hi
here is hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 22:00:03, on 01/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Santa Cruz Networks\vSkype\vSkype.exe
C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
C:\Program Files\Softwin\BitDefender8\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\??ool32.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\aths\tres.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender8\vsserv.exe
c:\program files\softwin\bitdefender8\bdmcon2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: HyperSearchHook - {672A27BD-7BBE-4569-961B-E537C6607F60} - C:\Program Files\Fichiers communs\Hyperbar\HyperbarSS3.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Fichiers communs\ReGet Shared\Catcher.dll
O2 - BHO: (no name) - {5C034E1D-D5DB-8503-F6B4-8F6DA232B7EA} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: (no name) - {5C034E1F-D5A8-F005-F6C1-876DD446B79F} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {A6CA2D0F-B2B2-9F11-B08E-EA9B1EA93B90} - C:\WINDOWS\System32\mcj.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vSkype] C:\Program Files\Santa Cruz Networks\vSkype\vSkype.exe no
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\Softwin\BitDefender8\bdmcon2.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Program Files\Softwin\BitDefender8\bdnagent.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ackzng] C:\WINDOWS\System32\r?ndll.exe
O4 - HKCU\..\Run: [Uoal] C:\Documents and Settings\samir\Application Data\repn.exe
O4 - HKCU\..\Run: [Tspr] C:\Documents and Settings\samir\Application Data\stsa.exe
O4 - HKCU\..\Run: [Eryk] C:\WINDOWS\system32\??ool32.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [Osac] C:\Documents and Settings\samir\Application Data\beet.exe
O4 - HKCU\..\Run: [Didb] C:\WINDOWS\system32\??rss.exe
O4 - HKCU\..\Run: [Oueh] C:\Program Files\aths\tres.exe
O4 - Global Startup: eFax DllCmd 3.5.lnk
O4 - Global Startup: eFax Tray Menu 3.5.lnk
O8 - Extra context menu item: Té&lécharger tous les éléments avec ReGet Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Télécharger avec Re&Get Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_Link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68CE6874-96C1-4640-816F-B953CCD0EDBB}: NameServer = 212.217.1.4 212.217.0.3
O18 - Protocol: vskype - (no CLSID) - (no file)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender8\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
thank you Wave.gif
Full Version: help please
Please disable Spyware Doctor before you start the cleanup process so that it doesn't interfere.
Go to Control Panel >Add Remove Programs.
find this entry if it exists:
Startnow ToolBar (v1.0.1.1)
Highlight it and click the remove button.
------------------
You will be restarting into Safe mode later. Here's help if you need it.
To use the F8 key to start Windows XP in Safe mode
Restart the computer.
Some computers have a progress bar that refers to the word BIOS. Others may not let you know what is happening.
As soon as the BIOS loads, begin tapping the F8 key on your keyboard. Do so until the Windows Advanced Options menu appears.
If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. If this happens, restart the computer and try again.
Using the arrow keys on the keyboard, select Safe mode and then press Enter.
------
Because XP will not always show you hidden files and folders by default.
Reset your search settings first.
Open Folder Options>view and check your settings:
Select
Show hidden files and folders
Display the contents of system folders
Uncheck: Hide protected operating system files
Next go to Search and look down to More advanced options and click onthe chevron next to it.
Be sure the first three boxes are selected:
Search System folders
Search Hidden Files and folders
Search SubFolders
--------
Restart into safe mode.
Go to Start > Run and type
hijackthis
Press enter.
Select the following itewms and click the fix checked button.
R3 - URLSearchHook: HyperSearchHook - {672A27BD-7BBE-4569-961B-E537C6607F60} - C:\Program Files\Fichiers communs\Hyperbar\HyperbarSS3.dll
O2 - BHO: (no name) - {5C034E1D-D5DB-8503-F6B4-8F6DA232B7EA} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: (no name) - {5C034E1F-D5A8-F005-F6C1-876DD446B79F} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: (no name) - {A6CA2D0F-B2B2-9F11-B08E-EA9B1EA93B90} - C:\WINDOWS\System32\mcj.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Ackzng] C:\WINDOWS\System32\r?ndll.exe
O4 - HKCU\..\Run: [Uoal] C:\Documents and Settings\samir\Application Data\repn.exe
O4 - HKCU\..\Run: [Tspr] C:\Documents and Settings\samir\Application Data\stsa.exe
O4 - HKCU\..\Run: [Eryk] C:\WINDOWS\system32\??ool32.exe
O4 - HKCU\..\Run: [Osac] C:\Documents and Settings\samir\Application Data\beet.exe
O4 - HKCU\..\Run: [Didb] C:\WINDOWS\system32\??rss.exe
O4 - HKCU\..\Run: [Oueh] C:\Program Files\aths\tres.exe
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O18 - Protocol: vskype - (no CLSID) - (no file)
Delete these files:
C:\Documents and Settings\samir\Application Data\repn.exe
C:\Documents and Settings\samir\Application Data\stsa.exe
C:\Documents and Settings\samir\Application Data\beet.exe
Delete this folder:
C:\Program Files\aths
Go for free online Virus scans here:
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.pandasoftware.com/activescan/
Allow them to clean
Panda will have the option to create a log afer the scan has finished. Click the See Report button. Then click the save Report button. IT will be saved inder the name activescan.txt Do that and post that log into your next reply here.
