Malicious spyware attack - Sitcoms Online Message Boards

Czas na Zywiec · 09-10-2005, 03:25 PM

It just happened overnight and it SUCKS. I really don't understand why people even make programs like this, it's sick. Anyway, I've used Spybot and Adaware a couple times and I still can't get of it. I keep getting pop ups that I'm at risk, my credit card information is being shared, download this file to get rid of it all, etc., but I don't trust any of those programs to use them. Roby (or anyone else), do you have any good links for me to do a system scan to see what I need to do to get rid of this crap...AGAIN?

Czas na Zywiec · 09-10-2005, 03:29 PM

Now, before I was able to post that, it asked me if I'm sure I want to share this "information" with the internet and that I should check it before I send it out. I've never gotten that before. And then this, too.

James"Thunder"Early · 09-10-2005, 03:31 PM

Try Microsoft Anti-Spyware, it works well

Czas na Zywiec · 09-10-2005, 04:11 PM

I just found a website - Spyware Warrior - that might be able to help.

Does anyone know how one can prevent spyware from finding itself on your computer? Besides the obvious like not downloading wierd files or following weird links from pop-ups. It seem that I'm always careful about where I go and what I do, but I still seem to get this crap over and over again. I really don't get it.

robyrob · 09-10-2005, 04:52 PM

the important thing is to get the most up-to-date versions of AdAware/Spybot and Microsoft Antispyware and run them in SAFEMODE.

if you can download HijackThis, run a scan and post a log here and we'll see what you've got.

as for keeping stuff out... run all your antispware programs regularily and keep them up-to-date, and use SpywareBlaster, Mike's Host's file and MS Antispyware to block known bad programs.

PZelda · 09-10-2005, 04:57 PM

...And most importantly, PLEASE STOP USING INTERNET EXPLORER. Switch to Firefox - you have far less probs that way.

IE is full of holes and it's really easy for you to get hit with nasty spyware when you're on IE. If you use Firefox, it will be much better. There are devs constantly working to improve Firefox, so it's harder for you to get hit with bad spyware when you use Firefox.

robyrob · 09-10-2005, 05:27 PM

Quote:

Originally Posted by PZelda

...And most importantly, PLEASE STOP USING INTERNET EXPLORER. Switch to Firefox - you have far less probs that way.

IE is full of holes and it's really easy for you to get hit with nasty spyware when you're on IE. If you use Firefox, it will be much better. There are devs constantly working to improve Firefox, so it's harder for you to get hit with bad spyware when you use Firefox.

word.

Czas na Zywiec · 09-10-2005, 07:41 PM

^^ I've used Firefox before, but I don't really like it. Nothing major, but little things that Firefox has and doesn't have is annoying and hard to get used to. I could try and stay on a little longer, but I just don't find it as comfortable as IE.

Czas na Zywiec · 09-10-2005, 08:58 PM

So I dowloaded the Microsoft Antispyware software, and it ran a GREAT scan. Showed me everything I had and told me it got rid of it. But when I rebooted, I still have the little exclamtion points in my bottom toolbar (In the picture attached) that saying that my system is infected with spyware and that I should go to THEIR links to get anti-spyware software. Well, when I ran the Microsoft Application, one of THEIR anti-spyware programs was on there AS spyware...nice huh? I clicked on all the links Roby gave me and downloaded them all, ran them, and then rebooted, but I still think something is wrong. I also went to my favorites list to see if someone had replied to my post on the spyware boards yet, and I found a bunch of "new" favorites that I never put there in the first place. I hope they reply to me soon because this is one of the worst infections I've ever had. I think it's also time to venture over to Firefox permanently...if it gets rid of this crap, I guess I can get used to it. Though I'm not looking forward to resetting all my favorites all over again.

