Spyware infestation

sjt269 · 28 Apr 2007 at 15:07

While I'm in this part of the forum, I might as well try to get this stuff fixed as well...

Anyway, for the past few weeks, my PC has been horribly clogged with spyware. Not entirely sure how it got on, though I have my suspicions about a downloaded .exe file that wasn't what it was meant to be (and it wasn't anything dodgy either, it was a recording program app). So, I keep getting popups asking me if I'm in debt, need a loan, or telling me I'm infected with spyware. No kidding!

So, spyware scans almost always show up positive for trojans, tracking cookies and other nasties, but I can't get rid of them. When I tell my spyware programs to 'fix selected problems', they do it. But the problems reappear pretty quickly. Also, AVG periodically pops up to tell me it's discovered a trojan or two.

So far, I've used Ad-Aware SE, Spybot S&D, AVG, and a squared. They each show up with different types of spyware, and none of them can definitively get rid of it. I don't want to have to reformat the PC, so what else can I do? System restore is turned off, since I heard something about how trojans etc can 'hide' in there without being detected.

Thanks
tTz

sjt269 · 28 Apr 2007 at 15:11

Damn. I was really hoping I wouldn't have to do that.

:edit:

Also, explorer.exe is behaving really strangely, and it's been doing it since the start of the spyware problem. I'm maybe just being paranoid though, I dunno.

sjt269 · 28 Apr 2007 at 15:18

Just a thought, but as most of the popups are via IE, and I use Firefox, could I just uninstall IE to get rid of them? I know its not a full solution (I'm petrified of going anywhere near my online banking details atm on this PC in case any logins get stolen) but it could be a start.

:edit:

Funnily enough, smitfraud is one of the persistent ones. I don't have names for the others though.

sjt269 · 28 Apr 2007 at 15:30

I've got HijackThis, I just don't know what I'm looking for. Tried an online analyser thing, but it didn't work.

Checking the other stuff now...

sjt269 · 28 Apr 2007 at 15:37

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 15:35:11, on 28/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\uCheat\uCheat-1.6.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Photoshop Elements\PhotoshopElements.exe
C:\Program Files\Common Files\Adobe\Web\AOM.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Documents and Settings\Steven\My Documents\My Downloads\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Trellian BHO Impl - {24180B00-2EB6-11d7-BD6F-004854603DCE} - C:\Program Files\TRELLIAN\Toolbar\toolbar.dll (file missing)
O2 - BHO: (no name) - {49B9430B-A360-41FB-82F1-96269C5C7FE1} - C:\WINDOWS\system32\jandyxha.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6148028B-D532-4417-8C0B-5A4A0B745393} - C:\WINDOWS\system32\ljjkkjh.dll
O2 - BHO: (no name) - {6F1EB372-4EAF-47EC-80B6-7F98A917D5B0} - C:\WINDOWS\system32\ssqrp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\otcdcnln.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\system32\nyknfboq.dll",realset
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uCheat\uCheat-1.6.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140383823342
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140383813889
O17 - HKLM\System\CCS\Services\Tcpip\..\{18A2ACBA-25B0-4B9A-B990-3740361B79A5}: NameServer = 192.168.0.1
O20 - Winlogon Notify: ljjkkjh - C:\WINDOWS\SYSTEM32\ljjkkjh.dll
O20 - Winlogon Notify: ssqrp - C:\WINDOWS\system32\ssqrp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6745 bytes

That's the log. Gibberish to me, but maybe someone out there can understand it.

sjt269 · 28 Apr 2007 at 15:38

hp7909 said:
http://hijackthis.de/

Funnily enough, that was the one I used last time, and even funnier, this time it worked. And right enough, there be malware lurking in my PC.

sjt269 · 28 Apr 2007 at 15:45

As far as I know:

uCheat is a torrent program

Trellian toolbar is a part of an HTML editor I had installed, but have now uninstalled. Funnily enough, that's something that comes up in spyware scans quite often. I thought I'd got rid of it though.

About the .dll files, how do I get rid of them? Is it as simple as navigating to the folder and deleting them?

As for AVG and NOD, no idea. Must've installed NOD a while back and forgot about it.

sjt269 · 28 Apr 2007 at 15:50

Great, I'll have a look.

I *think* uCheat is a modded version of uTorrent (it was recommended by a mate on another forum who's used it for ages), though what exactly the mods are, I've no idea...I might get rid of that and just use plain old uTorrent again.

