I have tried Everything, now i need help

[TheWanderer]

Hello

i have tried everything you suggested on another thread http://www.daniweb.com/techtalkforums/showpost.php?p=110612&postcount=2

and still i'm, more or less, where i was at the beginning. I am having troubles installing kaspersky trial version, probably because i had another version installed some time ago. Here is my hijack log, its my first message so i hope i respect the forum rules.

Logfile of HijackThis v1.99.1
Scan saved at 11:37:04 a.m., on 13/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\W2\INTEGRATOR.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LNKSTASH.EXE
C:\W2\SYSTEM\PSTORES.EXE
C:\W2\SYSTEM\DDHELP.EXE
C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-WATCH.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\W2\TEMP\se.dll/spage.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/271/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\W2\TEMP\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = =%3D
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll (file missing)
O2 - BHO: (no name) - {f8ac5ce3-4b50-49d6-b632-faea1734fd29} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [QuickTime Task] "C:\W2\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKLM\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - HKLM\..\Run: [Desktop Search] C:\W2\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\W2\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\W2\FARMMEXT.exe
O4 - HKLM\..\Run: [drftfq] c:\w2\system\drftfq.exe
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - HKCU\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKCU\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\W2\SYSTEM\MSJAVA.DLL (file missing)
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\W2\SYSTEM\MSJAVA.DLL (file missing)
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .mpeg: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.traffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.crazywinnings.com
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net/crackspider.exe
O19 - User stylesheet: (file missing)

[TheWanderer]

I thought that perhaps my ad-Watch log could also throw some light into the problem:

Ad-Watch Logfile, exported on 13/04/05
Total number of events:12
===============================================
13/04/05 11:21:02 a.m. - Definitions file SE1R38 11.04.2005 loaded successfully.
Build:SE1R38 11.04.2005
Total Signatures :37278
Target Families :648
Target Categories :6
CSI data Size :53244

File Size :1387485

===============================================
13/04/05 11:21:02 a.m. - User preferences file loaded.
Ad-Watch preference file loaded.
Applying user settings
C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\awsettings.awc
Initialization complete.

===============================================
13/04/05 11:21:02 a.m. - Sites file loaded.
Sites file loaded successfully.
C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\sites.txt
Total entries : 3229

===============================================
13/04/05 11:21:03 a.m. - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Search Page
Data:http://www.google.com
New Data:about:blank

===============================================
13/04/05 11:21:03 a.m. - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Search
Value:SearchAssistant
Data:
New Data:about:blank

===============================================
13/04/05 11:21:03 a.m. - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Internet Explorer\Main
Value:Search Page
Data:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
New Data:about:blank

===============================================
13/04/05 11:21:03 a.m. - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Internet Explorer\Search
Value:SearchAssistant
Data:http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
New Data:about:blank

===============================================
13/04/05 11:21:12 a.m. - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:http://www.hotoffers.info/271/
New Data:http://www.eltiempo.com/

===============================================
13/04/05 11:21:12 a.m. - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Internet Explorer\Main
Value:Start Page
Data:http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
New Data:about:blank

===============================================
13/04/05 11:28:45 a.m. - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:THGuard
Data:
New Data:C:\Archivos de programa\TrojanHunter 4.2\THGuard.exe

===============================================
13/04/05 11:40:27 a.m. - Tracking cookie blocked.
Name: Cookie:m**** g****@advertising.com/
Size: 91 Bytes.
Hits: 1
UseCount: 0
Expires: 12/04/10 11:39:48 a.m.

Last Sync Time: 13/04/05 11:39:54 a.m.

===============================================
13/04/05 11:40:27 a.m. - Tracking cookie blocked.
Name: Cookie:m**** g****@servedby.advertising.com/
Size: 132 Bytes.
Hits: 1
UseCount: 0
Expires: 13/05/05 11:39:48 a.m.

Last Sync Time: 13/04/05 11:39:54 a.m.

