Popups and viruses

[anitadoll]

Hi,
Hoping someone can help me with this. This morning I rebooted after window update and could not log on with my pw that I know is correct. I am using an hp notebook running windows xp media edition. No caps lock was not on. Ran system recovery using backup disks. Ran full system scan with norton. Can up clean. Hours later Norton pops up with detecting Downloader Trojan, followed by Adclicker. Norton said it was deleted, yada yada. Still getting popups galore. Here is hijack this log

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:31:15 PM, on 4/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Anita Dolloway.PC325862970629\Local Settings\Temporary Internet Files\Content.IE5\C9AJ7C1P\HiJackThis_v2[1].exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.optonline.net/Home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {eb176bce-9424-45f4-a053-f3b23d3949ab} - C:\WINDOWS\system32\cmdcls.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: cmdcls - C:\WINDOWS\SYSTEM32\cmdcls.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 8424 bytes

Any help would be most appreciated.
Thankyou,
anitadoll

Here is AVG log

AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 8:00:33 AM 4/5/2007
+ Scan result:

C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@2o7"]dolloway@2o7[/EMAIL][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@aavalue"]dolloway@aavalue[/EMAIL][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@adbrite"]dolloway@adbrite[/EMAIL][2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@adrevolver"]dolloway@adrevolver[/EMAIL][1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@advertising"]dolloway@advertising[/EMAIL][1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@atdmt"]dolloway@atdmt[/EMAIL][2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@casalemedia"]dolloway@casalemedia[/EMAIL][1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@clickbank"]dolloway@clickbank[/EMAIL][2].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@com"]dolloway@com[/EMAIL][1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@cpvfeed"]dolloway@cpvfeed[/EMAIL][2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@doubleclick"]dolloway@doubleclick[/EMAIL][1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@fastclick"]dolloway@fastclick[/EMAIL][2].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@fortunecity"]dolloway@fortunecity[/EMAIL][1].txt -> TrackingCookie.Fortunecity : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@hitbox"]dolloway@hitbox[/EMAIL][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@mediaplex"]dolloway@mediaplex[/EMAIL][1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@overture"]dolloway@overture[/EMAIL][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@questionmarket"]dolloway@questionmarket[/EMAIL][1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@realmedia"]dolloway@realmedia[/EMAIL][2].txt -> TrackingCookie.Realmedia : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@revsci"]dolloway@revsci[/EMAIL][1].txt -> TrackingCookie.Revsci : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail]4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@tacoda"]dolloway@tacoda[/EMAIL][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@targetnet"]dolloway@targetnet[/EMAIL][1].txt -> TrackingCookie.Targetnet : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@tradedoubler"]dolloway@tradedoubler[/EMAIL][1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@trafficmp"]dolloway@trafficmp[/EMAIL][2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@tribalfusion"]dolloway@tribalfusion[/EMAIL][2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][2].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [e-mail][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Anita Dolloway.PC325862970629\Cookies\anita [EMAIL="dolloway@zedo"]dolloway@zedo[/EMAIL][2].txt -> TrackingCookie.Zedo : Cleaned.
C:\RECYCLER\S-1-5-21-2854360671-3503533726-2355952709-1005\Dc10.exe -> Trojan.Small : Cleaned.

::Report end
I am still having problems and norton has now detected drive cleaner virus.
Please help,
Thank you

[TT4Titans]

Have HJT fix these.

O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe

O20 - AppInit_DLLs:

[anitadoll]

thank you, will try

[gerbil]

Heya, titans.. you beat me this time.. could you handle a bit of help with this one? Yeah? Really? Cool... :)
Anita, lessee... AVG left a lot, not to be desired....
==First, dump that hijackthis and get a new one from http://216.180.233.162/~merijn/files/HijackThis.exe
-install it to a new folder alongside your program files and then rename the Hijackthis.exe to imabunny.exe.
==Please download VundoFix.exe to your desktop from http://www.atribune.org/ccount/click.php?id=4
Double-click VundoFix.exe to run it, and click the Scan for Vundo button.
When the scan completes click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files - click YES
Your desktop will then go blank as the process of removing Vundo starts.
When completed it will prompt that it will shutdown your computer - click OK.
Restart your computer.
==Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1 --click in the download window to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Next click Firefox [if you have that browser..] at the top, Select All again, and Empty Selected again. Follow that procedure also if you have Opera.
Close ATF.
[If you wish, save ATF Cleaner to your desktop or a cleaning folder somewhere as it is a fairly useful tool for occasional use.]
==Start HijackThis by dclicking imabunny.exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-Click the Scan Only button and then place checkmarks against all entries below that still exist, and press Fix Checked.

O2 - BHO: (no name) - {eb176bce-9424-45f4-a053-f3b23d3949ab} - C:\WINDOWS\system32\cmdcls.dll
O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O20 - AppInit_DLLs:
O20 - Winlogon Notify: cmdcls - C:\WINDOWS\SYSTEM32\cmdcls.dll

Now press Config buton, Misc Tools tab and press Delete a File on Reboot and in the window which opens paste into the text box the following pathname, press Open and then Yes....

C:\WINDOWS\system32\lsasss.exe

When it restarts run hijackthis again to produce a fresh scan log. Post it and the contents of C:\vundofix.txt.

==Java update!!! This is for security reasons. Go control panel > java > update, & press update now. Restart after installing the update, and then go into control panel again, add/remove pgms and remove all old versions of java. Vsn 1.5.0.11 is current....

[gerbil]

Titans, I'm just wordy...
And Anita, be very careful of the spelling of that file if you type the name instead of doing a copynpaste..... LSASS.exe is a very necessary windows file, LSASSS.exe is the pest.

[crunchie]

Out of curiosity, can you do the following too;

Download the tool below:

http://noahdfear.geekstogo.com/FindAWF.exe

Save the file to your desktop and double click it to start it.

It will scan files on your C: drive and then when finished it will produce a log called awf.txt. Please post that log in your next reply.

[anitadoll]

Thank you for all of your help, unfortunately, my system crashed, and I had to to a full restore, from back up disked. Hope I am clean, now, but downloaded hijack this again, and here is the latest log.

Logfile of HijackThis v1.99.1
Scan saved at 3:42:34 PM, on 4/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Anita\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=80744
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=laptop
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[TT4Titans]

Fix these.

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Another thing you may consider norton used to be good other than being a resource hog.but not that good anymore Switch to McAfee.

[gerbil]

AAAARRRGHHHhhh.....!
I hate reinstalls, esp when I just got me teeth into something....
No laughing, now, Titans!!