we weren't able to fix it - make sure you tell the place you take it to to TRY and get your data off of there - it still should be retreivable (just make sure they scan it for crap before you try to access it again

that second link was just a different place to download nailfix.exe so dont worry too much if it doesnt work (i tried to link directly to the file, but you probably need to go to the site and DL it from there)

make sure that after you get it fixed you take all the precautions you can to keep this crap off in the future, and back up regularily, because there really is NO way to be 100% spyware/virus proof.

At the library now. Just thought I'd let you know that my computer died. The system32 file was somehow "damaged" so that I can't even start Windows, or so it tells me when I start my computer. I tried reinstalling it with the XP CD, but my computer keeps giving me error message and nothing will work. So Monday, it's going to the shop to be completely redone. And I lost everything...wonderful. Thank you SO much you ****ing spyware/virus/worm distributors. I really appreciate having to shell loads of cash for something that YOU did to my PC. I hope you burn in hell.

Roby, thank you SO much for bearing with me through all of this. Unfortunately, the outcome of this turned out to be the worst case scenario, but alas, we're not all lucky enough to beat this **** and avoid it from eating away at our systems. But I appreciate all the help you gave me and having to deal with my problems all the time. I greatly appreciate your time and patience.


They may be able to fix it with a system restore disk. That worked on mine a few weeks ago. Good luck :wave:

When my laptop had to get fixed earlier this year, they said I could retrieve my data for a fee. I don't know if it would have been guaranteed, though. I didn't want to pay money for it, however, since I didn't have anything worth saving.