So here goes, I have no idea what I am doing. I tried to read other responses to others with this same/similar problem but got lost on the way. I stupidly clicked on the link that asks something along the lines of, "Hey, is it okay if I put this pic of you up on MySpace or Facebook?" and then figured it was a virus. I did the HijackThis thing and if anyone could help, I'd be soooo grateful!!!! Here is my long:
Logfile of HijackThis v1.99.1
Scan saved at 11:05:08 PM, on 4/27/2006
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v6.00 SP2
(6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program
Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\CA\eTrust EZ
Armor\eTrust
Anti-Spam\QSP-2.1.215.5\QOELoader.exe
C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Antivirus\CAVTray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\AIM\aim.exe
C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\regsvr32.exe
C:\Program Files\Common
Files\Real\Update_OB\realsched.exe
C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Mozilla
Firefox\firefox.exe
C:\DOCUMENTS AND SETTINGS\ROBERTA NAD
AARON\DESKTOP\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Bar =
http://red.clientapps.yahoo.com/customiz
e/ycomp/defaults/sb/*http://www.yahoo.co
m/search/ie.html
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://red.clientapps.yahoo.com/customiz
e/ycomp/defaults/sp/*http://www.yahoo.co
m
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Bar =
http://red.clientapps.yahoo.com/customiz
e/ie/defaults/sb/ymsgr6/*http://www.yaho
o.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet
Explorer\SearchURL,(Default) =
http://red.clientapps.yahoo.com/customiz
e/ie/defaults/su/ymsgr6/*http://www.yaho
o.com
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat
6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client]
"C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [TkBellExe]
"C:\Program Files\Common
Files\Real\Update_OB\realsched.exe"
-osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched]
C:\Program
Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [QOELOADER]
"C:\Program Files\CA\eTrust EZ
Armor\eTrust
Anti-Spam\QSP-2.1.215.5\QOELoader.exe"
O4 - HKLM\..\Run: [MW1HelperStartUp]
C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE
/partner MW1
O4 - HKLM\..\Run: [Lexmark X74-X75]
"C:\Program Files\Lexmark
X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe
"C:\Program
Files\AIM\\DeadAIM.ocm",ExportedCheckODL
s
O4 - HKLM\..\Run: [CAVRID] "C:\Program
Files\CA\eTrust EZ Armor\eTrust EZ
Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [CaAvTray] "C:\Program
Files\CA\eTrust EZ Armor\eTrust EZ
Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [AlcxMonitor]
ALCXMNTR.EXE
O4 - HKCU\..\Run: [Yahoo! Pager]
"C:\Program
Files\Yahoo!\Messenger\ypager.exe"
-quiet
O4 - HKCU\..\Run: [AIM] C:\Program
Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Microsoft
Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to
Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCE
L.EXE/3000
O9 - Extra button: AIM -
{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows
Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O16 - DPF:
{17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine Advantage Validation
Tool) -
http://go.microsoft.com/fwlink/?linkid=3
9204
O23 - Service: CAISafe - Computer
Associates International, Inc. -
C:\Program Files\CA\eTrust EZ
Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Microsoft DLL
Registration Component (DLLReg) -
Unknown owner - C:\WINDOWS\regsvr32.exe
O23 - Service: LexBce Server (LexBceS) -
Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: VET Message Service
(VETMSGNT) - Computer Associates
International, Inc. - C:\Program
Files\CA\eTrust EZ Armor\eTrust EZ
Antivirus\VetMsg.exe
O23 - Service: TrueVector Internet
Monitor (vsmon) - Zone Labs Inc. -
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
