I've been infected with this annoying virus which changes my background, tries to get me to register with some fake spyware removers, gets an annoying "Your computer has been infected!" bubble that gets in the way of things, have random italian messages pop up, change my webpage to an italian homepage : www.skymasters.biz/?4289 and occasionally random others I can't find. I've used countless miscellaneous antispyware programs, too. Can anyone help me? Here's my Hijack This log C:\Program Files\LANSA11B\Connect\LCOLIST.EXE c:\Program Files\lotus\notes\ntmulti.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Checkpoint\SecuRemote\bin\SR_Service.exe C:\Program Files\Checkpoint\SecuRemote\bin\SR_WatchDog.exe C:\WINDOWS\System32\svchost.exe c:\Toshiba\IVP\swupdate\swupdtmr.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\SYSTEM32\WISPTIS.EXE C:\WINDOWS\System32\tabbtnu.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Checkpoint\SecuRemote\bin\SR_GUI.Exe C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe C:\Program Files\ltmoh\Ltmoh.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\System32\00THotkey.exe C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe C:\Program Files\Toshiba\TapButton\TapButt.exe C:\WINDOWS\system32\TPSMain.exe C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE C:\WINDOWS\system32\TFNF5.exe C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe C:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe C:\Program Files\TOSHIBA\TouchED\TouchED.Exe C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe C:\Program Files\iPass\iPassConnect\downloader\ipccheck.exe C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\Check Point\Integrity Client\iclient.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe C:\Program Files\TOSHIBA\TME3\TMETEMNU.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\TPSBattM.exe C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\iPass\iPassConnect\IPassConnectGUI.exe C:\WINDOWS\system32\RAMASST.exe C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe C:\Program Files\Verizon Online\Help Support\bin\mpbtn.exe C:\toshiba\ivp\ism\ivpsvmgr.exe C:\DOCUME~1\PCXUSE~1.WMA\LOCALS~1\Temp\22173.exe C:\DOCUME~1\PCXUSE~1.WMA\LOCALS~1\Temp\11602.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\PCXUSER.WMAY2717\Application Data\sgrunt\IE4321.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.37\adulto.exe E:\start.exe C:\WINDOWS\regedit.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.37\AUTO_4289_N.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://camps.wiley.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: WCNetMon Class - {3BE313C3-DAD6-4da6-801D-75860118A0B5} - C:\Program Files\blcorp\WCCSC\WCPStop\wcpstop.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {CF2C5E69-BEAA-955A-A5FC-E93B870574CA} - (no file) O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Check Point\Integrity Client\iclient.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: iPassConnect.lnk = C:\Program Files\iPass\iPassConnect\IPassConnectGUI.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe O4 - Global Startup: Verizon Online Help & Support.lnk = C:\Program Files\Verizon Online\Help Support\bin\matcli.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com O15 - Trusted Zone: www.archiviosex.net O15 - Trusted Zone: www.linkautomatici.com O15 - Trusted Zone: www.redfunny.com O15 - Trusted Zone: www.sgrunt.biz O15 - Trusted Zone: www.skymasters.biz O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.m7z.net/content.inf...W/win/019-0312.20050111.MmVrT/iTunesSetup.exe O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://wiley.webex.com/client/v_mywebex-t20/training/ieatgpc.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2EAD6CDC-8C28-4D23-B437-719E05F8959C}: Domain = wiley.com O17 - HKLM\System\CCS\Services\Tcpip\..\{FA3ED5C3-C5A6-4B5C-B6E7-94A8A3176A22}: Domain = wiley.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = wiley.com,wileynet.net,northamerica,wiley.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = wiley.com,wileynet.net,northamerica,wiley.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = wiley.com,wileynet.net,northamerica,wiley.com O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dll O20 - Winlogon Notify: loginkey - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: TabBtnWL - C:\WINDOWS\SYSTEM32\TabBtnWL.dll O20 - Winlogon Notify: tpgwlnotify - C:\WINDOWS\SYSTEM32\tpgwlnot.dll O23 - Service: Adaptive Server Anywhere - LANSA11B (ASANYs_LANSA11B) - iAnywhere Solutions, Inc. - C:\Program Files\Sybase\ASA9\SQL Anywhere 9\win32\dbsrv9.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LConnect Services 1 - 11.0.0 (11003) - Unknown owner - C:\Program Files\LANSA11B\Connect\LCOLIST.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lotus Notes Single Logon - IBM Corp - c:\WINDOWS\system32\nslsvice.exe O23 - Service: Multi-user Cleanup Service - IBM Corp - c:\Program Files\lotus\notes\ntmulti.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\Checkpoint\SecuRemote\bin\SR_Service.exe O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\Checkpoint\SecuRemote\bin\SR_WatchDog.exe O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Tmesrv3 (Tmesrv) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe" /Service (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Hi jackal912. That was not the whole log... Please post a full log, begins with: Logfile of HijackThis v1.99.1... etc Then we'll help you out.
