spyware/adware/viruses help? 2 Options

[yukichan]

<!-- begin code provided by createblog.com --><br />Logfile of HijackThis v1.99.1<br />Scan saved at 10:04:15, on 2005/06/06<br />Platform: Windows XP SP2 (WinNT 5.01.2600)<br />MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)<br /><br />Running processes:<br />C:\WINDOWS\System32\smss.exe<br />C:\WINDOWS\system32\winlogon.exe<br />C:\WINDOWS\system32\services.exe<br />C:\WINDOWS\system32\lsass.exe<br />C:\WINDOWS\system32\svchost.exe<br />C:\WINDOWS\System32\svchost.exe<br />C:\WINDOWS\system32\spoolsv.exe<br />C:\WINDOWS\Explorer.exe<br />C:\WINDOWS\system32\ctfmon.exe<br />C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe<br />C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe<br />C:\Program Files\Common Files\Symantec Shared\ccApp.exe<br />C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe<br />C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe<br />C:\Program Files\HP\hpcoretech\hpcmpmgr.exe<br />C:\WINDOWS\System32\hphmon05.exe<br />C:\Program Files\Norton AntiVirus\navapsvc.exe<br />C:\Program Files\QuickTime\qttask.exe<br />C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe<br />C:\Program Files\Common Files\AOL\ACS\AOLDial.exe<br />C:\Program Files\Norton AntiVirus\SAVScan.exe<br />C:\Program Files\Common Files\Real\Update_OB\realsched.exe<br />C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe<br />C:\WINDOWS\system32\nsvsvc\nsvsvc.exe<br />C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />C:\WINDOWS\system32\picsvr\picsvr.exe<br />C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe<br />C:\Program Files\webHancer\Programs\whSurvey.exe<br />C:\Program Files\webHancer\Programs\whAgent.exe<br />c:\windows\system32\photgac.exe<br />C:\Program Files\aim\aim.exe<br />C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe<br />C:\Program Files\BigFix\BigFix.exe<br />C:\WINDOWS\System32\HPZipm12.exe<br />C:\Program Files\Internet Explorer\iexplore.exe<br />C:\Program Files\Internet Explorer\IEXPLORE.EXE<br />C:\Program Files\Messenger\msmsgs.exe<br />C:\DOCUME~1\NANCYS~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe<br /><br />F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe<br />N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Nancy Sato\Application Data\Mozilla\Profiles\default\qnlupyzf.slt\prefs.js)<br />O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)<br />O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll<br />O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)<br />O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll (file missing)<br />O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll<br />O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll<br />O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll<br />O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)<br />O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll<br />O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll<br />O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)<br />O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file)<br />O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"<br />O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"<br />O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe<br />O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe<br />O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"<br />O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe<br />O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32<br />O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC<br />O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC<br />O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName<br />O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime<br />O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe<br />O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe<br />O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot<br />O4 - HKLM\..\Run: [xixzig] c:\windows\system32\xixzig.exe<br />O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe<br />O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe<br />O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe<br />O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1<br />O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer<br />O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"<br />O4 - HKLM\..\Run: [CyQbid6] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe<br />O4 - HKLM\..\Run: [C:\WI^#OWS\gfywdt.exC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32\nsvsvc\nsvsvc.exe<br />O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe<br />O4 - HKLM\..\Run: [C:\WI3ﾔOW^#gfywdt.exC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u<br />O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe<br />O4 - HKLM\..\Run: [C:\WI3ﾔOW^#gfywdtNxC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"<br />O4 - HKLM\..\Run: [C:\WI3ﾔOWGGgfﾏNb化9:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"<br />O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"<br />O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"<br />O4 - HKLM\..\Run: [zeiszma] c:\windows\system32\photgac.exe<br />O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe<br />O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"<br />O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background<br />O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet<br />O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl<br />O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\Nancy Sato\Application Data\rncr.exe<br />O4 - HKCU\..\Run: [Nvbde] C:\WINDOWS\system32\wυcrtupd.exe<br />O4 - Startup: AdDestroyer.lnk = C:\Program Files\AdDestroyer\AdDestroyer.exe<br />O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe<br />O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE<br />O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html<br />O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html<br />O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html<br />O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html<br />O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html<br />O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll<br />O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll<br />O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe<br />O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe<br />O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe<br />O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll<br />O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe<br />O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe<br />O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)<br />O10 - Hijacked Internet access by WebHancer<br />O10 - Hijacked Internet access by WebHancer<br />O10 - Hijacked Internet access by WebHancer<br />O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com<br />O15 - Trusted Zone: *.media-motor.net<br />O15 - Trusted Zone: *.popuppers.com<br />O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - [url=http://help.rr.com/Foundrysdccommon/download/tgctlar.cab]http://help.rr.com/Foundrysdccommon/download/tgctlar.cab[/url]<br />O16 - DPF: {04719992-296F-4958-AA0F-FA25FFA5008B} - [url=http://www1.excite.com/ct/speedbar/x8bar1,0,2,3.cab]http://www1.excite.com/ct/speedbar/x8bar1,0,2,3.cab[/url]<br />O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - [url=https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab]https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab[/url]<br />O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - [url=http://pictures02.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.7.cab]http://pictures02.aim.com/ygp/aol/plugin/u...AIM.9.5.1.7.cab[/url]<br />O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - [url=http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab]http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab[/url]<br />O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - [url=http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab]http://games-dl.real.com/gameconsole/Bundl...ArcadeRdxIE.cab[/url]<br />O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - [url=https://www-secure.symantec.com/techsupp/asa/SymAData.cab]https://www-secure.symantec.com/techsupp/asa/SymAData.cab[/url]<br />O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - [url=http://chat.msn.com/bin/msnchat45.cab]http://chat.msn.com/bin/msnchat45.cab[/url]<br />O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - [url=http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab]http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab[/url]<br />O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll<br />O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe<br />O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe<br />O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe<br />O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe<br />O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe<br />O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe<br />O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe<br />O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe<br />O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe<br />O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe<br />O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe<br /><!-- end code provided by createblog.com -->