Czas na Zywiec · 09-11-2005, 02:01 PM

I think a move to Firefox is what I'm going to do. I scanned and I scanned and I scanned so much last night. And my computer said it got rid of everything, yet, when I restart right after, it says I STILL have infections. Theres this one peice of spywar (trojan.intell32) that Microsoft Antispyware program says I have, and it keeps removing it, yet it keeps coming back. And then this "PSGuard spyware remover" keeps installig on my computer after I constantly delete it...the spyware program roby told me to download keeps detecting it, removing it, but it keeps coming BACK. And I have no idea why....I still didn't get a responce on that other site with my log, but it's as if I can't even go online without any of this stupid crap reappearing again and again. Can you reccomend I download anything ELSE?! And maybe how to restart in safe mode (and come back from it) so I can scan that way? I went to my computers help menu, but the directions didn't work (IT says go to shut down then to pull down to "shut down in safe mode," but I only have Turn Off Computer, and nothing else. I know there's a way to do it because I've done it before, but I can't remember how.

Also...when I run the scan, it always says I have two less items detected than the number by the signatures. (In the attached picture) And I'm concerned about it. I'm now on Firefox only and will only open IE to get my links to my favorites, but I'm convinced everytime I just open it, I open a portal to let more and more of this damn spyware come in. I'm at the point where I want to just chuck this thing out the window. I don't know what to do anymore.

Oh, and I can't even get on AIM to talk to anyone about help (I have a friend who also helps me a lot), so this is just getting more frustrated by the minute.

Czas na Zywiec · 09-11-2005, 02:11 PM

And here's my HijackThis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 12:10:28, on 2005-09-11
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\msole32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...mickey/us/win/

QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...all.trendmicro.

com/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/

MsnMessengerSetupDownloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

robyrob · 09-11-2005, 06:32 PM

Some of this MAY be overkill, but it shouldn't miss anything:

Download CCleaner at http://www.ccleaner.com/ccdownload.asp and install it, but do not run it yet.

Download Nailfix Utility at http://www.noidea.us/easyfile/file.p...50711214630636 Save it to your desktop. Do NOT run it yet.

Download smitRem.zip at http://noahdfear.geekstogo.com/click...click.php?id=1 and save the file to your desktop.
Unzip the file to it's own folder on the desktop.

Download the trial version of Ewido Security Suite at http://www.ewido.net/en/download/ and read the Ewido setup instructions at http://rstones12.geekstogo.com/ewidosetup.htm. Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Download CoolwebShredder at http://www.trendmicro.com/ftp/produc...cwshredder.exe
run it and click on the "fix ->" button - if it finds anything, run the tool again in safemode.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Once in Safe Mode, double-click on nailfix.exe.
Click 'Next' in the setup, then make sure 'Run Nailfix' is checked and click 'Finish'.
Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

C:\WINDOWS\System32\msole32.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000
R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52.../mickey/us/win/

O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19
O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll

Open the smitRem folder and double click on the RunThis.bat file to start the tool. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish.

Uninstall these from the Add/Remove panel if found:

PSGuard
MyWebSearch

Delete these if found:

C:\Program Files\MyWebSearch\
C:\WINDOWS\Nail.exe
C:\WINDOWS\wupdt.exe
C:\WINDOWS\System32\yaemu.exe
c:\windows\system32\cphrxsm.exe
C:\PROGRA~1\Toolbar\
c:\windows\system32\krxjphfci.exe
C:\WINDOWS\system32\msmsgs.exe
C:\WINDOWS\system32\intell32.exe
C:\Program Files\PSGuard\
EGDACCESS_1061.dll

The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log

Open Ad-aware and do a full scan. Remove all it finds.

Run Ewido:

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* While the scan is in progress you will be prompted to clean files, click OK
* When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop.

Close Ewido.

Next go to Control Panel->Display->Desktop->Customize Desktop->Web-> Uncheck 'Security Info' if present.

Now run CCleaner.

1. Uncheck 'Cookies' under 'Internet Explorer'.
2. If running Firefox: click on the 'Applications' tab and uncheck 'Cookies' under 'Firefox'.
3. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.