----------------
Run hijackthis again and post the new log into your next reply here.
Go to Control Panel >Add Remove Programs.
find this entry if it exists:
Startnow ToolBar (v1.0.1.1)
Highlight it and click the remove button.
------------------
You will be restarting into Safe mode later. Here's help if you need it.
To use the F8 key to start Windows XP in Safe mode
Restart the computer.
Some computers have a progress bar that refers to the word BIOS. Others may not let you know what is happening.
As soon as the BIOS loads, begin tapping the F8 key on your keyboard. Do so until the Windows Advanced Options menu appears.
If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. If this happens, restart the computer and try again.
Using the arrow keys on the keyboard, select Safe mode and then press Enter.
------
Because XP will not always show you hidden files and folders by default.
Reset your search settings first.
Open Folder Options>view and check your settings:
Select
Show hidden files and folders
Display the contents of system folders
Uncheck: Hide protected operating system files
Next go to Search and look down to More advanced options and click onthe chevron next to it.
Be sure the first three boxes are selected:
Search System folders
Search Hidden Files and folders
Search SubFolders
--------
Restart into safe mode.
Go to Start > Run and type
hijackthis
Press enter.
Select the following itewms and click the fix checked button.
R3 - URLSearchHook: HyperSearchHook - {672A27BD-7BBE-4569-961B-E537C6607F60} - C:\Program Files\Fichiers communs\Hyperbar\HyperbarSS3.dll
O2 - BHO: (no name) - {5C034E1D-D5DB-8503-F6B4-8F6DA232B7EA} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: (no name) - {5C034E1F-D5A8-F005-F6C1-876DD446B79F} - C:\WINDOWS\system32\lpoygo.dll
O2 - BHO: (no name) - {A6CA2D0F-B2B2-9F11-B08E-EA9B1EA93B90} - C:\WINDOWS\System32\mcj.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Ackzng] C:\WINDOWS\System32\r?ndll.exe
O4 - HKCU\..\Run: [Uoal] C:\Documents and Settings\samir\Application Data\repn.exe
O4 - HKCU\..\Run: [Tspr] C:\Documents and Settings\samir\Application Data\stsa.exe
O4 - HKCU\..\Run: [Eryk] C:\WINDOWS\system32\??ool32.exe
O4 - HKCU\..\Run: [Osac] C:\Documents and Settings\samir\Application Data\beet.exe
O4 - HKCU\..\Run: [Didb] C:\WINDOWS\system32\??rss.exe
O4 - HKCU\..\Run: [Oueh] C:\Program Files\aths\tres.exe
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O18 - Protocol: vskype - (no CLSID) - (no file)
Delete these files:
C:\Documents and Settings\samir\Application Data\repn.exe
C:\Documents and Settings\samir\Application Data\stsa.exe
C:\Documents and Settings\samir\Application Data\beet.exe
Delete this folder:
C:\Program Files\aths
Go for free online Virus scans here:
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.pandasoftware.com/activescan/
Allow them to clean
Panda will have the option to create a log afer the scan has finished. Click the See Report button. Then click the save Report button. IT will be saved inder the name activescan.txt Do that and post that log into your next reply here.
----------------
Run hijackthis again and post the new log into your next reply here.
