System is Very Slow

[Bratin Saha]

Logfile of HijackThis v1.99.1
Scan saved at 8:47:54 AM, on 8/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\RunDll32.exe
D:\WINDOWS\System32\hkcmd.exe
D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
D:\Program Files\webHancer\Programs\whAgent.exe
D:\Program Files\webHancer\Programs\whSurvey.exe
D:\Program Files\Common Files\CMEII\CMESys.exe
D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
D:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE
D:\program files\zangoclient\zanu.exe
D:\Program Files\NaviSearch\bin\nls.exe
D:\WINDOWS\System32\outpostupdate.exe
D:\WINDOWS\System32\rundll32.exe
D:\Program Files\Common Files\GMT\GMT.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\MemoKit\memokit2.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
D:\WINDOWS\system32\pctspk.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\bratin shah\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1 ... aIYwxxn7V6
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - d:\program files\zangoclient\zanuhook.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - D:\Program Files\SideFind\sfbho.dll
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - D:\WINDOWS\System32\nvms.dll
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - D:\Program Files\webHancer\programs\whiehlpr.dll
O2 - BHO: Starware - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - D:\Program Files\Starware\bin\Starware.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Starware - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - D:\Program Files\Starware\bin\Starware.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - D:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Adaptec DirectCD] D:\PROGRA~1\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [VetTray] D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [REGSHAVE] D:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [webHancer Agent] "D:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "D:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [CMESys] "D:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] D:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [zanu] d:\program files\zangoclient\zanu.exe
O4 - HKLM\..\Run: [BullsEye Network] D:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] D:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKLM\..\RunServices: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1043.dll,InstantAccess
O4 - Startup: MemoKit.lnk = D:\Program Files\MemoKit\mk.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = D:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: GStartup.lnk = D:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = D:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.h ... xdm337YYIN
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - D:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O12 - Plugin for .mpeg: D:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/downl ... TING32.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu ... .0.8-2.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://D:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares ... egular.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/installer ... taller.cab
O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.zango.com/GetZango/Download/zangoax.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://D:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {BD3653E4-884B-43C4-970B-670802501B7F} - http://akamai.downloadv3.com/binaries/P ... _EN_XP.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://D:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/I ... _EN_XP.cab
O16 - DPF: {CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E} (VacPro.internazionale_ver15) - http://advnt01.com/dialer/internazionale_ver15.CAB
O16 - DPF: {D22AC3EF-B7D8-11D5-A281-005056BF0101} (plug Class) - http://www.gxplugin.com/loader/dll/gxbplug.dll
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://xbscc1.mtree.com/mt/dialers/fc/UniDist.CAB
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://D:\Program Files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {FC87A650-207D-4392-A6A1-82ADBC56FA64} (MultiDist) - http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF36C27D-5D4D-46FE-97B3-5F2B8AA55AC6}: NameServer = 202.88.156.6,202.88.130.67,203.195.198.66
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - D:\WINDOWS\system32\pctspk.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe

[askey127]

Bratin Saha,
Welcome to the forum,

Print this out or save it to a notepad file on your desktop. There is some risk that your Internet connection may be lost when WebHancer is removed, and you will need to run LSPFix per the following instructions.
This computer has a very large number of infections.
It will take a number of passes to fix them. Let's do this first:
-----------------------------------------------------------
Download LSPFix from here : http://www.cexx.org/lspfix.htm
DON'T RUN LSPFIX NOW.
Run it ONLY if internet connectivity is lost following this fix when you reboot.

--------------To Run LSPFix in case of lost internet connection-------------------
First disconnect the cable from the internet, and close all browser windows.
Double-click LSPFix.
Click Finish. Don't use the "X" in the upper right hand corner to close the window, or the program won't execute.
Reboot Windows normally.

-----------------------------------------------------------
Stop Processes Prior to Removal
Close all Internet Browsers.
Start Hijackthis. Open the Misc Tools Section, then Open Process Manager; find each of these programs and click kill process (if they exist).
Then, click Refresh, check again, and repeat this step if any remain.

D:\Program Files\webHancer\Programs\whAgent.exe
D:\Program Files\webHancer\Programs\whSurvey.exe

-----------------------------------------------------------
Use Add/Remove Programs In Control Panel
From Start,Settings,Control Panel or Start,Control Panel, click Add/Remove Programs.
Highlight the following entries, one by one, if they exist, and choose Remove :

WebHancer

Take extra care in answering any questions posed by the uninstaller. Some questions may be worded to deceive you into choosing to keep the program.
-----------------------------------------------------------
File and Folder Deletion.
In Windows Explorer, Find and Delete these folders, if present:

D:\Program Files\webHancer\Programs\
D:\Program Files\webHancer\

Note any folder you cannot delete.
You may have to delete all the underlying files and folders before a target folder can be deleted.

