Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HijackThis! logfile [CLOSED]


  • This topic is locked This topic is locked

#1
mcbeng

mcbeng

    New Member

  • Member
  • Pip
  • 2 posts
Hi, runnign into some troubles with my neighbor's machine. I ran About:Buster 2x in safe mode. The second time it didn't find anything. I ran cleanup! in safe mode as well afterwards. Problem still exists, browser being redirected to About:Blank but hitting some search engine. My HijackThis! logfile is below...

EDIT - I also ran CWShredder and it didn't find anything.

Logfile of HijackThis v1.99.1
Scan saved at 8:05:00 PM, on 6/10/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\ATLBJ.EXE
C:\WINDOWS\WINIU32.EXE
C:\WINDOWS\SYSTEM\NETPJ32.EXE
C:\WINDOWS\SYSTEM\IPFP32.EXE
C:\WINDOWS\SDKCW32.EXE
C:\WINDOWS\SYSTEM\IEJZ32.EXE
C:\WINDOWS\SYSLG.EXE
C:\WINDOWS\SYSTEM\SYSHT32.EXE
C:\WINDOWS\SYSAT.EXE
C:\WINDOWS\SYSTEM\IPQR32.EXE
C:\WINDOWS\IPNM.EXE
C:\WINDOWS\MFCTR.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\JAVATM.EXE
C:\WINDOWS\IEJV.EXE
C:\WINDOWS\MFCIH.EXE
C:\WINDOWS\IEHI32.EXE
C:\WINDOWS\SYSTEM\IPVJ.EXE
C:\WINDOWS\SYSSY32.EXE
C:\WINDOWS\MSVC.EXE
C:\WINDOWS\JAVALE32.EXE
C:\WINDOWS\SYSTEM\NTJG32.EXE
C:\WINDOWS\APPLX.EXE
C:\WINDOWS\SYSTEM\IPXE.EXE
C:\WINDOWS\IEIM32.EXE
C:\WINDOWS\APIIO32.EXE
C:\WINDOWS\SYSTEM\APIXR.EXE
C:\WINDOWS\ATLDC32.EXE
C:\WINDOWS\IEPM32.EXE
C:\WINDOWS\SYSTEM\NTQE.EXE
C:\WINDOWS\SYSVJ.EXE
C:\WINDOWS\NTEN32.EXE
C:\WINDOWS\SYSTEM\D3QX32.EXE
C:\WINDOWS\SYSTEM\SDKWR32.EXE
C:\WINDOWS\SYSTEM\SDKDD32.EXE
C:\WINDOWS\SYSTEM\MFCEJ.EXE
C:\WINDOWS\SYSTEM\SDKSV.EXE
C:\WINDOWS\SYSTEM\MSEQ32.EXE
C:\WINDOWS\SYSTEM\SDKFN32.EXE
C:\WINDOWS\SYSTEM\MSZA.EXE
C:\WINDOWS\SYSTEM\APPHP32.EXE
C:\WINDOWS\SYSTEM\D3AN.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\MSQY.EXE
C:\WINDOWS\SYSTEM\D3HX.EXE
C:\WINDOWS\NTZF32.EXE
C:\WINDOWS\SYSTEM\SYSVJ32.EXE
C:\WINDOWS\IEFX32.EXE
C:\WINDOWS\IPUB32.EXE
C:\WINDOWS\D3FF.EXE
C:\WINDOWS\MFCPH32.EXE
C:\WINDOWS\SYSTEM\APILY32.EXE
C:\WINDOWS\WINIU32.EXE
C:\WINDOWS\ATLGF32.EXE
C:\WINDOWS\NETSE32.EXE
C:\WINDOWS\SYSTEM\SYSZN.EXE
C:\WINDOWS\SYSTEM\WINSA.EXE
C:\WINDOWS\SYSTEM\ATLZG32.EXE
C:\WINDOWS\SYSTEM\JAVADR.EXE
C:\WINDOWS\SYSTEM\ATLSH.EXE
C:\WINDOWS\SYSTEM\JAVAWN.EXE
C:\WINDOWS\MFCQM32.EXE
C:\WINDOWS\IEFX32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\PROGRAM FILES\HP PHOTOSMART\C500 CAMERA\HPI_MONITOR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFTRAY.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\ATLSH.EXE
C:\WINDOWS\SYSTEM\IEJZ32.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFAGENT.EXE
C:\WINDOWS\SYSYI32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {DFB4D259-8397-FA67-41F3-ADEFED1F6EEA} - C:\WINDOWS\SYSTEM\SYSWG32.DLL
O2 - BHO: Class - {5AA172E2-6059-7715-0AA0-87AE593D8F51} - C:\WINDOWS\WINHM.DLL
O2 - BHO: Class - {E82FC8AA-58EF-7C13-9034-56605E7C2294} - C:\WINDOWS\D3VO32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [HP PhotoSmart C500 Camera Monitor] C:\Program Files\HP PhotoSmart\C500 Camera\Hpi_Monitor.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Spyware Stormer] C:\PROGRAM FILES\SPYWARE STORMER\SPYWARESTORMER.Exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [NTRU32.EXE] C:\WINDOWS\SYSTEM\NTRU32.EXE