hi sir
here is the new log:
Logfile of HijackThis v1.99.1
Scan saved at 15:31:03, on 03/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Fichiers communs\ReGet Shared\Catcher.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: eFax DllCmd 3.5.lnk
O4 - Global Startup: eFax Tray Menu 3.5.lnk
O8 - Extra context menu item: Té&lécharger tous les éléments avec ReGet Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Télécharger avec Re&Get Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_Link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68CE6874-96C1-4640-816F-B953CCD0EDBB}: NameServer = 212.217.1.4 212.217.0.3
O18 - Protocol: vskype - (no CLSID) - (no file)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
and here is the log of panda active scan:
Incident Status Location
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\baitacesiteuser\BookWay.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Application Data\tres.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Local Settings\Temp\!update.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\meulhfrj.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\tseuipsi.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\vhawcynz.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Local Settings\Temporary Internet Files\Content.IE5\A14HO5OJ\!update-2042[1].0000
Adware:Adware/Lop No disinfected C:\Documents and Settings\User\Local Settings\Temp\ipicwkoo.exe
Adware:Adware/PurityScan No disinfected C:\Program Files\aths\tres.exe
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-269.dll
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-467.dll
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-563.dll
Possible Virus. No disinfected C:\Program Files\iolo\System Mechanic 5 Professional\Search and Recover\streamserver.exe
Adware:Adware/PurityScan No disinfected C:\WINDOWS\system32\Shex.exe
thank you
here is the new log:
Logfile of HijackThis v1.99.1
Scan saved at 15:31:03, on 03/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Fichiers communs\ReGet Shared\Catcher.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\FICHIE~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\system32\khooker.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: eFax DllCmd 3.5.lnk
O4 - Global Startup: eFax Tray Menu 3.5.lnk
O8 - Extra context menu item: Té&lécharger tous les éléments avec ReGet Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_All.htm
O8 - Extra context menu item: Télécharger avec Re&Get Jr. - C:\Program Files\Fichiers communs\ReGet Shared\CC_Link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68CE6874-96C1-4640-816F-B953CCD0EDBB}: NameServer = 212.217.1.4 212.217.0.3
O18 - Protocol: vskype - (no CLSID) - (no file)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
and here is the log of panda active scan:
Incident Status Location
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\baitacesiteuser\BookWay.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Application Data\tres.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Local Settings\Temp\!update.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\meulhfrj.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\tseuipsi.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\samir\Local Settings\Temp\vhawcynz.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\samir\Local Settings\Temporary Internet Files\Content.IE5\A14HO5OJ\!update-2042[1].0000
Adware:Adware/Lop No disinfected C:\Documents and Settings\User\Local Settings\Temp\ipicwkoo.exe
Adware:Adware/PurityScan No disinfected C:\Program Files\aths\tres.exe
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-269.dll
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-467.dll
Adware:Adware/PurityScan No disinfected C:\Program Files\hijackthis\backups\backup-20050702-232241-563.dll
Possible Virus. No disinfected C:\Program Files\iolo\System Mechanic 5 Professional\Search and Recover\streamserver.exe
Adware:Adware/PurityScan No disinfected C:\WINDOWS\system32\Shex.exe
thank you
You're welcome. That is looking very good.
The Panda Scan results show you have some leftovers.
Go to Start >Run and type %Temp%
Press enter
When your temp folder opens, select all and delete all. Some things will be in use and will not allow you to delte them. That's normal. But, if any of these are still there, let me know and we'll have to do something to delete them:
!update.exe
meulhfrj.exe
tseuipsi.exe
vhawcynz.exe
------------------------
Delete these two folders:
C:\Documents and Settings\All Users\Application Data\baitacesiteuser
C:\Program Files\aths
Delete these files:
C:\WINDOWS\system32\Shex.exe
C:\Documents and Settings\samir\Application Data\tres.exe
Empty your Temporary Internet Files.
If you have no problems ikn doing that then follow these next instructions:
Once you have rebooted a time or two, be sure everything is in working order. It is time to flush your system restore points. Once you do that you will not be able to correct any problems you may have now by going back to a point before today.
After something like this it is a good idea to Flush the Restore Points and start fresh.
To flush the XP system Restore Points.
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn off System restore.
Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.
----------------------------
Also here is an excellent source for tips to tighten security. Follow the advice and get the free downloads to help avoid some of these problems in the future.
http://www.computercops.biz/postt7736.html
Let me know how it all goes and if you need any more help.
The Panda Scan results show you have some leftovers.
Go to Start >Run and type %Temp%
Press enter
When your temp folder opens, select all and delete all. Some things will be in use and will not allow you to delte them. That's normal. But, if any of these are still there, let me know and we'll have to do something to delete them:
!update.exe
meulhfrj.exe
tseuipsi.exe
vhawcynz.exe
------------------------
Delete these two folders:
C:\Documents and Settings\All Users\Application Data\baitacesiteuser
C:\Program Files\aths
Delete these files:
C:\WINDOWS\system32\Shex.exe
C:\Documents and Settings\samir\Application Data\tres.exe
Empty your Temporary Internet Files.
If you have no problems ikn doing that then follow these next instructions:
Once you have rebooted a time or two, be sure everything is in working order. It is time to flush your system restore points. Once you do that you will not be able to correct any problems you may have now by going back to a point before today.
After something like this it is a good idea to Flush the Restore Points and start fresh.
To flush the XP system Restore Points.
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn off System restore.
Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.
----------------------------
Also here is an excellent source for tips to tighten security. Follow the advice and get the free downloads to help avoid some of these problems in the future.
http://www.computercops.biz/postt7736.html
Let me know how it all goes and if you need any more help.
thank you all is good
Wave.gif
Wave.gif
Hi samirov,
That's good to hear. You're welcome.
I'll close this Topic now that is has been resolved. If you need it reopened please PM a Moderator or Admin to do that.
Anyone else, please start your own topic and someone will help.
Mo
That's good to hear. You're welcome.
I'll close this Topic now that is has been resolved. If you need it reopened please PM a Moderator or Admin to do that.
Anyone else, please start your own topic and someone will help.
Mo
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.