===============================================

[TheWanderer]

No answers? I have even ran the kaspersky AV and it did detect some files, i deleted them, then i ran ad-aware and spybot, deleted all the temps, all of these steps under safe mode, then i rebooted and the da*n thing still is there. Im getting REALLY worried. It reminds me of that Seinfeld episode where he got a bad smell on his car and he couldnt get rid of it, no matter what he tried. DAM* Hotoffers people burn in hell :twisted:

[TheWanderer]

This is my latest hijack log, although seems that at the moment there are no spyware residents (as long as i can see) theres still the hotoffers home page imposing itself no matter what i do, and some processes that my ad watch keeps catching as "Registry modification detected". I gotta say this hotoffers malware is one of the most incredibly annoying things ive found in my life :mad: i have spent noe 2 and ahlf days trying to clean it and without success. Hopefully you people out there can help me:

Logfile of HijackThis v1.99.1
Scan saved at 02:23:38 a.m., on 14/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\W2\INTEGRATOR.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-WATCH.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LNKSTASH.EXE
C:\W2\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/271/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = =%3D
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: Loader Class - {2E246FAE-8420-11D9-870D-000C2917DE7F} - C:\WINDOWS\SYSTEM\Loader.dll (file missing)
O2 - BHO: (no name) - {f8ac5ce3-4b50-49d6-b632-faea1734fd29} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5EB4E4D4-AC0A-11D9-B43D-00484893095C} - C:\W2\SYSTEM\NBM.DLL (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\W2\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [Desktop Search] C:\W2\isrvs\desktop.exe
O4 - HKLM\..\Run: [drftfq] c:\w2\system\drftfq.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\W2\FARMMEXT.exe
O4 - HKLM\..\Run: [ffis] C:\W2\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKLM\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - HKCU\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKCU\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\W2\SYSTEM\MSJAVA.DLL (file missing)
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\W2\SYSTEM\MSJAVA.DLL (file missing)
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .mpeg: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.traffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.crazywinnings.com
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net/crackspider.exe
O19 - User stylesheet: (file missing)

[crunchie]

Go here to TrendMicro for an on-line scan & set it to autoclean for you. When it completes, post back the full filename of any files that cannot be cleaned or deleted.

Try this scan at Panda as well.

The scan here does not require an active X install, but uses java instead.
http://fr.trendmicro-europe.com/consumer/products/housecall_launch.php

Reboot when done and post another log please.

[TheWanderer]

Thanks Crunchie

Ive tried everything you told me and then some other things ive read on this board without success. Im losing the battle......

Basically when i try all the solutions known, the hotoffers thing seems to be quiet for a few hours, even a whole day but it always returns :evil:

heres my HJ log:

Logfile of HijackThis v1.99.1
Scan saved at 05:48:25 p.m., on 20/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\W2\RUNDLL32.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\ARCHIVOS DE PROGRAMA\3M\PSNLITE\PSNLITE.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\W2\INTEGRATOR.EXE
C:\ARCHIVOS DE PROGRAMA\3M\PSNLITE\PSNGIVE.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\ARCHIVOS DE PROGRAMA\WINAMP\WINAMP.EXE
C:\W2\SYSTEM\DDHELP.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LNKSTASH.EXE
C:\W2\SYSTEM\PSTORES.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\OUTLOOK EXPRESS\MSIMN.EXE
C:\ARCHIVOS DE PROGRAMA\MESSENGER\MSMSGS.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\W2\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\W2\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = =%3D
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {D6435532-AF63-11D9-B43D-0048B900F5B4} - C:\W2\SYSTEM\EMIAFH.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [QuickTime Task] "C:\W2\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKLM\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - HKLM\..\Run: [Desktop Search] C:\W2\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\W2\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\W2\FARMMEXT.exe
O4 - HKLM\..\Run: [drftfq] c:\w2\system\drftfq.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\W2\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - HKCU\..\Run: [WebRun] C:\W2\SYSTEM\WMPLAYER.EXE
O4 - HKCU\..\Run: [Windows Service] C:\W2\SYSTEM\PRIVATE-ZONE.EXE
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: ToolBar.lnk = C:\Archivos de programa\Software by Design\ToolBar.exe
O4 - Startup: SuperKeys.lnk = C:\Archivos de programa\SuperKeys\SuperKeys.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O4 - Startup: Post-it® Software Notes Lite.lnk = C:\Archivos de programa\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .mpeg: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.traffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.crazywinnings.com
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net/crackspider.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O18 - Filter: text/html - {CDE68767-AF97-11D9-B43D-0048567BDB5D} - C:\W2\SYSTEM\EMIAFH.DLL
O18 - Filter: text/plain - {CDE68767-AF97-11D9-B43D-0048567BDB5D} - C:\W2\SYSTEM\EMIAFH.DLL