O4 - HKLM\..\Run: [SYSJF32.EXE] C:\WINDOWS\SYSJF32.EXE
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [JAVALE32.EXE] C:\WINDOWS\JAVALE32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [D3XR32.EXE] C:\WINDOWS\D3XR32.EXE /s
O4 - HKLM\..\RunServices: [D3AZ32.EXE] C:\WINDOWS\D3AZ32.EXE /s
O4 - HKLM\..\RunServices: [NTCJ.EXE] C:\WINDOWS\SYSTEM\NTCJ.EXE /s
O4 - HKLM\..\RunServices: [CRXS.EXE] C:\WINDOWS\CRXS.EXE /s
O4 - HKLM\..\RunServices: [CRNK32.EXE] C:\WINDOWS\CRNK32.EXE /s
O4 - HKLM\..\RunServices: [D3AK32.EXE] C:\WINDOWS\D3AK32.EXE /s
O4 - HKLM\..\RunServices: [D3PC.EXE] C:\WINDOWS\SYSTEM\D3PC.EXE /s
O4 - HKLM\..\RunServices: [NETQM32.EXE] C:\WINDOWS\NETQM32.EXE /s
O4 - HKLM\..\RunServices: [WINJH32.EXE] C:\WINDOWS\WINJH32.EXE /s
O4 - HKLM\..\RunServices: [MFCOR32.EXE] C:\WINDOWS\SYSTEM\MFCOR32.EXE /s
O4 - HKLM\..\RunServices: [MFCCG32.EXE] C:\WINDOWS\SYSTEM\MFCCG32.EXE /s
O4 - HKLM\..\RunServices: [SYSNZ.EXE] C:\WINDOWS\SYSNZ.EXE /s
O4 - HKLM\..\RunServices: [D3OS32.EXE] C:\WINDOWS\SYSTEM\D3OS32.EXE /s
O4 - HKLM\..\RunServices: [NETDQ32.EXE] C:\WINDOWS\NETDQ32.EXE /s
O4 - HKLM\..\RunServices: [WINRF32.EXE] C:\WINDOWS\WINRF32.EXE /s
O4 - HKLM\..\RunServices: [APPDE32.EXE] C:\WINDOWS\SYSTEM\APPDE32.EXE /s
O4 - HKLM\..\RunServices: [SYSEG32.EXE] C:\WINDOWS\SYSEG32.EXE /s
O4 - HKLM\..\RunServices: [WINNK.EXE] C:\WINDOWS\WINNK.EXE /s
O4 - HKLM\..\RunServices: [D3TK.EXE] C:\WINDOWS\D3TK.EXE /s
O4 - HKLM\..\RunServices: [ADDAG32.EXE] C:\WINDOWS\SYSTEM\ADDAG32.EXE /s
O4 - HKLM\..\RunServices: [NETAZ32.EXE] C:\WINDOWS\SYSTEM\NETAZ32.EXE /s
O4 - HKLM\..\RunServices: [ADDKS.EXE] C:\WINDOWS\ADDKS.EXE /s
O4 - HKLM\..\RunServices: [ADDAV32.EXE] C:\WINDOWS\ADDAV32.EXE /s
O4 - HKLM\..\RunServices: [IEPK32.EXE] C:\WINDOWS\IEPK32.EXE /s
O4 - HKLM\..\RunServices: [ADDUG.EXE] C:\WINDOWS\ADDUG.EXE /s
O4 - HKLM\..\RunServices: [SYSZS32.EXE] C:\WINDOWS\SYSZS32.EXE /s
O4 - HKLM\..\RunServices: [WINFG.EXE] C:\WINDOWS\WINFG.EXE /s
O4 - HKLM\..\RunServices: [MSIE.EXE] C:\WINDOWS\SYSTEM\MSIE.EXE /s
O4 - HKLM\..\RunServices: [JAVAQB.EXE] C:\WINDOWS\JAVAQB.EXE /s
O4 - HKLM\..\RunServices: [IEBI.EXE] C:\WINDOWS\IEBI.EXE /s
O4 - HKLM\..\RunServices: [CROH32.EXE] C:\WINDOWS\SYSTEM\CROH32.EXE /s
O4 - HKLM\..\RunServices: [D3QH.EXE] C:\WINDOWS\SYSTEM\D3QH.EXE /s
O4 - HKLM\..\RunServices: [JAVAIF.EXE] C:\WINDOWS\JAVAIF.EXE /s
O4 - HKLM\..\RunServices: [SDKMX32.EXE] C:\WINDOWS\SYSTEM\SDKMX32.EXE /s
O4 - HKLM\..\RunServices: [ATLLG.EXE] C:\WINDOWS\ATLLG.EXE /s
O4 - HKLM\..\RunServices: [WINYL.EXE] C:\WINDOWS\SYSTEM\WINYL.EXE /s
O4 - HKLM\..\RunServices: [ATLCI32.EXE] C:\WINDOWS\SYSTEM\ATLCI32.EXE /s
O4 - HKLM\..\RunServices: [APPKC.EXE] C:\WINDOWS\APPKC.EXE /s
O4 - HKLM\..\RunServices: [IPDZ.EXE] C:\WINDOWS\IPDZ.EXE /s
O4 - HKLM\..\RunServices: [APPJR.EXE] C:\WINDOWS\APPJR.EXE /s
O4 - HKLM\..\RunServices: [CRAV.EXE] C:\WINDOWS\CRAV.EXE /s
