Cant Run And Install certain programs

I cant run and install this program we use here at work im including the hijack this log to see if anyone can help me. Whenever I try to run the program or setup file on this specific computer it pops up then immediately closes.

Logfile of HijackThis v1.99.1
Scan saved at 1:43:00 PM, on 11/7/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.EXE
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\NavNT\vptray.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\System32\macromed\flash\GetFlash.exe
C:\Documents and Settings\administrator.SPIFLOORS\My Documents\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.popupsearches.com/sidesearch.html
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINNT\System32\msconfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\calsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1131387048070
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = spifloors.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{63537994-43F9-4CCB-9962-0CE3DF589C77}: NameServer = 201.1.6.7
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = spifloors.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = spifloors.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Backup Exec Remote Agent for Windows NT/2000 (BackupExecAgentAccelerator) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Cintech StatusServer (StatusServer) - Cintech LLC - C:\Program Files\Cintech\Status Display\PROGRAM\StatusServer.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe


thanks ahead of time for any help.

Hi and welcome to DAL,


Download and Unzip the LSP tool from

here:
http://www.snapfiles.com/get/lspfix.html
or here:
http://www.cexx.org/LSPFix.exe

CLOSE the internet connection and any programs that show in the taskbar, start the tool, check the box that says I know what I am doing, Check all instances of (and only those) of "calsp.dll" move it/them to the remove window, click finish. Close the tool.

Now restart your computer, and delete
c:\windows\system32\calsp.dll--< file in system32 folder


Reboot and post a new HJT log please.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

I tried but that didnt work, I can install any other program but this specific one is not working, I can install this program on other computers fine its a little frustrating.

Post a new HJT log there is more to do that was just the first step.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

oh my bad... I will get a new one up soon, when I get a chance to get on that computer

ok guys here it is...
might I add that u guys rock.

Logfile of HijackThis v1.99.1
Scan saved at 3:09:39 PM, on 11/8/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NavNT\rtvscan.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\dmi\win32\bin\Win32sl.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe C:\Program Files\NavNT\vptray.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Microsoft Office\Office10\msoffice.exe C:\Program Files\Cintech\Status Display\PROGRAM\SDContrl.exe C:\WINNT\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINNT\system32\ntvdm.exe C:\Program Files\Windows NT\HYPERTRM.EXE C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE C:\Documents and Settings\administrator.SPIFLOORS\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.popupsearches.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.flowgo.com/rsubf.cfm?id=f...613&d=05-26-02
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\pyqqic.exe reg_run O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file) O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1131387048070
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = spifloors.com O17 - HKLM\System\CCS\Services\Tcpip\..\{63537994-43F9-4CCB-9962-0CE3DF589C77}: NameServer = 201.1.6.7 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = spifloors.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = spifloors.com O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Backup Exec Remote Agent for Windows NT/2000 (BackupExecAgentAccelerator) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe O23 - Service: Cintech StatusServer (StatusServer) - Cintech LLC - C:\Program Files\Cintech\Status Display\PROGRAM\StatusServer.exe O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe

I have updated to sp4 since the last hjt log as well.

Hello,

Create a new folder in your C: Drive
Name it C:\HJT or HijackThis and move the HijackThis.exe file in it.
It's best for this tool NOT TO be located in your Desktop or in a TEMP folder.
This way you can undo any changes if something goes wrong


Scan with HJT again and put a check next to these items, making sure all browser windows are closed includeing this one so print this or create a new text document on desktop by right clicking an open area select new text document and save it to what ever you like. Now put a check next to these:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.popupsearches.com/sidesearch.html

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.flowgo.com/rsubf.cfm?id=...1613&d=05-26-02---did you install flowgo if no fix this also

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing

Make sure nothing is open but hijackthis and click fix checked

Then this next tool is a Trojan scanner and to get rid of the Trojan you have must be run from safe mode or it will not work.

Safe mode explained below:


reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter. Only after installing the Ewido Program please.



Here is the tool:


Please download, install, update and scan your system with the free version of Ewido trojan scanner: www.ewido.net/en/download/

1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

2. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.

3. From the main ewido screen, click on UPDATE in the left menu, then click the Start update button.

4. After the update finishes (the status bar at the bottom will display "Update successful"), click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run.


5. If ewido finds anything, it will pop up a notification. You can select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.


6. When the scan finishes, click on "Save Report". This will create a text file. Please then paste the contents of the text file to this thread, along with a new HijackThis log.


Make sure you are set to normal startup. Click Start -> Run -> Type Msconfig -> Press Enter -> make sure Startup is set to Normal.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 3:05:44 PM, 11/14/2005
+ Report-Checksum: 18DE5923

+ Scan result:

HKLM\SOFTWARE\AkSoft -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\2-spyware.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\888.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\basic-recipes.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\c.microsoft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\carnival.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\download.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\games.zango.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\go.microsoft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\google.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\heavy.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\hey.lt -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\istudentloan.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\microsoft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\msn.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\pacificpoker.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\rad.microsoft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\s.clkoptimizer.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\safer-networking.org -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\search.msn.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\v4.windowsupdate.mi crosoft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\view.atdmt.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\web.tickle.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Hotsites\windowsupdate.micro soft.com -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\AOL.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\EXPLORER.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\IEXPLORE.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\MOZILLA.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\NETSCP.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\NETSCP6.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\OPERA.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\WAOL.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Support\YBROWSER.EXE -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\.Target -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\a\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\b\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\c\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\d\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\e\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\a -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\b -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\c -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\d -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\e -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\f -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\g -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\h -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\i -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\j -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\k -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\l -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\m -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\n -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\o -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\p -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\q -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\r -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\s -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\t -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\u -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\v -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\w -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\x -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\y -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\z -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\f\[ -> Spyware.AkSoft : Cleaned with backup
HKLM\SOFTWARE\AkSoft\a\g -> Spyware.AkSoft : Cleaned with backup


...it keeps on goin
i think 20500 files ahhhh.
here is the HJT log.
Logfile of HijackThis v1.99.1
Scan saved at 4:25:19 PM, on 11/14/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\Program Files\Cintech\Status Display\PROGRAM\SDContrl.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\Documents and Settings\administrator.SPIFLOORS\My Documents\HJT\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\pyqqic.exe reg_run
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1131387048070
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = spifloors.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{63537994-43F9-4CCB-9962-0CE3DF589C77}: NameServer = 201.1.6.7
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = spifloors.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = spifloors.com
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Backup Exec Remote Agent for Windows NT/2000 (BackupExecAgentAccelerator) - VERITAS Software Corporation - C:\Program Files\VERITAS\Backup Exec\RANT\beremote.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Cintech StatusServer (StatusServer) - Cintech LLC - C:\Program Files\Cintech\Status Display\PROGRAM\StatusServer.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe

thanks again neal, if u need the rest of that first log I could send it to you as a .txt file maybe... my browser kept freezing up when i tried to copy and paste that whole thing.

Hi,

Rescan with hijackthis and put a check next to these:

O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\pyqqic.exe reg_run

O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)

Now make sure everything is closed out exceot HJT and click fix checked

Reboot to safe mode and delete this if found:

C:\WINNT\system32\pyqqic.exe reg_run---reg_run may not be showing when you find it.

reboot normal mode post a new HJT log and feedback on how she is behaving now?

your computer that is.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.