Infected with spyware.. please help

[Gunther947]

Logfile of HijackThis v1.99.1
Scan saved at 5:56:27 PM, on 10/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\sumsw32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: (no name) - {00000000-59D4-4008-9058-080011001200} - (no file)
O2 - BHO: (no name) - {00000000-C1EC-0345-6EC2-4D0300000000} - (no file)
O2 - BHO: (no name) - {00000000-F09C-02B4-6EC2-AD0300000000} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1417BE01-6123-2F17-C863-09D551ED8478} - C:\WINDOWS\system32\dxulmsg.dll
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7b55bb05-0b4d-44fd-81a6-b136188f5deb} - (no file)
O2 - BHO: (no name) - {8333c319-0669-4893-a418-f56d9249fca6} - (no file)
O2 - BHO: (no name) - {9c691a33-7dda-4c2f-be4c-c176083f35cf} - (no file)
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O2 - BHO: (no name) - {ffd2825e-0785-40c5-9a41-518f53a8261f} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\system32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\system32\susp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

[Gunther947]

Incident Status Location

Virus:Trj/Lager.BZ Disinfected Operating system
Adware:Adware/AntispywareSoldier Not disinfected C:\WINDOWS\system32\sumsw32.exe
Adware:adware/superspider Not disinfected c:\windows\system32\a.exe
Adware:adware/alexa-toolbar Not disinfected c:\windows\system32\alxres.dll
Spyware:spyware/bridge Not disinfected c:\windows\system32\bridge.dll
Adware:adware/dailytoolbar Not disinfected c:\windows\system32\dailytoolbar.dll
Adware:adware/antivirus-gold Not disinfected c:\windows\system32\runsrv32.exe

Virus:trj/abwiz.a Disinfected Operating system

Adware:adware/admess Not disinfected c:\windows\system32\tcpservice2.exe
Adware:adware/topspyware Not disinfected c:\windows\system32\txfdb32.dll
Adware:adware/btgrab Not disinfected c:\windows\BTGrab.dll
Adware:adware/transponder Not disinfected c:\windows\dlmax.dll
Spyware:spyware/betterinet Not disinfected c:\windows\susp.exe
Adware:adware/thespyguard Not disinfected c:\windows\yod.htm
Adware:adware/wupd Not disinfected Windows Registry
Dialer:dialer.du Not disinfected HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B55BB05-0B4D-44FD-81A6-B136188F5DEB}
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@2o7[1].txt
Spyware:Cookie/66.246.209 Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@66.246.209[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@ad.yieldmanager[1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@ads.addynamix[1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@adtech[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@atwola[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@bs.serving-sys[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@com[1].txt
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@counter13.sextracker[1].txt
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@counter9.sextracker[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@doubleclick[1].txt
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@findwhat[1].txt
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@gostats[2].txt
Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@kinghost[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@overture[2].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@questionmarket[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@serving-sys[2].txt
Spyware:Cookie/Sextracker Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@sextracker[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@statcounter[1].txt
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@toplist[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@tribalfusion[2].txt
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@z1.adserver[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Colin Kanewske\Cookies\colin kanewske@zedo[1].txt
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Application Data\388e37a2.exe
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Temp\Cookies\colin kanewske@ad.yieldmanager[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Temp\Cookies\colin kanewske@atwola[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Temp\Cookies\colin kanewske@go[2].txt
Possible Virus. Not disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Temporary Internet Files\Content.IE5\8L2JGXIF\image[1].gif
Virus:Trj/Lager.BZ Disinfected C:\Documents and Settings\Colin Kanewske\Local Settings\Temporary Internet Files\Content.IE5\JXYW7KFW\adirss[1].exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Colin Kanewske\My Documents\smit\SmitfraudFix\Process.exe
Adware:Adware/UltimateCleaner Not disinfected C:\Program Files\Ultimate Cleaner\IeSafe.exe
Hacktool:Rootkit/Alanchum.GC Not disinfected C:\WINDOWS\system32\adir.dll
Virus:Trj/Downloader.KMY Disinfected C:\WINDOWS\system32\hlwmhnpw.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\image.gif.exe
Adware:Adware/TitanShield Not disinfected C:\WINDOWS\system32\iwspcwpv.exe
Adware:Adware/TitanShield Not disinfected C:\WINDOWS\system32\jtsdqczh.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Virus:Trj/Gagar.AG Disinfected C:\WINDOWS\system32\psqmbulk.exe
Virus:Trj/Gagar.P Disinfected C:\WINDOWS\system32\xlluuvuk.exe

[LonnyRJones]

Hi

Fallow the instructions here, afterwards post the logs mentioned.
http://forums.spybot.info/showthread.php?t=4015
If you have any questions ask before getting started.

[tashi]

This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.