Reboot back into Windows and go to http://www.pandasoftware.com/actives..._principal.htm to do a full system scan. Make sure the autoclean box is checked. Save the scan log and post it along with a new HijackThis log, the contents of the smitfiles.txt log and the Ewido log

you may also want to try the 30-day trial version of the a-squared trojan removal tool: http://www.emsisoft.com/en/software/download/

a couple of sites with important info (incuding manual removal instructions):

http://www.spyware-removal-guideline...sguard-removal
http://www.greatis.com/appdata/d/_/_...xe_Removal.htm

Czas na Zywiec · 09-12-2005, 02:22 AM

I've been trying to post this....but I keep having this window closed. Over and over again. Microsoft Antispyware keeps giving me warning every MINUTE that Trojan.Intell and the PSGuard keep trying to install, I select the 'remove' option, yet PSGuard KEEPS installing and I have to keep deleting it from the Add/Remove Programs in the Control Panel. Every time I delete it...I think the situation is every WORSE after doing all that. It's not your fault, I just don't know what the hell I'm doing wrong. I did everthing you told me to do, in that exact order, and in Safemode...and everything keeps screwing up. Anyway, here are my logs.

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 00:10:54, on 2005-09-12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\msole32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\intell32.exe
C:\Program Files\Microsoft AntiSpyware\gcasServAlert.exe
C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU)
O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab
O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Ewido

---------------------------------------------------------
ewido security suite - Startup report
---------------------------------------------------------

+ Created on: 22:18:50, 2005-09-11
+ Report-Checksum: 8AF4EFBB

Reg\HKLM\Run ATIModeChange Ati2mdxx.exe
Reg\HKLM\Run ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Reg\HKLM\Run MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
Reg\HKLM\Run Display Settings C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
Reg\HKLM\Run QT4HPOT C:\Program Files\HPQ\One-Touch\OneTouch.EXE
Reg\HKLM\Run SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
Reg\HKLM\Run SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Reg\HKLM\Run HPHUPD05 c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
Reg\HKLM\Run HP Software Update "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
Reg\HKLM\Run HPHmon05 C:\WINDOWS\System32\hphmon05.exe
Reg\HKLM\Run RoxioDragToDisc "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
Reg\HKLM\Run RoxioEngineUtility "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
Reg\HKLM\Run CARPService carpserv.exe
Reg\HKLM\Run WMC_AutoUpdate
Reg\HKLM\Run TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Reg\HKLM\Run HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
Reg\HKLM\Run HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
Reg\HKLM\Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
Reg\HKLM\Run RegSvr32 C:\WINDOWS\System32\msmsgs.exe
Reg\HKLM\Run gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
Reg\HKLM\Run MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
Reg\HKCU\Run Weather C:\Program Files\AWS\WeatherBug\Weather.exe 1
Reg\HKCU\Run CTFMON.EXE C:\WINDOWS\System32\CTFMON.EXE
Reg\HKCU\Run Skype "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
Reg\HKCU\Run MsnMsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Shell\CommonStartup hp psc 1000 series.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
Shell\CommonStartup hpoddt01.exe.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk

---------------------------------------------------------
ewido security suite - Process report
---------------------------------------------------------

+ Created on: 22:18:59, 2005-09-11
+ Report-Checksum: 544A9FCE

0: System Process
4: System Process
156: \SystemRoot\System32\smss.exe
204: \??\C:\WINDOWS\system32\csrss.exe
228: \??\C:\WINDOWS\system32\winlogon.exe
272: C:\WINDOWS\system32\services.exe
284: C:\WINDOWS\system32\lsass.exe
464: C:\WINDOWS\system32\svchost.exe
496: C:\WINDOWS\system32\svchost.exe
704: C:\WINDOWS\Explorer.EXE
940: C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\SecuritySuite.exe

NailFix, SmitRem, and pandasoftware, I couldn't get those because the links didn't work.

robyrob · 09-12-2005, 07:26 AM

Quote:

Originally Posted by Czas na Zywiec

I've been trying to post this....but I keep having this window closed. Over and over again. Microsoft Antispyware keeps giving me warning every MINUTE that Trojan.Intell and the PSGuard keep trying to install, I select the 'remove' option, yet PSGuard KEEPS installing and I have to keep deleting it from the Add/Remove Programs in the Control Panel. Every time I delete it...I think the situation is every WORSE after doing all that. It's not your fault, I just don't know what the hell I'm doing wrong. I did everthing you told me to do, in that exact order, and in Safemode...and everything keeps screwing up. Anyway, here are my logs.

