Logfile of HijackThis v1.98.0
Scan saved at 11:57:36 AM, on 8/16/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Ascent\Server\MSSQL$AscentCapture\Binn\sqlse rvr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\mfcge.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec\VPNClient\vpnservices.exe
C:\Program Files\Symantec\VPNClient\logd.exe
C:\Program Files\Symantec\VPNClient\emroute.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\addqk32.exe
C:\WINNT\system32\SWEEPER.EXE
C:\Documents and Settings\amisiewicz\My Documents\Personal\JOHN\Medical School\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\pvbqb.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pvbqb.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://pvbqb.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://pvbqb.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\pvbqb.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\pvbqb.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\pvbqb.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://pvbqb.dll/index.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\pvbqb.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\pvbqb.dll/sp.html#96676
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {9407E41A-7C0F-B5C6-1D61-8C738A6CDC87} - C:\WINNT\system32\ipfn32.dll
O4 - HKLM\..\Run: [addqk32.exe] C:\WINNT\system32\addqk32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Internet Sweeper] C:\WINNT\system32\SWEEPER.EXE /Q

I can see your problem, but I would like you to explain your own problem. Please could you update your version of Hijack This and post a fresh log http://hjt.isecureit.co.uk

Ok, I did the house call scan and it found a bunch of uncleanable trojans. I deleted them. I updated hijackthis. The problem is IE comes up with home seach pages and I get pop ups with spyware advertisments, I friends and other crap with the window title of, "only the best." I did not download anything, I got routed to a page that took forever to load and the hard drive was turning like mad, then I had this problem.

Here is my new log:
Logfile of HijackThis v1.98.2
Scan saved at 4:17:15 PM, on 8/17/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Ascent\Server\MSSQL$AscentCapture\Binn\sqlse rvr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\mfcge.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec\VPNClient\vpnservices.exe
C:\Program Files\Symantec\VPNClient\logd.exe
C:\Program Files\Symantec\VPNClient\emroute.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\addqk32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\amisiewicz\Desktop\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://xjjaf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://xjjaf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://xjjaf.dll/index.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xjjaf.dll/sp.html#96676
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {58F72D8D-7E38-D1C1-1C2E-6173BFF8F9AD} - C:\WINNT\system32\crxm.dll
O4 - HKLM\..\Run: [addqk32.exe] C:\WINNT\system32\addqk32.exe

1. Download AboutBuster http://www.downloads.subratam.org/AboutBuster.zip

Unzip it to your desktop but don't run it yet.

2. Download Ad-aware from here. Open the Ad-aware program and near the bottom click the Check For Updates link. This will open the update manager. Follow the prompts to update your Ad-aware Reference File. Close Ad-aware for now, we will use it later.

3. You may want to print out these instructions for further reference when completing the following steps.

4. Make sure your PC is configured to show hidden files

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

5. Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok

Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

6. Then reboot your PC into Safe Mode. If you don't know how to do this, see here for further instructions.

7. Restart Hijack This and put a checkmark next to the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://xjjaf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://xjjaf.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\xjjaf.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://xjjaf.dll/index.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xjjaf.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\xjjaf.dll/sp.html#96676
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {58F72D8D-7E38-D1C1-1C2E-6173BFF8F9AD} - C:\WINNT\system32\crxm.dll
O4 - HKLM\..\Run: [addqk32.exe] C:\WINNT\system32\addqk32.exe

Then delete the following files and folders:

C:\WINNT\system32\addqk32.exe

8. Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

9. Scan with Adaware and let it remove any bad files found.

10. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure that Temporary Files, Temporary Internet Files and Recycle Bin

11. Reboot to normal mode

12. Finally, pay a visit to Housecall. Scan for and remove any infected files found on your system.

Post a fresh HijackThis log and the AboutBuster report back here please.