[crunchie]

Download CWShredder 2.14 from here.

Download[/url] \'SpSeHjfix\' to the desktop and then
right click a blank part of the desktop and select new folder, call it spfix
unzip the file into that folder.

Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.

If it doesn't find any of the SE files or any hidden reinstallers it will say system clean and not go on to next stage.

Run the shredder and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.

Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.

[TheWanderer]

Crunchie:

I Followed the two steps you asked me. I have to say that the immediate effect after, was that i couldnt start internet explorer, i had to use the repair tool and now it seems to work. Here are the logs and thanks for your help.

SPFix log:

(4/21/05 03:32:14 p.m.) SPSeHjFix started v1.09
(4/21/05 03:32:14 p.m.) OS: Win98SE A (4.10.67766446)
(4/21/05 03:32:14 p.m.) Language: español
(4/21/05 03:32:20 p.m.) Disinfect started
(4/21/05 03:32:20 p.m.) Bad-Dll(IEP): se.dll
(4/21/05 03:32:20 p.m.) Searchassistant Uninstaller found: regsvr32 /s /u C:\W2\SYSTEM\EMIAFH.DLL
(4/21/05 03:32:20 p.m.) Searchassistant Uninstaller - Keys Deleted
(4/21/05 03:32:20 p.m.) UBF: 6
(4/21/05 03:32:20 p.m.) UBB: 10
(4/21/05 03:32:20 p.m.) FilterKey: HKCR\text/html (deleted)
(4/21/05 03:32:20 p.m.) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(4/21/05 03:32:20 p.m.) FilterKey: HKCR\CLSID\{CDE68767-AF97-11D9-B43D-0048567BDB5D} (deleted)
(4/21/05 03:32:20 p.m.) FilterKey: HKCR\text/plain (deleted)
(4/21/05 03:32:20 p.m.) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(4/21/05 03:32:20 p.m.) FilterKey: HKCR\CLSID\{CDE68767-AF97-11D9-B43D-0048567BDB5D} (error while deleting)
(4/21/05 03:32:20 p.m.) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D6435532-AF63-11D9-B43D-0048B900F5B4} (deleted)
(4/21/05 03:32:20 p.m.) BHO-Key: HKCR\CLSID\{D6435532-AF63-11D9-B43D-0048B900F5B4} (deleted)
(4/21/05 03:32:20 p.m.) UBR: 18
(4/21/05 03:32:20 p.m.) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\W2\TEMP\SE.DLL,DllInstall (deleted)
(4/21/05 03:32:20 p.m.) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\W2\TEMP\se.dll/sp.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\W2\TEMP\se.dll/sp.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(4/21/05 03:32:20 p.m.) Stealth-String found: C:\W2\SOFTWAFE.TXT
(4/21/05 03:32:21 p.m.) File added to delete: c:\w2\system\emiafh.dll
(4/21/05 03:32:21 p.m.) File added to delete: c:\w2\system\emiafh.dll
(4/21/05 03:32:21 p.m.) File added to delete: c:\w2\temp\se.dll
(4/21/05 03:32:21 p.m.) File added to delete: c:\w2\softwafe.txt
(4/21/05 03:32:21 p.m.) Reboot
(4/21/05 03:34:07 p.m.) SPSeHjFix 2nd Step
(4/21/05 03:34:08 p.m.) RunServicesOnce-Key: (edited)
(4/21/05 03:34:16 p.m.) Cleaned

HJ log:

Logfile of HijackThis v1.99.1
Scan saved at 03:58:33 p.m., on 21/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\W2\INTEGRATOR.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\W2\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = =%3D
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: ToolBar.lnk = C:\Archivos de programa\Software by Design\ToolBar.exe
O4 - Startup: SuperKeys.lnk = C:\Archivos de programa\SuperKeys\SuperKeys.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O4 - Startup: Post-it® Software Notes Lite.lnk = C:\Archivos de programa\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\W2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\W2\web\related.htm
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .mpeg: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin3.dll
O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.traffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.crazywinnings.com
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/us/win/QuickTimeFullInstaller.exe
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net/crackspider.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

[crunchie]

OK. Just a few more things for you to do...

===============

Go to Add/Remove programs and remove(uninstall) the following, if present:

NewDotNet

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

===============

Run HiJackThis and click "Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = =%3D
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,YAHOOSubst =

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\W2\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\W2\web\related.htm

O15 - Trusted Zone: *.iframe.biz
O15 - Trusted Zone: *.newiframe.biz
O15 - Trusted Zone: *.sp2fucked.biz
O15 - Trusted Zone: *.sp2admin.biz
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.overpro.com
O15 - Trusted Zone: *.megapornix.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.traffic2cash.biz
O15 - Trusted Zone: *.admin2cash.biz
O15 - Trusted Zone: *.private-iframe.biz
O15 - Trusted Zone: *.private-dialer.biz
O15 - Trusted Zone: *.bettersearch.biz
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.crazywinnings.com

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/qtinstall.i...llInstaller.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/mini...ransporter.cab?
O16 - DPF: {10954C80-4F0F-11D3-B17C-00C0DFE39736} - http://crackspider.net/crackspider.exe

Now, with all windows closed except HiJackThis, click "Fix checked".

===============

To help protect your system from hostile ActiveX content, or special 'downloadable' files:

Download, install and keep updated, SpywareBlaster. If you've installed it for the first time:

1) Check for any available updates; if present, they'll be automatically downloaded and installed.
2) Next, "Enable all protection".
3) Exit the program.

-

Note: Remember to regularly check for updates.

===============

After rebooting your PC, post back a new log and let me know how everything goes.

-

crunchie.

[TheWanderer]

ok after those procedures heres the new log:

Logfile of HijackThis v1.99.1
Scan saved at 05:19:03 p.m., on 21/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\W2\INTEGRATOR.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eltiempo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: ToolBar.lnk = C:\Archivos de programa\Software by Design\ToolBar.exe
O4 - Startup: SuperKeys.lnk = C:\Archivos de programa\SuperKeys\SuperKeys.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O4 - Startup: Post-it® Software Notes Lite.lnk = C:\Archivos de programa\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O12 - Plugin for .mpeg: C:\ARCHIV~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

[dlh6213]

Can I butt in? I just have a couple of comments/suggestions.

In your first post you mentioned trying to install Kaspersky; it's not good to have more then one antivirus program installed, and since you already have Nod32 (probably the best), you should stick with that -- unless there is some reason you're not happy with it?

Also, your first log indicated you had HotOffers, so I think it would be a good idea to make sure you have gotten rid of that completely:

Boot into Safe Mode and do a search for these files:

param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe

Delete those files (if found), and then reboot normally; delete any HotOffer icons from your desktop.

Empty your Recycle Bin.

[TheWanderer]

Thanks dlh6213, i did find the popup_bl.dll and deleted it.

