Spy/Virus... Interpretation Hijackthis...

Logfile of HijackThis v1.99.1
Scan saved at 13:45:58, on 19/02/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\CSAFE\AUTOCHK.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\BUREAU\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ConfigSafe] C:\CSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [LVComs] c:\windows\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0
O4 - Startup: EPSON Contrôleur en arrière plan.lnk = C:\ESM2\STMS.exe
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

<?xml version = "1.0"?>
<Session START = "18 Feb 05 22:38:09" END = "18 Feb 05 22:45:29">
<Information Version = "4.10" DatabaseVersion = "60" DataBaseDate = "04 February 2005"/>
<Information OS = "OS_WIN98"/>
<Information ServicePack = "Unknown or None"/>
<Information WorkingDirectory = "C:\PROGRAM FILES\XOFTSPY\"/>
<Information Option = "AdvSpyware Scan" State = "ON"/>
<Information Option = "Scan IE Favorites" State = "ON"/>
<Information Option = "Scan Host Files" State = "ON"/>
<Information Option = "Scan Drives" State = "ON"/>
<Information Option = "Do Not Scan Executables" State = "OFF"/>
<Information Option = "Scan Registry" State = "ON"/>
<Information Option = "Scan Active Processes" State = "ON"/>
<Information RootKey = "HKEY_CURRENT_USER" KeyPath = "Software\Microsoft\Windows\CurrentVersion\Run"/>
<Information Value = "MsnMsgr" Data = ""c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background"/>
<Information Value = "SpySweeper" Data = ""C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /0"/>
<Information RootKey = "HKEY_CURRENT_USER" KeyPath = "Software\Microsoft\Internet Explorer\Main"/>
<Information Value = "Anchor Underline" Data = "yes"/>
<Information Value = "Cache_Update_Frequency" Data = "Once_Per_Session"/>
<Information Value = "Display Inline Images" Data = "yes"/>
<Information Value = "Do404Search" Data = "
"/>
<Information Value = "Save_Session_History_On_Exit" Data = "no"/>
<Information Value = "Show_FullURL" Data = "no"/>
<Information Value = "Show_StatusBar" Data = "yes"/>
<Information Value = "Show_ToolBar" Data = "yes"/>
<Information Value = "Show_URLinStatusBar" Data = "yes"/>
<Information Value = "Show_URLToolBar" Data = "yes"/>
<Information Value = "Start Page" Data = "http://www.google.fr/"/>
<Information Value = "Use_DlgBox_Colors" Data = "yes"/>
<Information Value = "Search Page" Data = "http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"/>
<Information Value = "Show_ChannelBand" Data = "no"/>
<Information Value = "ViewSettings" Data = ""/>
<Information Value = "Window_Placement" Data = ","/>
<Information Value = "FullScreen" Data = "no"/>
<Information Value = "NotifyDownloadComplete" Data = "yes"/>
<Information Value = "LastCheckedHi" Data = "X	Å
"/>
<Information Value = "FormSuggest PW Ask" Data = "no"/>
<Information Value = "Use FormSuggest" Data = "no"/>
<Information Value = "AddToFavoritesExpanded" Data = ""/>
<Information Value = "Error Dlg Displayed On Every Error" Data = "no"/>
<Information Value = "Error Dlg Details Pane Open" Data = "no"/>
<Information Value = "Disable Script Debugger" Data = "yes"/>
<Information Value = "Level" Data = "ª4"/>
<Information Value = "Local Page" Data = "C:\WINDOWS\SYSTEM\blank.htm"/>
<Information Value = "Default_Search_URL" Data = "http://www.msn.com/access/allinone.htm"/>
<Information Value = "Search Bar" Data = "http://www.free.fr/search/"/>
<Information RootKey = "HKEY_CURRENT_USER" KeyPath = "Software\Microsoft\Internet Explorer\Search"/>
<Information Value = "CustomizeSearch" Data = ""/>
<Information Value = "SearchAssistant" Data = ""/>
<Information RootKey = "HKEY_LOCAL_MACHINE" KeyPath = "Software\Microsoft\Internet Explorer\Main"/>
<Information Value = "Enable_Disk_Cache" Data = "yes"/>
<Information Value = "Cache_Percent_of_Disk" Data = "
"/>
<Information Value = "Delete_Temp_Files_On_Exit" Data = "yes"/>
<Information Value = "Local Page" Data = "c:\windows\SYSTEM\blank.htm"/>
<Information Value = "Anchor_Visitation_Horizon" Data = "
"/>
<Information Value = "Use_Async_DNS" Data = "yes"/>
<Information Value = "Placeholder_Width" Data = ""/>
<Information Value = "Placeholder_Height" Data = ""/>
<Information Value = "Start Page" Data = "about:blank"/>
<Information Value = "Wizard_Version" Data = "6.00.2800.1106"/>