Scanned at: 5:07:23 PM on: 8/20/2004


-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Deleted 2 Service Keys Successfully!
Removed! : C:\WINNT\abjxz.dat
Removed! : C:\WINNT\acmgf.dat
Removed! : C:\WINNT\addhp.exe
Removed! : C:\WINNT\adhhi.dll
Removed! : C:\WINNT\alegy.dll
Removed! : C:\WINNT\awvik.dat
Removed! : C:\WINNT\aytxs.dat
Removed! : C:\WINNT\bazmh.dll
Removed! : C:\WINNT\bbcvl.dll
Removed! : C:\WINNT\bereg.dat
Removed! : C:\WINNT\blxud.dat
Removed! : C:\WINNT\bpmbs.dll
Removed! : C:\WINNT\bqtsx.dat
Removed! : C:\WINNT\brhqt.dat
Removed! : C:\WINNT\ccrmg.dat
Removed! : C:\WINNT\cgnzg.dll
Removed! : C:\WINNT\cjdcz.dat
Removed! : C:\WINNT\cvnow.dll
Removed! : C:\WINNT\dcdlh.dat
Removed! : C:\WINNT\dykxd.dat
Removed! : C:\WINNT\edetd.dat
Removed! : C:\WINNT\ewocq.dat
Removed! : C:\WINNT\fmhth.dat
Removed! : C:\WINNT\fovbp.dll
Removed! : C:\WINNT\fptwa.dat
Removed! : C:\WINNT\gcryo.dll
Removed! : C:\WINNT\ggrns.dat
Removed! : C:\WINNT\gmhof.dll
Removed! : C:\WINNT\gxtao.dat
Removed! : C:\WINNT\gycra.dat
Removed! : C:\WINNT\hftza.dat
Removed! : C:\WINNT\hjeqz.dat
Removed! : C:\WINNT\hnbuo.dll
Removed! : C:\WINNT\humgk.dll
Removed! : C:\WINNT\hvgwp.dll
Removed! : C:\WINNT\hxusb.dll
Removed! : C:\WINNT\hzayk.dll
Removed! : C:\WINNT\ihniy.dll
Removed! : C:\WINNT\ihoqd.dat
Removed! : C:\WINNT\iosxd.dll
Removed! : C:\WINNT\jaeou.dat
Removed! : C:\WINNT\jahsi.dat
Removed! : C:\WINNT\jarpx.dat
Removed! : C:\WINNT\jieev.dat
Removed! : C:\WINNT\jkwms.dll
Removed! : C:\WINNT\jkzmp.dat
Removed! : C:\WINNT\kdexf.dll
Removed! : C:\WINNT\kdnas.dat
Removed! : C:\WINNT\khmfb.dat
Removed! : C:\WINNT\kpkdh.dat
Removed! : C:\WINNT\krfsd.dat
Removed! : C:\WINNT\ktuus.dll
Removed! : C:\WINNT\kwoia.dll
Removed! : C:\WINNT\lbecp.dll
Removed! : C:\WINNT\llobq.dll
Removed! : C:\WINNT\lmdom.dat
Removed! : C:\WINNT\ltyub.dat
Removed! : C:\WINNT\lxurq.dll
Removed! : C:\WINNT\mlite.dll
Removed! : C:\WINNT\mltov.dat
Removed! : C:\WINNT\nnmtg.dat
Removed! : C:\WINNT\nnoac.dat
Removed! : C:\WINNT\notom.dat
Removed! : C:\WINNT\npolz.dat
Removed! : C:\WINNT\nwksf.dat
Removed! : C:\WINNT\nwzui.dat
Removed! : C:\WINNT\ohisz.dat
Removed! : C:\WINNT\ojrwb.dat
Removed! : C:\WINNT\okcjd.dat
Removed! : C:\WINNT\oxluo.dll
Removed! : C:\WINNT\oxnxa.dll
Removed! : C:\WINNT\pkjfj.dat
Removed! : C:\WINNT\prelg.dat
Removed! : C:\WINNT\pvbqb.dll
Removed! : C:\WINNT\qfaza.dat
Removed! : C:\WINNT\qhghz.dat
Removed! : C:\WINNT\qlooe.dat
Removed! : C:\WINNT\qlxur.dat
Removed! : C:\WINNT\qvhbg.dat
Removed! : C:\WINNT\qxwwv.dat
Removed! : C:\WINNT\qyepr.dat
Removed! : C:\WINNT\rcgrx.dll
Removed! : C:\WINNT\reibw.dll
Removed! : C:\WINNT\rgtrk.dat
Removed! : C:\WINNT\rishv.dat
Removed! : C:\WINNT\royls.dat
Removed! : C:\WINNT\rwyfl.dll
Removed! : C:\WINNT\sbnnb.dat
Removed! : C:\WINNT\sjmox.dat
Removed! : C:\WINNT\skolm.dat
Removed! : C:\WINNT\syseq32.exe
Removed! : C:\WINNT\tcrih.dll
Removed! : C:\WINNT\telfu.dll
Removed! : C:\WINNT\trrhf.dat
Removed! : C:\WINNT\ttdei.dat
Removed! : C:\WINNT\txjja.dat