I'll let you know how the rest goes on. Thanks!

sjt269 · 28 Apr 2007 at 17:00

I got rid of one of the .dll files (got an error on startup about it too) but two of them don't want to leave, and one of them doesn't appear to exist. :confused:

If I unlock winlogon.exe then the PC restarts, and I need to unlock that to be able to delete the two visible .dll files...as for the other one, I'm presuming it's hidden itself.

sjt269 · 28 Apr 2007 at 17:02

That's what I'm about to do. The system had just restarted when I made that post, and I hadn't gotten the search started yet.

sjt269 · 28 Apr 2007 at 17:26

System restore is already off, but I might try restarting the system in safe mode. I must admit, I'm not entirely sure how to do that (on purpose) but I'll find a way.

sjt269 · 28 Apr 2007 at 17:32

My major problem with that is that I can't get my data backed up...why, you might ask? Because my DVD burner doesn't bloody work either!

Plus, with the nightmare I'm having installing Windows on my brother's PC atm (please take a look at my other thread, anyone who knows about these things) I really don't want to reinstall Windows unless I have to.

sjt269 · 28 Apr 2007 at 22:14

Safe mode scans found a few spyware programs etc, but going back to normal mode just invites the popups right back again.

MarcLister said:
Do you have another hard disk in your PC? If so, just copy all your data to that disk and don't format that particular disk if/when you format. Or just make a new partition on your disk, if you've only one, and label it D: or something and just format the C:\ partition.

I don't have another hard disk, but I might be able to lay my hands on one, come to think of it...there might be an old, unformatted 10Gb one lying in one of my cupboards. Dunno if it still works or not.

michael baxter said:
Are you short of drive space?

As a matter of fact, yes.

I'm not sure if it's worth the effort tbh...I can find other PCs for online banking stuff, and popups are annoying, but not really crippling...the thing is, there is a lot of stuff I don't want to lose, and I don't really have the time to back it all up, format, reinstall and then get all my data back. Maybe in a few weeks, but I'm really busy right now. I was planning on getting another PC in a few months too, but that's a bit too long to live under the shadow of spyware.

sjt269 · 29 Apr 2007 at 15:11

Right, what I think I'm going to do is buy a new hard drive. I'll get a £30-ish drive, copy all my valuable data onto it, reformat the existing drive, copy all the data back, then I'll have 2 hard drives worth of space, plus when/if I get a new PC later in the year, I can do the same thing so that I don't lose any data (and might end up with 3 hard drives, who knows?).

Gets rid of spyware, saves the important files, gives me extra storage space, and speeds up Windows...win-win situation. I hope.

Thanks for the help, guys. It's a shame that it's had to come to a reformat, but I'm sure it could have been worse.

sjt269 · 29 Apr 2007 at 15:14

I think I'd be just as well keeping it internal, to be honest. I doubt I'd ever really need to use an external hard drive. It's worth a thought, I suppose.

sjt269 · 29 Apr 2007 at 15:19

Well I'm really hoping that situations like this will never arise again, but I take your point. My USB is only 1.1 just now, so I'd have to buy an add-in card as well (not that that's an insurmountable obstacle; just an extra £10 or so).

sjt269 · 1 May 2007 at 16:19

Richdog said:
Also, download and install AOL Activevirus shied frm here http://www.activevirusshield.com/antivirus/freeav/index.adp? and then uninstall existing AV software and install that one. It's basically Kaspersky 6 for free, and it's the best for detection and cleaning.

It worked! :eek:

It got rid of all the .dll files I've been fighting with, and so far (only had the PC on for 30 minutes) I've not had any popups...

HiJack this log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:16:43, on 01/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\AOL\Active Virus Shield\avp.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Steven\My Documents\My Downloads\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - (no file)
O2 - BHO: (no name) - {24180B00-2EB6-11d7-BD6F-004854603DCE} - (no file)
O2 - BHO: (no name) - {31917F9D-39AD-498E-8969-236DC820334C} - (no file)
O2 - BHO: (no name) - {49B9430B-A360-41FB-82F1-96269C5C7FE1} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6148028B-D532-4417-8C0B-5A4A0B745393} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - (no file)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [aol] "C:\Program Files\AOL\Active Virus Shield\avp.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140383823342
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140383813889
O17 - HKLM\System\CCS\Services\Tcpip\..\{18A2ACBA-25B0-4B9A-B990-3740361B79A5}: NameServer = 192.168.0.1
O20 - Winlogon Notify: ljjkkjh - ljjkkjh.dll (file missing)
O20 - Winlogon Notify: ssqrp - C:\WINDOWS\system32\ssqrp.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Active Virus Shield (AVP) - AOL - C:\Program Files\AOL\Active Virus Shield\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 5844 bytes

As you can see (if you put it into hijackthis.de) there are some 'unncessary' entries in there, which I presume is a result of me deleting anything vaguely looking like spyware instead of healing it...I dunno if I desperately need to replace the files or anything, but the PC seems to be working fine, with no popups or anything.

Thanks a lot, to everyone who's been helping

sjt269 · 1 May 2007 at 16:48

Done. The system is looking good, and I'm installing that other program right now. You've saved me £30 on a new hard drive, and a lot of time reformatting. Thanks.