Re: Hijack log-WMP Internal application error ha occured

Hi! To start with I would like you to do this

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan here.
If you get report of files that can’t be cleaned / deleted please write down the filenames and locations and post that in your reply.

Then please do this since it’s better to use automated tools to get rid of the bad stuff use these 2 programs first before doing the final cleaning with HJT

First use Spybot S&D. (Version 1.3)
Spybot
Unzip, and update. Install the updates and run. Delete all that it marks in red.
Reboot

Then it’s time for Ad-Aware
Ad-Aware
Install and update by using the globe icon. Restart your computer and run Ad-Aware.
Press scan now and select drives and/or partitions to be scanned. When done select all and click next. Remove all checked items and then reboot your computer.

Please go to this page and read the instructions for how to configure Spybot S&D & Ad-Aware
How To Setup Spybot SD and Ad-Aware

Then post a new HJT log as a reply to this topic.

just want add that the next time you post a new log just copy and paste it from note pad to here in a quick reply just below this post

ok - I did everything you requested.

Following are the infected files that were not removed by the virus software and the hijack log file. Housecall would not open in Netscape, so I used AVG and Stinger.

C:\WINNT\system32\dbentry.exe:\explorer.sys Virus found IRC/BackDoor.Flood Infected, Embedded object
C:\WINNT\system32\dbentry.exe:\frntok.exe Trojan horse HideWindow Infected, Embedded object
C:\WINNT\system32\dbentry.exe:\lxmstart.exe Virus identified Worm/Tzet.A Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv453.jar-1f16a0fa-4c5d21ff.zip:\Counter.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv453.jar-1f16a0fa-4c5d21ff.zip:\Parser.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-1f5b6b54-4586aac9.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-1f5b6b54-4586aac9.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-1f5b6b54-4586aac9.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\clsld.jar-455f8b8a-5dd26592.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\clsld.jar-455f8b8a-5dd26592.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\clsld.jar-455f8b8a-5dd26592.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-487b52a0-7e5a2f0d.zip:\BlackBox.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-487b52a0-7e5a2f0d.zip:\winmodem.exe Trojan horse Startpage.10.AH Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-487b52a0-7e5a2f0d.zip:\rundll32.exe Trojan horse Startpage.9.BB Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-221510f7-5c85b9b6.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-221510f7-5c85b9b6.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-221510f7-5c85b9b6.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-6a3ab14e-6c288c9f.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-6a3ab14e-6c288c9f.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-6a3ab14e-6c288c9f.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\count1.jar-5e1a93af-7a256ca2.zip:\BlackBox.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\playup_ro.jar-45c6f3d0-2136efd4.zip:\Bubble.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\playup_ro.jar-45c6f3d0-2136efd4.zip:\VerifierBug.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\playup_ro.jar-45c6f3d0-2136efd4.zip:\Beyond.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\freemovies.jar-677d2343-28b46ff1.zip:\VerifierBug.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv133.jar-7cfa3db3-3d980ff3.zip:\Counter.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv133.jar-7cfa3db3-3d980ff3.zip:\Parser.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-5aefffee-72e70e79.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-5aefffee-72e70e79.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-5aefffee-72e70e79.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\count1.jar-200a5225-79d5ffa4.zip:\BlackBox.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-34ea5eb2-51e39463.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-34ea5eb2-51e39463.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-34ea5eb2-51e39463.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-d350ec1-4745c3b1.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-d350ec1-4745c3b1.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-d350ec1-4745c3b1.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-4235d44a-208246dd.zip:\BlackBox.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-4235d44a-208246dd.zip:\winmodem.exe Trojan horse Startpage.10.AH Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\archive.jar-4235d44a-208246dd.zip:\rundll32.exe Trojan horse Startpage.9.BB Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv342.jar-63d61450-1f4333b2.zip:\Counter.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\loaderadv342.jar-63d61450-1f4333b2.zip:\Parser.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-2dd0698-28708d24.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-2dd0698-28708d24.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-2dd0698-28708d24.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-11faa9ed-1375e84b.zip:\GetAccess.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-11faa9ed-1375e84b.zip:\InsecureClassLoader.class Virus identified Java/ByteVerify Infected, Embedded object
C:\Documents and Settings\Tim Lee\.jpi_cache\jar\1.0\classload.jar-11faa9ed-1375e84b.zip:\Installer.class Virus identified Java/ByteVerify Infected, Embedded object