O4 - HKLM\..\RunServices: [SYSMY32.EXE] C:\WINDOWS\SYSMY32.EXE /s
O4 - HKLM\..\RunServices: [ADDWF.EXE] C:\WINDOWS\ADDWF.EXE /s
O4 - HKLM\..\RunServices: [ATLRH32.EXE] C:\WINDOWS\SYSTEM\ATLRH32.EXE /s
O4 - HKLM\..\RunServices: [ATLVC.EXE] C:\WINDOWS\ATLVC.EXE /s
O4 - HKLM\..\RunServices: [IPQK.EXE] C:\WINDOWS\IPQK.EXE /s
O4 - HKLM\..\RunServices: [APPZR.EXE] C:\WINDOWS\APPZR.EXE /s
O4 - HKLM\..\RunServices: [CRKF.EXE] C:\WINDOWS\CRKF.EXE /s
O4 - HKLM\..\RunServices: [IEWB32.EXE] C:\WINDOWS\IEWB32.EXE /s
O4 - HKLM\..\RunServices: [SYSWJ32.EXE] C:\WINDOWS\SYSWJ32.EXE /s
O4 - HKLM\..\RunServices: [D3JP32.EXE] C:\WINDOWS\SYSTEM\D3JP32.EXE /s
O4 - HKLM\..\RunServices: [CRTL.EXE] C:\WINDOWS\CRTL.EXE /s
O4 - HKLM\..\RunServices: [IEBK32.EXE] C:\WINDOWS\SYSTEM\IEBK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAIV.EXE] C:\WINDOWS\JAVAIV.EXE /s
O4 - HKLM\..\RunServices: [ATLBJ.EXE] C:\WINDOWS\ATLBJ.EXE /s
O4 - HKLM\..\RunServices: [WINIU32.EXE] C:\WINDOWS\WINIU32.EXE /s
O4 - HKLM\..\RunServices: [ATLAL32.EXE] C:\WINDOWS\SYSTEM\ATLAL32.EXE /s
O4 - HKLM\..\RunServices: [MSAY32.EXE] C:\WINDOWS\SYSTEM\MSAY32.EXE /s
O4 - HKLM\..\RunServices: [NETPJ32.EXE] C:\WINDOWS\SYSTEM\NETPJ32.EXE /s
O4 - HKLM\..\RunServices: [IPFP32.EXE] C:\WINDOWS\SYSTEM\IPFP32.EXE /s
O4 - HKLM\..\RunServices: [SDKCW32.EXE] C:\WINDOWS\SDKCW32.EXE /s
O4 - HKLM\..\RunServices: [IEJZ32.EXE] C:\WINDOWS\SYSTEM\IEJZ32.EXE /s
O4 - HKLM\..\RunServices: [SYSLG.EXE] C:\WINDOWS\SYSLG.EXE /s
O4 - HKLM\..\RunServices: [SYSHT32.EXE] C:\WINDOWS\SYSTEM\SYSHT32.EXE /s
O4 - HKLM\..\RunServices: [SYSAT.EXE] C:\WINDOWS\SYSAT.EXE /s
O4 - HKLM\..\RunServices: [IPQR32.EXE] C:\WINDOWS\SYSTEM\IPQR32.EXE /s
O4 - HKLM\..\RunServices: [IPNM.EXE] C:\WINDOWS\IPNM.EXE /s
O4 - HKLM\..\RunServices: [MFCTR.EXE] C:\WINDOWS\MFCTR.EXE /s
O4 - HKLM\..\RunServices: [WINCE.EXE] C:\WINDOWS\SYSTEM\WINCE.EXE /s
O4 - HKLM\..\RunServices: [JAVATM.EXE] C:\WINDOWS\JAVATM.EXE /s
O4 - HKLM\..\RunServices: [IEJV.EXE] C:\WINDOWS\IEJV.EXE /s
O4 - HKLM\..\RunServices: [MFCIH.EXE] C:\WINDOWS\MFCIH.EXE /s
O4 - HKLM\..\RunServices: [IEHI32.EXE] C:\WINDOWS\IEHI32.EXE /s
O4 - HKLM\..\RunServices: [IPVJ.EXE] C:\WINDOWS\SYSTEM\IPVJ.EXE /s
O4 - HKLM\..\RunServices: [CRJB32.EXE] C:\WINDOWS\SYSTEM\CRJB32.EXE /s
O4 - HKLM\..\RunServices: [SYSSY32.EXE] C:\WINDOWS\SYSSY32.EXE /s
O4 - HKLM\..\RunServices: [MSVC.EXE] C:\WINDOWS\MSVC.EXE /s
O4 - HKLM\..\RunServices: [NTJG32.EXE] C:\WINDOWS\SYSTEM\NTJG32.EXE /s
O4 - HKLM\..\RunServices: [APPLX.EXE] C:\WINDOWS\APPLX.EXE /s
O4 - HKLM\..\RunServices: [IPXE.EXE] C:\WINDOWS\SYSTEM\IPXE.EXE /s
O4 - HKLM\..\RunServices: [IEIM32.EXE] C:\WINDOWS\IEIM32.EXE /s
O4 - HKLM\..\RunServices: [APIIO32.EXE] C:\WINDOWS\APIIO32.EXE /s
O4 - HKLM\..\RunServices: [APIXR.EXE] C:\WINDOWS\SYSTEM\APIXR.EXE /s
O4 - HKLM\..\RunServices: [ATLDC32.EXE] C:\WINDOWS\ATLDC32.EXE /s
O4 - HKLM\..\RunServices: [IEPM32.EXE] C:\WINDOWS\IEPM32.EXE /s
O4 - HKLM\..\RunServices: [NTQE.EXE] C:\WINDOWS\SYSTEM\NTQE.EXE /s
O4 - HKLM\..\RunServices: [SYSVJ.EXE] C:\WINDOWS\SYSVJ.EXE /s
