josh10581 HJT log

[josh10581]

Hi guys, spyware has almost completely debilitated my computer despite Microsoft Antispyware, Spybot, Adaware, etc. Here is my log please, had to run in safe mode.

Logfile of HijackThis v1.99.1
Scan saved at 10:20:49 PM, on 6/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.exe
D:\WINDOWS\xvchost.exe
D:\Documents and Settings\JQ\Desktop\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\xvchost.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AutoVirusProtection] ciscv.exe
O4 - HKLM\..\Run: [ofyryf] D:\WINDOWS\ofyryf.exe
O4 - HKLM\..\Run: [Calc Microsoft Windows] wincalc.exe
O4 - HKLM\..\Run: [cdkb] d:\windows\cdkb.exe
O4 - HKLM\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\Run: [Windows USBD] msifirewall.exe
O4 - HKLM\..\Run: [Norton Updater] navupdtr.exe
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Required Service Drivers] micront.exe
O4 - HKLM\..\Run: [cjsl] d:\windows\cjsl.exe
O4 - HKLM\..\Run: [msxct] msxct.exe
O4 - HKLM\..\Run: [Windows Desktop Daemon] winpadg.exe
O4 - HKLM\..\Run: [ilshkn] d:\windows\ilshkn.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Service Manager] D:\WINDOWS\xvchost.exe
O4 - HKLM\..\Run: [ilcryz] d:\windows\ilcryz.exe
O4 - HKLM\..\Run: [salm] d:\temp\salm.exe
O4 - HKLM\..\Run: [ap9h4qmo] D:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [hgr] d:\windows\hgr.exe
O4 - HKLM\..\Run: [checkrun] d:\windows\system32\eliteacv32.exe
O4 - HKLM\..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\RunServices: [AutoVirusProtection] ciscv.exe
O4 - HKLM\..\RunServices: [Calc Microsoft Windows] wincalc.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\RunServices: [Windows USBD] msifirewall.exe
O4 - HKLM\..\RunServices: [Norton Updater] navupdtr.exe
O4 - HKLM\..\RunServices: [Required Service Drivers] micront.exe
O4 - HKLM\..\RunServices: [Windows Desktop Daemon] winpadg.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Calc Microsoft Windows] wincalc.exe
O4 - HKCU\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKCU\..\Run: [Norton Updater] navupdtr.exe
O4 - HKCU\..\Run: [Required Service Drivers] micront.exe
O4 - HKCU\..\RunServices: [Compaq Service Drivers] systeminfos.exe
O4 - HKCU\..\RunServices: [Norton Updater] navupdtr.exe
O4 - HKCU\..\RunServices: [Required Service Drivers] micront.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 3446917796
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-l ... cfscan.cab
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - D:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - D:\WINDOWS\System32\mousehs.exe
O23 - Service: Windows Update Service - Unknown owner - D:\WINDOWS\pwnsvc.exe

[Gecko]

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Boot into safe mode and:

Press Ctrl/Alt/Del and"End Task"or"End Process"on each of the following:
(They may or may not be there)
SearchAssistant
EliteToolBar
180Search
TBPS
MediaAccK
Azesearch
ciscv
ofyryf
wincalc
cdkb
systeminfos
msifirewall
navupdtr
micront
cjsl
msxct
winpadg
ilshkn
xvchost
ilshkn
salm
ap9h4qmo
hgr
eliteacv32
MediaAccK
msifirewall

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://D:\PROGRA~1\Toolbar\toolbar.dll/sa
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\xvchost.exe
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - D:\WINDOWS\EliteToolBar\EliteToolBar version 60.dll
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [AutoVirusProtection] ciscv.exe
O4 - HKLM\..\Run: [ofyryf] D:\WINDOWS\ofyryf.exe
O4 - HKLM\..\Run: [Calc Microsoft Windows] wincalc.exe
O4 - HKLM\..\Run: [cdkb] d:\windows\cdkb.exe
O4 - HKLM\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\Run: [Windows USBD] msifirewall.exe
O4 - HKLM\..\Run: [Norton Updater] navupdtr.exe
O4 - HKLM\..\Run: [Required Service Drivers] micront.exe
O4 - HKLM\..\Run: [cjsl] d:\windows\cjsl.exe
O4 - HKLM\..\Run: [msxct] msxct.exe
O4 - HKLM\..\Run: [Windows Desktop Daemon] winpadg.exe
O4 - HKLM\..\Run: [ilshkn] d:\windows\ilshkn.exe
O4 - HKLM\..\Run: [Windows Service Manager] D:\WINDOWS\xvchost.exe
O4 - HKLM\..\Run: [ilcryz] d:\windows\ilcryz.exe
O4 - HKLM\..\Run: [salm] d:\temp\salm.exe
O4 - HKLM\..\Run: [ap9h4qmo] D:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [hgr] d:\windows\hgr.exe
O4 - HKLM\..\Run: [checkrun] d:\windows\system32\eliteacv32.exe
O4 - HKLM\..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Media Access] D:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\RunServices: [AutoVirusProtection] ciscv.exe
O4 - HKLM\..\RunServices: [Calc Microsoft Windows] wincalc.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\RunServices: [Windows USBD] msifirewall.exe
O4 - HKLM\..\RunServices: [Norton Updater] navupdtr.exe
O4 - HKLM\..\RunServices: [Required Service Drivers] micront.exe
O4 - HKLM\..\RunServices: [Windows Desktop Daemon] winpadg.exe
O4 - HKCU\..\Run: [Calc Microsoft Windows] wincalc.exe
O4 - HKCU\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKCU\..\Run: [Norton Updater] navupdtr.exe
O4 - HKCU\..\Run: [Required Service Drivers] micront.exe
O4 - HKCU\..\RunServices: [Compaq Service Drivers] systeminfos.exe
O4 - HKCU\..\RunServices: [Norton Updater] navupdtr.exe
O4 - HKCU\..\RunServices: [Required Service Drivers] micront.exe
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - D:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Mouse Hardware Sync (mousehs) - Unknown owner - D:\WINDOWS\System32\mousehs.exe
O23 - Service: Windows Update Service - Unknown owner - D:\WINDOWS\pwnsvc.exe


Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
SearchAssistant
EliteToolBar
180Search
TBPS
MediaAccK
Azesearch

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
D:\Program Files\Toolbar\
D:\WINDOWS\xvchost.exe
D:\WINDOWS\EliteToolBar\
D:\WINDOWS\ofyryf.exe
d:\windows\cjsl.exe
d:\windows\ilshkn.exe
D:\WINDOWS\xvchost.exe
d:\windows\ilcryz.exe
d:\temp\salm.exe
D:\WINDOWS\System32\ap9h4qmo.exe
d:\windows\hgr.exe
d:\windows\system32\eliteacv32.exe
D:\Program Files\Media Access\MediaAccK.exe
D:\WINDOWS\System32\mousehs.exe
D:\WINDOWS\pwnsvc.exe

If you could not delete any of the above files then:
Start HijackThis and click the Open the misc tools section now click Delete a file on reboot
Select one file from above

Click open but click no to reboot now do the same for each file that you cound not delete:

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

[josh10581]

Sorry for the delay. Anyway, I've tried a couple of times to clean computer, but everytime I do there is still a file or two that should have been removed. Should I repost in case of new spyware, or just give it another go?

[Gecko]

I would suggest that you run both Ad-Aware and Spy-Bot delete everything they find.
Then without rebooting post a new HijackThis log.