[reemi]

Hello Everyone ..
First i would like to thank u for the help .. i read a lot in this forum before posting my problem .. and i learned a lot .. good work really ..

About my problem .. my pc had a problem shutting down, i find a program which might be a worm "msmsgs.exe" i tried to delete it by hijackthis, then while doing a scan by Ad-Aware SE i found that i have the IStbar and xxxtoolbar malware, i tried to remove it by so many programs such as Spyware, Spyhunter and by deleting it from Regedit, i guess that i deleted the xxxtoolbar, but i couldn't delete the IStbar, after reboot the ISTbar is still there. I did a hijackthis scan and saved logfile .. have a look tell me what u find..
Thanx a lot
Reemi


Logfile of HijackThis v1.99.1
Scan saved at 22:08:41, on 24/03/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\gsicon.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\odjuk.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rula\My Documents\My Files\hijackthis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.panet.co.il/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://h10025.www1.h...item=pv-20132-3
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\Program Files\LostGoggles\LGoggles.dll
O2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\azesearch.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [uITnDotl] C:\WINDOWS\odjuk.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O9 - Extra 'Tools' menuitem: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.co...wnload/cult.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1106529282609
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azese...l/azesearch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ECFED776-3E4D-4A37-B73D-5B14323DEE30}: NameServer = 212.116.161.37 212.117.129.5
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

[Advertisements]

Hi Reemi

Download Hoster from here http://members.aol.c...dbee/hoster.zip Unzip and extract it to a folder. We'll use it later.

Open Adaware and make sure it is fully updated. Close Adaware.

Open Control Panel and go to Add/Remove programs. If this program is listed remove it.

RegFreeze

If Spyhunter is still installed please remove that also. It is of dubious value.

You might like to print these instructions out so you don't forget a step.

Open HijackThis and click on Do System Scan Only. Check these items. Close all open windows, including this one, diconnect from the internet and click on Fix Checked.

O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\azesearch.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [uITnDotl] C:\WINDOWS\odjuk.exe
O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
O9 - Extra button: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O9 - Extra 'Tools' menuitem: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.co...wnload/cult.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azese...l/azesearch.cab

Open Windows Explorer and configure to show all files:

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Find these files and delete them.

C:\WINDOWS\odjuk.exe - Delete file
C:\WINDOWS\System32\azesearch.ocx - Delete file if it is still there
C:\Program Files\RegFreeze - Delete entire folder if it is still there

Open Hoster from the folder you installed it into earlier and double click Hoster.exe. Select to replace your hosts file. This will remove the incorrect entries and return it to the default settings.

Reboot your computer and open Adaware SE Personal

1. Reconfigure Ad-Aware for Full Scan as per the following instructions:

• Launch the program, and click on the Gear at the top of the start screen.
  
• Under General Settings the following boxes should all be checked off:

(Checked will be indicated by a green circle with a check mark in it, Un-Checked is a red circle with an X in it. If it is greyed out, those features are only available in the retail version.)

• "Automatically save logfile"
  
• "Automatically quarantine objects prior to removal"
  
• Safe Mode (always request confirmation)
  
• Prompt to update outdated confirmation) - Change to 7 days.
  
• Click the "Scanning" button (On the left side).
  
• Under Drives & Folders, select "Scan within Archives"
  
• Click "Click here to select Drives + folders" and select your installed hard drives.
  
• Under Memory & Registry, select all options.
  
• Click the "Advanced" button (On the left hand side).
  
• Under "Shell Integration", select "Move deleted files to Recycle Bin".
  
• Under "Log-file detail", select all options.
  
• Click on the "Defaults" button on the left.
  
• Type in the full url of what you want as your default homepage and searchpage e.g. http://www.google.com.
  
• Click the "Tweak" button (Again, on the left hand side).
  