If you have any problem deleting a file, right click the file and check Properties to see if it's read-only. Uncheck the read-only box, click Apply and OK. Then retry Delete.
Note the name and location of any file or folder you cannot delete.
-----------------------------------------------------------
Retrieve the List of Installed programs Using HJT
Open HijackThis, click Miscellaneous Tools. Then click Uninstall Manager and Save List...
The List of installed programs will automatically be saved as uninstall_list.txt in your HiJackThis folder. In addition, it opens in Notepad so you can also save as another name in another location if you wish. Please paste the contents into your next reply.
-----------------------------------------------------------
Post a New HJT Log
Reboot your computer. Start HijackThis. Click Do System Scan and Save a Log File.
When the Scan is complete, select the whole log (Ctrl-A), copy and paste the log contents in a reply, along with the Installed programs List you saved.
I will also need to know the name of your Internet Service Provider.

askey127

[Bratin Saha]

Logfile of HijackThis v1.99.1
Scan saved at 6:42:30 AM, on 8/11/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\RunDll32.exe
D:\WINDOWS\System32\hkcmd.exe
D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
D:\Program Files\Common Files\CMEII\CMESys.exe
D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
D:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE
D:\program files\zangoclient\zanu.exe
D:\Program Files\NaviSearch\bin\nls.exe
D:\WINDOWS\System32\outpostupdate.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\rundll32.exe
D:\Program Files\FinePixViewer\QuickDCF.exe
D:\Program Files\Common Files\GMT\GMT.exe
D:\Program Files\MemoKit\memokit2.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ

Antivirus\isafe.exe
D:\WINDOWS\system32\pctspk.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\WINDOWS\System32\wuauclt.exe
D:\Documents and Settings\bratin shah\Local

Settings\Temp\Temporary Directory 4 for

hijackthis.zip\HijackThis.exe
D:\WINDOWS\System32\wuauclt.exe

R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) -

{00A6FAF6-072E-44cf-8957-5838F569A31D} -

D:\Program

Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO -

{00A6FAF1-072E-44cf-8957-5838F569A31D} -

D:\Program

Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

D:\Program Files\Adobe\Acrobat

6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO -

{07B18EA1-A523-4961-B6BB-170DE4475CCA} -

D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: SABHO -

{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} -

d:\program files\zangoclient\zanuhook.dll
O2 - BHO: BAHelper Class -

{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -

D:\Program Files\SideFind\sfbho.dll
O2 - BHO: NLS UrlCatcher Class -

{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -

D:\WINDOWS\System32\nvms.dll
O2 - BHO: Starware -

{CA356D79-679B-4b4c-8E49-5AF97014F4C1} -

D:\Program Files\Starware\bin\Starware.dll
O3 - Toolbar: &Radio -

{8E718888-423F-11D2-876E-00A0C9082467} -

D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Starware -

{D49E9D35-254C-4c6a-9D17-95018D228FF5} -

D:\Program Files\Starware\bin\Starware.dll
O3 - Toolbar: ISTbar -

{FAA356E4-D317-42a6-AB41-A3021C6E7D52} -

D:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32

cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Adaptec DirectCD]

D:\PROGRA~1\DirectCD\DIRECTCD.EXE
O4 - HKLM\..\Run: [IgfxTray]

D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds]

D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [VetTray]

D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [REGSHAVE] D:\Program

Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [CMESys] "D:\Program Files\Common

Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin]

D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [MW1HelperStartUp]

D:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner

MW1
O4 - HKLM\..\Run: [zanu] d:\program

files\zangoclient\zanu.exe
O4 - HKLM\..\Run: [BullsEye Network] D:\Program

Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] D:\Program

Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [outpostupdate]

D:\WINDOWS\System32\outpostupdate.exe
O4 - HKLM\..\RunServices: [outpostupdate]

D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program

Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program

Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MyWebSearch Email Plugin]

D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [outpostupdate]

D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe

p2esocks_1043.dll,InstantAccess
O4 - Startup: MemoKit.lnk = D:\Program

Files\MemoKit\mk.exe
O4 - Startup: MyWebSearch Email Plugin.lnk =

D:\Program

Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program

Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: GStartup.lnk = D:\Program

Files\Common Files\GMT\GMT.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk =

D:\Program

Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search -

http://bar.mywebsearch.com/menusearch.html?p=ZCxdm3

37YYIN
O9 - Extra button: SideFind -

{10E42047-DEB9-4535-A118-B3F6EC39B807} -

D:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} -

D:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} -

D:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Related -

{c95fe080-8f5d-11d2-a20b-00aa003c157a} -

D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -

{c95fe080-8f5d-11d2-a20b-00aa003c157a} -

D:\WINDOWS\web\related.htm
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

D:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mpeg: D:\Program Files\Internet

Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: D:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF:

{0878B424-1F95-4E26-B5AB-F0D349D89650} -

http://download.bargain-buddy.net/download/bargain_bud

dy/cab/installer_MARKETING32.cab
O16 - DPF:

{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -

http://ak.imgfarm.com/images/nocache/funwebproducts/e

i-2/CursorManiaFWBInitialSetup1.0.0.8-2.cab
O16 - DPF:

{78AF2F24-A9C3-11D3-BF8C-0060B0FCC122}

(AcDcToday Control) - file://D:\Program Files\AutoCAD

2002\AcDcToday.ocx
O16 - DPF:

{7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer

Class) -

http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_reg

ular.cab
O16 - DPF:

{88D758A3-D33B-45FD-91E3-67749B4057FA}

(Sinstaller Class) -

http://dm.screensavers.com/dm/installer ... sinstaller.

cab
O16 - DPF:

{99410CDE-6F16-42ce-9D49-3807F78F0287}

(ClientInstaller Class) -

http://www.zango.com/GetZango/Download/zangoax.cab
O16 - DPF:

{AE563720-B4F5-11D4-A415-00108302FDFD}

(NOXLATE-BANR) - file://D:\Program Files\AutoCAD

2002\InstBanr.ocx
O16 - DPF:

{BD3653E4-884B-43C4-970B-670802501B7F} -

http://akamai.downloadv3.com/binaries/P2EClient/EGAUT

H_1043_EN_XP.cab
O16 - DPF:

{C6637286-300D-11D4-AE0A-0010830243BD}

(InstaFred) - file://D:\Program Files\AutoCAD

2002\InstFred.ocx
O16 - DPF:

{C6760A07-A574-4705-B113-7856315922C3} -

http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_E

N_XP.cab
O16 - DPF:

{CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E}

(VacPro.internazionale_ver15) -

http://advnt01.com/dialer/internazionale_ver15.CAB
O16 - DPF:

{D22AC3EF-B7D8-11D5-A281-005056BF0101} (plug

Class) - http://www.gxplugin.com/loader/dll/gxbplug.dll
O16 - DPF:

{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}

(MoneyTree Dialer) -

http://xbscc1.mtree.com/mt/dialers/fc/UniDist.CAB
O16 - DPF:

{F281A59C-7B65-11D3-8617-0010830243BD}

(AcPreview Control) - file://D:\Program Files\AutoCAD

2002\AcPreview.ocx
O16 - DPF:

{FC87A650-207D-4392-A6A1-82ADBC56FA64}

(MultiDist) -

http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB
O17 -

HKLM\System\CCS\Services\Tcpip\..\{DF36C27D-5D4D-

46FE-97B3-5F2B8AA55AC6}: NameServer =

202.88.156.6,202.88.130.67,203.195.198.66
O20 - Winlogon Notify: igfxcui -

D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: CA ISafe (CAISafe) - Computer

Associates International, Inc. - D:\Program

Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel,

Inc. - D:\WINDOWS\system32\pctspk.exe
O23 - Service: VET Message Service (VETMSGNT) -

Computer Associates International, Inc. -

D:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe

Saved Programs List:

