Does this look right, Help ?

[Jp]

I submitted my HJT log to Virus Total, the feed back was this, and I do not recognize these files as being installed on my system.

Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.27.2007  no virus found
AntiVir 7.4.0.15 04.27.2007  no virus found
Authentium 4.93.8 04.26.2007  no virus found
Avast 4.7.981.0 04.26.2007  no virus found
AVG 7.5.0.464 04.26.2007  no virus found
BitDefender 7.2 04.27.2007  no virus found
CAT-QuickHeal 9.00 04.27.2007  no virus found
ClamAV devel-20070416 04.27.2007  no virus found
DrWeb 4.33 04.27.2007  no virus found
eSafe 7.0.15.0 04.27.2007  no virus found
eTrust-Vet 30.7.3599 04.27.2007  no virus found
Ewido 4.0 04.27.2007  no virus found
FileAdvisor 1 04.27.2007  no virus found
Fortinet 2.85.0.0 04.27.2007  no virus found
F-Prot 4.3.2.48 04.26.2007  no virus found
F-Secure 6.70.13030.0 04.27.2007  no virus found
Ikarus T3.1.1.5 04.27.2007  no virus found
Kaspersky 4.0.2.24 04.27.2007  no virus found
McAfee 5018 04.26.2007  no virus found
Microsoft 1.2405 04.27.2007  no virus found
NOD32v2 2223 04.27.2007  no virus found
Norman 5.80.02 04.27.2007  no virus found
Panda 9.0.0.4 04.27.2007  no virus found
Prevx1 V2 04.27.2007  no virus found
Sophos 4.16.0 04.23.2007  no virus found
Sunbelt 2.2.907.0 04.19.2007  no virus found
Symantec 10 04.27.2007  no virus found
TheHacker 6.1.6.095 04.15.2007  no virus found
VBA32 3.11.4 04.27.2007  no virus found
VirusBuster 4.3.7:9 04.27.2007  no virus found
Webwasher-Gateway 6.0.1 04.27.2007 no virus found


Aditional Information
File size: 9767 bytes
MD5: 454e572f2707309af9ccb9fc3f357b3f
SHA1: 38ce61132083daa6cc5c826ce665341eb892e79 c

HJT log to come in following post.

Jp

[Jp]

Logfile of HijackThis v1.99.1
Scan saved at 9:39:46 AM, on 4/26/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~2\CPQWEB~1\WebDmi.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\Compaq\COMPAQ~2\cpqdmi.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Microsoft Works\WksSb.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Common Files\AOL\1143471933\ee\AOLSoftware.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\PROGRA~1\Compaq\COMPAQ~2\CHKADMIN.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\PROGRA~1\RINGCE~1\RINGCE~1\RCIMAP.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\Documents and Settings\Joe Poole\Desktop\HijackThis.exe

[Jp]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/customize/yessentials_cq/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SST - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ThomasNet.com Toolbar - {46AE03C0-BCFA-4728-90E7-00EB4A8B3863} - C:\WINDOWS\Downloaded Program Files\AtHocTBr.DLL
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [netdefense2003] C:\Documents and Settings\Joe Poole\Desktop\epc protector\netdefense.exe
O4 - HKLM\..\Run: [mswspl] C:\Documents and Settings\Joe Poole\Desktop\epc protector\netdefense.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.0\masqform.exe -UpdateCurrentUser
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\JOEPOO~1\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe -startup -product IncrediMail
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1143471933\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~2\CHKADMIN.EXE
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\AOL.EXE" -b
O4 - HKCU\..\Run: [RCSync] "C:\PROGRA~1\RINGCE~1\RINGCE~1\RCIMAP.exe"
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143817725593
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169617713187
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_16_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F7A1AF5-AB99-4CB3-8138-3C843F1ED6DA}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\COMPAQ\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~2\cpqdmi.exe
O23 - Service: Compaq DMI Web Agent (cpqWebDmi) - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~2\CPQWEB~1\WebDmi.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe

I will appreciate your review.

Jp

[GX1_Man]

Jp I think Raptor is looking for you.

[Jp]

GX1_Man,
It can't be for anything serious, ....................Can It ? 

[GX1_Man]

Here you go:

http://www.computerhope.com/forum/index.php/topic,34526.0.html

[CBMatt]

I don't have the time to look at your log right now, but I can tell you that uploading your HJT log to VirusTotal will tell you absoluely nothing.  It's just a Notepad file.

I do not recognize these files as being installed on my system.

What files are you referring to?

[Jp]

CBMatt,
The files I am referring to as not being familiar, are the ones that were returned that say no viruses found, etc.

Not to worry about time I had some difficulties during this time this morning, am not sure what it is, I think that Prevx 1 which has expired, is giving me some background run time when I open my IS.