Removed! : C:\WINNT\vowke.dat
Removed! : C:\WINNT\wdyyr.dll
Removed! : C:\WINNT\whwaz.dat
Removed! : C:\WINNT\wyhxn.dat
Removed! : C:\WINNT\xbath.dat
Removed! : C:\WINNT\xceex.dll
Removed! : C:\WINNT\xdaqx.dat
Removed! : C:\WINNT\xgmho.dat
Removed! : C:\WINNT\xjjaf.dll
Removed! : C:\WINNT\xksee.dll
Removed! : C:\WINNT\yaeno.dat
Removed! : C:\WINNT\yayjn.dat
Removed! : C:\WINNT\yduqw.dat
Removed! : C:\WINNT\yqoay.dll
Removed! : C:\WINNT\ysmsn.dat
Removed! : C:\WINNT\ytxsn.dll
Removed! : C:\WINNT\yvodp.dll
Removed! : C:\WINNT\zlrnx.dll
Removed! : C:\WINNT\zolkl.dll
Removed! : C:\WINNT\zqvro.dat
Removed! : C:\WINNT\zwxsf.dll
Removed! : C:\WINNT\zzckt.dat
Removed! : C:\WINNT\System32\acqjs.dll
Removed! : C:\WINNT\System32\aiexj.dll
Removed! : C:\WINNT\System32\alpjj.dat
Removed! : C:\WINNT\System32\apbcv.dll
Removed! : C:\WINNT\System32\axgqm.dat
Removed! : C:\WINNT\System32\ayhgw.dat
Removed! : C:\WINNT\System32\bjkoq.dll
Removed! : C:\WINNT\System32\bliqr.dll
Removed! : C:\WINNT\System32\bohfv.dat
Removed! : C:\WINNT\System32\cdkwn.dat
Removed! : C:\WINNT\System32\ceplf.dat
Removed! : C:\WINNT\System32\cguwv.dll
Removed! : C:\WINNT\System32\ciaja.dll
Removed! : C:\WINNT\System32\coqqx.dat
Removed! : C:\WINNT\System32\ctcbb.dll
Removed! : C:\WINNT\System32\ctjql.dll
Removed! : C:\WINNT\System32\dhahs.dat
Removed! : C:\WINNT\System32\dqqih.dat
Removed! : C:\WINNT\System32\ealcn.dat
Removed! : C:\WINNT\System32\eankc.dat
Removed! : C:\WINNT\System32\evyqg.dat
Removed! : C:\WINNT\System32\fhubm.dll
Removed! : C:\WINNT\System32\fipew.dat
Removed! : C:\WINNT\System32\fnbcl.dat
Removed! : C:\WINNT\System32\foxpy.dat
Removed! : C:\WINNT\System32\frdwq.dat
Removed! : C:\WINNT\System32\ftaeb.dat
Removed! : C:\WINNT\System32\ftkpq.dat
Removed! : C:\WINNT\System32\fxyig.dat
Removed! : C:\WINNT\System32\fyybg.dat
Removed! : C:\WINNT\System32\gfyao.dll
Removed! : C:\WINNT\System32\glpja.dat
Removed! : C:\WINNT\System32\gqdmj.dll
Removed! : C:\WINNT\System32\grwhd.dll
Removed! : C:\WINNT\System32\gtcgg.dat
Removed! : C:\WINNT\System32\gwjzc.dat
Removed! : C:\WINNT\System32\hcwym.dat
Removed! : C:\WINNT\System32\hjupv.dat
Removed! : C:\WINNT\System32\hrilk.dll
Removed! : C:\WINNT\System32\hsuyd.dat
Removed! : C:\WINNT\System32\huwsd.dat
Removed! : C:\WINNT\System32\hzdgq.dat
Removed! : C:\WINNT\System32\icskc.dll
Removed! : C:\WINNT\System32\ienct.dat
Removed! : C:\WINNT\System32\iievm.dat
Removed! : C:\WINNT\System32\iiidt.dll
Removed! : C:\WINNT\System32\ipign.dat
Removed! : C:\WINNT\System32\iuwht.dll
Removed! : C:\WINNT\System32\jfpuy.dll
Removed! : C:\WINNT\System32\jmigq.dat
Removed! : C:\WINNT\System32\jpyur.dll
Removed! : C:\WINNT\System32\jupvy.dll
Removed! : C:\WINNT\System32\kdcmk.dll
Removed! : C:\WINNT\System32\ktjzg.dat
Removed! : C:\WINNT\System32\ktxon.dll
Removed! : C:\WINNT\System32\larhe.dll
Removed! : C:\WINNT\System32\lkkuo.dll
Removed! : C:\WINNT\System32\lnhhz.dll
Removed! : C:\WINNT\System32\lqalf.dll
Removed! : C:\WINNT\System32\lscrc.dat
Removed! : C:\WINNT\System32\lvsvd.dat