.......

NailFix, SmitRem, and pandasoftware, I couldn't get those because the links didn't work.

yeah, i guess those links have expired, it is still in there big time - try again with these links:

http://www.spywareedge.net/nf/nailfix.exe
http://www.spywareaid.com/index.php?...2&softtype=exe

http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.google.com/url?sa=t&ct=re...NcT0iQHN-9CYAQ

just follow the same instructions again, you NEED to run nailfix.exe in safemode to get rid of this - if CWshredder doesn't find anything you dont need to run it again.

it is also VERY important to make sure that you can see hidden files and MANUALLY delete all the files and folders that I listed WHEN YOU ARE IN SAFEMODE. if you leave pretty much ANY of that stuff, it will just restore it after the next boot

Dr. John Becker · 09-12-2005, 09:17 AM

Quote:

Originally Posted by Czas na Zywiec

It just happened overnight and it SUCKS. I really don't understand why people even make programs like this, it's sick. Anyway, I've used Spybot and Adaware a couple times and I still can't get of it. I keep getting pop ups that I'm at risk, my credit card information is being shared, download this file to get rid of it all, etc., but I don't trust any of those programs to use them. Roby (or anyone else), do you have any good links for me to do a system scan to see what I need to do to get rid of this crap...AGAIN?

JW, Do you have AOL? If so, avoid any AOL spyware removing programs. I ran one, and it made my windows crash completely.

09-10-2005, 03:25 PM	#1
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	Malicious spyware attack It just happened overnight and it SUCKS. I really don't understand why people even make programs like this, it's sick. Anyway, I've used Spybot and Adaware a couple times and I still can't get of it. I keep getting pop ups that I'm at risk, my credit card information is being shared, download this file to get rid of it all, etc., but I don't trust any of those programs to use them. Roby (or anyone else), do you have any good links for me to do a system scan to see what I need to do to get rid of this crap...AGAIN?

09-10-2005, 03:29 PM	#2
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	Now, before I was able to post that, it asked me if I'm sure I want to share this "information" with the internet and that I should check it before I send it out. I've never gotten that before. And then this, too. Attached Images

09-10-2005, 03:31 PM	#3
James"Thunder"Early Whoever's In New England Forum Veteran Join Date: Feb 23, 2004 Location: The Apollo Posts: 7,088	Try Microsoft Anti-Spyware, it works well
	__________________ Esther Anderson: Get thee behind me, Satan, but I'm gon' get behind you, 'cause I'm gonna put my foot in your--- Peggy Mitchell: Get outta my pub! You better pray you get the last laugh, it's a kick in the teeth when you don't get it.

09-10-2005, 04:52 PM	#5
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,200	the important thing is to get the most up-to-date versions of AdAware/Spybot and Microsoft Antispyware and run them in SAFEMODE. if you can download HijackThis, run a scan and post a log here and we'll see what you've got. as for keeping stuff out... run all your antispware programs regularily and keep them up-to-date, and use SpywareBlaster, Mike's Host's file and MS Antispyware to block known bad programs.
	__________________ * firefox * AdAware * HiJackThis * CoolWebShredder * Spybot * SpywareBlaster * Spyware Terminator * * GeeksToGo * AntiVir * Avast antivirus * Housecall Online * Sysinternals Security Utilities * * ZoneAlarm * Agnitum-firewall * Comodo Firewall * AVG Anti-Rootkit * RootkitRevealer * ParasiteCheck * * Annoyances * FreeCodecs * Mikes-Hosts-File * GRC.com * MSAntispyware * DVD's * TradeList * myspace *

09-10-2005, 04:57 PM	#6
PZelda Two Valeries! <3 Forum Addict Join Date: Jul 15, 2002 Location: I'm STILL missing NYC. :( Posts: 78,223	...And most importantly, PLEASE STOP USING INTERNET EXPLORER. Switch to Firefox - you have far less probs that way. IE is full of holes and it's really easy for you to get hit with nasty spyware when you're on IE. If you use Firefox, it will be much better. There are devs constantly working to improve Firefox, so it's harder for you to get hit with bad spyware when you use Firefox.
	__________________ Cheers behind the couch!