I should have this post removed to Other or something, but if and when you get time I would like to know if there is anything in the HJT log that might be causing me problems.

Thanks much,

Keep in touch.

Jp

[CBMatt]

Well, Joe, your log isn't too bad, but there are a couple of things that need attention.  But first, I'd like to address your question...  I'm still not entirely sure what files you're referring to.  Are you talking about that long list of anti-virus programs?  If so, then those aren't actually on your computer.  VirusTotal just uses those to scan files online.  It's somewhat like scanning with Panda online.  You can scan with it, but it's not actually on your computer.  I hope I've answered your question.  If not, please clarify a bit more to help me understand.  Now, time for your log...

First...
O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\JOEPOO~1\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe -startup -product IncrediMail

Have you installed IncrediMail?  This appears to just be the installer for it, so if you don't need it, it can be deleted.  If you want it for any reason, you'll want to move it because it's in your Temp folder, which means it'll get deleted after a certain amount of time.

Speaking of your Temp folder...download CCleaner]http://www.ccleaner.com]CCleaner (install without the Yahoo! toolbar) and use it to clean up a bit.

Now, open HJT and do a scan.  Check the following entries if they still appear (don't fix them yet)...
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)

O2 - BHO: SST - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll (file missing)

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O4 - HKLM\..\Run: [netdefense2003] C:\Documents and Settings\Joe Poole\Desktop\epc protector\netdefense.exe
O4 - HKLM\..\Run: [mswspl] C:\Documents and Settings\Joe Poole\Desktop\epc protector\netdefense.exe
(Do you recognize this at all?  I can't find any real info on it, but the program appears to have been infected with a trojan.  If you do in fact know this program and want to keep it, the easiest route would be reinstalling it after the fix.  But because I don't recognize it, I would recommend not using it.)

Please print out these steps before proceding, and make sure your anti-virus defintions are up-to-date.  Now, close all windows (including this one) besides HiJackThis, then click Fix Checked.  Close HiJackThis and reboot into Safe Mode.

Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following (if present)...

NetOptimizer
Lycos SideSearch
EPC Protector or NetDefense2003
Alexa

Navigate to and delete the following folder (if present)...

C:\Documents and Settings\Joe Poole\Desktop\epc protector

Do the same for the following files (if present)...

C:\Program Files\Lycos\sst.dll
C:\WINDOWS\web\related.htm

If you can't find the aforementioned files/folders, you may need to have Windows allow you to view hidden files and folders.  If you're not sure how to do so, please read this.  Perform a full-system scan with your virus scan (I would suggest AVG Free) and let it clean anything bad it finds.  Once you've done all of this, reboot into Normal Mode and post a new HijackThis log so we can see if there's any other junk we need to clean up.  Let me know how everything's running now and if you had any problems following my steps.

[Jp]

Hi Chris,
I have found Free Registry Scan!
 
 
RegCure Premium Registry Cleaner and PC Optimizer
 

and am not really sure what to do there seems to be several
CCleaners , exactly which one should I be using.


As I am writing this my curser is out of control, blinking
and scrolling down the page leaving the printed word far behind.

A lot of strange things are going on, like the picture program icon on the desk top opens all by itself and won't close, etc.

Generally a computer that is not working.

Jp

[Jp]

I was unable to reply from my computer I am using another.The curser will not stay still long enough for me to write.

I have completed AVG Virus Scan, over 4oo threats, but I don't know what to do next, how to clear etc. will wait for your reply.

[Jp]

Please Help !

Over 400 threats found need to deal with this how to correct or finish AVG Virus scan cleanup ?



JP

[Jp]

OS: Microsoft Windows XP
Home Edition
Version 2002
Service Pack 1
128 MB of RAM

Did you check out the virus scan ob the previous page ?

I must add, that during this episode, I was not able to re-start in safe mode,
also I restored the system once last week and then again today, no dif. seems worse, I wish I would have taken dl65's advice way back when but I had 2 many issues I hate malicious S-Birds, and would like to blame the FCC, for sitting on the Buts while I am eating some S-Birds dirt !


Jp

[Zylstra]

Just for future refrence:
Instead of making a whole bunch of posts, you can use a service like Pastebin http://pastebin.com/ to have a lot of text

(I dont consider HJT logs a waste of post counts, it just takes a long time to do that)

[Jp]

Hun !! Whatever I'm just glad that I still have a telecommunications system to answer you, like if my motor tickle was still running , . I would be tickled until the end of time.

I just need to get through this and I promise I will be good from now on.

Your hearts desire, I would K.Y.A. , . . .


Just don't break me because I am already a Bkn. A.



Jp

Besides that I would have to use the computer at the library if I wanted to go on line, . .  then I probably wouldn't need you any more, . . and that my love is unamaginable.