Thanks Illuka - didn't expect to hear from you over the weekend
VundoFix V6.2.13
Checking Java version...
Sun Java not detected
Scan started at 21:30:03 02/12/2006
Listing files found while scanning....
C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\byxwt.dll
C:\WINDOWS\system32\cbaya.dll
C:\WINDOWS\system32\dtfucdcf.dll
C:\WINDOWS\system32\efcaw.dll
C:\WINDOWS\system32\efcbx.dll
C:\WINDOWS\system32\hxpdmoye.dll
C:\WINDOWS\system32\kiwclxah.dll
C:\WINDOWS\system32\mayufxod.dll
C:\WINDOWS\system32\mepdkrmf.dll
C:\WINDOWS\system32\mhdavqbe.dll
C:\WINDOWS\system32\nbublfjr.dll
C:\WINDOWS\system32\nnlkl.dll
C:\WINDOWS\system32\opnmj.dll
C:\WINDOWS\system32\opnnk.dll
C:\WINDOWS\system32\pkvoftsl.dll
C:\WINDOWS\system32\pmkki.dll
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\qopnn.dll
C:\WINDOWS\system32\qoppp.dll
C:\WINDOWS\system32\ssqqo.dll
C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\uairdsbq.dll
C:\WINDOWS\system32\ursrp.dll
C:\WINDOWS\system32\wcudrcoj.dll
C:\WINDOWS\system32\wvwuv.dll
C:\WINDOWS\system32\xjwkvnug.dll
C:\WINDOWS\system32\xxyab.dll
C:\WINDOWS\system32\yabcy.dll
C:\WINDOWS\system32\yabxv.dll
C:\WINDOWS\repair\natiibn.dll
C:\WINDOWS\repair\nbiitan.ini
C:\WINDOWS\repair\nbiitan.bak1
C:\WINDOWS\repair\nbiitan.bak2
C:\WINDOWS\repair\nbiitan.ini2
Beginning removal...
Attempting to delete C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\awtqo.dll Has been deleted!
Logfile of HijackThis v1.99.1
Scan saved at 21:40:44, on 02/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\UPDATE_FILES\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\system32\wahgliam.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O2 - BHO: (no name) - {781E3C97-CD31-46C7-9AB4-76C860082482} - C:\WINDOWS\repair\natiibn.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
Attempting to delete C:\WINDOWS\system32\byxwt.dll
C:\WINDOWS\system32\byxwt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\cbaya.dll
C:\WINDOWS\system32\cbaya.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\dtfucdcf.dll
C:\WINDOWS\system32\dtfucdcf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\efcaw.dll
C:\WINDOWS\system32\efcaw.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\efcbx.dll
C:\WINDOWS\system32\efcbx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hxpdmoye.dll
C:\WINDOWS\system32\hxpdmoye.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\kiwclxah.dll
C:\WINDOWS\system32\kiwclxah.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mayufxod.dll
C:\WINDOWS\system32\mayufxod.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mepdkrmf.dll
C:\WINDOWS\system32\mepdkrmf.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\mhdavqbe.dll
C:\WINDOWS\system32\mhdavqbe.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nbublfjr.dll
C:\WINDOWS\system32\nbublfjr.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nnlkl.dll
C:\WINDOWS\system32\nnlkl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\opnmj.dll
C:\WINDOWS\system32\opnmj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\opnnk.dll
C:\WINDOWS\system32\opnnk.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pkvoftsl.dll
C:\WINDOWS\system32\pkvoftsl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmkki.dll
C:\WINDOWS\system32\pmkki.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\pmnll.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qopnn.dll
C:\WINDOWS\system32\qopnn.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\qoppp.dll
C:\WINDOWS\system32\qoppp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ssqqo.dll
C:\WINDOWS\system32\ssqqo.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ssttt.dll
C:\WINDOWS\system32\ssttt.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\uairdsbq.dll
C:\WINDOWS\system32\uairdsbq.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ursrp.dll
C:\WINDOWS\system32\ursrp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\wcudrcoj.dll
C:\WINDOWS\system32\wcudrcoj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\wvwuv.dll
C:\WINDOWS\system32\wvwuv.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xjwkvnug.dll
C:\WINDOWS\system32\xjwkvnug.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\xxyab.dll
C:\WINDOWS\system32\xxyab.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\yabcy.dll
C:\WINDOWS\system32\yabcy.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\yabxv.dll
C:\WINDOWS\system32\yabxv.dll Has been deleted!
Attempting to delete C:\WINDOWS\repair\natiibn.dll
C:\WINDOWS\repair\natiibn.dll Has been deleted!
Attempting to delete C:\WINDOWS\repair\nbiitan.ini
C:\WINDOWS\repair\nbiitan.ini Has been deleted!
Attempting to delete C:\WINDOWS\repair\nbiitan.bak1
C:\WINDOWS\repair\nbiitan.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\repair\nbiitan.bak2
C:\WINDOWS\repair\nbiitan.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\repair\nbiitan.ini2
C:\WINDOWS\repair\nbiitan.ini2 Has been deleted!
Performing Repairs to the registry.
Done!
Logfile of HijackThis v1.99.1
Scan saved at 21:40:44, on 02/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\UPDATE_FILES\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - C:\WINDOWS\system32\wahgliam.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O2 - BHO: (no name) - {781E3C97-CD31-46C7-9AB4-76C860082482} - C:\WINDOWS\repair\natiibn.dll (file missing)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
last wee bit of help please
Oh well, thanks. I appreciate all your efforts. I have done a reformat and reinstall before, but I still have the problem of having loads of documents - music and photos mainly - that I want to keep. Why can't I use an external hard drive to copy them all onto? Also, if I format the C drive and reinstall, will my D drive with all the data still be intact or is there a chance I'll lose everything?
When I turn on the external drive it comes up as an F drive on my computer but when I try to use it I get a message saying "F:\ is not accessible. The request could not be performed because of an I/O device error." It's plugged into a USB 2 port which works on my ipod. Is there something I can do rather than spend a whole day burning CDs?
thanks
S