Removed! : C:\WINNT\System32\mkizi.dat
Removed! : C:\WINNT\System32\moxxn.dat
Removed! : C:\WINNT\System32\moxxn.dll
Removed! : C:\WINNT\System32\nfgsd.dat
Removed! : C:\WINNT\System32\nguue.dat
Removed! : C:\WINNT\System32\ngyzo.dat
Removed! : C:\WINNT\System32\nktxo.dat
Removed! : C:\WINNT\System32\ohbnj.dll
Removed! : C:\WINNT\System32\ojfix.dll
Removed! : C:\WINNT\System32\owdyp.dat
Removed! : C:\WINNT\System32\pejbk.dat
Removed! : C:\WINNT\System32\pnufq.dat
Removed! : C:\WINNT\System32\pobex.dat
Removed! : C:\WINNT\System32\pqudh.dat
Removed! : C:\WINNT\System32\pvfzu.dll
Removed! : C:\WINNT\System32\pyaic.dll
Removed! : C:\WINNT\System32\qfati.dat
Removed! : C:\WINNT\System32\qrmbk.dat
Removed! : C:\WINNT\System32\qstom.dat
Removed! : C:\WINNT\System32\qxlij.dat
Removed! : C:\WINNT\System32\qyfbd.dll
Removed! : C:\WINNT\System32\rawhh.dat
Removed! : C:\WINNT\System32\rrjrc.dat
Removed! : C:\WINNT\System32\rwfaf.dat
Removed! : C:\WINNT\System32\rxhlr.dat
Removed! : C:\WINNT\System32\sdkfj32.exe
Removed! : C:\WINNT\System32\sysdv32.exe
Removed! : C:\WINNT\System32\szalq.dat
Removed! : C:\WINNT\System32\szzxt.dat
Removed! : C:\WINNT\System32\tugdt.dat
Removed! : C:\WINNT\System32\tugdt.dll
Removed! : C:\WINNT\System32\ucjda.dll
Removed! : C:\WINNT\System32\udqgs.dll
Removed! : C:\WINNT\System32\ueykw.dll
Removed! : C:\WINNT\System32\ukwbq.dat
Removed! : C:\WINNT\System32\ulbqp.dll
Removed! : C:\WINNT\System32\vqqrn.dll
Removed! : C:\WINNT\System32\wacuj.dat
Removed! : C:\WINNT\System32\waqtk.dat
Removed! : C:\WINNT\System32\wfkja.dat
Removed! : C:\WINNT\System32\wvvfj.dat
Removed! : C:\WINNT\System32\wzank.dll
Removed! : C:\WINNT\System32\xivfn.dll
Removed! : C:\WINNT\System32\xmcvb.dat
Removed! : C:\WINNT\System32\xvjvp.dat
Removed! : C:\WINNT\System32\xyxfi.dll
Removed! : C:\WINNT\System32\ytdly.dat
Removed! : C:\WINNT\System32\ytfwk.dat
Removed! : C:\WINNT\System32\ywatg.dll
Removed! : C:\WINNT\System32\ywosh.dat
Removed! : C:\WINNT\System32\zacqj.dat
Removed! : C:\WINNT\System32\zalqg.dll
Removed! : C:\WINNT\System32\zruxx.dll
Removed! : C:\WINNT\System32\zzyou.dll
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!






Scanned at: 5:13:57 PM on: 8/21/2004


-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!


Logfile of HijackThis v1.98.2
Scan saved at 3:42:15 PM, on 8/21/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Ascent\Server\MSSQL$AscentCapture\Binn\sqlse rvr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Symantec\VPNClient\vpnservices.exe
C:\Program Files\Symantec\VPNClient\logd.exe
C:\Program Files\Symantec\VPNClient\emroute.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\SWEEPER.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\amisiewicz\Desktop\hijackthis.exe

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Internet Sweeper] C:\WINNT\system32\SWEEPER.EXE /Q
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

It appears to be gone!

Thats looks better, how are things running?

you da man, it is all better!