Help Removing "Shopping Wizard / CoolWeb"

Hi I have this hijack called shopping wizard or coolweb. Ive used adaware and spybot yet I cannot get rid of it can someone help? This is my Hijackthislog

Logfile of HijackThis v1.99.1
Scan saved at 1:01:57 PM, on 5/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\ipnd.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {CD2B4BEE-4A8D-CAD0-4A3B-C9335C175D2A} - C:\WINDOWS\ntzo.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [ipnd.exe] C:\WINDOWS\ipnd.exe
O4 - HKLM\..\RunOnce: [appdh32.exe] C:\WINDOWS\system32\appdh32.exe
O4 - HKLM\..\RunOnce: [appsf32.exe] C:\WINDOWS\system32\appsf32.exe
O4 - HKLM\..\RunOnce: [sysle32.exe] C:\WINDOWS\sysle32.exe
O4 - HKLM\..\RunOnce: [iele.exe] C:\WINDOWS\system32\iele.exe
O4 - HKLM\..\RunOnce: [ntfd32.exe] C:\WINDOWS\system32\ntfd32.exe
O4 - HKLM\..\RunOnce: [atlop.exe] C:\WINDOWS\system32\atlop.exe
O4 - HKLM\..\RunOnce: [addek.exe] C:\WINDOWS\system32\addek.exe
O4 - HKLM\..\RunOnce: [ntbo.exe] C:\WINDOWS\ntbo.exe
O4 - HKLM\..\RunOnce: [appvf.exe] C:\WINDOWS\system32\appvf.exe
O4 - HKLM\..\RunOnce: [javapq32.exe] C:\WINDOWS\javapq32.exe
O4 - HKLM\..\RunOnce: [netqp.exe] C:\WINDOWS\netqp.exe
O4 - HKLM\..\RunOnce: [javaur.exe] C:\WINDOWS\javaur.exe
O4 - HKLM\..\RunOnce: [d3st.exe] C:\WINDOWS\d3st.exe
O4 - HKLM\..\RunOnce: [ieqv32.exe] C:\WINDOWS\ieqv32.exe
O4 - HKLM\..\RunOnce: [crbr.exe] C:\WINDOWS\system32\crbr.exe
O4 - HKLM\..\RunOnce: [crrr32.exe] C:\WINDOWS\system32\crrr32.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115863062187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appdh32.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Hello,oZ.& Welcome

First make sure you can view all hidden files and folders, use this link for help.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Copy all my instructions into wordpad and save to your desktop. You can't have any open browser windows.

Go to Start->Run and type "Services.msc" (without quotes) then hit OK
Scroll down and find the service called.

Network Security Service ( 11Fßä#·ºÄÖ`I)

Make sure it is selected in color. Right click on the service and click on stop. Right click on it again and go to Properties. In the Properties screen and under the General Tab, change the Startup Type to Disabled in the dropdown box. Click on Apply. Then OK. If the service isn't listed go ahead with the rest of these instructions anyway.


Now Download the following Cleanup! About:Buster, CWshredder,Ad-aware, & Spy-Bot.

* Updating Ad-aware:
Double-Click the Desktop Icon > Click 'Check For Updates Now' > Click 'Connect'
* Updating Spybot:
Double-Click the Desktop Icon > Click Update > Drop-Down Box UniDo(Europe) > Select Pure-Elite(USA) or EON (AU) > Click 'Search for Updates' > Click 'Download Updates'

Please Copy ALL My Notes Below Into Notepad and Save the File to Your Desktop. You Need to be Offline and In Safe Mode to Remove Everything in your Log

Now rebooot into safe mode (press f8 during reboot, select safe mode) and DON'T reconnect to the net. You MUST be in safe mode to remove the About:Blank Bug on your system.

Press control-alt-delete to get into the task manager and end the follow processes if they exist:

ipnd.exe
appdh32.exe
appsf32.exe
sysle32.exe
iele.exe
ntfd32.exe
atlop.exe
addek.exe
ntbo.exe
appvf.exe
javapq32.exe
netqp.exe
javaur.exe
d3st.exe
ieqv32.exe
crbr.exe
crrr32.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.