09-10-2005, 04:11 PM	#4
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	I just found a website - Spyware Warrior - that might be able to help. Does anyone know how one can prevent spyware from finding itself on your computer? Besides the obvious like not downloading wierd files or following weird links from pop-ups. It seem that I'm always careful about where I go and what I do, but I still seem to get this crap over and over again. I really don't get it.

09-10-2005, 07:41 PM	#8
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	^^ I've used Firefox before, but I don't really like it. Nothing major, but little things that Firefox has and doesn't have is annoying and hard to get used to. I could try and stay on a little longer, but I just don't find it as comfortable as IE.

09-10-2005, 08:58 PM	#9
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	So I dowloaded the Microsoft Antispyware software, and it ran a GREAT scan. Showed me everything I had and told me it got rid of it. But when I rebooted, I still have the little exclamtion points in my bottom toolbar (In the picture attached) that saying that my system is infected with spyware and that I should go to THEIR links to get anti-spyware software. Well, when I ran the Microsoft Application, one of THEIR anti-spyware programs was on there AS spyware...nice huh? I clicked on all the links Roby gave me and downloaded them all, ran them, and then rebooted, but I still think something is wrong. I also went to my favorites list to see if someone had replied to my post on the spyware boards yet, and I found a bunch of "new" favorites that I never put there in the first place. I hope they reply to me soon because this is one of the worst infections I've ever had. I think it's also time to venture over to Firefox permanently...if it gets rid of this crap, I guess I can get used to it. Though I'm not looking forward to resetting all my favorites all over again. Attached Images

09-11-2005, 02:01 PM	#10
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	I think a move to Firefox is what I'm going to do. I scanned and I scanned and I scanned so much last night. And my computer said it got rid of everything, yet, when I restart right after, it says I STILL have infections. Theres this one peice of spywar (trojan.intell32) that Microsoft Antispyware program says I have, and it keeps removing it, yet it keeps coming back. And then this "PSGuard spyware remover" keeps installig on my computer after I constantly delete it...the spyware program roby told me to download keeps detecting it, removing it, but it keeps coming BACK. And I have no idea why....I still didn't get a responce on that other site with my log, but it's as if I can't even go online without any of this stupid crap reappearing again and again. Can you reccomend I download anything ELSE?! And maybe how to restart in safe mode (and come back from it) so I can scan that way? I went to my computers help menu, but the directions didn't work (IT says go to shut down then to pull down to "shut down in safe mode," but I only have Turn Off Computer, and nothing else. I know there's a way to do it because I've done it before, but I can't remember how. Also...when I run the scan, it always says I have two less items detected than the number by the signatures. (In the attached picture) And I'm concerned about it. I'm now on Firefox only and will only open IE to get my links to my favorites, but I'm convinced everytime I just open it, I open a portal to let more and more of this damn spyware come in. I'm at the point where I want to just chuck this thing out the window. I don't know what to do anymore. Oh, and I can't even get on AIM to talk to anyone about help (I have a friend who also helps me a lot), so this is just getting more frustrated by the minute. Attached Images

09-11-2005, 02:11 PM	#11
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	And here's my HijackThis logfile: Logfile of HijackThis v1.99.1 Scan saved at 12:10:28, on 2005-09-11 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\HPConfig.exe C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\msole32.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\HPQ\One-Touch\OneTouch.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\WINDOWS\System32\carpserv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000 R3 - Default URLSearchHook is missing O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...mickey/us/win/ QuickTimeInstaller.exe O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...all.trendmicro. com/housecall/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ MsnMessengerSetupDownloader.cab O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

