I have run Adaware & Spybot.
Attatched are my Hijack This and Panda online logs.
Thanks in advance for any thing you can help me with.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:39:37 PM, on 4/9/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Brian\Desktop\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us6.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.winpatrol.com/cgi-bin/plusin ... oc=en&ext=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [WinPatrol Explorer] "C:\Program Files\BillP Studios\WinPatrol\WinPatrolEx.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
O4 - HKUS\S-1-5-18\..\Run: [Ouiv] C:\WINDOWS\System32\??rvices.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Ouiv] C:\WINDOWS\System32\??rvices.exe (User 'Default user')
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5581223125
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {9C024426-7859-4B2D-AB4C-B1E370AE7549} - http://us.mcafee.com/Apps/WSC/en-us/Wsc ... erCtrl.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/S ... anager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/in ... ction3.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol ... _en_dl.cab
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 5281 bytes
Incident
Status Location
Adware:adware/powersearch
Not disinfected c:\windows\system32\stlb2.xml
Adware:adware/bookedspace
Not disinfected c:\windows\cfgmgr52.ini
Adware:adware/elitebar
Not disinfected C:\Documents and
Settings\Brian\Favorites\Casino & Carrers
Adware:adware/transponder
Not disinfected Windows Registry
Spyware:Cookie/Belnk
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@ath.belnk[2].txt
Spyware:Cookie/Azjmp
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@azjmp[2].txt
Spyware:Cookie/Belnk
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@belnk[1].txt
Spyware:Cookie/Ccbill
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@ccbill[1].txt
Spyware:Cookie/360i
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@ct.360i[1].txt
Spyware:Cookie/did-it
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@did-it[1].txt
Spyware:Cookie/Belnk
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@dist.belnk[2].txt
Spyware:Cookie/Screensavers
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@i.screensavers[1].txt
Spyware:Cookie/Xiti
Not disinfected C:\Documents and
Settings\Jason\Cookies\jason@xiti[1].txt
Potentially unwanted tool:Application/Processor
Not disinfected C:\Documents and
Settings\Jason\Desktop\John\l2mfix.exe[l2mfix/Process.exe]
Spyware:Cookie/Atwola
Not disinfected C:\Documents and Settings\Jason\Local
Settings\Temp\Cookies\jason@atwola[1].txt
Spyware:Cookie/Belnk
Not disinfected C:\Documents and Settings\Jason\Local
Settings\Temp\Cookies\jason@belnk[1].txt
Spyware:Cookie/Belnk
Not disinfected C:\Documents and Settings\Jason\Local
Settings\Temp\Cookies\jason@dist.belnk[2].txt
Potentially unwanted tool:Application/HideWindow.A
Not disinfected C:\hp\bin\FondleWindow.exe
Potentially unwanted tool:Application/KillApp.B
Not disinfected C:\hp\bin\KillIt.exe
Potentially unwanted tool:Application/MyWay
Not disinfected C:\Program Files\iolo\System Mechanic
Professional
6\Undo\Manual\{E7F35FB2-2C57-476F-BDC0-788DA3029428}\{AA7C5741-6C86-4BA7-AAD7-F9B6B19F33F6}.DLL[{AA7C5741-6C86-4BA7-AAD7-F9B6B19F33F6}.DLL]