Probably Spyaxe

[mmatt]

I had an icon in my system tray that kept popping up balloons telling me to download their anti spyware product. I looked up the text and I was told it was spyaxe.

I scanned with Norton AV, Spybot S&D and Ad-Aware and ran CWShredder 1.19 before I was directed to this forum.

HJT log from -after- the above:

Logfile of HijackThis v1.99.1
Scan saved at 4:51:08 PM, on 2/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: winprq32 - C:\WINDOWS\SYSTEM32\winprq32.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

----------------------------------------
HJT log from after SmitRem and ewido:

Logfile of HijackThis v1.99.1
Scan saved at 2:12:07 AM, on 2/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: winprq32 - winprq32.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

---------------------------
smitfiles.txt (run before ewido) :


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Thu 02/23/2006
The current time is: 16:52:00.70

Running from
C:\Documents and Settings\Administrator\Desktop\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"="Wheel Mouse Optical Driver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

1024 dir
msvol.tlb
ld****.tmp
nvctrl.exe
logfiles


~~~ Icons in System32 ~~~

ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 796 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"="Wheel Mouse Optical Driver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN! :)

-------------------------
Ewido report:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 2:11:12 AM, 2/25/2006
+ Report-Checksum: EEF639F9

+ Scan result:

[232] C:\WINDOWS\system32\winprq32.dll -> Hijacker.Small.kb : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.46:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.222:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.238:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.259:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Spylog : Cleaned with backup
:mozilla.263:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Trafic : Cleaned with backup
:mozilla.287:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.335:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Yadro : Cleaned with backup
:mozilla.337:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.338:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.342:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.343:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.353:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.354:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Goclick : Cleaned with backup
:mozilla.368:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.369:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.370:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Aavalue : Cleaned with backup
:mozilla.390:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned with backup
:mozilla.417:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
:mozilla.418:C:\Documents and Settings\Matthew\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Matthew\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv698.jar-2ad2754e-6ea4c946.zip/Matrix.class -> Downloader.OpenStream.c : Error during cleaning
C:\Documents and Settings\Matthew\Local Settings\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\Cache\8F6FACFDd01 -> Dropper.Agent.aiq : Cleaned with backup
C:\Documents and Settings\Matthew\Local Settings\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\Cache\A2139149d01 -> Dropper.Agent.aiq : Cleaned with backup
:mozilla.24:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.25:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.26:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.27:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.28:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.29:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.30:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.31:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.32:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.51:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.52:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.53:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.54:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.64:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Coremetrics : Cleaned with backup

[mmatt]

Unfortunatly, the rest of this isn't in order (if it matters) because I cut and pasted wrong.

TrackingCookie.2o7 : Cleaned with backup
:mozilla.76:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.77:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.78:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.79:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.104:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned with backup
:mozilla.122:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.123:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.124:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.125:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.133:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.188:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.195:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Mx-targeting : Cleaned with backup
:mozilla.196:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Mx-targeting : Cleaned with backup
:mozilla.197:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Mx-targeting : Cleaned with backup
:mozilla.198:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Mx-targeting : Cleaned with backup
:mozilla.212:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.213:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.214:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.215:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.216:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.217:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.218:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.219:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.220:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.221:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.222:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.223:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.68:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt ->
:mozilla.224:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned with backup
:mozilla.225:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.226:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.228:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.229:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.232:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.242:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.243:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.244:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.245:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt ->
TrackingCookie.Qksrv : Cleaned with backup
:mozilla.277:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.294:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.295:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.301:C:\Documents and Settings\naomi\Application Data\Mozilla\Firefox\Profiles\b62xyrjx.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.34:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.43:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