O4 - HKLM\..\RunServices: [NTEN32.EXE] C:\WINDOWS\NTEN32.EXE /s
O4 - HKLM\..\RunServices: [NETDJ.EXE] C:\WINDOWS\NETDJ.EXE /s
O4 - HKLM\..\RunServices: [MFCWG.EXE] C:\WINDOWS\MFCWG.EXE /s
O4 - HKLM\..\RunServices: [D3QX32.EXE] C:\WINDOWS\SYSTEM\D3QX32.EXE /s
O4 - HKLM\..\RunServices: [NETWL.EXE] C:\WINDOWS\NETWL.EXE /s
O4 - HKLM\..\RunServices: [SDKWR32.EXE] C:\WINDOWS\SYSTEM\SDKWR32.EXE /s
O4 - HKLM\..\RunServices: [SDKDD32.EXE] C:\WINDOWS\SYSTEM\SDKDD32.EXE /s
O4 - HKLM\..\RunServices: [CRLA32.EXE] C:\WINDOWS\CRLA32.EXE /s
O4 - HKLM\..\RunServices: [ADDXK32.EXE] C:\WINDOWS\ADDXK32.EXE /s
O4 - HKLM\..\RunServices: [NETST32.EXE] C:\WINDOWS\NETST32.EXE /s
O4 - HKLM\..\RunServices: [SYSBF32.EXE] C:\WINDOWS\SYSBF32.EXE /s
O4 - HKLM\..\RunServices: [MFCEJ.EXE] C:\WINDOWS\SYSTEM\MFCEJ.EXE /s
O4 - HKLM\..\RunServices: [SDKSV.EXE] C:\WINDOWS\SYSTEM\SDKSV.EXE /s
O4 - HKLM\..\RunServices: [APPTB.EXE] C:\WINDOWS\APPTB.EXE /s
O4 - HKLM\..\RunServices: [MSEQ32.EXE] C:\WINDOWS\SYSTEM\MSEQ32.EXE /s
O4 - HKLM\..\RunServices: [SDKFN32.EXE] C:\WINDOWS\SYSTEM\SDKFN32.EXE /s
O4 - HKLM\..\RunServices: [MSZI32.EXE] C:\WINDOWS\MSZI32.EXE /s
O4 - HKLM\..\RunServices: [IPSB32.EXE] C:\WINDOWS\IPSB32.EXE /s
O4 - HKLM\..\RunServices: [MSZA.EXE] C:\WINDOWS\SYSTEM\MSZA.EXE /s
O4 - HKLM\..\RunServices: [APPHP32.EXE] C:\WINDOWS\SYSTEM\APPHP32.EXE /s
O4 - HKLM\..\RunServices: [D3AN.EXE] C:\WINDOWS\SYSTEM\D3AN.EXE /s
O4 - HKLM\..\RunServices: [MSQY.EXE] C:\WINDOWS\MSQY.EXE /s
O4 - HKLM\..\RunServices: [D3HX.EXE] C:\WINDOWS\SYSTEM\D3HX.EXE /s
O4 - HKLM\..\RunServices: [NTZF32.EXE] C:\WINDOWS\NTZF32.EXE /s
O4 - HKLM\..\RunServices: [SYSVJ32.EXE] C:\WINDOWS\SYSTEM\SYSVJ32.EXE /s
O4 - HKLM\..\RunServices: [IPUB32.EXE] C:\WINDOWS\IPUB32.EXE /s
O4 - HKLM\..\RunServices: [D3FF.EXE] C:\WINDOWS\D3FF.EXE /s
O4 - HKLM\..\RunServices: [MFCPH32.EXE] C:\WINDOWS\MFCPH32.EXE /s
O4 - HKLM\..\RunServices: [APILY32.EXE] C:\WINDOWS\SYSTEM\APILY32.EXE /s
O4 - HKLM\..\RunServices: [ATLGF32.EXE] C:\WINDOWS\ATLGF32.EXE /s
O4 - HKLM\..\RunServices: [NETSE32.EXE] C:\WINDOWS\NETSE32.EXE /s
O4 - HKLM\..\RunServices: [SYSZN.EXE] C:\WINDOWS\SYSTEM\SYSZN.EXE /s
O4 - HKLM\..\RunServices: [WINSA.EXE] C:\WINDOWS\SYSTEM\WINSA.EXE /s
O4 - HKLM\..\RunServices: [ATLZG32.EXE] C:\WINDOWS\SYSTEM\ATLZG32.EXE /s
O4 - HKLM\..\RunServices: [JAVADR.EXE] C:\WINDOWS\SYSTEM\JAVADR.EXE /s
O4 - HKLM\..\RunServices: [ATLSH.EXE] C:\WINDOWS\SYSTEM\ATLSH.EXE /s
O4 - HKLM\..\RunServices: [JAVAWN.EXE] C:\WINDOWS\SYSTEM\JAVAWN.EXE /s
O4 - HKLM\..\RunServices: [MFCQM32.EXE] C:\WINDOWS\MFCQM32.EXE /s
O4 - HKLM\..\RunServices: [IEFX32.EXE] C:\WINDOWS\IEFX32.EXE /s
O4 - HKLM\..\RunServices: [SYSYI32.EXE] C:\WINDOWS\SYSYI32.EXE /s
O4 - Startup: Reminder-hpc40416.lnk = C:\Program Files\HP PhotoSmart\C500 Camera\Registration\Remind32.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.c...aploader_v6.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,21/mcgdmgr.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...4.47/ttinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab

Edited by mcbeng, 16 June 2005 - 07:45 AM.

  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Download AboutBuster http://www.greyknigh...AboutBuster.zip and unzip the files to a folder on your Desktop. Run AboutBuster and click OK. Click Update button to see if there are any updates. Close the program now.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. OK, before we go on, I want you to take note of this first. This program will wipe out all files in your Temporary folders, any file extensions that have a tilde (~) in it, .bak files, .chk files, .tmp files and index.dat files. Most of you should be ok with this, but there may be some who need these files. If you are one of them, do not follow this step. Post back a reply telling us about this. So if that's ok, then download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Don't run it yet.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

Spyware Stormer - it’s rogueware (or known to be rogueware in the past) and we highly recommend that you uninstall it. Rogue/Suspect means that these products are of unknown, questionable, or dubious value as anti-spyware protection.

Viewpoint


Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\apbrj.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {DFB4D259-8397-FA67-41F3-ADEFED1F6EEA} - C:\WINDOWS\SYSTEM\SYSWG32.DLL
O2 - BHO: Class - {5AA172E2-6059-7715-0AA0-87AE593D8F51} - C:\WINDOWS\WINHM.DLL
O2 - BHO: Class - {E82FC8AA-58EF-7C13-9034-56605E7C2294} - C:\WINDOWS\D3VO32.DLL
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Spyware Stormer] C:\PROGRAM FILES\SPYWARE STORMER\SPYWARESTORMER.Exe
O4 - HKLM\..\Run: [NTRU32.EXE] C:\WINDOWS\SYSTEM\NTRU32.EXE
O4 - HKLM\..\Run: [SYSJF32.EXE] C:\WINDOWS\SYSJF32.EXE
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [JAVALE32.EXE] C:\WINDOWS\JAVALE32.EXE
O4 - HKLM\..\RunServices: [D3XR32.EXE] C:\WINDOWS\D3XR32.EXE /s
O4 - HKLM\..\RunServices: [D3AZ32.EXE] C:\WINDOWS\D3AZ32.EXE /s
O4 - HKLM\..\RunServices: [NTCJ.EXE] C:\WINDOWS\SYSTEM\NTCJ.EXE /s
O4 - HKLM\..\RunServices: [CRXS.EXE] C:\WINDOWS\CRXS.EXE /s
O4 - HKLM\..\RunServices: [CRNK32.EXE] C:\WINDOWS\CRNK32.EXE /s
O4 - HKLM\..\RunServices: [D3AK32.EXE] C:\WINDOWS\D3AK32.EXE /s
O4 - HKLM\..\RunServices: [D3PC.EXE] C:\WINDOWS\SYSTEM\D3PC.EXE /s
O4 - HKLM\..\RunServices: [NETQM32.EXE] C:\WINDOWS\NETQM32.EXE /s
O4 - HKLM\..\RunServices: [WINJH32.EXE] C:\WINDOWS\WINJH32.EXE /s
O4 - HKLM\..\RunServices: [MFCOR32.EXE] C:\WINDOWS\SYSTEM\MFCOR32.EXE /s
O4 - HKLM\..\RunServices: [MFCCG32.EXE] C:\WINDOWS\SYSTEM\MFCCG32.EXE /s
O4 - HKLM\..\RunServices: [SYSNZ.EXE] C:\WINDOWS\SYSNZ.EXE /s
O4 - HKLM\..\RunServices: [D3OS32.EXE] C:\WINDOWS\SYSTEM\D3OS32.EXE /s
O4 - HKLM\..\RunServices: [NETDQ32.EXE] C:\WINDOWS\NETDQ32.EXE /s
O4 - HKLM\..\RunServices: [WINRF32.EXE] C:\WINDOWS\WINRF32.EXE /s
O4 - HKLM\..\RunServices: [APPDE32.EXE] C:\WINDOWS\SYSTEM\APPDE32.EXE /s
O4 - HKLM\..\RunServices: [SYSEG32.EXE] C:\WINDOWS\SYSEG32.EXE /s
O4 - HKLM\..\RunServices: [WINNK.EXE] C:\WINDOWS\WINNK.EXE /s
O4 - HKLM\..\RunServices: [D3TK.EXE] C:\WINDOWS\D3TK.EXE /s
O4 - HKLM\..\RunServices: [ADDAG32.EXE] C:\WINDOWS\SYSTEM\ADDAG32.EXE /s
O4 - HKLM\..\RunServices: [NETAZ32.EXE] C:\WINDOWS\SYSTEM\NETAZ32.EXE /s
O4 - HKLM\..\RunServices: [ADDKS.EXE] C:\WINDOWS\ADDKS.EXE /s
O4 - HKLM\..\RunServices: [ADDAV32.EXE] C:\WINDOWS\ADDAV32.EXE /s
O4 - HKLM\..\RunServices: [IEPK32.EXE] C:\WINDOWS\IEPK32.EXE /s
O4 - HKLM\..\RunServices: [ADDUG.EXE] C:\WINDOWS\ADDUG.EXE /s
O4 - HKLM\..\RunServices: [SYSZS32.EXE] C:\WINDOWS\SYSZS32.EXE /s
O4 - HKLM\..\RunServices: [WINFG.EXE] C:\WINDOWS\WINFG.EXE /s
O4 - HKLM\..\RunServices: [MSIE.EXE] C:\WINDOWS\SYSTEM\MSIE.EXE /s
O4 - HKLM\..\RunServices: [JAVAQB.EXE] C:\WINDOWS\JAVAQB.EXE /s
O4 - HKLM\..\RunServices: [IEBI.EXE] C:\WINDOWS\IEBI.EXE /s
O4 - HKLM\..\RunServices: [CROH32.EXE] C:\WINDOWS\SYSTEM\CROH32.EXE /s
O4 - HKLM\..\RunServices: [D3QH.EXE] C:\WINDOWS\SYSTEM\D3QH.EXE /s
O4 - HKLM\..\RunServices: [JAVAIF.EXE] C:\WINDOWS\JAVAIF.EXE /s
O4 - HKLM\..\RunServices: [SDKMX32.EXE] C:\WINDOWS\SYSTEM\SDKMX32.EXE /s
O4 - HKLM\..\RunServices: [ATLLG.EXE] C:\WINDOWS\ATLLG.EXE /s
O4 - HKLM\..\RunServices: [WINYL.EXE] C:\WINDOWS\SYSTEM\WINYL.EXE /s
O4 - HKLM\..\RunServices: [ATLCI32.EXE] C:\WINDOWS\SYSTEM\ATLCI32.EXE /s
O4 - HKLM\..\RunServices: [APPKC.EXE] C:\WINDOWS\APPKC.EXE /s
O4 - HKLM\..\RunServices: [IPDZ.EXE] C:\WINDOWS\IPDZ.EXE /s
O4 - HKLM\..\RunServices: [APPJR.EXE] C:\WINDOWS\APPJR.EXE /s
O4 - HKLM\..\RunServices: [CRAV.EXE] C:\WINDOWS\CRAV.EXE /s
O4 - HKLM\..\RunServices: [SYSMY32.EXE] C:\WINDOWS\SYSMY32.EXE /s
O4 - HKLM\..\RunServices: [ADDWF.EXE] C:\WINDOWS\ADDWF.EXE /s
O4 - HKLM\..\RunServices: [ATLRH32.EXE] C:\WINDOWS\SYSTEM\ATLRH32.EXE /s
O4 - HKLM\..\RunServices: [ATLVC.EXE] C:\WINDOWS\ATLVC.EXE /s
O4 - HKLM\..\RunServices: [IPQK.EXE] C:\WINDOWS\IPQK.EXE /s
O4 - HKLM\..\RunServices: [APPZR.EXE] C:\WINDOWS\APPZR.EXE /s
O4 - HKLM\..\RunServices: [CRKF.EXE] C:\WINDOWS\CRKF.EXE /s
O4 - HKLM\..\RunServices: [IEWB32.EXE] C:\WINDOWS\IEWB32.EXE /s
O4 - HKLM\..\RunServices: [SYSWJ32.EXE] C:\WINDOWS\SYSWJ32.EXE /s
O4 - HKLM\..\RunServices: [D3JP32.EXE] C:\WINDOWS\SYSTEM\D3JP32.EXE /s
O4 - HKLM\..\RunServices: [CRTL.EXE] C:\WINDOWS\CRTL.EXE /s
O4 - HKLM\..\RunServices: [IEBK32.EXE] C:\WINDOWS\SYSTEM\IEBK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAIV.EXE] C:\WINDOWS\JAVAIV.EXE /s
O4 - HKLM\..\RunServices: [ATLBJ.EXE] C:\WINDOWS\ATLBJ.EXE /s
O4 - HKLM\..\RunServices: [WINIU32.EXE] C:\WINDOWS\WINIU32.EXE /s
O4 - HKLM\..\RunServices: [ATLAL32.EXE] C:\WINDOWS\SYSTEM\ATLAL32.EXE /s
O4 - HKLM\..\RunServices: [MSAY32.EXE] C:\WINDOWS\SYSTEM\MSAY32.EXE /s
O4 - HKLM\..\RunServices: [NETPJ32.EXE] C:\WINDOWS\SYSTEM\NETPJ32.EXE /s
O4 - HKLM\..\RunServices: [IPFP32.EXE] C:\WINDOWS\SYSTEM\IPFP32.EXE /s
O4 - HKLM\..\RunServices: [SDKCW32.EXE] C:\WINDOWS\SDKCW32.EXE /s
O4 - HKLM\..\RunServices: [IEJZ32.EXE] C:\WINDOWS\SYSTEM\IEJZ32.EXE /s
O4 - HKLM\..\RunServices: [SYSLG.EXE] C:\WINDOWS\SYSLG.EXE /s
O4 - HKLM\..\RunServices: [SYSHT32.EXE] C:\WINDOWS\SYSTEM\SYSHT32.EXE /s
O4 - HKLM\..\RunServices: [SYSAT.EXE] C:\WINDOWS\SYSAT.EXE /s
O4 - HKLM\..\RunServices: [IPQR32.EXE] C:\WINDOWS\SYSTEM\IPQR32.EXE /s
O4 - HKLM\..\RunServices: [IPNM.EXE] C:\WINDOWS\IPNM.EXE /s
O4 - HKLM\..\RunServices: [MFCTR.EXE] C:\WINDOWS\MFCTR.EXE /s
O4 - HKLM\..\RunServices: [WINCE.EXE] C:\WINDOWS\SYSTEM\WINCE.EXE /s
O4 - HKLM\..\RunServices: [JAVATM.EXE] C:\WINDOWS\JAVATM.EXE /s
O4 - HKLM\..\RunServices: [IEJV.EXE] C:\WINDOWS\IEJV.EXE /s
O4 - HKLM\..\RunServices: [MFCIH.EXE] C:\WINDOWS\MFCIH.EXE /s
O4 - HKLM\..\RunServices: [IEHI32.EXE] C:\WINDOWS\IEHI32.EXE /s
O4 - HKLM\..\RunServices: [IPVJ.EXE] C:\WINDOWS\SYSTEM\IPVJ.EXE /s
O4 - HKLM\..\RunServices: [CRJB32.EXE] C:\WINDOWS\SYSTEM\CRJB32.EXE /s
O4 - HKLM\..\RunServices: [SYSSY32.EXE] C:\WINDOWS\SYSSY32.EXE /s
O4 - HKLM\..\RunServices: [MSVC.EXE] C:\WINDOWS\MSVC.EXE /s
O4 - HKLM\..\RunServices: [NTJG32.EXE] C:\WINDOWS\SYSTEM\NTJG32.EXE /s
O4 - HKLM\..\RunServices: [APPLX.EXE] C:\WINDOWS\APPLX.EXE /s
O4 - HKLM\..\RunServices: [IPXE.EXE] C:\WINDOWS\SYSTEM\IPXE.EXE /s
O4 - HKLM\..\RunServices: [IEIM32.EXE] C:\WINDOWS\IEIM32.EXE /s
O4 - HKLM\..\RunServices: [APIIO32.EXE] C:\WINDOWS\APIIO32.EXE /s
O4 - HKLM\..\RunServices: [APIXR.EXE] C:\WINDOWS\SYSTEM\APIXR.EXE /s
O4 - HKLM\..\RunServices: [ATLDC32.EXE] C:\WINDOWS\ATLDC32.EXE /s
O4 - HKLM\..\RunServices: [IEPM32.EXE] C:\WINDOWS\IEPM32.EXE /s
O4 - HKLM\..\RunServices: [NTQE.EXE] C:\WINDOWS\SYSTEM\NTQE.EXE /s
O4 - HKLM\..\RunServices: [SYSVJ.EXE] C:\WINDOWS\SYSVJ.EXE /s
O4 - HKLM\..\RunServices: [NTEN32.EXE] C:\WINDOWS\NTEN32.EXE /s
O4 - HKLM\..\RunServices: [NETDJ.EXE] C:\WINDOWS\NETDJ.EXE /s
O4 - HKLM\..\RunServices: [MFCWG.EXE] C:\WINDOWS\MFCWG.EXE /s
O4 - HKLM\..\RunServices: [D3QX32.EXE] C:\WINDOWS\SYSTEM\D3QX32.EXE /s
O4 - HKLM\..\RunServices: [NETWL.EXE] C:\WINDOWS\NETWL.EXE /s
O4 - HKLM\..\RunServices: [SDKWR32.EXE] C:\WINDOWS\SYSTEM\SDKWR32.EXE /s
O4 - HKLM\..\RunServices: [SDKDD32.EXE] C:\WINDOWS\SYSTEM\SDKDD32.EXE /s
O4 - HKLM\..\RunServices: [CRLA32.EXE] C:\WINDOWS\CRLA32.EXE /s
O4 - HKLM\..\RunServices: [ADDXK32.EXE] C:\WINDOWS\ADDXK32.EXE /s
O4 - HKLM\..\RunServices: [NETST32.EXE] C:\WINDOWS\NETST32.EXE /s
O4 - HKLM\..\RunServices: [SYSBF32.EXE] C:\WINDOWS\SYSBF32.EXE /s
O4 - HKLM\..\RunServices: [MFCEJ.EXE] C:\WINDOWS\SYSTEM\MFCEJ.EXE /s
O4 - HKLM\..\RunServices: [SDKSV.EXE] C:\WINDOWS\SYSTEM\SDKSV.EXE /s
O4 - HKLM\..\RunServices: [APPTB.EXE] C:\WINDOWS\APPTB.EXE /s
O4 - HKLM\..\RunServices: [MSEQ32.EXE] C:\WINDOWS\SYSTEM\MSEQ32.EXE /s
O4 - HKLM\..\RunServices: [SDKFN32.EXE] C:\WINDOWS\SYSTEM\SDKFN32.EXE /s
O4 - HKLM\..\RunServices: [MSZI32.EXE] C:\WINDOWS\MSZI32.EXE /s
O4 - HKLM\..\RunServices: [IPSB32.EXE] C:\WINDOWS\IPSB32.EXE /s
O4 - HKLM\..\RunServices: [MSZA.EXE] C:\WINDOWS\SYSTEM\MSZA.EXE /s
O4 - HKLM\..\RunServices: [APPHP32.EXE] C:\WINDOWS\SYSTEM\APPHP32.EXE /s
O4 - HKLM\..\RunServices: [D3AN.EXE] C:\WINDOWS\SYSTEM\D3AN.EXE /s
O4 - HKLM\..\RunServices: [MSQY.EXE] C:\WINDOWS\MSQY.EXE /s
O4 - HKLM\..\RunServices: [D3HX.EXE] C:\WINDOWS\SYSTEM\D3HX.EXE /s
O4 - HKLM\..\RunServices: [NTZF32.EXE] C:\WINDOWS\NTZF32.EXE /s
O4 - HKLM\..\RunServices: [SYSVJ32.EXE] C:\WINDOWS\SYSTEM\SYSVJ32.EXE /s
O4 - HKLM\..\RunServices: [IPUB32.EXE] C:\WINDOWS\IPUB32.EXE /s
O4 - HKLM\..\RunServices: [D3FF.EXE] C:\WINDOWS\D3FF.EXE /s
O4 - HKLM\..\RunServices: [MFCPH32.EXE] C:\WINDOWS\MFCPH32.EXE /s
O4 - HKLM\..\RunServices: [APILY32.EXE] C:\WINDOWS\SYSTEM\APILY32.EXE /s
O4 - HKLM\..\RunServices: [ATLGF32.EXE] C:\WINDOWS\ATLGF32.EXE /s
O4 - HKLM\..\RunServices: [NETSE32.EXE] C:\WINDOWS\NETSE32.EXE /s
O4 - HKLM\..\RunServices: [SYSZN.EXE] C:\WINDOWS\SYSTEM\SYSZN.EXE /s
O4 - HKLM\..\RunServices: [WINSA.EXE] C:\WINDOWS\SYSTEM\WINSA.EXE /s
O4 - HKLM\..\RunServices: [ATLZG32.EXE] C:\WINDOWS\SYSTEM\ATLZG32.EXE /s
O4 - HKLM\..\RunServices: [JAVADR.EXE] C:\WINDOWS\SYSTEM\JAVADR.EXE /s
O4 - HKLM\..\RunServices: [ATLSH.EXE] C:\WINDOWS\SYSTEM\ATLSH.EXE /s
O4 - HKLM\..\RunServices: [JAVAWN.EXE] C:\WINDOWS\SYSTEM\JAVAWN.EXE /s
O4 - HKLM\..\RunServices: [MFCQM32.EXE] C:\WINDOWS\MFCQM32.EXE /s
O4 - HKLM\..\RunServices: [IEFX32.EXE] C:\WINDOWS\IEFX32.EXE /s
O4 - HKLM\..\RunServices: [SYSYI32.EXE] C:\WINDOWS\SYSYI32.EXE /s