[TheWanderer]

this hotoffers thing is really cruel. I mean after i tried everything you suggested the pc seemed clean and overall it was running smoother than ever, BUT.....a few moments ago i open my IE and puff! (not magic dragon but of course my inseparable friends from hotoffers have taken control of my start page again :evil: I check the msconfig to see if the usual suspects have returned to my start menu, and indeed! Seems theres no way im going to get rid of this! I have been using computers since 1982 and this is the nastiest piece of work ive encountered!

I suppose i should be posting my HJ log but right now im so depressed, later ill try and i appreciate very much all your help guys. Damn hotoffers! :sad:

P.S: i should point out that im not visiting any "dangerous" sites to be infected over and over again, and i have updated SpywareBlaster. i think im going to try again all the last steps you suggested and add a kaspersky scan, which luckily i was able to install. Wish me luck!

[dlh6213]

Try this; go to C:\windows\system32

Have the files arranged by Modified; then, look near the bottom for any files that were added around the time you noticed the infections return, and post the names here.

Also, post a new log (when you're feeling up to it).

[TheWanderer]

(I changed my start page seconds ago and unchecked all the Hotoffers residents at the msconfig - start menu)

ok under windows/system32 there werent any files modified in the past month, in the windows/system i noticed this file:

vsconfig.xml which was modified exactly at the same time i noticed the plague returning.

These are the files modified in the past week from the system folder:

d3d8caps.dat
pav.sig
imon1.dat
Ibcvid.dll
Itmui.dll

And heres my HJ log:

Logfile of HijackThis v1.99.1
Scan saved at 05:46:13 p.m., on 22/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\W2\SYSTEM\KERNEL32.DLL
C:\W2\SYSTEM\MSGSRV32.EXE
C:\W2\SYSTEM\MPREXE.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KRN.EXE
C:\W2\SYSTEM\mmtask.tsk
C:\W2\EXPLORER.EXE
C:\W2\SYSTEM\RPCSS.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32KUI.EXE
C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE
C:\ARCHIVOS DE PROGRAMA\LINKSTASH\LSMON.EXE
C:\ARCHIVOS DE PROGRAMA\TALKINGAGENTCLOCK\TALKINGAGENTCLOCK.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\ARCHIVOS DE PROGRAMA\SOFTWARE BY DESIGN\TOOLBAR.EXE
C:\W2\INTEGRATOR.EXE
C:\W2\MSAGENT\AGENTSVR.EXE
C:\W2\SYSTEM\DDHELP.EXE
C:\W2\SYSTEM\PSTORES.EXE
C:\W2\NOTEPAD.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eltiempo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\ARCHIVOS DE PROGRAMA\DAP\DAPBHO.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NewzCrawlerRSSAutodiscovery2 Object - {5F50A50A-0A0F-4F58-8B1C-62BC60F9B05A} - C:\ARCHIV~1\NEWZCR~1\NCRSSA~1.DLL
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O2 - BHO: BHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\W2\SYSTEM\MSDXM.OCX
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Archivos de programa\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\ARCHIVOS DE PROGRAMA\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Archivos de programa\FerretSoft\WebFerret\FerretBand.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [Ad-Aware] "C:\ARCHIVOS DE PROGRAMA\LAVASOFT\AD-AWARE SE PROFESSIONAL\AD-AWARE.EXE" +c
O4 - HKLM\..\RunServices: [NOD32kernel] "C:\Archivos de programa\Eset\nod32krn.exe"
O4 - HKLM\..\RunServices: [TrueVector] C:\W2\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [MSGTAG] "C:\ARCHIVOS DE PROGRAMA\MSGTAG\MSGTAG.EXE" /startup
O4 - HKCU\..\Run: [LinkStashMonitor] "C:\ARCHIVOS DE PROGRAMA\LINKSTASH\lsmon.exe"
O4 - Startup: TalkingAgentClock.LNK = C:\Archivos de programa\TalkingAgentClock\TalkingAgentClock.exe
O4 - Startup: ToolBar.lnk = C:\Archivos de programa\Software by Design\ToolBar.exe
O4 - Startup: AntiCrash.lnk = C:\Archivos de programa\Dachshund Software\AntiCrash\AntiCrash.exe
O4 - Startup: Hare.lnk = C:\Archivos de programa\Dachshund Software\Hare\Hare.exe
O4 - Startup: Post-it® Software Notes Lite.lnk = C:\Archivos de programa\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: Check &Spelling - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL/SPELLOPTION.HTM
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\ARCHIV~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - C:\Archivos de programa\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: IE Zoom &In - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom In.htm
O8 - Extra context menu item: IE Zoom O&ut - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoom Out.htm
O8 - Extra context menu item: Open in IE &Zoomer - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\Open in IE Zoomer.htm
O8 - Extra context menu item: IE Zoomer Help... - C:\ARCHIVOS DE PROGRAMA\IE ZOOMER\IE Zoomer Help.htm
O8 - Extra context menu item: Save F&lash with FlashCapture - res://C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL/FCIEXT.htm
O8 - Extra context menu item: Download using FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Download All by FlashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O8 - Extra context menu item: Translate into English - res://C:\ARCHIVOS DE PROGRAMA\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\ARCHIVOS DE PROGRAMA\VISUALROUTE\vrie.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\ARCHIVOS DE PROGRAMA\IESPELL\IESPELL.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: MS&N Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\ARCHIVOS DE PROGRAMA\COPERNIC AGENT\COPERNICAGENT.EXE
O9 - Extra button: (no name) - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra 'Tools' menuitem: Track Page Using Copernic Agent - {0BCBCDD8-E5D9-417D-A752-C2DA929A21BF} - C:\ARCHIV~1\COPERN~1\COPERN~1.DLL
O9 - Extra button: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra 'Tools' menuitem: Turbo Memory Charger - {ECC5778A-6E89-BFCE-13CE-81F134789E7B} - C:\ARCHIVOS DE PROGRAMA\TURBO MEMORY CHARGER\TURBOMEMORYCHARGER (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra 'Tools' menuitem: Newz Crawler - {CA7C41C8-5C9D-4A03-A101-B0AA4F0C3ABC} - C:\Archivos de programa\NewzCrawler\News.exe
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\ARCHIVOS DE PROGRAMA\FLASHCAPTURE\FCIEXT.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\W2\SYSTEM32\msjava.dll
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\W2\SYSTEM\SHDOCVW.DLL (HKCU)
O9 - Extra button: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash - {4874F370-402D-4d09-A73E-FAB439934E56} - C:\Archivos de programa\LinkStash\lsshow.exe (HKCU)
O9 - Extra button: Grab URLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra 'Tools' menuitem: LinkStash GrabURLs - {957DCFA2-39F7-4443-9677-1B14E83A2F87} - C:\Archivos de programa\LinkStash\lsgrab.exe (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Archivos de programa\AWS\WeatherBug\Weather.exe (HKCU)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

[dlh6213]

Good find on the vsconfig.xml, it is a baddie. Here's some info on it:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.aladinz.n.html

d3d8caps.dat, Ibcvid.dll, Itmui.dll, and imon1.dat I suspect are bad, but not sure yet.

pav.sig I believe is from Panda

Update your antivirus program and run a full system scan; if it finds anything it can't fix, let us know.

See if the .xml file is still there, if it is, try to delete it, but you'll probably need to be in Safe Mode to do it.

See if the other suspect files are still present, and if they are, let us know which ones.

There are a few entries you can fix with hijackthis:

O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {173F3521-8FBE-4d0c-B14D-C4D8513A06C0} - (no file) (HKCU)

[crunchie]

TheWanderer. Upload those files wxcept pav.sig for a scan.

http://virusscan.jotti.org/

Post back the results.