Logfile of HijackThis v1.99.0
Scan saved at 4:35:46 PM, on 12/29/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\PROCRE~1\upload mode third.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINNT\Services32.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\WINNT\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\wuauclt.exe
C:\PROGRA~1\Netscape\Netscape\Netscp.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.html?http://foxnews.com/
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PopupBlockerBHO.CPopupBlockerBHO - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\Program Files\SmartPopupBlocker\PopupBlockerBHO.dll
O2 - BHO: long meow burn - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll
O2 - BHO: CBundleObj Object - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - c:\program files\clientman\run\bundleaef94639.dll (file missing)
O2 - BHO: TChkBHO Class - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - C:\WINNT\system32\oymikwg.dll
O3 - Toolbar: view ooze - {C3F78CC8-F0A2-FB38-4E32-DD0295889BCB} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Great hold] C:\PROGRA~1\PROCRE~1\upload mode third.exe
O4 - HKLM\..\Run: [fash] C:\WINNT\fash.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ASTART] C:\WINNT\ASTART
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [System32] C:\WINNT\Services32.exe NORMAL
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINNT\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O18 - Filter: text/html - {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} - c:\program files\clientman\run\searchrep4acf6c0b.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Firewall - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ScriptBlocking Service - Unknown - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: ScsiAccess - Unknown - C:\WINNT\System32\ScsiAccess.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

My suggestion to you is this ,Go to control panel / add and remove programs and uninstall messenger plus 2 ,[it came with spyware ,you can reinstall it but when you do dont install the supporeted software ],then download trojanHunter 30 day trial
and scan with it also run spybot and ad-aware again making sure you check to to fix all it finds in RED.
,,,,,,,,,,,,,,,,,,,,,,,,,
online trojan /virus scan also
Please run these free online Virus scan

Be sure to Check off Auto Fix on this site

http://housecall.trendmicro.com/housecall/start_corp.asp
please run this one also to be sure .

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Also a trip to windows updates is needed for critical updates

WINDOWS UPDATES

My suggestion to you is this ,Go to control panel / add and remove programs and uninstall messenger plus 2 ,[it came with spyware ,you can reinstall it but when you do dont install the supporeted software ],then download trojanHunter 30 day trial
and scan with it also run spybot and ad-aware again making sure you check to to fix all it finds in RED.
,,,,,,,,,,,,,,,,,,,,,,,,,
online trojan /virus scan also
Please run these free online Virus scan

Be sure to Check off Auto Fix on this site

http://housecall.trendmicro.com/housecall/start_corp.asp
please run this one also to be sure .

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Also a trip to windows updates is needed for critical updates

WINDOWS UPDATES

I ran everything you suggested with the exception of the panda virus scan - it would not load. I was able to get housecall to run by using the explorer browser.
The trojan hunter removed another 11 trojans.
What should i do next ?

I ran everything you suggested with the exception of the panda virus scan - it would not load. I was able to get housecall to run by using the explorer browser.
The trojan hunter removed another 11 trojans.
What should i do next ?

Close all browser windows, nothing open but Hijackthis ,scan with hijackthis and post a new log ,thanks

Here's the new hijack log.

Logfile of HijackThis v1.99.0
Scan saved at 8:52:32 AM, on 1/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\PROGRA~1\PROCRE~1\upload mode third.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINNT\Services32.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\WINNT\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\wuauclt.exe
C:\PROGRA~1\Netscape\Netscape\Netscp.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.html?http://ABOUT:BLANK
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PopupBlockerBHO.CPopupBlockerBHO - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\Program Files\SmartPopupBlocker\PopupBlockerBHO.dll
O2 - BHO: long meow burn - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll
O2 - BHO: CBundleObj Object - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - c:\program files\clientman\run\bundleaef94639.dll (file missing)
O2 - BHO: TChkBHO Class - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - C:\WINNT\system32\oymikwg.dll
O3 - Toolbar: view ooze - {C3F78CC8-F0A2-FB38-4E32-DD0295889BCB} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [Great hold] C:\PROGRA~1\PROCRE~1\upload mode third.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ASTART] C:\WINNT\ASTART
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [fash] C:\WINNT\fash.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [System32] C:\WINNT\Services32.exe NORMAL
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINNT\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O18 - Filter: text/html - {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} - c:\program files\clientman\run\searchrep4acf6c0b.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Firewall - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ScriptBlocking Service - Unknown - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: ScsiAccess - Unknown - C:\WINNT\System32\ScsiAccess.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/in...p://about:BLANK

O2 - BHO: CBundleObj Object - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - c:\program files\clientman\run\bundleaef94639.dll (file missing

I can't find any info on these 2 ,do you lnow what Bowsan~1 is ,if no you can fix them .

O2 - BHO: long meow burn - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll

O3 - Toolbar: view ooze - {C3F78CC8-F0A2-FB38-4E32-DD0295889BCB} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll

O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)

I suggest you go to add and remove programs in the control panel and uninstall p2p networking its not needed ,and Messenger plus 2,it came with the spyware you have on you computer ,you can reinstall it later but install with out the support software ,

O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"

O4 - HKLM\..\Run: [Great hold] C:\PROGRA~1\PROCRE~1\upload mode third.exe

O4 - HKLM\..\Run: [ASTART] C:\WINNT\ASTART

O4 - HKCU\..\Run: [System32] C:\WINNT\Services32.exe NORMAL

O4 - HKLM\..\Run: [fash] C:\WINNT\fash.exe

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

Now reboot into safe mode and delete the following files and folders if found .

