spyware/adware/viruses help? 2 Options

[yukichan]

<!-- begin code provided by createblog.com --><br />Logfile of HijackThis v1.99.1<br />Scan saved at 10:04:15, on 2005/06/06<br />Platform: Windows XP SP2 (WinNT 5.01.2600)<br />MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)<br /><br />Running processes:<br />C:\WINDOWS\System32\smss.exe<br />C:\WINDOWS\system32\winlogon.exe<br />C:\WINDOWS\system32\services.exe<br />C:\WINDOWS\system32\lsass.exe<br />C:\WINDOWS\system32\svchost.exe<br />C:\WINDOWS\System32\svchost.exe<br />C:\WINDOWS\system32\spoolsv.exe<br />C:\WINDOWS\Explorer.exe<br />C:\WINDOWS\system32\ctfmon.exe<br />C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe<br />C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe<br />C:\Program Files\Common Files\Symantec Shared\ccApp.exe<br />C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe<br />C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe<br />C:\Program Files\HP\hpcoretech\hpcmpmgr.exe<br />C:\WINDOWS\System32\hphmon05.exe<br />C:\Program Files\Norton AntiVirus\navapsvc.exe<br />C:\Program Files\QuickTime\qttask.exe<br />C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe<br />C:\Program Files\Common Files\AOL\ACS\AOLDial.exe<br />C:\Program Files\Norton AntiVirus\SAVScan.exe<br />C:\Program Files\Common Files\Real\Update_OB\realsched.exe<br />C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe<br />C:\WINDOWS\system32\nsvsvc\nsvsvc.exe<br />C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />C:\WINDOWS\system32\picsvr\picsvr.exe<br />C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe<br />C:\Program Files\webHancer\Programs\whSurvey.exe<br />C:\Program Files\webHancer\Programs\whAgent.exe<br />c:\windows\system32\photgac.exe<br />C:\Program Files\aim\aim.exe<br />C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe<br />C:\Program Files\BigFix\BigFix.exe<br />C:\WINDOWS\System32\HPZipm12.exe<br />C:\Program Files\Internet Explorer\iexplore.exe<br />C:\Program Files\Internet Explorer\IEXPLORE.EXE<br />C:\Program Files\Messenger\msmsgs.exe<br />C:\DOCUME~1\NANCYS~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe<br /><br />F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe<br />N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Nancy Sato\Application Data\Mozilla\Profiles\default\qnlupyzf.slt\prefs.js)<br />O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)<br />O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll<br />O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)<br />O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll (file missing)<br />O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll<br />O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll<br />O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll<br />O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)<br />O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll<br />O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll<br />O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)<br />O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file)<br />O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"<br />O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"<br />O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe<br />O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe<br />O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"<br />O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe<br />O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32<br />O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC<br />O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC<br />O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName<br />O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime<br />O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe<br />O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe<br />O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot<br />O4 - HKLM\..\Run: [xixzig] c:\windows\system32\xixzig.exe<br />O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe<br />O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe<br />O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe<br />O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1<br />O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer<br />O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"<br />O4 - HKLM\..\Run: [CyQbid6] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe<br />O4 - HKLM\..\Run: [C:\WI^#OWS\gfywdt.exC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32\nsvsvc\nsvsvc.exe<br />O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe<br />O4 - HKLM\..\Run: [C:\WI3ﾔOW^#gfywdt.exC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u<br />O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe<br />O4 - HKLM\..\Run: [C:\WI3ﾔOW^#gfywdtNxC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"<br />O4 - HKLM\..\Run: [C:\WI3ﾔOWGGgfﾏNb化9:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\gfywdt.exe<br />O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"<br />O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"<br />O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"<br />O4 - HKLM\..\Run: [zeiszma] c:\windows\system32\photgac.exe<br />O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe<br />O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"<br />O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background<br />O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet<br />O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl<br />O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\Nancy Sato\Application Data\rncr.exe<br />O4 - HKCU\..\Run: [Nvbde] C:\WINDOWS\system32\wυcrtupd.exe<br />O4 - Startup: AdDestroyer.lnk = C:\Program Files\AdDestroyer\AdDestroyer.exe<br />O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe<br />O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE<br />O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html<br />O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html<br />O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html<br />O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html<br />O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html<br />O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll<br />O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll<br />O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe<br />O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe<br />O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe<br />O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll<br />O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe<br />O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe<br />O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)<br />O10 - Hijacked Internet access by WebHancer<br />O10 - Hijacked Internet access by WebHancer<br />O10 - Hijacked Internet access by WebHancer<br />O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com<br />O15 - Trusted Zone: *.media-motor.net<br />O15 - Trusted Zone: *.popuppers.com<br />O16 - DPF: {01111C00-3E00-11D2-8470-0060089874ED} (Support.com ActionRunner Class) - [url=http://help.rr.com/Foundrysdccommon/download/tgctlar.cab]http://help.rr.com/Foundrysdccommon/download/tgctlar.cab[/url]<br />O16 - DPF: {04719992-296F-4958-AA0F-FA25FFA5008B} - [url=http://www1.excite.com/ct/speedbar/x8bar1,0,2,3.cab]http://www1.excite.com/ct/speedbar/x8bar1,0,2,3.cab[/url]<br />O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - [url=https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab]https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab[/url]<br />O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - [url=http://pictures02.aim.com/ygp/aol/plugin/upf/AOLUPF.en-US-AIM.9.5.1.7.cab]http://pictures02.aim.com/ygp/aol/plugin/u...AIM.9.5.1.7.cab[/url]<br />O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - [url=http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab]http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab[/url]<br />O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - [url=http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab]http://games-dl.real.com/gameconsole/Bundl...ArcadeRdxIE.cab[/url]<br />O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - [url=https://www-secure.symantec.com/techsupp/asa/SymAData.cab]https://www-secure.symantec.com/techsupp/asa/SymAData.cab[/url]<br />O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - [url=http://chat.msn.com/bin/msnchat45.cab]http://chat.msn.com/bin/msnchat45.cab[/url]<br />O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - [url=http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab]http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab[/url]<br />O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll<br />O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe<br />O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe<br />O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe<br />O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe<br />O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe<br />O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe<br />O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe<br />O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe<br />O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe<br />O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe<br />O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe<br />O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe<br /><!-- end code provided by createblog.com -->

Umm..Made a new topic as dispn0ygonekrazy requested...
For more information check http://www.createblog.com/forums/index.php...=0#entry1343361

[dispn0ygonekrazy]

Alright lets try this, Download Ewido Security Suite from its website, just google it, install and update the definitions but dont run it yet.

Clear your temporary internet files and folders and run MooSoft, if you dont have it Download it from my Signature.

Reboot in Safe Mode and run Ewido Security Suite and restart your computer and tell me how it is.