Adware Spotreasults And Loadingwebsite Problem !

Dear All,

Im New In This Forum , I Need Some Help With Spot reasults And LoadingWebsite. And Some Icons That Keep Appearing In My DeskTop , If You Need My Log its under. I Have Installed plvx2cleaner But I Wish You Can Guide Me Through The Steps. Thank You

Logfile of HijackThis v1.99.1
Scan saved at 4:50:09 AM, on 5/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
c:\windows\system32\segein.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Sam AbuL\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [qsjrkqi] c:\windows\system32\segein.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...amp;clcid=0x409
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c...DC_1_0_0_44.cab
O16 - DPF: {5AA5A569-F96F-4628-A528-8B3698F558BB} (HS_live Control) - http://install.homestead.com/~site/...ive/HS_live.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1103928608874
O16 - DPF: {77AAD261-A84E-4564-BEC2-C51FF6A7187F} (MRActivXUI Class) - http://66.35.195.125/webcomp/ver6.1.2.0/wbaxuiph612.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensavers.com/dm/insta.../sinstaller.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...pDownloader.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/BM2/BM2.dll
O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\j8p0li7m18.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe






Truly I Need To Fix This Experts

Thank You So Much

And Now There Is A New AD By Clicksor , Says Ads By PopPayup.

I Really Dont Know Where Are Those Anoying Ads Coming From ! .

Made Me Real Insane Some Damaged My Games And I Really Dont Want To Format my PC.

Please Help Me With That Issue.

Thank You.

And There A Strange Thing Going On.....

Sometimes My Computer Restarts Automatically, then the error i get after it restarts, is from WINLOGIN ?

What does that have to do with it ?

And My Computer Is Not Letting Me Enter Safe Mode. I Tried Clicking F8 And F5 but Its Not Working? :confused:

thanks

start here:

http://hijackthis.de/index.php?langselect=english

Hi Sam, Welcom to this forum.

First of all you need to do is turn of "system Restore" as you migth have a virus as well which now also resides in the "system restore" (if enabled offcourse) ... To do this --> right click "my computer" click on the tab "system restore" and enable "Turn off System Restore on all drives" ... after this empty all your "temp" and "Temporary Internet Files" folders and do a complete scan with your antivirus ( all this if possible in Safe Mode , but because this seams not possible at the moment try it in "online" mode) ...Check if your antivirus is still up to date before you scan.

After the antivirus scan do a complete checkup with antispyware/malware tools like adaware , seek and destroy and so on... also try the Antispyware (Beta) from Microsoft (it's actually not that bad) Link...

For more info regarding cleaning your pc to get rid of spyware and sorts take a look at these articles created by Antionline specialists...

HijackThis Usage
Another HijackThis article
Adaware spyware removal
Another Malware spyware removal article
And there are plenty more ..just do a search on this forum and you will find some nice tutorials but these should get you on your way.
If after or during these operations you still have problems don't hesitate to ask , but first try these things because that's what everyone will tell you to do anyway.

And if you need a special tool to get rid of some pests try to google the name of the pest and you'll probably wont be far
away from a good cleaning tool.

Ch33rzz,

C.

Watch those LSPs...removing them can really muck up your system...

This thread talks about how to fix after removing them

http://www.antionline.com/showthread...969#post835969

MLF

Thank You All FOr Your Replys ,

I Did The Log File In http://hijackthis.de/index.php?langselect=english

and had my reasults and i think alot were nasty files. now how can i delete them or how can i fix this?

thank you

Im Doing The Search And Destroy Check Now , But Not In Safe Mode , Normaly. Because I Dunno Why My Computer Doesnt Let Me Enter Safe Mode. But Im Doing The The Search And Destroy At The Moment.

Reboot the system and push either F5 or F8 before the OS starts up; you'll get into boot up menu...

if it won't work the first time ... keep pushing the keys repeatedly UNTILL YOU GET IT.

Needless to say it's important to do it in safe mode.

As has already been mentioned, turn off system restore. Here's a tutorial I wrote to help you clean your mess up:

http://www.antionline.com/showthread...hreadid=267907

q8_sam:

Just a little word of advice for this site, instead of making mulitple, little posts, go back and edit and add on to a previous post. I'm just letting you know this because there are some here that will jump on you for making numerous posts that aren't saying too much. You're new here, I know, but I'm just letting you know this to keep others off your back who might not care whether you are new or not.

Anyway, what OS are you using, anyway? If you are using XP, and can't get into safe mode by pressing F5 or F8 (I know how frustrating it can be to try to get in that way, trust me), when your box boots up and it holds on the "Windows XP" logo, press and hold the power off button until your computer shuts off, then power back up. When your computer powers back up you should be taken to a screen that give you the option "Safe Mode" among a couple other options. Select safe mode by using the arrow up/down keys and press enter. Scan. When you want to get out of safe mode, just simply restart.

I know, I know, killing the power like that probably isn't the best thing for your box, but if it wasn't for someone cluing me in on that, I would probably still be here to this day restarting and pressing F8.

But I suggest posting your HighjackThis files here, as you posted your previous log, and have someone with some expertise take a look at it and tell you what you do or do not need to remove. As is stated here quite frequently when this sort of thing comes up, you can do serious damage by deleting the wrong item. And I have used other sites, such as Help2Go, crossing it with another similiar site, to determine what I needed to remove, and have gotten mixed results from both. So it's best to post the log here and someone will give you the correct information of what to remove.