Spyware problem

[Orbs]

So I lapsed on re-installing the MS Anti Spyware beta, and even though I use Firefox, I seem to have caught something. I've since updated the antispyware, and it found some of it (I believe) but now it says that there's nothing on my machine, yet I'm still seeing symptoms.

I also tried using HijackThis (and the online analyzer) to remove anything suspicous. I ran the L2mefix because I believed that is what I had, but it failed to solve the problem.

I'm still getting popups (even in FireFox) that resize my browser window, and direct me to sites such as http://www.super-stock.com/normal/yyy53.html, http://e.rn11.com/adbuys/a174-admed-ron and http://incentiverewardcenter.com/rd_p?p=97..._d1f1&a=AFFILID. Also, my hosts file keeps getting over-written with some garbage file. Always the same size, no matter what I do to try and get a lock on the file after I clean/save it.

Any help would be GREATLY appreciated.
Jared

Here's a dump of my log...

Logfile of HijackThis v1.99.1
Scan saved at 5:02:51 AM, on 10/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wnvtmr32.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\taskswitch.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\hphmon03.exe
C:\Program Files\Winnov Videum NT\WvStatus.Exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~2\VPTray.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\wnvirq32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\HPHipm09.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Security\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1125616956019
O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\ir0ql5d51.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: Retrospect Helper - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\rthlpsvc.exe

 

[mgob]

go to microsoft.com download and isntall their anti spyware software (yes M$ made software that works)
use spybot S&D
and Adaware

a combination of those should do the trick

also make sure you run some anti-virus software.

 

[Orbs]

I have tried the MS software but will also try Spy Bot and Adaware. Not too hopeful though, this thing looks like it's good at evading the "scan for everything" tools.

I also run Symantec Antivirus and did a scan in safe mode that found nothing.

Thanks for the advice.

 

[montag451]

Try also, most importantly -
updating all the software in normal mode.
Disabling System Restore.
Doing the scans in Safe mode. All the scans.
If that doesn't do it, you might want to try slaving the drive into another system and doing some bad asss whopping from another system.

 

[AuthorityZero]

It's a stretch, but I don't trust norton. The things it never found scared me.

housecall.trendmicro.com

Try it, like I said, it's a stretch, but it might find something.

 

[mechBgon]

Right-click this link and save target: www.omnicast.net/~tmcfadden/scan.txt Follow the directions precisely, using the referenced scanner in Safe Mode with System Restore disabled. This may be a case of Winfixer.

 

[amdskip]

Another thing to do is to download ccleaner and run it. All of your temporary files will be removed. Something might be hiding in there.