• Expand "Scanning Engine" by clicking on the "+" (Plus) symbol and select the following:
  [o] "Unload recognized processes during scanning."
  [o] "Obtain command line of scanned processes"
  [o] "Scan registry for all users instead of current user only"
  
• Under "Cleaning Engine", select the following:
  [o] "Automatically try to unregister objects prior to deletion."
  [o] "During removal, unload explorer and IE if necessary"
  [o] "Let Windows remove files in use at next reboot."
  [o] "Delete quarrantined objects after restoring"
  
• Click on "Safety Settings" and select "Write-protect system files after repair (Hosts file, etc)"
  
• Click on "Proceed" to save these Preferences.
  
• Click on the "Scan Now" button on the left.
  
• Under "Select Scan Mode, be sure to select "Use Custom Scanning Options"

2. Close all programs except ad-aware.
3. Click on "Next" in the bottom right corner to start the scan.
4. Run the Ad-Aware scan and allow it to remove everything it finds in the Critical Objects screen and then REBOOT - Even if not prompted to.
5. After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

Please do a fresh HijackThis log and post it for checking.

[ilago]

Hi Reemi

Download Hoster from here http://members.aol.c...dbee/hoster.zip Unzip and extract it to a folder. We'll use it later.

Open Adaware and make sure it is fully updated. Close Adaware.

Open Control Panel and go to Add/Remove programs. If this program is listed remove it.

RegFreeze

If Spyhunter is still installed please remove that also. It is of dubious value.

You might like to print these instructions out so you don't forget a step.

Open HijackThis and click on Do System Scan Only. Check these items. Close all open windows, including this one, diconnect from the internet and click on Fix Checked.

O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O1 - Hosts: 207.68.172.246 msn.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\azesearch.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [uITnDotl] C:\WINDOWS\odjuk.exe
O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
O9 - Extra button: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O9 - Extra 'Tools' menuitem: Search and Remove Spyware - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - C:\Program Files\RegFreeze\rfsearchhandler.dll
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.co...wnload/cult.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azese...l/azesearch.cab

Open Windows Explorer and configure to show all files:

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Find these files and delete them.

C:\WINDOWS\odjuk.exe - Delete file
C:\WINDOWS\System32\azesearch.ocx - Delete file if it is still there
C:\Program Files\RegFreeze - Delete entire folder if it is still there

Open Hoster from the folder you installed it into earlier and double click Hoster.exe. Select to replace your hosts file. This will remove the incorrect entries and return it to the default settings.

Reboot your computer and open Adaware SE Personal

1. Reconfigure Ad-Aware for Full Scan as per the following instructions:

• Launch the program, and click on the Gear at the top of the start screen.
  
• Under General Settings the following boxes should all be checked off:

(Checked will be indicated by a green circle with a check mark in it, Un-Checked is a red circle with an X in it. If it is greyed out, those features are only available in the retail version.)

• "Automatically save logfile"
  
• "Automatically quarantine objects prior to removal"
  
• Safe Mode (always request confirmation)
  
• Prompt to update outdated confirmation) - Change to 7 days.
  
• Click the "Scanning" button (On the left side).
  
• Under Drives & Folders, select "Scan within Archives"
  
• Click "Click here to select Drives + folders" and select your installed hard drives.
  
• Under Memory & Registry, select all options.
  
• Click the "Advanced" button (On the left hand side).
  
• Under "Shell Integration", select "Move deleted files to Recycle Bin".
  
• Under "Log-file detail", select all options.
  
• Click on the "Defaults" button on the left.
  
• Type in the full url of what you want as your default homepage and searchpage e.g. http://www.google.com.
  
• Click the "Tweak" button (Again, on the left hand side).
  
