[ScHwErV]

Dennis Hall

That log looks a ton better than the last one. Hopefully things are also running better.

A few more things to clean up in your HJT log.

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINNT\dlmax.dll (file missing)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll (file missing)
O4 - HKLM\..\Run: [Win Server Updt] C:\WINNT\wupdt.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE <== Optional and not malware but recommended - Resource Hog

Now close all windows other than HiJackThis, then click Fix Checked. After that, Reboot.

After you reboot pleas post back with a fresh HiJackThis log.

ScHwErV

[Advertisements]

Deleted first two items (dlmax.dll and systb.dll).
Third item not present.
Did not delete fourth item (OSA9.exe); Google search results make me leary of deleting this file without a better understanding of it's function.

Computer function is MUCH better than initially. In fact, initially, it was effectively functionless. Now, it has near normal functionality. The only negative issue still aparant is that the system still goes for hours whirring and buzzing even without any user instructions to conduct any tasks.

Here is the new HJT log; note that OSA9.exe has not been deleted.

Attached Files

•  hijackthis.log.03_30_05.txt   7.67KB   180 downloads

[Dennis Hall]

Deleted first two items (dlmax.dll and systb.dll).
Third item not present.
Did not delete fourth item (OSA9.exe); Google search results make me leary of deleting this file without a better understanding of it's function.

Computer function is MUCH better than initially. In fact, initially, it was effectively functionless. Now, it has near normal functionality. The only negative issue still aparant is that the system still goes for hours whirring and buzzing even without any user instructions to conduct any tasks.

Here is the new HJT log; note that OSA9.exe has not been deleted.

Attached Files

•  hijackthis.log.03_30_05.txt   7.67KB   180 downloads

[ScHwErV]

the OSA9 entry is related to Microsoft Office and is unnecessary. It allows Office Applications to "start faster" according to Microsoft, but I have never noticed any difference. It does however take up a ton of system resources just sitting there.

You dont have to delete the OSA9 file, just remove the entry from HiJackThis and see what you think after a reboot. See if your whirring and buzzing stops or if your computer seems a little faster.

If you dont like the results or want that back, then you can restore it from the HJT backups. I can walk you through that when the time comes.

ScHwErV

[Dennis Hall]

Thanks for hte explanation. OSA9.exe deleted. Here is a new HJT log, if needed...

Attached Files

•  hijackthis.log.03_30_05A.txt   7.32KB   129 downloads

[Dennis Hall]

Are we done?

[ScHwErV]

Sorry yes. Your log is now clean!

Congratulations.

The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

• Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
  
• AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
  
• SpywareBlaster - Great prevention tool to keep nasties from installing on your system.
  
• SpywareGuard - Works as a Spyware "Shield" to protect your computer from getting malware in the first place.
  
• IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
  
• CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  
• Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows.
  
• Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein

ScHwErV