1000 Best Windows Games
Action Sats Learning Mental Maths
Adaptec DirectCD
Adaptec DirectCD Reader
Adaptec Easy CD Creator
Adobe Acrobat 5.0
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 6.0
Atomic Superball (Demo)
AutoCAD 2002
Cheater's Lair
C-Media 3D Audio
Compton's Learning Math
Delta Force 2 Demo
eTrust EZ Antivirus
FinePixViewer Ver.4.0
FUJIFILM USB Driver
GAIN
GameSpy Arcade
Guard Force
GXB Dialer 716
Hardcore
Harry Potter II
HijackThis 1.99.1
ImageMixer VCD for FinePix
Intel(R) 82845G Graphics Driver Software
Internet Update
ISTsvc
jenniferlopez
LucasArts' Mysteries of the Sith Demo
Magic Waterfall Screensaver
MemoKit
Michael Vaughan's Championship Cricket Manager
Microsoft Age of Empires Trial
Microsoft Office 2000 Premium
MicroStaff WINASPI NT
Mordor II: Darkness Awakening (v0.990b)
MoviePlay
My Web Search (Cursor Mania)
NaviSearch
Pokémon Masters Arena
PowerDVD
PuritySCAN
QuickTime
RAW FILE CONVERTER LE
Repair Registry
Search Assistant
SideFind
SlotchBar
SolarWolf 1.1
Star Wars Starfighter Web Demo
Starware 3.1.3.0
Superscape Viscape Universal
Swarm Demo
Tennis Titans
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB887822
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q815021
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP2) [See Q329115 for more information]
Yahoo! Messenger
Yahoo! Messenger Explorer Bar


Internet Service Provider:

The ISP is http://www.Hathway.com

Thanks
Bratin

[askey127]

Bratin Saha,

Your operating system is only partially protected. Please limit your web surfing until these fixes are complete. We don't want to start over.
I see you have StarWare on your computer. I should warn you that your computer is EXTREMELY vulnerable to ID or Account theft if you do online banking in this condition.
This is quite long, but you can do it.
Print this out or save it to a notepad file on your desktop, and work through all the corrections. You will not have access to the Internet during part of this fix.
-----------------------------------------------------------
Move HijackThis into its own folder. It is now in a temporary folder whose contents may get deleted. This would destroy the backups made by HiJackThis.
To make a new permanent folder: Go to My Computer, doubleclick D:
- Click File, New, Folder
- type in HJT
You now have a new folder at D:\HJT\. Copy all the HijackThis files from your present location into the new folder.
-----------------------------------------------------------
Please download, install, and update the free version of Ewido trojan scanner:
http://www.ewido.net/en/download/
* Install ewido security suite
* When installing, under "Additional Options", UNCHECK "Install background guard" and UNCHECK "Install scan via context menu."
* Launch ewido, there should be a big "E" icon on your desktop, double-click it.
* The program will prompt you to update; click the "OK" button
* The program will now go to the main screen

Update ewido:
You will need to update ewido to the latest definition files.
* On the left hand side of the main screen click update
* Click on Start
* The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.
-----------------------------------------------------------
Start Your Computer in Safe Mode.
Reboot into Safe Mode by hitting the F8 key repeatedly as the machine boots, until a menu shows up. Choose Safe Mode from the list. In some systems, this may be the F5 key, so try that if F8 doesn't work. Extra instructions are here if you need them.
-----------------------------------------------------------

Now Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!

Run Ewido
* Click on scanner
* Click on Settings
o Under "How to scan" all boxes should be selected
o Under "Possibly unwanted software" all boxes should be selected
o Under "What to scan" select scan every file
o Click OK
* Click on Complete system scan
* Let the program scan the machine
* If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so you need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. The Helper assisting you will see it in the log that you will post later and they will let you know if ewido needs to be run again.

Save Your Report:
Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
* Click Save report
* Save it to your desktop
* Exit ewido
-----------------------------------------------------------
Stop Processes Prior to Deletion
Run HiJackThis, open the Misc Tools Section, then Open Process Manager; find each of these programs and click kill process (if they exist).
Then, click Refresh, check again, and repeat this step if any remain.
D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
D:\program files\zangoclient\zanu.exe
D:\Program Files\NaviSearch\bin\nls.exe
-----------------------------------------------------------
Use Add/Remove Programs In Control Panel
From Start,Settings,Control Panel or Start,Control Panel, click Add/Remove Programs.
Highlight the following entries, one at a time, if they exist, and choose Remove. In each case, follow the removal instructions carefully.

