Here is the latest on my logs after following your tips. The problem seems to stop (or at least is not as frequent) after running all these spyware, virus, and shredder programs, security updates, etc. But, then I reboot and open my task manager to see what's going on and its just a matter of seconds usually until exlorer opens up (in task manager) and then a bunch of porn sites. I even see it go to download.com for a second. (This is all in task manager. otherwise none of it is visible). you can hear the defaults sounds though when its starts up. I Can't seem to shake this thing! any other tips? also, the shredder fixed everything you told me to fix except the host sites. It said "permission denied" error #70. I don't know what that means!?
COOLWEB SHREDDER STUFF - SCAN
AppData folder: C:\Documents and Settings\*****\Application Data
Username: ******
Found Hosts file: C:\WINNT\system32\drivers\etc\hosts (309412 bytes, -)
Hosts file: 66.40.16.131 livesexlist.com
Hosts file: 66.40.16.131 lanasbigboobs.com
Hosts file: 66.40.16.131 thumbnailpost.com
Hosts file: 66.40.16.131 adult-series.com
Hosts file: 66.40.16.131
www.livesexlist.com
Hosts file: 66.40.16.131
www.lanasbigboobs.com
Hosts file: 66.40.16.131
www.thumbnailpost.com
Hosts file: 66.40.16.131
www.adult-series.com
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINNT\system32\userinit.exe,
Found Win.ini file: C:\WINNT\win.ini (1658 bytes, A)
Found line in Win.ini: run=
Found System.ini file: C:\WINNT\system.ini (231 bytes, A)
- END OF REPORT –
COOLWEB SHREDDER STUFF - FIX
Done!
Removed from your system:
- CWS affiliate: Tooncomics
- Hosts file redirections
Windows 2000 (5.00.2195 SP4)
CWShredder v1.47.1
Written by Merijn -
merijn@spywareinfo.com
For any additional help with this program or removing CWS, visit
http://forums.spywareinfo.com/
For information and documentation on the Coolwebsearch
trojan and its variants, visit
http://www.merijn.org/cwschronicles.html
START UP STUFF--
StartupList version: 1.52
Started from : C:\antihijacker.software\HijackThis.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Belkin Bulldog\upsd.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\dtmonx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\rundll32.exe
C:\HPDESK\hppddir.exe
C:\WINNT\system32\taskmgr.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\antihijacker.software\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
America Online 8.0 Tray Icon.lnk.disabled
Document Assistant.lnk = C:\HPDESK\hppddir.exe
Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Synchronization Manager = mobsync.exe /logon
NeroCheck = C:\WINNT\System32\NeroCheck.exe
zBrowser Launcher = C:\Program Files\Logitech\iTouch\iTouch.exe
Logitech Utility = Logi_MwX.Exe
InCD = C:\Program Files\ahead\InCD\InCD.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
Advanced Tools Check = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
STOPzilla = "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
AVG7_CC = C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
AVG7_EMC = C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
MigrateMMDrivers = rundll32.exe mmsys.cpl,mmseRunOnce
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
rundll32 = C:\WINNT\rundll32.exe
LDM = \Program\BackWeb-8876480.exe
--------------------------------------------------
Load/Run keys from C:\WINNT\WIN.INI:
load=
run=
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=,DTMONX.EXE
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
Shell & screensaver key from C:\WINNT\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=(NONE)
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\WINNT\system32\StopzillaBHO.dll - {E3215F20-3212-11D6-9F8B-00D0B743919D}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Norton AntiVirus - Scan my computer - Scott.job
Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job
--------------------------------------------------
Enumerating Download Program Files:
[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE =
http://download.microsoft.com/downlo...22/wmv9VCM.CAB
[OPUCatalog Class]
InProcServer32 = C:\WINNT\System32\opuc.dll
CODEBASE =
http://office.microsoft.com/productu...ntent/opuc.cab
[Update Class]
InProcServer32 = C:\WINNT\System32\iuctl.dll
CODEBASE =
http://v4.windowsupdate.microsoft.co...972.3886342593
[Downloader Class]
InProcServer32 = C:\WINNT\DOWNLO~1\dwnldr.dll
CODEBASE =
https://www.stopzilla.com/_download/...ler/dwnldr.cab
[{D27CDB6E-AE6D-11CF-96B8-444553540000}]
CODEBASE =
http://download.macromedia.com/pub/s...sh/swflash.cab
[McFreeScan Class]
InProcServer32 = C:\WINNT\McAfee.com\FreeScan\mcfscan.dll
CODEBASE =
http://download.mcafee.com/molbin/is...17/mcfscan.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: c:\documents and settings\scott\cookies\scott@bluestreak[2].txt||c:\documents and settings\scott\cookies\scott@doubleclick[1].txt||c:\documents and settings\scott\cookies\scott@ehg-findlaw.hitbox[2].txt||c:\documents and settings\scott\cookies\scott@ehg.hitbox[2].txt||c:\documents and settings\scott\cookies\scott@hitbox[2].txt||c:\documents and settings\scott\cookies\scott@paycounter[1].txt||c:\documents and settings\scott\cookies\scott@valueclick[1].txt||c:\documents and settings\scott\cookies\scott@z1.adserver[1].txt||c:\documents and settings\scott\cookies\scott@zedo[2].txt
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: stobject.dll
--------------------------------------------------
End of report, 8,780 bytes
Report generated in 0.150 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
/end/
Unsolved 
Offline 