<Information Value = "FullScreen" Data = "no"/>
<Information Value = "Update_Check_Page" Data = "http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update"/>
<Information Value = "Update_Check_Interval" Data = ""/>
<Information Value = "CompanyName" Data = "proxad"/>
<Information Value = "Use Search Asst" Data = "no"/>
<Information Value = "Level" Data = "º:"/>
<Information Value = "Timer" Data = ";"/>
<Information Value = "Enable Browser Extensions" Data = "yes"/>
<Information Value = "" Data = ""/>
<Information Value = "Search Bar" Data = "res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001"/>
<Information Value = "Default_Page_URL" Data = "about:blank"/>
<Information Value = "Default_Search_URL" Data = "res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001"/>
<Information Value = "Search Page" Data = "res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001"/>
<Information RootKey = "HKEY_LOCAL_MACHINE" KeyPath = "Software\Microsoft\Internet Explorer\Search"/>
<Information Value = "CustomizeSearch" Data = "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"/>
<Information Value = "SearchAssistant" Data = "res://C:\WINDOWS\system\hvdxw.dll/sp.html#10001"/>
<Information RootKey = "HKEY_LOCAL_MACHINE" KeyPath = "Software\Microsoft\Windows\CurrentVersion\Run"/>
<Information Value = "SystemTray" Data = "SysTray.Exe"/>
<Information Value = "LoadPowerProfile" Data = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"/>
<Information Value = "ConfigSafe" Data = "C:\CSAFE\AUTOCHK.EXE"/>
<Information Value = "AtiCwd32" Data = "Aticwd32.exe"/>
<Information Value = "AtiKey" Data = "Atitask.exe"/>
<Information Value = "LVComs" Data = "c:\windows\SYSTEM\LVComS.exe"/>
<Information Value = "StillImageMonitor" Data = "C:\WINDOWS\SYSTEM\STIMON.EXE"/>
<Information Value = "LoadQM" Data = "loadqm.exe"/>
<Information Value = "ashMaiSv" Data = "C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe"/>
<Information RootKey = "HKEY_LOCAL_MACHINE" KeyPath = "Software\Microsoft\Internet Explorer\URLSearchHooks"/>
<Information Value = "{A039511A-2DA4-BD56-736A-678456D795AA}" Data = ""/>
<Information RootKey = "HKEY_CURRENT_USER" KeyPath = "Software\Microsoft\Internet Explorer\URLSearchHooks"/>
<Information Value = "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" Data = ""/>
<Scanning TIME = "18 Feb 05 22:38:09">
<PROCESS NAME = "C:\WINDOWS\SYSTEM\KERNEL32.DLL" MD5 = "8da63e863e14aec76ab6d557d410e972"/>
<PROCESS NAME = "C:\WINDOWS\SYSTEM\MSGSRV32.EXE" MD5 = "617a88e59b7e35c0516e63284b3cc9b6"/>
<PROCESS NAME = "C:\WINDOWS\SYSTEM\MPREXE.EXE" MD5 = "9d67e7a3ca0baed7172e273f0fadeefb"/>
<PROCESS NAME = "C:\WINDOWS\EXPLORER.EXE" MD5 = "128927b0dc7f54135308a6997176beee"/>
<PROCESS NAME = "C:\PROGRAM FILES\XOFTSPY\XOFTSPY.EXE" MD5 = "a32b6df132bcab46d04ba3d273a61cba"/>
<ScanningRegKeys>
</ScanningRegKeys>
<ScanningRegValues>
</ScanningRegValues>
<ScanningRegValuesChanged>
</SW>
<SW NAME = "CWS.Homepage">
<REGVALUE NAME = "CWS.Homepage Software\Microsoft\Internet Explorer\Main\Search Bar\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
<REGVALUECHANGEDFOUND NAME = "Software\Microsoft\Internet Explorer\Main\Search Bar\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
</SW>
<SW NAME = "CWS.Homepage">
<REGVALUE NAME = "CWS.Homepage Software\Microsoft\Internet Explorer\Main\Default_Search_URL\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
<REGVALUECHANGEDFOUND NAME = "Software\Microsoft\Internet Explorer\Main\Default_Search_URL\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
</SW>
<SW NAME = "CWS.Homepage">
<REGVALUE NAME = "CWS.Homepage Software\Microsoft\Internet Explorer\Main\Search Page\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
<REGVALUECHANGEDFOUND NAME = "Software\Microsoft\Internet Explorer\Main\Search Page\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
</SW>
<SW NAME = "CWS.Homepage">
<REGVALUE NAME = "CWS.Homepage Software\Microsoft\Internet Explorer\Search\SearchAssistant\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
<REGVALUECHANGEDFOUND NAME = "Software\Microsoft\Internet Explorer\Search\SearchAssistant\res://c:\windows\system\hvdxw.dll/sp.html#10001:@:res://c:\windows\system\hvdxw.dll/sp.html#10001"/>
</ScanningRegValuesChanged>
</Scanning>

</Session>

c:\windows\system\hvdxw.dll/sp.html#10001