My Web Search (Cursor Mania)
NaviSearch
Hardcore
GXB Dialer 716
Search Assistant
SideFind
SlotchBar
ISTsvc

Take extra care in answering any questions posed by the uninstaller. Some questions may be worded to deceive you into choosing to keep the program.
Reboot after you have uninstalled 3 items, then continue. Reboot after each 2 or 3 items.
-----------------------------------------------------------
Remove log items with HighjackThis. Start HijackThis. If the opening screen shows, choose None of the above, just start the program.
Click Scan. When the Scan is complete, Check the following entries:
(Some of these lines may be missing)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) -{00A6FAF6-072E-44cf-8957-5838F569A31D} -D:\ProgramFiles\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO -{00A6FAF1-072E-44cf-8957-5838F569A31D} -D:\ProgramFiles\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO -{07B18EA1-A523-4961-B6BB-170DE4475CCA} -D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: SABHO -{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} -d:\program files\zangoclient\zanuhook.dll
O2 - BHO: BAHelper Class -{A3FDD654-A057-4971-9844-4ED8E67DBBB8} -D:\Program Files\SideFind\sfbho.dll
O2 - BHO: NLS UrlCatcher Class -{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} -D:\WINDOWS\System32\nvms.dll
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} -D:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [CMESys] "D:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] D:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [zanu] d:\program files\zangoclient\zanu.exe
O4 - HKLM\..\Run: [BullsEye Network] D:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] D:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKLM\..\RunServices: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [outpostupdate] D:\WINDOWS\System32\outpostupdate.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1043.dll,InstantAccess
O4 - Startup: MyWebSearch Email Plugin.lnk =D:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: GStartup.lnk = D:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk =D:\ProgramFiles\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search -http://bar.mywebsearch.com/menusearch.html?p=ZCxdm337YYIN
O9 - Extra button: SideFind -{10E42047-DEB9-4535-A118-B3F6EC39B807} -D:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Related -{c95fe080-8f5d-11d2-a20b-00aa003c157a} -D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -{c95fe080-8f5d-11d2-a20b-00aa003c157a} -D:\WINDOWS\web\related.htm
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF:{0878B424-1F95-4E26-B5AB-F0D349D89650} -http://download.bargain-buddy.net/download/bargain_buddy/cab/installer_MARKETING32.cab
O16 - DPF:{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/CursorManiaFWBInitialSetup1.0.0.8-2.cab
O16 - DPF:{7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) -http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
O16 - DPF:{88D758A3-D33B-45FD-91E3-67749B4057FA}(Sinstaller Class) -http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 - DPF:{99410CDE-6F16-42ce-9D49-3807F78F0287}(ClientInstaller Class) -http://www.zango.com/GetZango/Download/zangoax.cab
O16 - DPF:{CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E}(VacPro.internazionale_ver15) -http://advnt01.com/dialer/internazionale_ver15.CAB
O16 - DPF:{D22AC3EF-B7D8-11D5-A281-005056BF0101} (plug Class) - http://www.gxplugin.com/loader/dll/gxbplug.dll
O16 - DPF:{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}(MoneyTree Dialer) -http://xbscc1.mtree.com/mt/dialers/fc/UniDist.CAB
O16 - DPF:{FC87A650-207D-4392-A6A1-82ADBC56FA64}(MultiDist) -http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF36C27D-5D4D- 46FE-97B3-5F2B8AA55AC6}: NameServer = 202.88.156.6,202.88.130.67,203.195.198.66
Make sure all other windows except HJT are closed, and Click Fix Checked.
-----------------------------------------------------------
Start Your Computer in Safe Mode.
-----------------------------------------------------------
File and Folder Deletion.
In Windows Explorer, navigate to these files. Use Find (F3) or Start, Search if the folder is not shown; then Delete these files, if present:
D:\WINDOWS\System32\outpostupdate.exe
D:\WINDOWS\web\related.htm
msblast.exe <== probably in D:\windows\ or D:\windows\system32\
If you have any problem deleting a file, right click the file and check Properties to see if it's read-only. Uncheck the read-only box, click Apply and OK. Then retry Delete.
Note the name and location of any file you cannot delete.

Find and Delete these folders, if present:
D:\Program Files\Common Files\CMEII\
D:\program files\zangoclient\
D:\Program Files\BullsEye Network\
D:\Program Files\NaviSearch\
D:\Program Files\MyWebSearch\
D:\Program Files\Common Files\GMT\
D:\Program Files\SideFind\
Note any folder you cannot delete.
You may have to delete all the underlying files and folders before a target folder can be deleted.
-----------------------------------------------------------
Post a New HJT Log
Reboot your computer into Normal mode. Start HijackThis. Click Do System Scan and Save a Log File.
When the Scan is complete, select the whole log (Ctrl-A), copy and paste the log contents in a reply.
Please do not use Word Wrap when you paste in the reply.
Also paste the Ewido report in your reply.

This sequence should remove quite a number of infections and make any remaining corrections easier.
askey127

[Nick-YF19]

Whilst we appreciate that you may be busy, it has been 14 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.