09-11-2005, 06:32 PM	#12
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,200	Some of this MAY be overkill, but it shouldn't miss anything: Download CCleaner at http://www.ccleaner.com/ccdownload.asp and install it, but do not run it yet. Download Nailfix Utility at http://www.noidea.us/easyfile/file.p...50711214630636 Save it to your desktop. Do NOT run it yet. Download smitRem.zip at http://noahdfear.geekstogo.com/click...click.php?id=1 and save the file to your desktop. Unzip the file to it's own folder on the desktop. Download the trial version of Ewido Security Suite at http://www.ewido.net/en/download/ and read the Ewido setup instructions at http://rstones12.geekstogo.com/ewidosetup.htm. Install it, and update the definitions to the newest files. Do NOT run a scan yet. Download CoolwebShredder at http://www.trendmicro.com/ftp/produc...cwshredder.exe run it and click on the "fix ->" button - if it finds anything, run the tool again in safemode. Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Once in Safe Mode, double-click on nailfix.exe. Click 'Next' in the setup, then make sure 'Run Nailfix' is checked and click 'Finish'. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): C:\WINDOWS\System32\msole32.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ask.com/iesearch/index.asp?origin=7019 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qus8l.hpwis.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=sas.r4.attbi.com:8000 R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\System32\yaemu.exe O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52.../mickey/us/win/ O17 - HKLM\System\CCS\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CCS\Services\Tcpip\..\{D2C92699-0AA2-425A-998B-EA26538A6385}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CS1\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O17 - HKLM\System\CS2\Services\Tcpip\..\{1DC14C42-E830-4AD9-A817-DB9B64B80C35}: NameServer = 69.50.168.138,85.255.112.19 O20 - AppInit_DLLs: vgtzkf4km9s1tsll.dll Open the smitRem folder and double click on the RunThis.bat file to start the tool. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish. Uninstall these from the Add/Remove panel if found: PSGuard MyWebSearch Delete these if found: C:\Program Files\MyWebSearch\ C:\WINDOWS\Nail.exe C:\WINDOWS\wupdt.exe C:\WINDOWS\System32\yaemu.exe c:\windows\system32\cphrxsm.exe C:\PROGRA~1\Toolbar\ c:\windows\system32\krxjphfci.exe C:\WINDOWS\system32\msmsgs.exe C:\WINDOWS\system32\intell32.exe C:\Program Files\PSGuard\ EGDACCESS_1061.dll The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log Open Ad-aware and do a full scan. Remove all it finds. Run Ewido: * Click on scanner * Click on Complete System Scan and the scan will begin. * While the scan is in progress you will be prompted to clean files, click OK * When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK. * Once the scan has completed, there will be a button located on the bottom of the screen named Save report * Click Save report. * Save the report .txt file to your desktop. Close Ewido. Next go to Control Panel->Display->Desktop->Customize Desktop->Web-> Uncheck 'Security Info' if present. Now run CCleaner. 1. Uncheck 'Cookies' under 'Internet Explorer'. 2. If running Firefox: click on the 'Applications' tab and uncheck 'Cookies' under 'Firefox'. 3. Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run. Reboot back into Windows and go to http://www.pandasoftware.com/actives..._principal.htm to do a full system scan. Make sure the autoclean box is checked. Save the scan log and post it along with a new HijackThis log, the contents of the smitfiles.txt log and the Ewido log you may also want to try the 30-day trial version of the a-squared trojan removal tool: http://www.emsisoft.com/en/software/download/ a couple of sites with important info (incuding manual removal instructions): http://www.spyware-removal-guideline...sguard-removal http://www.greatis.com/appdata/d/_/_...xe_Removal.htm

09-12-2005, 02:22 AM	#13
Czas na Zywiec what up Forum Star Join Date: Jun 28, 2001 Location: Southwest Side, Chicago Posts: 18,398	I've been trying to post this....but I keep having this window closed. Over and over again. Microsoft Antispyware keeps giving me warning every MINUTE that Trojan.Intell and the PSGuard keep trying to install, I select the 'remove' option, yet PSGuard KEEPS installing and I have to keep deleting it from the Add/Remove Programs in the Control Panel. Every time I delete it...I think the situation is every WORSE after doing all that. It's not your fault, I just don't know what the hell I'm doing wrong. I did everthing you told me to do, in that exact order, and in Safemode...and everything keeps screwing up. Anyway, here are my logs. HijackThis Logfile of HijackThis v1.99.1 Scan saved at 00:10:54, on 2005-09-12 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe C:\WINDOWS\system32\HPConfig.exe C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\msole32.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\HPQ\One-Touch\OneTouch.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\WINDOWS\System32\carpserv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\intell32.exe C:\Program Files\Microsoft AntiSpyware\gcasServAlert.exe C:\Documents and Settings\Chris Gryglak\Desktop\Hijack This\Hijack This.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colorado.edu/ O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe" O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra button: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {BD2E6393-C7B9-4C00-A74D-A486AD42C421} - (no file) (HKCU) O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://assaffair.com/ChatSource/aVideoContol.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab O23 - Service: ewido security suite control - ewido networks - C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\ewidoctrl.exe O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe Ewido --------------------------------------------------------- ewido security suite - Startup report --------------------------------------------------------- + Created on: 22:18:50, 2005-09-11 + Report-Checksum: 8AF4EFBB Reg\HKLM\Run ATIModeChange Ati2mdxx.exe Reg\HKLM\Run ATIPTA C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe Reg\HKLM\Run MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe Reg\HKLM\Run Display Settings C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s Reg\HKLM\Run QT4HPOT C:\Program Files\HPQ\One-Touch\OneTouch.EXE Reg\HKLM\Run SynTPLpr C:\Program Files\Synaptics\SynTP\SynTPLpr.exe Reg\HKLM\Run SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Reg\HKLM\Run HPHUPD05 c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe Reg\HKLM\Run HP Software Update "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" Reg\HKLM\Run HPHmon05 C:\WINDOWS\System32\hphmon05.exe Reg\HKLM\Run RoxioDragToDisc "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" Reg\HKLM\Run RoxioEngineUtility "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" Reg\HKLM\Run CARPService carpserv.exe Reg\HKLM\Run WMC_AutoUpdate Reg\HKLM\Run TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot Reg\HKLM\Run HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" Reg\HKLM\Run HPDJ Taskbar Utility C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe Reg\HKLM\Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime Reg\HKLM\Run RegSvr32 C:\WINDOWS\System32\msmsgs.exe Reg\HKLM\Run gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" Reg\HKLM\Run MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto Reg\HKCU\Run Weather C:\Program Files\AWS\WeatherBug\Weather.exe 1 Reg\HKCU\Run CTFMON.EXE C:\WINDOWS\System32\CTFMON.EXE Reg\HKCU\Run Skype "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized Reg\HKCU\Run MsnMsgr "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background Shell\CommonStartup hp psc 1000 series.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk Shell\CommonStartup hpoddt01.exe.lnk C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk --------------------------------------------------------- ewido security suite - Process report --------------------------------------------------------- + Created on: 22:18:59, 2005-09-11 + Report-Checksum: 544A9FCE 0: System Process 4: System Process 156: \SystemRoot\System32\smss.exe 204: \??\C:\WINDOWS\system32\csrss.exe 228: \??\C:\WINDOWS\system32\winlogon.exe 272: C:\WINDOWS\system32\services.exe 284: C:\WINDOWS\system32\lsass.exe 464: C:\WINDOWS\system32\svchost.exe 496: C:\WINDOWS\system32\svchost.exe 704: C:\WINDOWS\Explorer.EXE 940: C:\Documents and Settings\Chris Gryglak\Desktop\Anti-Spyware Programs\security suite\SecuritySuite.exe NailFix, SmitRem, and pandasoftware, I couldn't get those because the links didn't work.