Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

My log. [RESOLVED]


  • Please log in to reply

#31
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
You said you were able to delete the folder, I want to see if the entries will go away.

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Click this link to be sure you can view hidden files.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Close all browsers, windows and unneeded programs.

5. Open HiJack and do a scan.

6. Put a Check next to the following items:

O4 - HKLM\..\Run: [dg0HYkUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [16 gram bird locks] C:\Documents and Settings\All Users\Application Data\Build bags 16 gram\EXITELSE.exe
O4 - HKLM\..\Run: [dI0GQ5Ex] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [bAVJYAEw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [YkFHW5ow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [aQFGRA1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eI0HXkEw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [YEVGZ5Uw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [REVGUcUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [aY0HQcUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RMFGSsEx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [dYVGUAov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [awVHWsUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ck0HRkEx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZY0GSAEw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eIVHQgov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cApGWw1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fg0HRoUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fk0HWcov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eMVGVcox] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [bMpGYA1v] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cYVJScox] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RUFHYwEw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZU0GSoov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZkFHTgUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [QYVHUs1w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fk0HZkUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cYFJYgov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ckVJXc1v] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [aMFHYsow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cYFHRgEx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [dI0GXc1w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fUFJWAov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [YE0HUgUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [bEpGTw1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ewVHZcEx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [bkpGWoov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [Rg0GR5ov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [QYFHVwow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eUFJQc1w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eU0HT51v] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RUFGTg1v] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [aQpHX5Ux] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RkFJWAow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [QMVHVcov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [QA0HWkUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fApHT5Ux] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZUpGQ9Ux] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eQ0HU9Ew] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [QEFJWcov] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [dApGZwow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RwpHX9Ux] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [Zg0GTsow] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [bMpGTc1w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cg0HTkEx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [eUVJYgEw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [awpHS9Ux] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [dYpGWgUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RgpGWoUw] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cwFJRA1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [dwVGXg1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [awVHRgUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZEpGZ51w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fYFHRAUx] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [cMFJW11w] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ew0HYgox] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [RIpHZs1v] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [ZYVGZw1x] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe
O4 - HKLM\..\Run: [fwVJRcox] C:\PROGRA~1\wwrxsour\b0xDI8BM.exe


7. click the Fix Checked box

8. Please remove the following folders using Windows Explorer (if present):

C:\PROGRA~1\wwrxsour
C:\Documents and Settings\All Users\Application Data\Build bags 16 gram


9. Please remove just the files from the following paths using Windows Explorer (if present):

Start>Search on the following:
(Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked)

A3358486918E3EBE.job
AB4B53ED9314C4BD.job
ACCD57D1918AC969.job
AFD8D70E910B4B5A.job
B1723C50966DB3CC.job
B3789DFD93EF162D.job


10. Reboot into Normal Mode

11. Please run the registry search tool again from post #17 and search for winIk

13. Please post a fresh HiJackThis log and the results from the registry search.
  • 0

Advertisements


#32
Mike7392000

Mike7392000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
None of these were present:
C:\PROGRA~1\wwrxsour
C:\Documents and Settings\All Users\Application Data\Build bags 16 gram
A3358486918E3EBE.job
AB4B53ED9314C4BD.job
ACCD57D1918AC969.job
AFD8D70E910B4B5A.job
B1723C50966DB3CC.job
B3789DFD93EF162D.job

Here's my registry search, followed by my HJT log.

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "WinIk" 14/07/2005 19:30:48

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK\0000\Control]
"ActiveService"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK\Enum]
"0"="Root\\LEGACY_WINIK\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"Service"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000]
"DeviceDesc"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK\0000\Control]
"ActiveService"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]
"DisplayName"="WinIK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK\Enum]
"0"="Root\\LEGACY_WINIK\\0000"

[HKEY_USERS\S-1-5-21-1356174792-2906385658-1794019246-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
"a"="sc stop winik\\1"

[HKEY_USERS\S-1-5-21-1356174792-2906385658-1794019246-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
"b"="sc delete winik\\1"

Logfile of HijackThis v1.99.1
Scan saved at 19:36:51, on 14/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Firewall\CPD.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Common Files\AOL\1121172593\ee\AOLHostManager.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\AOL\1121172593\ee\AOLServiceHost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\Program Files\Opera75\opera.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Mike\Desktop\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn0\ycomp5_6_2_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn0\ycomp5_6_2_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDBL10] C:\Program Files\EzButton\CPLDBL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1121172593\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband medic\bin\matcli.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmesus.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...MineSweeper.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.c.../ymmapi_416.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab30149.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...352/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVSync Manager (AvSynMgr) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: McAfee Firewall - Unknown owner - C:\Program Files\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
  • 0

#33
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
Mike is Winik.sys still present?


Tom
  • 0

#34
Mike7392000

Mike7392000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Yes, it's still there. :tazz:
  • 0

#35
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
Ok another attempt....lol

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.


Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme2.reg (make sure that Save as Type is set at "All Files") on your Desktop. Ensure there is no space at above REGEDIT 4.


REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_WINIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WinIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINIK]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinIK]


naviagte to C:\WINDOWS\system32\drivers\winik.sys. Right click and rename it to winik.old.

reboot

Delete the file C:\WINDOWS\system32\drivers\winik.old

Locate fixme2.reg on your Desktop and double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer "Yes" and wait for a message to appear similar to "Merged Successfully".


Reboot.

Let me know what happens.

Thanks,

:tazz:

tom
  • 0

#36
Mike7392000

Mike7392000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
The merge was successful, and I finally was able to delete the file! Thank you very much! :tazz: ;)
  • 0

#37
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
Posted Image

Thats awesome!

Great job, it appears your computer is clean :tazz:

Ensure you rehide your “hidden files and folders” back to the way they were.

Now that your system is Malware Free, it is important to reset your system Restore. Click Here to learn how to.

Might I suggest the following Free Spyware programs, if you don't already have them, for added security, you can download them at the following links. These programs work great for detection:

Ad-aware SE
Spybot S&D
Microsoft Anti-Spyware


If you are unhappy with your current antivirus and want to replace it or if you dont already have one, I suggest one of these free programs:
*Note - do not use more than one anti-virus program as it will more than likely cause conflict.

AVG
Avast
AntiVir


The following free programs are great for prevention:

SpywareBlaster 3.4
Spywareguard
IE/Spyad

A Firewall is a must! Here are 3 good free versions:

Sygate
Kerio
ZoneLabs

There are other options other than Internet Explorer for a browser, which some say have better security. Two of them are:

Firefox
Opera

If you decide to keep Internet Explorer, This site is a great source for tightening up security on It's settings.

Make sure that you keep your Operating System and IE updated with the latest Critical Security Updates from Microsoft...they usually come out once a month, on the 2nd Tuesday of each month.

Be sure and give the Temp folders a cleaning out now and then as well, Make sure after you clean your Temp files to empty out your Recycle bin as well.
For ease use the following program:

Cleanup
Run "Cleanup" and when it has finished, Reboot

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided. Also read How I got Infected
  • 0

#38
Mike7392000

Mike7392000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Thank you once again!

Just one final question, it will be okay to delete some of the files we created like "Fixme.reg"and "Fixme2.reg"?
  • 0

#39
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
Yes :tazz:
  • 0

#40
Excal

Excal

    Malware Slayer Extraordinaire!

  • Retired Staff
  • 12,739 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP