some help for another hijack-this log

[outcold]

I need to get rid of Aurora and I have followed all of the instructions untill the hijack this part. I have the log file but I cannot interpret what to delete and what to keep. Plz help me. The log file is pasted below

Logfile of HijackThis v1.99.1

Scan saved at 12:14:44 PM, on 6/20/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\explorer.exe

C:\DOCUME~1\Kurt\LOCALS~1\Temp\Temporary Directory 1 for hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\mfplay.dll/sp.html (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R3 - URLSearchHook: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\system32\toolbar.dll

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O1 - Hosts: 127.0.0.0 localhost

O1 - Hosts: 127.0.0.2 auditmypc.com

O1 - Hosts: 127.0.0.3 boards.cexx.org

O1 - Hosts: 127.0.0.4 bulletproofsoft.net

O1 - Hosts: 127.0.0.5 camtech2000.net

O1 - Hosts: 127.0.0.6 cexx.org

O1 - Hosts: 127.0.0.7 computercops.us

O1 - Hosts: 127.0.0.8 ct7support.com

O1 - Hosts: 127.0.0.9 doxdesk.com

O1 - Hosts: 127.0.0.20 kellys-korner-xp.com

O1 - Hosts: 127.0.0.21 kephyr.com

O1 - Hosts: 127.0.0.22 lavasoft.de

O1 - Hosts: 127.0.0.23 lavasoftusa.com

O1 - Hosts: 127.0.0.24 lurkhere.com

O1 - Hosts: 127.0.0.25 majorgeeks.com

O1 - Hosts: 127.0.0.26 merijn.org

O1 - Hosts: 127.0.0.27 mjc1.com

O1 - Hosts: 127.0.0.28 moosoft.com

O1 - Hosts: 127.0.0.29 mvps.org

O1 - Hosts: 127.0.0.30 net-integration.net

O1 - Hosts: 127.0.0.31 noadware.net

O1 - Hosts: 127.0.0.32 no-spybot.com

O1 - Hosts: 127.0.0.33 onlinepcfix.com

O1 - Hosts: 127.0.0.34 pchell.com

O1 - Hosts: 127.0.0.35 pestpatrol.com

O1 - Hosts: 127.0.0.36 safer-networking.org

O1 - Hosts: 127.0.0.37 secure.spykiller.com

O1 - Hosts: 127.0.0.38 secureie.com

O1 - Hosts: 127.0.0.39 security.kolla.de

O1 - Hosts: 127.0.0.40 spybot.info

O1 - Hosts: 127.0.0.41 spychecker.com

O1 - Hosts: 127.0.0.42 spychecker.com

O1 - Hosts: 127.0.0.43 spycop.com

O1 - Hosts: 127.0.0.44 spyguard.com

O1 - Hosts: 127.0.0.45 spykiller.com

O1 - Hosts: 127.0.0.46 spyware.co.uk

O1 - Hosts: 127.0.0.47 spyware-cop.com

O1 - Hosts: 127.0.0.48 spywareinfo.com

O1 - Hosts: 127.0.0.49 spywarenuker.com

O1 - Hosts: 127.0.0.50 spywareremove.com

O1 - Hosts: 127.0.0.51 spywareremove.com

O1 - Hosts: 127.0.0.52 stopzillapro.com

O1 - Hosts: 127.0.0.53 sunbelt-software.com

O1 - Hosts: 127.0.0.54 thiefware.com

O1 - Hosts: 127.0.0.55 tomcoyote.org

O1 - Hosts: 127.0.0.56 unwantedlinks.com

O1 - Hosts: 127.0.0.57 webattack.com

O1 - Hosts: 127.0.0.58 wilders.org

O1 - Hosts: 127.0.0.59 www.auditmypc.com

O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net

O1 - Hosts: 127.0.0.61 www.cexx.org

O1 - Hosts: 127.0.0.62 www.computercops.us

O1 - Hosts: 127.0.0.63 www.ct7support.com

O1 - Hosts: 127.0.0.64 www.doxdesk.com

O1 - Hosts: 127.0.0.65 www.eblocs.com

O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com

O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com

O1 - Hosts: 127.0.0.68 www.free-web-browsers.com

O1 - Hosts: 127.0.0.69 www.grc.com

O1 - Hosts: 127.0.0.70 www.grisoft.com

O1 - Hosts: 127.0.0.71 www.hackfaq.org

O1 - Hosts: 127.0.0.72 www.hazeleger.net

O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com

O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com

O1 - Hosts: 127.0.0.75 www.kephyr.com

O1 - Hosts: 127.0.0.76 www.lavasoft.de

O1 - Hosts: 127.0.0.77 www.lavasoftusa.com

O1 - Hosts: 127.0.0.78 www.lurkhere.com

O1 - Hosts: 127.0.0.79 www.majorgeeks.com

O1 - Hosts: 127.0.0.80 www.merijn.org

O1 - Hosts: 127.0.0.81 www.mjc1.com

O1 - Hosts: 127.0.0.82 www.moosoft.com

O1 - Hosts: 127.0.0.83 www.mvps.org

O1 - Hosts: 127.0.0.84 www.net-integration.net

O1 - Hosts: 127.0.0.85 www.noadware.net

O1 - Hosts: 127.0.0.86 www.no-spybot.com

O1 - Hosts: 127.0.0.87 www.onlinepcfix.com

O1 - Hosts: 127.0.0.88 www.pchell.com

O1 - Hosts: 127.0.0.89 www.pestpatrol.com

O1 - Hosts: 127.0.0.90 www.safer-networking.org

O1 - Hosts: 127.0.0.91 www.secureie.com

O1 - Hosts: 127.0.0.92 www.security.kolla.de

O1 - Hosts: 127.0.0.93 www.spybot.info

O1 - Hosts: 127.0.0.94 www.spychecker.com

O1 - Hosts: 127.0.0.95 www.spychecker.com

O1 - Hosts: 127.0.0.96 www.spycop.com

O1 - Hosts: 127.0.0.97 www.spyguard.com

O1 - Hosts: 127.0.0.98 www.spykiller.com

O1 - Hosts: 127.0.0.99 www.spyware.co.uk

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)

O2 - BHO: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\system32\toolbar.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll

O2 - BHO: (no name) - {302A3240-4805-4a34-97D7-1645A0B08410} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: FlashEnhancer Ext - {5EDB03AF-0341-4e96-9E9B-3171522E4BAF} - c:\Program Files\Fla\fla.dll

O2 - BHO: BRedObj Class - {63CF97E8-4133-438a-A831-CC9C6D47D673} - c:\Program Files\Reg2\Reg2.dll (file missing)

O2 - BHO: BRedObj Class - {7371F073-AC0F-4b80-BB2F-96A488CEFB32} - c:\Program Files\Xmod\xm320.dll (file missing)

O2 - BHO: (no name) - {85CBFDE0-B26B-4EE5-BD3C-4DE111DE763E} - C:\WINDOWS\System32\winnet.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS\system32\toolbar.dll

O3 - Toolbar: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr_.exe

O4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [WUSB54Gv2] C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\InvokeSvc3.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe

O4 - HKLM\..\Run: [wqmPKJ] C:\WINDOWS\oaeksbul.exe

O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\Pwsbyo.exe

O4 - HKLM\..\Run: [secure] C:\WINDOWS\system32\Afrtxy.exe

O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"

O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"

O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

O4 - HKLM\..\Run: [iST Service] C:\Program Files\ISTsvc\istsvc.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [bdqgse] c:\windows\system32\wscnwq.exe

O4 - HKCU\..\Run: [steam] "c:\valve\steam\steam.exe" -silent

O4 - HKCU\..\Run: [spyware Begone] C:\freescan\freescan.exe -FastScan

O4 - HKCU\..\Run: [spywareKilla] "C:\PROGRA~1\SPYWAR~1\SpywareKilla.exe" /s

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [wruw] C:\PROGRA~1\COMMON~1\wruw\wruwm.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\system32\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} (iSearch Toolbar) - file://C:\install.cab

O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...90/mcinsctl.cab

O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildtangent.com/bgn/partner...lim/install.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab

O16 - DPF: {FDDCE9FE-1FC6-413C-80B1-37B101FDA1D4} (ShellInstaller Control) - http://download.buddylinks.net/ShellInstallerRaptor.cab

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: WUSB54Gv2SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv2.exe (file missing)

[dman]

Aurora is associated with "NAIL.EXE". Believe it or not, as pernicious as this software is, the company behind it actually offers an uninstaller. If only they would avertise that in their popups!

http://www.mypctuneup.com/

[outcold]

thanks dman. Now I only have regular (but less frequent) pop ups.

[dman]

re run ad-aware, spybot s&d and AV and then post your hijackthis log again. you probably still have crumbs.

Edited June 21, 2005 by dman

[Tarun]

That computer is infected with CoolWebSearch, Aurora, and several other nasty variants.

Download Anti-Malware Package and install all of these. Update them all then boot into Safe Mode (F8 before the Windows splash). Then run CWShredder, MSAS, Ad-Aware, Spybot.

THEN you should repost your log.