E2Give and others won't go away

[thepicman]

Trying to fix a friends wife's computer. Started with over 3000 spybot entrys.:sick:

Here are the Hijack log The Virus log is in the next post. Please help, I've followed the To Do list on the forum. Thanks!


Logfile of HijackThis v1.99.1
Scan saved at 3:43:24 PM, on 7/25/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\msiexec.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe
O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll
O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll
O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing)
O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot
O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE
O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE
O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE
O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE
O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe
O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE
O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.snipernet.us
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.snipernet.us (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

[thepicman]

#Trend Micro HouseCall - Storage of detected incidents
#Sat Jul 22 16:05:48 GMT-06:00 2006
scanned.pattern.type=malware,grayware,system.grayware,vulnerability.software
system.username=Administrator
infectivethreats.failed.reason=unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown,unknown
infectivethreats.type=
created=2006-07-22 06\:44\:30 GMT-06\:00
personalize=false
infectivethreats.amount=1,1,1,1,1,1,1,1,2,1,2,1,2,1,1,1,1,2,1,6,1,2,1,1,1,1,1,2,2,2,1,1,1,1,1,1,1,2,6,1,1,2,1,1,6,2,1,1,2,1,6,1,1,1,1,1,1,1,2,1,2,2,1,1,1,1,1,2,1,1,3,1,1,1,1,2,2,1,1,3,1,10,1,1,1,2,1,1,1,1,1,1,1,1,50,2,1,1,27,3,4,1,1,3,1,1,1,1,3,1,2,1,2,5,2,1,1,2,1,1,3,1,1,5,7,1,1,1,1,1,1,1,2,1,1,1,2,2,22,1,3,1,1,1,1,1,1,1,2,2,1,1,1,1,1,1,1,1,3,1,1,1,1,3,1,1,1,4,4,1,1,1,1,1,1,5,1,1,2,1,1,2,1,1,2,2,1,3,1,1,1,1,1,1,2,1,1,1,1,2,1,2,7,1,2,1,1,1,1,3,1,1,3,18,2,1,1,1,1,1,1,1,1,2,1,1,1,5,4,3,1,1,1,3,1,1,1,2
vulnerabilities.type=software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software,software
system.ip=192.168.1.118
scanned.pattern.version=359100,39300,38500,4600
system.architecture=x86
infectivethreats.class=malware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,malware,grayware,malware,malware,grayware,malware,grayware,malware,grayware,malware,grayware,grayware,malware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,malware,grayware,grayware,grayware,grayware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,malware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,grayware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,malware,malware,malware,malware,malware,grayware,grayware,malware,malware,grayware,malware,grayware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,malware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware,malware,malware,grayware,grayware,malware,grayware,malware,grayware,grayware,grayware,malware,malware,malware,grayware,grayware,grayware,malware,grayware,grayware,malware,malware,malware,grayware,malware,grayware,grayware,malware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,grayware,malware