C:\PROGRA~1\PROCRE~1\upload mode third.exe,,,,,delete file

C:\WINNT\ASTART,,,,delete file

C:\WINNT\Services32.exe ,,,,delete file

C:\WINNT\fash.exe,,,,delete file

to delete the above files and folder you will need to do the following.
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

Those entries are LOP related caperjack.

Those entries are LOP related caperjack.

I thought so wasn't sure .I really can't keep up to all the different shit out there .!

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/in...p://about:BLANK

O2 - BHO: CBundleObj Object - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - c:\program files\clientman\run\bundleaef94639.dll (file missing

I can't find any info on these 2 ,do you lnow what Bowsan~1 is ,if no you can fix them .

O2 - BHO: long meow burn - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll

O3 - Toolbar: view ooze - {C3F78CC8-F0A2-FB38-4E32-DD0295889BCB} - C:\PROGRA~1\BOWSAN~1\BitsObj.dll

O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)

I suggest you go to add and remove programs in the control panel and uninstall p2p networking its not needed ,and Messenger plus 2,it came with the spyware you have on you computer ,you can reinstall it later but install with out the support software ,

O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"

O4 - HKLM\..\Run: [Great hold] C:\PROGRA~1\PROCRE~1\upload mode third.exe

O4 - HKLM\..\Run: [ASTART] C:\WINNT\ASTART

O4 - HKCU\..\Run: [System32] C:\WINNT\Services32.exe NORMAL

O4 - HKLM\..\Run: [fash] C:\WINNT\fash.exe

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

Now reboot into safe mode and delete the following files and folders if found .

C:\PROGRA~1\PROCRE~1\upload mode third.exe,,,,,delete file

C:\WINNT\ASTART,,,,delete file

C:\WINNT\Services32.exe ,,,,delete file

C:\WINNT\fash.exe,,,,delete file

to delete the above files and folder you will need to do the following.
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

jus learnin ,
Before you fix the above please do the following'
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:
http://members.rogers.com/rjmac/new_uninstall.exe

LOP toolbar uninstaller http://members.rogers.com/rjmac/toolbar_uninstall.exe

Uninstall Messenger Plus if you have it, as it comes bundled with LOP, You can reinstall Messenger Plus without the sponsor

Here's the new log. I did everything with the exception of removing P2P networking because my son uses kazaa lite. Is this a problem ?

Logfile of HijackThis v1.99.0
Scan saved at 8:01:48 PM, on 1/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\WINNT\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Tim Lee\Application Data\Mozilla\Profiles\default\7f1osgn1.slt\prefs.js)
O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PopupBlockerBHO.CPopupBlockerBHO - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\Program Files\SmartPopupBlocker\PopupBlockerBHO.dll
O2 - BHO: (no name) - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - (no file)
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - (no file)
O2 - BHO: TChkBHO Class - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - C:\WINNT\system32\oymikwg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINNT\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O18 - Filter: text/html - {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} - c:\program files\clientman\run\searchrep4acf6c0b.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Firewall - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ScriptBlocking Service - Unknown - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: ScsiAccess - Unknown - C:\WINNT\System32\ScsiAccess.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Here's the new log. I did everything with the exception of removing P2P networking because my son uses kazaa lite. Is this a problem ?

You don't need it to use Kazaa lite.you can uninstall it an kazaa will still work .I did when i use to use kazaa lite
EDIT:
Read this You decide
http://www.kephyr.com/spywarescanner/library/p2pnetworking/index.phtml

Aliitle clean up of some i missed .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Have Hijack This fix the following by placing a check in the

appropriate boxes and selecting fix checked. Make sure all

browser and all Windows Explorer windows are closed before

fixing.
You might want to print out or copy & paste to notePad , these

instructions as you will need to close this browser window to

fix with hijackthis !

O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)

O2 - BHO: (no name) - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - (no file)

O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - (no file)

O2 - BHO: TChkBHO Class - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - C:\WINNT\system32\oymikwg.dll

O18 - Filter: text/html - {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} - c:\program files\clientman\run\searchrep4acf6c0b.dll

reboot computer and post a new log

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

   See this link for a listing of some online & their stand-alone antivirus programs:

   Virus, Spyware, and Malware Protection and Removal Resources

2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

   For a tutorial on Firewalls and a listing of some available ones see the link below:

   Understanding and Using Firewalls

4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
5. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

   A tutorial on installing & using this product can be found here:

   Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

6. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

   A tutorial on installing & using this product can be found here:

   Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

7. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

   A tutorial on installing & using this product can be found here:

   Using SpywareBlaster to protect your computer from Spyware and Malware

8. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
   

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

thanks for the info on p2p. I removed it. I also fixed the additional items. I notice that the BHO entries are still in the log though. Here's the new log.