Umm..Made a new topic as dispn0ygonekrazy requested...
For more information check http://www.createblog.com/forums/index.php...=0#entry1343361

[dispn0ygonekrazy]

Yes sir i can definitely help you let me make a fix for you individually as well also alright please be patient ill get to you

Alright gotnoheart sorry it took so long to get to you, im on vacation and currently still but i have time to help you =].

Please follow the instructions thoroughly and making sure you do them in order.

MooSoft <------ Download the program and run a scan for trojans. You have a trojan detected in your harddrive.

Run this online virus scan: ActiveScan - Save the results from the scan!

1.) Download The Hoster Press "Restore Original Hosts" and press "OK". Exit Program.

2.) Right-Click HERE and Save As to download DelDomains.inf to your desktop.
To use: RIGHT-CLICK DelDomains.inf on your desktop and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

3.) Download, install. CleanUp!

You have a CoolWebSearch infection.

Download CWShredder here to its own folder.

Update CWShredder

* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder

Open HJT, Scan then put a check on the following files below.

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%s
O2 - BHO: ohb Class - {0AEE4D0C-4B38-4196-AE32-70ACE5656647} - C:\WINDOWS\System32\winsrm32.dll (file missing)
O2 - BHO: (no name) - {10AA115E-9874-17AF-147C-C424D9FA21F0} - C:\WINDOWS\ipin32.dll (file missing)
O2 - BHO: (no name) - {A6504E6D-DF84-8F54-841C-8C1D866319B2} - C:\WINDOWS\System32\zpvupmgh.dll
O3 - Toolbar: TheSearchMall.com Bar - {4B8F38C7-62FC-4762-B9A0-27E63F768167} - C:\WINDOWS\System32\winsrm32.dll (file missing)
O4 - HKLM\..\RunServices: [MSN Update] dllcon.exe
O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {41D13E9A-BB94-402A-8502-AFA78526B63D} (iiittt Class) - http://www.thesearchmall.com/toolbar/winsrm32.cab
O16 - DPF: {BAB3E70B-A847-4A88-ACFC-778FCCC00287} (CActSetupObj Object) - http://www.odysseusmarketing.com/actsetup.cab

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about. Reboot your computer into normal windows.

Post a new HiJackThis log along with the results from ActiveScan.