infectivethreats.failed.amount=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
infectivethreats.removed=1,1,1,1,1,1,1,1,1,1,2,1,2,1,1,1,1,2,1,0,1,0,0,1,1,1,1,2,2,0,1,1,1,1,1,1,1,2,6,1,1,1,1,1,6,2,1,1,2,1,6,1,1,1,1,1,1,1,2,1,2,2,1,1,1,1,1,2,1,1,3,1,1,1,1,2,2,1,1,3,1,10,1,1,1,2,1,0,1,1,1,1,1,1,50,1,1,1,27,3,4,1,1,0,1,1,1,1,3,1,2,1,2,5,2,1,1,2,1,1,3,1,1,5,7,0,1,1,1,1,1,1,2,1,0,1,2,2,22,1,3,1,1,1,1,1,1,1,2,1,1,1,1,1,1,1,1,1,0,1,1,1,1,0,1,1,1,4,0,1,1,1,1,1,1,4,1,1,2,1,0,2,1,1,2,2,1,3,1,1,1,1,1,1,2,1,1,1,1,0,1,2,7,1,2,1,1,1,1,3,1,1,3,18,2,1,1,1,1,1,1,1,1,2,1,1,1,5,4,2,1,1,1,3,1,1,1,2
scanned.count=143736,143736,49953,150
scanned.engine.version=800001001,800001001,330001048,398001012
infectivethreats=TROJ_SMALL.GO,ADWARE_ABETTERINTERNET,COOKIE_STARWARE,ADW_EZULA.B,COOKIE_PARTYPOKER,TROJ_VB.CAC,ADW_SURFKICK.Q,ADW_ICONADS.A,PE_GENERIC,ADW_WWBARS.A,BKDR_BDI.A,TROJ_SCTHOUGHT.L,ADW_APROPOS.M,ADW_CMAPP.C,TROJ_ALCHEMIC.A,TROJ_STILEN.A,ADW_ADDESTROY.A,ADW_SAHAGENT.A,ADWARE_IBIS.WEBSEARCH,JAVA_BYTEVER.AB,TROJ_DROPPER.YY,ADW_MYSEARCH.202,ADWARE_MAXIFILES,TROJ_VB.AGZ,COOKIE_ZEDO,TROJ_SMALL.IQ,TROJ_RK.A,ADW_EXSEARCH.A,TROJ_SMALL.JI,ADW_WINPUP32.A,TROJ_DROPPER.XV,SPYW_PPNETWORK.B,TROJ_ADCLICKER.A,ADW_FCHELP.A,ADW_SRCHENH.A,TROJ_DLOADER.C,TROJ_CLICKER.JA,TROJ_SMALL.XC,ADW_SOLU180.A,ADWARE_CLEARSEARCH,ADW_DEALHELPER.E,WORM_GENERIC,TROJ_AGENT.AWP,SPYW_IESEARCH.A,ADW_SAFESURF.J,ADW_SAFESURF.G,ADW_DOWNLOADER.C,TROJ_VB.DB,ADW_SAFESURF.H,TROJ_MIDADDLE.A,ADW_BCPC.A,ADWARE_MIDADDLE,TROJ_DROPPER.UF,ADWARE_EZULA,TSPY_AGENT,ADWARE_MEDIAMOTOR,ADWARE_ALTNET,TROJ_SMALL.AXZ,ADW_SAFESURF.F,ADW_TVMEDIA.DR,ADW_FLASHTRCK.A,ADW_MEDTICKS.R,TROJ_VB.KQ,ADW_BITLOCKER.AA,TROJ_DLDR.2,ADWARE_TOTALVELOCITY,ADWARE_POPSSTOP,TROJ_AGENT.BT,ADWARE_ENBROWSER,TSPY_AGENT.L,ADW_DEALHELP.A,ADWARE_WINTOOLS,ADWARE_SHORTY,ADWARE_2NDTHOUGHT,ADW_BOTCER.A,TROJ_TVMEDIA.DR,TROJ_DELF.MC,ADW_WINFETCHER.A,SPYW_AGENT.A,ADW_SIDEKICK.B,ADWARE_BHOT_HUNTBAR,BKDR_HACDEF.AK,COOKIE_EXITEXCHANGE,TROJ_DLOADER.CRU,TROJ_DLOADER.BWW,ADW_SURFKICK.A,ADW_SURFKICK.O,ADW_ALTNET.C,ADWARE_ZQUEST,ADW_CMAPP.A,ADWARE_BHOT_E-VENTURES,TROJ_DROPPER.ABD,ADW_TVMEDIA.I,ADWARE_E2G,TROJ_SMALL.ID,TROJ_GENERIC,ADWARE_AVENUEMEDIANV,ADW_MYDLYSCOPE.A,ADW_SAFESURF.AE,ADW_DELFINMED.A,ADW_ELITEMEDIA.A,ADWARE_SAFESURF,ADW_BITLOCKER.AD,JAVA_BYTEVER.AC,TROJ_SMALL.AFA,ADW_SOFTOMATE.B,ADW_SAFESURF.AD,ADW_STC.A,ADW_MIDADDLE.B,DOWNLOADER_SMALL,ADW_IPEND.A,ADWARE_BEGIN2SEARCH,ADW_SAFESURF.AG,ADW_SURFKICK.U,TROJ_VB.ADP,TROJ_DLDR.CA,ADW_BITLOCKER.AC,SPYW_WEBSEARCH.G,ADWARE_COMMONCOMPONENTS,ADWARE_SYSNET,ADW_VIRTUMONDO.D,TROJ_SMALL.AQC,ADWARE_DYFUCA,TROJ_DLOADER.BE,ADW_ADCLICKER.A,ADW_TOPSEARCH.A,ADW_ESYN.A,ADWARE_DRSNSRCH,ADW_MIDADDLE.C,ADWARE_BROADCASTPC,FREELOADER_SPYWARELABS,ADWARE_CLIENTMAN,ADW_BINET.B,ADW_PASSIVECOW.A,TROJ_BISPY.D,TROJ_AGENT.AXT,ADW_WILDMEDIA.A,TROJ_VB.AMZ,ADW_WINSTOOL.B,SPYW_TWANT.E,ADW_SIDESEARCH.A,ADW_PWRSEARCH.A,HKTL_PROCKILL.A,ADW_TARGETSAV.C,ADWARE_VISFX,SPYW_VTBOUNCER.A,ADW_OVERPRO.A,ADWARE_SURFSIDEKICK,ADW_IMISERV.C,SPYW_CLEARSRCH.A,ADW_SCANPORTAL.A,ADWARE_EZULA.ILOOKUP,ADW_STATBLAST.A,TROJ_UPLOADER.F,TROJ_ZAPCHAST.J,ADW_IPWINS.A,ADWARE_APROPOS,COOKIE_SEARCHINGBOOTH,JAVA_BYTEVER.A,TROJ_QOOLOGIC.AI,ADWARE_DEALHELPER,ADW_QUICKBROWS.A,ADW_EGIV.A,ADW_WSEARCH.109,TROJ_DLOADER.AVG,TROJ_DLOADR.AA,TROJ_VB.AMJ,TROJ_TSUPDATE.G,JAVA_FEMAD.B,ADW_STATBLASTE.A,ADWARE_FLASHENHANCER,TROJ_DROPPER.YR,TROJ_NASCENE.Y,SPYW_CLIENTMAN.A,ADW_DOWNLD.A,SPYW_BISPY.A,COOKIE_YIELDMANAGER,SPYW_DYFUCA.E,TROJ_DYFUCA.I,ADW_BIGTRAFFIC.B,TROJ_STUBBY.D,SPYW_E2GIVE.A,SPYW_TWANT.A,COOKIE_FALKAG,TROJ_HACDEF.BS,CHM_SYSDOC.B,ADW_CMDDSKTOP.A,ADW_NETPALS.A,ADWARE_SUPERLOGY,ADWARE_SEARCHEXPLORER,ADWARE_WILDMEDIA,ADWARE_P2PNETWORK,ADWARE_BHO_SEP,ADW_WEBSEARCH.C,JS_ADCLICKER.BK,TROJ_REVOP.A,TROJ_DLOADER.ALW,TSPY_DROPPER.7,SPYW_WEBHANCER.A,JAVA_BYTEVER.A-1,ADW_COMMAD.A,CHM_SNIPLOAD.A,ADW_APROPOS.51,SPYW_CLIENTMAN.D,ADW_EXACTSER.A,TSPY_DLOADER.DG,TROJ_DYFUCA.AA,TROJ_SMALL.GV,ADW_ADROAR.A,ADW_TVMEDIA.C,COOKIE_TACODA,TROJ_APROPO.C,ADW_BCPC.B,ADW_NCASE.A,TROJ_IMISERV.C,TROJ_RVP.D,TROJ_MULTIDRP.BR,ADW_BB.A,TROJ_AGENT.CAC,ADWARE_SEARCHTOOLBAR,SPYW_MARKTSCOR.A,TROJ_APROPO.D,ADWARE_BESTOFFERS,SPYW_STINTER.A,ADWARE_SIDEFIND,COOKIE_REVSCI,ADWARE_ADROAR,ADW_SAFESURF.D,ADW_FLASHTRACK.E,ADW_LINKMAKER.D,ADW_BGN2SEARCH.A,TSPY_PRUTEC,ADWARE_CONSUMERALERTSYSTEM,ADW_FLASHTRACK.F,ADWARE_DELFINMED,ADWARE_FLASHTRACK,COOKIE_ADDYNAMIX,CHM_MEDTICKS.U
scanned.engine.type=main,main,system,system
vulnerabilities=MS06-007,MS05-004,MS06-005,MS05-048,MS05-049,MS05-047,MS05-039,MS05-037,MS05-025,MS05-026,MS05-040,MS05-036,MS05-043,MS05-042,MS06-016,MS05-041,MS06-015,MS06-013,MS06-014,MS06-018,MS05-045,MS06-030,MS05-038,MS06-032,MS05-027,MS05-052,MS04-041,MS05-054,MS06-002,MS05-053,MS06-023,MS06-022,MS05-051,MS06-021,MS05-050,MS06-025,MS05-032,MS06-008,MS06-001,MS05-033,MS06-006
send.report.key=5491081
infectivethreats.failed=false,true,true,false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,true,false,true,false,false,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,false,false,false,false,false,false,true,false,true,true,true,true,false,false,false,false,false,false,false,false,true,true,false,true,false,false,true,true,true,false,false,false,false,false,false,true,false,true,false,false,false,false,false,true,false,true,false,false,true,false,false,true,false,false,false,false,true,false,false,false,false,false,false,false,true,false,true,false,false,false,false,false,false,true,true,false,false,true,false,false,false,false,true,false,true,true,true,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,true,false,false,false,true,false,false,false,false,true,true,false,false,true,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,true,false,false,false,false,false,false,true,false,false,false,false,true,true,true,true,true,false,false,false,false,true,false,false,false,false,false,false,false,false,false,false,false,false,true,false,false,false,false,false,false,false,false,true,false,false,true,false,true,true,true,false,false,false,false,true,true,false,true,true,true,false
domain=housecall65.trendmicro.com
implementation=html/java

[pskelley]

Hello and welcome to the forum. I will say first that I have no idea what you posted from Housecall, that looks like to scan report I have ever seen??

You have quite a mess here, a bit of everything including E2Give and a Qoologic trojan. I really suggest you stay offline until you are clean, this junk will attract others and you have your share just now. This will be work, you must follow the directions carefully if you want the fixes to work. We will try to remove E2Give, then Qoologic and one run through with HJT and stop to see where we are. I want to say this is nothing to rush through, be careful. If this seem like something you wish to do, here we go.

1) Please download E2TakeOut by Rubber Ducky from here:

http://www.malwarebytes.org/E2TakeOut.zip

Extract the file to your Desktop
Double click E2TakeOut.exe
Click the Begin Removal button
Wait until the program is finished scanning
Once done, it will produce a popup stating that the infection has been found and you need to reboot you computer to complete the removal
Reboot your computer
Once your computer has rebooted E2TakeOut will open and produce a report
Please copy/paste that report into your next reply


2) Credit to Rubber Ducky for the tool...and Lonny for the original fix.
Please download Qoofix by Rubber Ducky (http://www.malwarebytes.org/Qoofix.zip) to your desktop.

Right click on the Qoofix folder, and choose "Extract All". Extract Qoofix to your C: drive
Close all windows and programs, including internet windows.
Go to C:\Qoofix and open the folder, then double click on Qoofix.exe
Click Begin Removal and wait for the scan to finish
If Qoofix finds an infection, select yes to restart your computer
You will now find a log from this tool, located at C:\Qoofix\Qoofix Logfile.txt Copy and paste the contents of that report into your next reply here.

3) Trusted Zone removal: this will clean those bad 015 items:
Download the attached zip file and unzip it to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf
Right-click on the deldomains.inf file and select 'Install'

4) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

5) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

(some items will be gone, removed by the tools, not to be concerned, just don't miss any)


6) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\xjvas.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,ifdedae.exe
O2 - BHO: (no name) - {24CDD264-853D-049B-DAFD-07894CF764E8} - C:\WINDOWS\Tknxcdpv.dll
O2 - BHO: (no name) - {34B5AF39-C3A6-9C5F-0FB7-15DC4E3D8B7F} - C:\WINDOWS\ofgi.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: KGhost - {968BC8A3-7660-4B12-B2BF-3334775835E1} - C:\Program Files\NetMeeting\KG\KGhost.dll
O2 - BHO: (no name) - {D4887992-E30C-C38E-7550-EA5B542F6192} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E3-E30E-CB86-7553-EE5B57296196} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {D58879E5-E30C-C381-7526-E95B51286191} - C:\WINDOWS\system32\sfsdb.dll (file missing)
O2 - BHO: (no name) - {DEB797C5-021A-4C2B-B490-F9B415179519} - C:\Program Files\Internet Explorer\pocevyhi.dll (file missing) G
O2 - BHO: (no name) - {FBD2EBD0-E6DF-456E-B300-A4D10A90C683} - (no file)
O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot
O4 - HKLM\..\Run: [C:\WINDOWS\fewazsot.exe] C:\WINDOWS\fewazsot.exe
O4 - HKLM\..\Run: [mszvdll] C:\WINDOWS\mszvdll.EXE
O4 - HKLM\..\Run: [qccaenc] C:\WINDOWS\qccaenc.EXE
O4 - HKLM\..\Run: [fdrpdll] C:\WINDOWS\fdrpdll.EXE
O4 - HKLM\..\Run: [fdrpenc] C:\WINDOWS\fdrpenc.EXE
O4 - HKLM\..\Run: [dhWin1.exe] dhWin1.exe
O4 - HKLM\..\Run: [qjikdll] C:\WINDOWS\qjikdll.EXE
O4 - HKLM\..\Run: [qjikenc] C:\WINDOWS\qjikenc.EXE
O4 - HKLM\..\Run: [adstart] iexplore.exe http://__adstart
O4 - HKCU\..\Run: [irssyncd] C:\WINDOWS\system32\irssyncd.exe
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.snipernet.us
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.errorsafe.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.media-motor.net (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.snipernet.us (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O15 - Trusted Zone: *.winfixer.com (HKLM)
O20 - AppInit_DLLs: iniwin32.dll,inicfg32.dll,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

Close all programs but HJT and all browser windows, then click on "Fix Checked"

7) RIGHT Click on Start then click on Explore. Locate and delete these items:

(All files may not be there, just DO NOT miss any)

C:\WINDOWS\fdrpdll.EXE
C:\WINDOWS\fdrpenc.EXE
C:\WINDOWS\fewazsot.exe
C:\WINDOWS\mszvdll.EXE
C:\WINDOWS\qccaenc.EXE
C:\WINDOWS\qjikdll.EXE
C:\WINDOWS\qjikenc.EXE
C:\WINDOWS\system32\irssyncd.exe
C:\WINDOWS\system32\ossproxy.exe

8) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

9) Restart the computer and post the report from E2TakeOut, C:\Qoofix\Qoofix Logfile.txt, a new HJT log and any comments you think will help. I will look at the information to see what is left to do as soon as possible after that.

Thanks...pskelley
Safer Networking Forums

[thepicman]

Thanks! when installing the .inf file "windows cannot find grpconv" and everytime I right click, I get an install window saying "installing Defender Pro Anti Virus"?