:mozilla.66:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.71:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.109:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.119:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
:mozilla.122:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.123:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.125:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
:mozilla.132:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.133:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.134:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.137:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
:mozilla.138:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Randy & Gail\Application Data\Mozilla\Firefox\Profiles\v48lntah.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
C:\WINDOWS\system32\dxmpp.dll -> Not-A-Virus.Hoax.Win32.Renos.v : Cleaned with backup
C:\WINDOWS\system32\winprq32.dll -> Hijacker.Small.kb : Cleaned with backup


::Report End
-----------------------
Ewido found and said it fixed 123 things. Is everything gone? I don't have the spyaxe "signature" system tray icon anymore and Tea Timer doesn't keep asking me to approve bho's and homepage settings.

[pskelley]

Hi Matthew, and you are right, the way you threw this information on here made me almost pass it by. I appreciate you tried to "do it myself" but you had some nasties including what looked like Look2me? that should have been removed first. It also looks like you may be running these logs in safe mode? I need to see the log in Normal Mode, with everything enabled in MSConfig. This logfile does not look to bad: Logfile of HijackThis v1.99.1 Scan saved at 2:12:07 AM, on 2/25/2006

What I would like you to do is this: Make sure TeaTimer is disabled until you are done: http://russelltexas.com/malware/teatimer.htm

1) Move HJT from the Desktop for safety. I prefer C:\HJT\HijackThis.exe, if you need additional instructions use these: http://russelltexas.com/malware/createhjtfolder.htm

2) Take a look at this information to help you control the nasty cookies getting on your system:
http://privacy.getnetwise.org/browsing/tools/firefox1/ffdisablecookies
http://www.mozilla.org/projects/security/pki/psm/help_21/using_priv_help.html

3) Update ewido and run a complete system scan. Post those results, please edit out any cookies ewido removes and any items reported to be in the System Restore files.

4) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O20 - Winlogon Notify: winprq32 - winprq32.dll (file missing)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\Windows\Prefetch\ >>> delete the contents (NOT THE FOLDER)
Prefetch info: http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html

If you don't have a good cleaner, use this one with these instuctions:
Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp
Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do.

Restart the computer and post the ewido scan results, a new HJT log (normal mode/all enabled in MSConfig) and any feedback you have. All going well, you should be good to go at that point.

Thanks...pskelley
Safer Networking Forums

[mmatt]

Ewido results, edited:

+ Created on: 12:35:05 AM, 2/26/2006
+ Scan result:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4da4616d-7e6e-4fd9-a2d5-b6c535733e22} -> Adware.Generic : Cleaned with backup
HKU\S-1-5-21-117609710-362288127-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4DA4616D-7E6E-4FD9-A2D5-B6C535733E22} -> Adware.Generic : Cleaned with backup
HKU\S-1-5-21-117609710-362288127-682003330-1003\Software\Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D} -> Adware.SpyFalcon : Cleaned with backup
HKU\S-1-5-21-117609710-362288127-682003330-1003_Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D} -> Adware.SpyFalcon : Cleaned with backup
C:\Documents and Settings\Matthew\Local Settings\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\Cache\3EF5D66Dd01 -> Dropper.Agent.aiq : Cleaned with backup
C:\Documents and Settings\Matthew\Local Settings\Application Data\Mozilla\Firefox\Profiles\k5izrasl.default\Cache\46969680d01 -> Dropper.Agent.aiq : Cleaned with backup
C:\RECYCLER\S-1-5-21-117609710-362288127-682003330-1003\Dc110.exe -> Dropper.Agent.aiq : Cleaned with backup
C:\RECYCLER\S-1-5-21-117609710-362288127-682003330-1003\Dc111.exe -> Dropper.Agent.aiq : Cleaned with backup

----------------------------------------------------------------------
new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 1:05:41 AM, on 2/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Screen Control\screencontrol.exe
C:\Documents and Settings\Matthew\Desktop\HijackThis1.99.exe
C:\WINDOWS\system32\wuauclt.exe

O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - Startup: Screen Control.lnk = C:\Program Files\Screen Control\screencontrol.exe
O4 - Startup: TeaTimer.lnk = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

-------------------------------------------------------------------------
Anything else I need to do?

[pskelley]

Hello Matthew, ewido had no surprises and removed what it located. Often a second run will find stuff the first missed, let's hope that is the case. Take a look at the log to see where the junk is hiding.

C:\Documents and Settings\Matthew\Desktop\HijackThis1.99.exe <<< you have not move HJT from the Desktop and you are still running it with no folder. Please read the instructions I posted and follow them, this is unsafe.

Turn off TeaTimer until you are finished

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O2 - BHO: (no name) - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - (no file)
O3 - Toolbar: (no name) - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - (no file)
(the next two restrictions can be removed if you don't need them? )
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Restart the computer. The above as clutter and unrequired restrictions, no malware is appearing in your HJT log here: 1:05:41 AM, on 2/26/2006
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

ewido is a great program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

System Restore does not know good from bad, it backs up everything. In case some of the infection got into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, restart your computer and turn it back on.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

If all is running well, you are good to go and safe surfing...Phil:bigthumb:

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[mmatt]

Why does it matter whether HijackThis is on the desktop or not? It's my private desktop and I'm not going to delete it. Furthermore, I have a copy archived.
Second, I did disable Teatimer until I was done doing the scans. Third (about your first post), it's not like I ignored anyone's instructions, I've never been to this board in my life and I hadn't seen anyone's instructions on anything related to spyaxe or look2me when I tried to remove the stuff. Fourth (about your first post), I put exactly the info on my posts as I was told to in the Spyaxe and Other Desktop Hijacks post.

Most of your advice has been helpful, however. Thank you for not telling me flat out to remove something I want (the IE restrictions), and thanks for the links about staying safe online. However, I know exactly what I did to get all this crap and I know how not to get it again. I'm not your 60 year old aunt or a child : ).

Thanks again for helping me and cya.

[pskelley]

Thanks for your feedback and safe surfing to you:) tashi will be along to close your topic shortly.

pskelley

[tashi]

Your welcome mmatt. :)