Run Hijackthis and place a check next to the following

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\yafnb.dll/sp.html#14044

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {CD2B4BEE-4A8D-CAD0-4A3B-C9335C175D2A} - C:\WINDOWS\ntzo.dll

O4 - HKLM\..\Run: [ipnd.exe] C:\WINDOWS\ipnd.exe
O4 - HKLM\..\RunOnce: [appdh32.exe] C:\WINDOWS\system32\appdh32.exe
O4 - HKLM\..\RunOnce: [appsf32.exe] C:\WINDOWS\system32\appsf32.exe
O4 - HKLM\..\RunOnce: [sysle32.exe] C:\WINDOWS\sysle32.exe
O4 - HKLM\..\RunOnce: [iele.exe] C:\WINDOWS\system32\iele.exe
O4 - HKLM\..\RunOnce: [ntfd32.exe] C:\WINDOWS\system32\ntfd32.exe
O4 - HKLM\..\RunOnce: [atlop.exe] C:\WINDOWS\system32\atlop.exe
O4 - HKLM\..\RunOnce: [addek.exe] C:\WINDOWS\system32\addek.exe
O4 - HKLM\..\RunOnce: [ntbo.exe] C:\WINDOWS\ntbo.exe
O4 - HKLM\..\RunOnce: [appvf.exe] C:\WINDOWS\system32\appvf.exe
O4 - HKLM\..\RunOnce: [javapq32.exe] C:\WINDOWS\javapq32.exe
O4 - HKLM\..\RunOnce: [netqp.exe] C:\WINDOWS\netqp.exe
O4 - HKLM\..\RunOnce: [javaur.exe] C:\WINDOWS\javaur.exe
O4 - HKLM\..\RunOnce: [d3st.exe] C:\WINDOWS\d3st.exe
O4 - HKLM\..\RunOnce: [ieqv32.exe] C:\WINDOWS\ieqv32.exe
O4 - HKLM\..\RunOnce: [crbr.exe] C:\WINDOWS\system32\crbr.exe
O4 - HKLM\..\RunOnce: [crrr32.exe] C:\WINDOWS\system32\crrr32.exe

O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\appdh32.exe


and click fix.

Remain in safe mode for the next part of the removal.

- First Run the Cleanit! Program

- Next, Unzip the About:Buster Program to your desktop > Double-Click the Folder > Double-Click About:Buster > Click 'OK' > Click 'Start' >

now the program will start to run, it will take a few minutes, once the program is complete go ahead and run the program again.

- Double-Click CWShredder and click 'Fix'

* Close CWShredder, open Ad-aware and make the following changes to the settings in Ad-aware.
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Scanning Engine:
check: "Unload recognized processes during scanning."
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Cleaning Engine:
Check: "Let Windows remove files in use at next reboot."

Press 'Proceed'

Press 'Start'

* Select option 'Use Custom scanning options'
* Click 'Activate in-depth scan'
* Press 'Select drives\folders to scan' Select the active partition which is usually C:

Click 'Customize'

* Make sure the following are all are Checked:
o 'Scan Within Archives'
o 'Scan Active Processes'
o 'Scan Registry'
o 'Deep Scan Registry'
o 'Scan My IE Favorites For Banned URL'S
o 'Scan My Hosts File'

Click 'Proceed'

* Now press "Next" to let Ad-aware scan your drives.
* Once Ad-aware has completed its scan click 'Next' > Now Click 'Scan Summary' > Click All the Boxes with a Green Check Mark
* Now Click 'Next' and Finally Click 'OK'

Close Out Ad-aware

Open Spybot.

* Click 'Search & Destroy'
* Click 'Check for problems' (the program will now search your HDD)
* Make sure all finding are checked and click 'Fix Selected Problems'


Close SpyBot!

Now Delete the following directories or files if they exist:

Files:

C:\WINDOWS\system32\crrr32.exe << This file
C:\WINDOWS\system32\crbr.exe << This file
C:\WINDOWS\ieqv32.exe << This file
C:\WINDOWS\d3st.exe << This file
C:\WINDOWS\javaur.exe << This file
C:\WINDOWS\netqp.exe << This file
C:\WINDOWS\javapq32.exe << This file
C:\WINDOWS\system32\appvf.exe << This file
C:\WINDOWS\ntbo.exe << This file
C:\WINDOWS\system32\addek.exe << This file
C:\WINDOWS\system32\atlop.exe << This file
C:\WINDOWS\system32\ntfd32.exe << This file
C:\WINDOWS\system32\iele.exe << This file
C:\WINDOWS\sysle32.exe << This file
C:\WINDOWS\system32\appsf32.exe << This file
C:\WINDOWS\system32\appdh32.exe << This file
C:\WINDOWS\ipnd.exe << This file

Reboot back into normal mode

Download the Hoster from here: http://www.funkytoad.com/download/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.