E2TakeOut v1.01 [http://www.malwarebytes.org]

Removed! C:\WINDOWS\system32\inicfg32.dll
Removed! C:\WINDOWS\system32\iniwin32.dll
Removed directory and files! C:\Program Files\E2G
Removed orphaned leftovers
AppInit key reset

Qoofix v1.02 by http://www.malwarebytes.org
Scan started on [7/26/2006] at [8:27:46 AM]
-------------------------------------------------------------
Terminated module: nhevjdp.dll found in Qoofix.exe (3884)
Terminated module: nhevjdp.dll found in hafvsu.exe (2672)
Terminated module: nhevjdp.dll found in explorer.exe (2736)
Terminated module: nhevjdp.dll found in xjvas.exe (2816)
Terminated module: nhevjdp.dll found in xjvas.exe (2848)
Terminated module: nhevjdp.dll found in xjvas.exe (2856)
Terminated module: nhevjdp.dll found in hphmon05.exe (3144)
Terminated module: nhevjdp.dll found in HpqCmon.exe (3212)
-------------------------------------------------------------
C:\WINDOWS\system32\hafvsu.exe will be deleted on reboot!
C:\WINDOWS\system32\ifdedae.exe will be deleted on reboot!
C:\WINDOWS\system32\mxtye.dat will be deleted on reboot!
C:\WINDOWS\system32\nhevjdp.dll will be deleted on reboot!
C:\WINDOWS\system32\xjvas.exe will be deleted on reboot!
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\yhqwy.exe will be deleted on reboot!

User prompted YES to reboot, system now rebooting...
-------------------------------------------------------------
Scan COMPLETED SUCCESSFULLY on [7/26/2006] at [8:29:30 AM]

Note: Some registry keys may have been removed.


Logfile of HijackThis v1.99.1
Scan saved at 9:00:39 AM, on 7/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
C:\WINDOWS\system32\MsiExec.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

[pskelley]

Seems you made some great progress:bigthumb: before I look at the log, I am interested in this message:

windows cannot find grpconv See this: http://www.liutilities.com/products/wintaskspro/processlibrary/grpconv/
seems this is an important part of Author: Microsoft Corp.
Part Of: Microsoft Windows Operating System

I think before we move on you should run System File Checker to make sure there are no missing or corrupt windows files. Have your CD handy in case you are asked for it:
Click Start > Run, type in sfc /scannow, hit Enter.
Note: there is a space between sfc and /scannow
This should replace any corrupted/missing system files
http://www.updatexp.com/windows-file-protection.html
http://www.networkclue.com/os/Windows/commands/sfc.aspx
http://www.updatexp.com/scannow-sfc.html

I get an install window saying "installing Defender Pro Anti Virus"?Start > Control Panel > Add Remove programs and look for that item, uninstall it it there, uninstall anything that should not be there, if you are unsure, let me know and I will look.

I apologize, I missed a nasty: http://www.spywareguide.com/product_show.php?id=794 and it could have to do with the message. Let's do this:

See this to help with ATF-cleaner: http://forums.security-central.us/showthread.php?t=1925

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(next two, download them fresh if you need them again)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
(next is the nasty I missed)
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.media-motor.net/cabs/mmed.cab


Close all programs but HJT and all browser windows, then click on "Fix Checked"

Run ATF-Cleaner again, you will not need to clean Prefetch again (cleaning Prefetch will slow you a little until Windows repopulates it, so purging is only needed when you have cleaned out infections)

Post a last HJT log and let me know how the computer is performing now.

Thanks...Phil

[thepicman]

Phil, thanks for the help. Was OOT for a few days, will finish up and get back to you.

TPM

[tashi]

Hi, how is it going with that computer.

[thepicman]

r that item, uninstall it it there, uninstall anything that should not be there, if you are unsure, let me know and I will look.

Post a last HJT log and let me know how the computer is performing now.

Thanks...Phil

:laugh: :laugh: I know how to unistall progs, I did not realize that was a "real" virus program, thought it was a spoof. It was never installed completely, so did not show in any of the normal places. Its gone now, ripped violently from the register :mad: . I think this box may be better as well. Thanks for the help on the nasty bits!

Here is the hijack.

Logfile of HijackThis v1.99.1
Scan saved at 5:34:26 PM, on 8/5/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

[pskelley]

Am I blind? Is there no active antivirus program running on this computer:confused: Online scans will just not protect you. Here are some free ones and I suggest AVG by Grisoft:
http://free.grisoft.com/freeweb.php
http://www.avast.com/eng/avast_4_home.html
http://www.free-av.com/

The HJT log appears clean of malware, here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

Safe surfing...tashi:) will close the topic in a day or so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[thepicman]

Am I blind? Is there no active antivirus program running on this computer:confused: Online scans will just not protect you.

Safe surfing...tashi:) will close the topic in a day or so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

Not you are not blind, I put Avast on it for her, but had not started it yet. I wanted you to see a clean hijack log before adding stuff to the process list. I am only doing this once for them, so I am safing it as much as I can for them. Thanks for your help!

TPM

[thepicman]

Nope, Spybot still shows this: :(

Huntbar: Uninstall settings (Registry key, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinTools


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-07-07 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-04 Includes\Cookies.sbi (*)
2006-08-04 Includes\Dialer.sbi (*)
2006-08-04 Includes\Hijackers.sbi (*)
2006-08-04 Includes\Keyloggers.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2006-08-04 Includes\Malware.sbi (*)
2006-08-04 Includes\PUPS.sbi (*)
2006-08-04 Includes\Revision.sbi (*)
2006-08-04 Includes\Security.sbi (*)
2006-08-04 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-04 Includes\Trojans.sbi (*)

Logfile of HijackThis v1.99.1
Scan saved at 6:55:15 PM, on 8/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092959613625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

[pskelley]

Sorry, that is left over from WinTools, we never removed WinTools so that must be a leftover registry entry from another removal. Only thing I can suggest is backup the registry and use regedit to delete the entry if you want it gone. I doubt it can do any harm with nothing left of the program.

http://ts.mcafeehelp.com/faq3.asp?docid=68037

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/tools_regeditors.mspx?mfr=true

Thanks

[thepicman]

Sorry, that is left over from WinTools, we never removed WinTools so that must be a leftover registry entry from another removal. Only thing I can suggest is backup the registry and use regedit to delete the entry if you want it gone. I doubt it can do any harm with nothing left of the program.

Thanks

Yeah, I tried del it with regedit, but it cannot be deleted or renamed. Thought maybe this was common and there was another way to kill it.

Thanks!

[pskelley]

Not to my knowledge, unless you know how to write your own regedit...I do not. try this tool.

http://www.hoverdesk.net/freeware.htm

Backup Registry: <<< Very important
Backup your Registry...
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run...)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL
_________________________________________________________

I recommend you download RegSeeker. Extract it to it's own folder,
open and double click RegSeeker.exe to start the program.
Maximize the window and click clean registry. Check all sections and click OK.
When the scan is complete, verify the backup box in lower left corner is checked
and click the select all button, then select all again. Then right click within
the search results and select delete. Run it again and again, deleting everything
it finds until it finds nothing. Reboot and make sure your programs are working properly,
control panel and add/remove programs windows open, etc (basically just do a quick check of everything).
In the event anything was 'broken', you can open RegSeeker, click backups and double click
any/all files to put the information back. A reboot may be required for the effects to be seen.
Reboot When done.

Thanks

[thepicman]

Not to my knowledge, unless you know how to write your own regedit...I do not. try this tool.


Thanks

Will do! Thansk! again!

[thepicman]

I recommend you download RegSeeker. Extract it to it's own folder,
open and double click RegSeeker.exe to start the program.
Maximize the window and click clean registry. Check all sections and click OK.
When the scan is complete, verify the backup box in lower left corner is checked
and click the select all button, then select all again. Then right click within
the search results and select delete. Run it again and again, deleting everything
it finds until it finds nothing. Reboot and make sure your programs are working properly,
control panel and add/remove programs windows open, etc (basically just do a quick check of everything).
In the event anything was 'broken', you can open RegSeeker, click backups and double click
any/all files to put the information back. A reboot may be required for the effects to be seen.
Reboot When done.

Thanks

THis cleaned out ~2000 things, but not the one I was looking to get ride of. Oh well, its going back to them. I thinks its clean and she will probably just fill it up again just to spite me :spider:

Thanks for all of the input!

TPM

[tashi]

This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me or your helper a pm and provide a link to the thread.

Applies only to the original topic starter.

Cheers.