Logfile of HijackThis v1.99.0
Scan saved at 7:54:06 AM, on 1/4/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WordWeb\wweb32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINNT\system32\drivers\KodakCCS.exe
C:\WINNT\System32\ScsiAccess.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://foxnews.com/
O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PopupBlockerBHO.CPopupBlockerBHO - {0D929918-C804-4756-B0AC-640EF3F061E9} - C:\Program Files\SmartPopupBlocker\PopupBlockerBHO.dll
O2 - BHO: (no name) - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - (no file)
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - (no file)
O2 - BHO: (no name) - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &WordWeb... - res://C:\WINNT\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVSync Manager - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Firewall - Network Associates, Inc. - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: ScriptBlocking Service - Unknown - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
O23 - Service: ScsiAccess - Unknown - C:\WINNT\System32\ScsiAccess.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Just discovered that all of my netscape mail profiles except for my peronal profile seem to have been deleted. When I open up the profiles I get a set up screen as if I am setting up the profile for the first time. Also all of the startup pages except for my personal profile have been changed to the following : http://wp.netscape.com/bookmark/7_1/startuppage.html

I am guessing these two incidents are connected, but don't really know what to do about it. Do you know if there is any way to recover the lost profiles and their mail ? This has not happened to me before.

I looked through all of the items that were fixed or deleted by hijack, and i did not see anything that seems to be related to netscape mail that could have caused this.
Any help would be appreciated.

The N3 entries that were in your log were for Netscape, but I don't see them there now, did you 'fix' them with HJT? If so, you should be able to restore them:

How to restore items mistakenly deleted.
HijackThis comes with a backup and restoral procedure in the event that you erroneously remove an entry that is actually legitimate. If you have configured HijackThis as was shown in this tutorial, then you should be able to restore entries that you have previously deleted. If you have had your HijackThis program running from a temporary directory, then the restoral procedure will not work.

If the configuration setting Make backups before fixing items is checked, HijackThis will make a backup of any entries that you fix in a directory called backups that resides in the same location as Hijackthis.exe.

If you start HijackThis and click on Config, and then the Backup button you will be presented with a screen. You will have a listing of all the items that you had fixed previously and have the option of restoring them. Once you restore an item that is listed in this screen, upon scanning again with HijackThis, the entries will show up again. Once you are finished restoring those items that were mistakenly fixed, you can close the program.

After you've restored those (if they were actually removed by HJT), scan again with HJT, and have it fix the following entries:

O2 - BHO: (no name) - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - (no file)
O2 - BHO: (no name) - {3F0DE170-80FB-DABB-7A54-88D4A3D16C58} - (no file)
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - (no file)
O2 - BHO: (no name) - {5B71E02D-4B7C-4266-8CA3-2135AF26104E} - (no file)

Remember to have all other windows closed when you hit the Fix button.

And this one while you at it .

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

I was able to check the HJ backups. The N3 entries weren't there. The only other process that i am aware of that was running between the HJ log last night when the N3 entries were present and the log this morning was the AVG virus scan and the spybot scan that were scheduled to run automatically. Is it possible either of these programs could have deleted these entries ? If not, are you aware of any other way i could restore these entries ?

Also, I am still receiving the internal application error when i attempt to open windows media player.

I was able to retrieve the netscape profiles by correcting the path to the mail folders in the directory field of the server settings. However, i still have not been able to recover the bookmarks.

Still receiving internal application error when accessing windows media player.

I have no idea regarding your mail. WMP may need reinstalling :).

As caperjack said in Post #5, you need to get the Critical Updates for your computer from Windows Update. There are also updates for Media Player which may correct your problem.

It's been too long since I've worked with Netscape; I don't remember where the Bookmarks are stored. You may have better luck posting that question in the Software forum. And the Media Player too, if the Updates don't work.

I was able to locate the bookmarks in the profile folder by following path thru documents & settings, application data, mozilla, profiles and then selecting the correct bookmark file and using the import command in Manage bookmarks.

This wmp error is becoming frustrating i have tried deleting all existing wmp files and installing new ver. 10. Also tried removing wmp from add/remove programs and reinstalling v.10. But still get internal application error. I tend to believe that it is not compatible with some other program i am running. I don't know what else could continually be causing this error.

Is it a file association problem? Go to control panel\folder options and hit the file types Tab. Scroll down to these file types and make sure they are registered to open with WMP;

WM
WMA
WMV

There are a few more, but this should see if that's the cause.

I checked the file types you listed and they are all registered to open with wmp