Once complete post a fresh Hijackthis log in your thread.

HGD

Here is my new log it looks the same to me

Logfile of HijackThis v1.99.1
Scan saved at 3:52:55 PM, on 5/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sysmo.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {BE14A955-DD6C-A165-6A81-393FF536A2E2} - C:\WINDOWS\system32\ntar.dll
O2 - BHO: Class - {E28302FE-B381-7680-D448-064B3F4763EE} - C:\WINDOWS\sdkaq32.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [sysmo.exe] C:\WINDOWS\system32\sysmo.exe
O4 - HKLM\..\RunOnce: [d3gc.exe] C:\WINDOWS\system32\d3gc.exe
O4 - HKLM\..\RunOnce: [javapc32.exe] C:\WINDOWS\system32\javapc32.exe
O4 - HKLM\..\RunOnce: [javajo.exe] C:\WINDOWS\javajo.exe
O4 - HKLM\..\RunOnce: [sdkyj32.exe] C:\WINDOWS\system32\sdkyj32.exe
O4 - HKLM\..\RunOnce: [apilj32.exe] C:\WINDOWS\system32\apilj32.exe
O4 - HKLM\..\RunOnce: [javajy32.exe] C:\WINDOWS\system32\javajy32.exe
O4 - HKLM\..\RunOnce: [atlpb32.exe] C:\WINDOWS\system32\atlpb32.exe
O4 - HKLM\..\RunOnce: [sdknq.exe] C:\WINDOWS\sdknq.exe
O4 - HKLM\..\RunOnce: [ntqi32.exe] C:\WINDOWS\ntqi32.exe
O4 - HKLM\..\RunOnce: [mfciy32.exe] C:\WINDOWS\mfciy32.exe
O4 - HKLM\..\RunOnce: [netrm32.exe] C:\WINDOWS\netrm32.exe
O4 - HKLM\..\RunOnce: [appww.exe] C:\WINDOWS\appww.exe
O4 - HKLM\..\RunOnce: [ntnx.exe] C:\WINDOWS\system32\ntnx.exe
O4 - HKLM\..\RunOnce: [javaqv.exe] C:\WINDOWS\system32\javaqv.exe
O4 - HKLM\..\RunOnce: [atlnt.exe] C:\WINDOWS\atlnt.exe
O4 - HKLM\..\RunOnce: [mfcvb.exe] C:\WINDOWS\mfcvb.exe
O4 - HKLM\..\RunOnce: [crtu.exe] C:\WINDOWS\system32\crtu.exe
O4 - HKLM\..\RunOnce: [iegf32.exe] C:\WINDOWS\system32\iegf32.exe
O4 - HKLM\..\RunOnce: [atlni.exe] C:\WINDOWS\system32\atlni.exe
O4 - HKLM\..\RunOnce: [wingf.exe] C:\WINDOWS\wingf.exe
O4 - HKLM\..\RunOnce: [ntyh32.exe] C:\WINDOWS\ntyh32.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115863062187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\d3gc.exe" /s (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Hi,oZ.

Ok what we are going to do has to be done from Safe Mode all of it

Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qjlwl.dll/sp.html#14044

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {E28302FE-B381-7680-D448-064B3F4763EE} - C:\WINDOWS\sdkaq32.dll

O4 - HKLM\..\Run: [sysmo.exe] C:\WINDOWS\system32\sysmo.exe
O4 - HKLM\..\RunOnce: [d3gc.exe] C:\WINDOWS\system32\d3gc.exe
O4 - HKLM\..\RunOnce: [javapc32.exe] C:\WINDOWS\system32\javapc32.exe
O4 - HKLM\..\RunOnce: [javajo.exe] C:\WINDOWS\javajo.exe
O4 - HKLM\..\RunOnce: [sdkyj32.exe] C:\WINDOWS\system32\sdkyj32.exe
O4 - HKLM\..\RunOnce: [apilj32.exe] C:\WINDOWS\system32\apilj32.exe
O4 - HKLM\..\RunOnce: [javajy32.exe] C:\WINDOWS\system32\javajy32.exe
O4 - HKLM\..\RunOnce: [atlpb32.exe] C:\WINDOWS\system32\atlpb32.exe
O4 - HKLM\..\RunOnce: [sdknq.exe] C:\WINDOWS\sdknq.exe
O4 - HKLM\..\RunOnce: [ntqi32.exe] C:\WINDOWS\ntqi32.exe
O4 - HKLM\..\RunOnce: [mfciy32.exe] C:\WINDOWS\mfciy32.exe
O4 - HKLM\..\RunOnce: [netrm32.exe] C:\WINDOWS\netrm32.exe
O4 - HKLM\..\RunOnce: [appww.exe] C:\WINDOWS\appww.exe
O4 - HKLM\..\RunOnce: [ntnx.exe] C:\WINDOWS\system32\ntnx.exe
O4 - HKLM\..\RunOnce: [javaqv.exe] C:\WINDOWS\system32\javaqv.exe
O4 - HKLM\..\RunOnce: [atlnt.exe] C:\WINDOWS\atlnt.exe
O4 - HKLM\..\RunOnce: [mfcvb.exe] C:\WINDOWS\mfcvb.exe
O4 - HKLM\..\RunOnce: [crtu.exe] C:\WINDOWS\system32\crtu.exe
O4 - HKLM\..\RunOnce: [iegf32.exe] C:\WINDOWS\system32\iegf32.exe
O4 - HKLM\..\RunOnce: [atlni.exe] C:\WINDOWS\system32\atlni.exe
O4 - HKLM\..\RunOnce: [wingf.exe] C:\WINDOWS\wingf.exe
O4 - HKLM\..\RunOnce: [ntyh32.exe] C:\WINDOWS\ntyh32.exe

O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\d3gc.exe" /s (file missing)

Make sure you can view hidden and system files: Instructions here

Then Boot to safe mode: Instructions here

Delete the following files\folders IF still present:

C:\WINDOWS\ntyh32.exe << This file
C:\WINDOWS\wingf.exe << This file
C:\WINDOWS\system32\atlni.exe << This file
C:\WINDOWS\system32\iegf32.exe << This file
C:\WINDOWS\system32\crtu.exe << This file
C:\WINDOWS\mfcvb.exe << This file
C:\WINDOWS\atlnt.exe << This file
C:\WINDOWS\system32\javaqv.exe << This file
C:\WINDOWS\system32\ntnx.exe << This file
C:\WINDOWS\appww.exe << This file
C:\WINDOWS\netrm32.exe << This file
C:\WINDOWS\mfciy32.exe << This file
C:\WINDOWS\ntqi32.exe << This file
C:\WINDOWS\sdknq.exe << This file
C:\WINDOWS\system32\atlpb32.exe << This file
C:\WINDOWS\system32\javajy32.exe << This file
C:\WINDOWS\system32\apilj32.exe << This file
C:\WINDOWS\system32\sdkyj32.exe << This file
C:\WINDOWS\javajo.exe << This file
C:\WINDOWS\system32\javapc32.exe << This file
C:\WINDOWS\system32\d3gc.exe << This file
C:\WINDOWS\sdkaq32.dll << This file

Now just so you know sometimes this can be fixed in one shot
but can take up to 3 or 4 times so take your time & go step by step

once you do the above reboot show us new logfile

HGD

Thank you HJthis

Hey,oZ.



HGD

Heres my new log

Logfile of HijackThis v1.99.1
Scan saved at 4:39:11 PM, on 5/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\sysmo.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hzbpm.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {11D7CE2C-3C7E-172D-9EE7-2407FBE0C0CF} - C:\WINDOWS\system32\sdkmr.dll
O2 - BHO: Class - {9854654D-8F9B-F8C9-3987-B48E58C9568D} - C:\WINDOWS\system32\ipqg32.dll
O2 - BHO: Class - {BE14A955-DD6C-A165-6A81-393FF536A2E2} - C:\WINDOWS\system32\ntar.dll
O2 - BHO: Class - {E28302FE-B381-7680-D448-064B3F4763EE} - C:\WINDOWS\sdkaq32.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\SOYO\HW Monitor\Itesmart.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [sysmo.exe] C:\WINDOWS\system32\sysmo.exe
O4 - HKLM\..\RunOnce: [ietv32.exe] C:\WINDOWS\system32\ietv32.exe
O4 - HKLM\..\RunOnce: [addjx.exe] C:\WINDOWS\system32\addjx.exe
O4 - HKLM\..\RunOnce: [nthq.exe] C:\WINDOWS\system32\nthq.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1115863062187
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\d3gc.exe" /s (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

and thnx for all your help already

Hi,oZ.

Ok this one wants to play games with us i have something
that should work but it is long as hell so can i E-Mail you
the info please if so lit me know by PM do not post

your E-Mail here again lit me know i will be more
then happy to send you the info

HGD