• Expand "Scanning Engine" by clicking on the "+" (Plus) symbol and select the following:
  [o] "Unload recognized processes during scanning."
  [o] "Obtain command line of scanned processes"
  [o] "Scan registry for all users instead of current user only"
  
• Under "Cleaning Engine", select the following:
  [o] "Automatically try to unregister objects prior to deletion."
  [o] "During removal, unload explorer and IE if necessary"
  [o] "Let Windows remove files in use at next reboot."
  [o] "Delete quarrantined objects after restoring"
  
• Click on "Safety Settings" and select "Write-protect system files after repair (Hosts file, etc)"
  
• Click on "Proceed" to save these Preferences.
  
• Click on the "Scan Now" button on the left.
  
• Under "Select Scan Mode, be sure to select "Use Custom Scanning Options"

2. Close all programs except ad-aware.
3. Click on "Next" in the bottom right corner to start the scan.
4. Run the Ad-Aware scan and allow it to remove everything it finds in the Critical Objects screen and then REBOOT - Even if not prompted to.
5. After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

Please do a fresh HijackThis log and post it for checking.

[reemi]

hi ilago
thanx for ur reply .. i did what u asked for .. and here's the last HijackThis Log i did after the scan ..

Logfile of HijackThis v1.99.1
Scan saved at 21:06:30, on 03/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\WINDOWS\System32\gsicon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Rula\My Documents\My Files\hijackthis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.panet.co.il/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://h10025.www1.h...item=pv-20132-3
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\Program Files\LostGoggles\LGoggles.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1106529282609
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

[ilago]

Hi Reemi

That log looks clean. For some additional protection and prevention:

Update Windows. Check that you have no software that is known to clash with SP2 and consider installing it. It provides additional protection for your system at operating system level. Microsoft's guide to installing SP2 is here http://h10025.www1.h...item=pv-20132-3

I would suggest you disconnect from the internet and disable your antivirus software during the installation. But you can ask for further advice here http://www.geekstogo...2003_NT-f5.html if you need to.

SpywareBlaster will block bad ActiveX and malevolent cookies. http://www.javacools...areblaster.html
SpywareGuard http://www.javacools...sgdownload.html - gives real time monitoring of common spyware changes.

IE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. The download is quite a long way down the page - but the page is worth reading for more information about malware. https://netfiles.uiu...ww/resource.htm

Stay Safe Online has information on how to
http://www.staysafeo....info/home.html

Keep antivirus software and Adaware and Spybot Search and Destroy up to date and do regular scans.

You can always ask for more information here as well

[reemi]

Hello ilago
I would like to thank u so much for ur help .. u did a great job really. I want to check with u on something .. when i open the task manager i can still see [B]msmsgs.exe does it harm the pc? and i tried to disable it, i removed the messenger of the windows .. but i can still see this program running in the task manager. what do u say about it ?

Thanx a lot
Reemi

[ilago]

Hi reemi

Happy to help

msmsgs.exe is the main process for msn instant messenger. it won't harm your computer but can be annoying. In Windows XP, Microsoft have made it quite difficult to remove as it doesn't list in Add/Remove programs. Open MSN Messenger from the little icon in the System tray at the bottom right of the screen or from the programs menu, go to Tools > Options and disable it from starting up.

Unfortunately it can be restarted when Outlook Express is opened. There is a utility on the Adaware site that lets you install a plug-in that stops that happening. It is called OE-W Messengerctrl and can be installed into Adaware as a plug-in. This page might help with that http://www.lavasoftu...engerctrl.shtml

Windows Messenger is a service that was originally designed as tool for network management and communication. It has been abused by advertisers and is unnecessary on home computers. You can make sure the Messenger service is disabled by running Shoot the Messenger from here http://grc.com/stm/s...hemessenger.htm You only need to run it once.

[reemi]

hello there ..

what can i say .. ur the expert and im trying to learn things from u Mr i downloaded the software and i guess everything is under control.
Would like to thank u agian for ur help .. and nice to meet u ilago..

Reemi

[ilago]

Hi Reemi

No worries

This topic will be closed now that the problems are resolved. If you need it re-opened for any reason please contact a moderator.