Help Joe Knecht!!! Techies Needed!

[Joe Knecht]

Sorry to burden everyone with my computer related ignorance but I am in a bind. NOTES: (1) Running Winoows XP Home (2)was browsing Internet Explorer, now Mozilla Firefox (3) installed spybot and adaware, both not properly destroying virus, malware, popup whatever ya wanna call it (4) Im on a network with no firewall(I know...) and will not mess with the ports. I need super intelligence here!!!(Monks and their wisdom haha.) Did a Hijackthis run and found the following files/information:

Logfile of HijackThis v1.99.0
Scan saved at 10:26:27 PM, on 1/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\msupd5.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\SPOOL\DRIVERS\W32X86\3\DLBKPSWX.EXE
C:\WINDOWS\System32\SPOOL\DRIVERS\W32X86\3\DLBKJSWX.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\NETGEAR\WG311TSU\Utility\Gear311T.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\documents and settings\brian\local settings\temp\QXUOv.exe
C:\windows\system32\RIi.exe
C:\windows\system32\KDgn.exe
C:\WINDOWS\System32\ACLUI976.exe
C:\Program Files\SED\SED.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
C:\WINDOWS\System32\vmss\vmss.exe
C:\windows\system32\saie.exe
C:\Program Files\CSBB\CSv10P070.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\xlelpez.exe
C:\Program Files\GogoTools\Gogoware\GogoLaunch.exe
C:\PROGRA~1\GOGOTO~1\Gogoware\GOGOTO~1.EXE
C:\WINDOWS\System32\polathlp.exe
C:\WINDOWS\SYSTEM32\KDgn.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\WINDOWS\System32\n?tepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\phomontr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Brian\Application Data\ctrt.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\WINDOWS\System32\Fqc3S.exe
C:\WINDOWS\System32\IcswrR5V.exe
C:\Documents and Settings\Brian\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {3D2F0A41-67DE-9BA4-1CC1-90066D5693BB} - C:\WINDOWS\System32\glcjoxwd.dll
O2 - BHO: (no name) - {74E4A57F-E7AD-7E0B-6044-2E2E5327F908} - C:\WINDOWS\System32\smievyko.dll
O2 - BHO: (no name) - {75AB45D7-8858-2C6D-A5B5-A16B705E76C4} - C:\WINDOWS\System32\spfsmoyv.dll
O2 - BHO: (no name) - {B8D1306D-6A5A-9355-ED51-7D21792D8561} - C:\WINDOWS\System32\aabostjj.dll
O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\Program Files\eSyndicate\esyn.dll
O2 - BHO: CSearchHelpIEExtension Object - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Program Files\Middadle\Clicks10017.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Common Files\Symantec Shared\cfgwiz.exe /GUID NIS /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AS00_Gear311T] C:\Program Files\NETGEAR\WG311TSU\Utility\Gear311T.exe -hide
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QXUOv] C:\documents and settings\brian\local settings\temp\QXUOv.exe
O4 - HKLM\..\Run: [RIi] C:\windows\system32\RIi.exe
O4 - HKLM\..\Run: [KDgn.exe] c:\windows\system32\KDgn.exe
O4 - HKLM\..\Run: [2d6bb71fe99d] C:\WINDOWS\System32\ACLUI976.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Lykopex.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe
O4 - HKLM\..\Run: [saie] c:\windows\system32\saie.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [laxax] C:\WINDOWS\laxax.exe
O4 - HKLM\..\Run: [bfihobov] C:\WINDOWS\System32\xlelpez.exe
O4 - HKLM\..\Run: [diqkyc] C:\WINDOWS\System32\diqkyc.exe
O4 - HKLM\..\Run: [r39h34R] polathlp.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [5NBCRTM2AQJZ7#] C:\WINDOWS\System32\LkhAX92.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Brian\Application Data\eetu.exe
O4 - HKCU\..\Run: [Ifovrbh] C:\WINDOWS\System32\n?tepad.exe
O4 - HKCU\..\Run: [SYSfit] C:\WINDOWS\SYSfit.exe
O4 - HKCU\..\Run: [a0qnRQdmh] phomontr.exe
O4 - HKCU\..\Run: [Isuf] C:\WINDOWS\System32\r?gedit.exe
O4 - HKCU\..\Run: [Aasa] C:\Documents and Settings\Brian\Application Data\ctrt.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - bannerfarm.ace.advertising.com/bannerfarm/47041/WrapperOuter1154041105.EXE
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - www.errorguard.com/installation/Install.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - static.topconverting.com/activex/loader2.ocx
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - download.websearch.com/Dnl/T_50223/QDow_AS2.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - download.overpro.com/WildApp.cab
O18 - Filter: text/html - {DFAA31C8-A356-4313-9D95-5EDAB46C5070} - C:\WINDOWS\System32\lmf32v.dll
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Miscrosoft Updates Service 5 - Unknown - C:\WINDOWS\System32\msupd5.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

I know you loving people do this for a living. I can pay you if needed through Paypal or in game help(i.e. rez/item trade/popping chests/commisions to write poems/back rubs?? etc..) E-Mail is: [e-mail] Brian Fleckenstein is my name and I don't care who knows!

O' yeah ummm more monk gloves!!!
Drunk Monks Rule!

[planetary04]

Hey Joe,

Do you know about system restore points in WinXP?

Go to start/programs/accessories/system tools and open system restore.

It creates backup copies of your registry when you make modifcations to your system. I believe it also makes regular 'maintenance' ones too.

The utility has a calendar, and dates that have restore points will be in bold.

See if you can find a restore point before the problems you have started and restore to it.

Then run adaware and spybot s&d again.

Please note, you may need to reinstall any software that was installed after the restore point you restored to. knowwhadimean?

Also, check out updating your av software to the newest symantec av as it seems to do a pretty good job of blocking spyware from installing.

MS also has a new anti spyware utility but i havent tried it out yet.

Lemme know how you go,

Fu, the 1/2 orc monk tech