Run AboutBuster and click Begin Removal button. Once that's done, just hit the OK button. Click Exit once you are done. Click the OK button and it should exit. Open up the 'Ab LogFile.txt' (which was created in the same folder as AboutBuster) and post the log here.

Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Copy the below files and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say no:

C:\WINDOWS\ATLBJ.EXE
C:\WINDOWS\WINIU32.EXE
C:\WINDOWS\SYSTEM\NETPJ32.EXE
C:\WINDOWS\SYSTEM\IPFP32.EXE
C:\WINDOWS\SDKCW32.EXE
C:\WINDOWS\SYSTEM\IEJZ32.EXE
C:\WINDOWS\SYSLG.EXE
C:\WINDOWS\SYSTEM\SYSHT32.EXE
C:\WINDOWS\SYSAT.EXE
C:\WINDOWS\SYSTEM\IPQR32.EXE
C:\WINDOWS\IPNM.EXE
C:\WINDOWS\MFCTR.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\JAVATM.EXE
C:\WINDOWS\IEJV.EXE
C:\WINDOWS\MFCIH.EXE
C:\WINDOWS\IEHI32.EXE
C:\WINDOWS\SYSTEM\IPVJ.EXE
C:\WINDOWS\SYSSY32.EXE
C:\WINDOWS\MSVC.EXE
C:\WINDOWS\JAVALE32.EXE
C:\WINDOWS\SYSTEM\NTJG32.EXE
C:\WINDOWS\APPLX.EXE
C:\WINDOWS\SYSTEM\IPXE.EXE
C:\WINDOWS\IEIM32.EXE
C:\WINDOWS\APIIO32.EXE
C:\WINDOWS\SYSTEM\APIXR.EXE
C:\WINDOWS\ATLDC32.EXE
C:\WINDOWS\IEPM32.EXE
C:\WINDOWS\SYSTEM\NTQE.EXE
C:\WINDOWS\SYSVJ.EXE
C:\WINDOWS\NTEN32.EXE
C:\WINDOWS\SYSTEM\D3QX32.EXE
C:\WINDOWS\SYSTEM\SDKWR32.EXE
C:\WINDOWS\SYSTEM\SDKDD32.EXE
C:\WINDOWS\SYSTEM\MFCEJ.EXE
C:\WINDOWS\SYSTEM\SDKSV.EXE
C:\WINDOWS\SYSTEM\MSEQ32.EXE
C:\WINDOWS\SYSTEM\SDKFN32.EXE
C:\WINDOWS\SYSTEM\MSZA.EXE
C:\WINDOWS\SYSTEM\APPHP32.EXE
C:\WINDOWS\SYSTEM\D3AN.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\MSQY.EXE
C:\WINDOWS\SYSTEM\D3HX.EXE
C:\WINDOWS\NTZF32.EXE
C:\WINDOWS\SYSTEM\SYSVJ32.EXE
C:\WINDOWS\IEFX32.EXE
C:\WINDOWS\IPUB32.EXE
C:\WINDOWS\D3FF.EXE
C:\WINDOWS\MFCPH32.EXE
C:\WINDOWS\SYSTEM\APILY32.EXE
C:\WINDOWS\WINIU32.EXE
C:\WINDOWS\ATLGF32.EXE
C:\WINDOWS\NETSE32.EXE
C:\WINDOWS\SYSTEM\SYSZN.EXE
C:\WINDOWS\SYSTEM\WINSA.EXE
C:\WINDOWS\SYSTEM\ATLZG32.EXE
C:\WINDOWS\SYSTEM\JAVADR.EXE
C:\WINDOWS\SYSTEM\ATLSH.EXE
C:\WINDOWS\SYSTEM\JAVAWN.EXE
C:\WINDOWS\MFCQM32.EXE
C:\WINDOWS\IEFX32.EXE
C:\WINDOWS\SYSTEM\ATLSH.EXE
C:\WINDOWS\SYSTEM\IEJZ32.EXE
C:\WINDOWS\SYSYI32.EXE
C:\WINDOWS\apbrj.dll
C:\WINDOWS\SYSTEM\SYSWG32.DLL
C:\WINDOWS\WINHM.DLL
C:\WINDOWS\D3VO32.DLL
C:\WINDOWS\SYSTEM\NTRU32.EXE
C:\WINDOWS\SYSJF32.EXE
C:\WINDOWS\JAVALE32.EXE
C:\WINDOWS\D3XR32.EXE
C:\WINDOWS\D3AZ32.EXE
C:\WINDOWS\SYSTEM\NTCJ.EXE
C:\WINDOWS\CRXS.EXE
C:\WINDOWS\CRNK32.EXE
C:\WINDOWS\D3AK32.EXE
C:\WINDOWS\SYSTEM\D3PC.EXE
C:\WINDOWS\NETQM32.EXE
C:\WINDOWS\WINJH32.EXE
C:\WINDOWS\SYSTEM\MFCOR32.EXE
C:\WINDOWS\SYSTEM\MFCCG32.EXE
C:\WINDOWS\SYSNZ.EXE
C:\WINDOWS\SYSTEM\D3OS32.EXE
C:\WINDOWS\NETDQ32.EXE
C:\WINDOWS\WINRF32.EXE
C:\WINDOWS\SYSTEM\APPDE32.EXE
C:\WINDOWS\SYSEG32.EXE
C:\WINDOWS\WINNK.EXE
C:\WINDOWS\D3TK.EXE
C:\WINDOWS\SYSTEM\ADDAG32.EXE
C:\WINDOWS\SYSTEM\NETAZ32.EXE
C:\WINDOWS\ADDKS.EXE
C:\WINDOWS\ADDAV32.EXE
C:\WINDOWS\IEPK32.EXE
C:\WINDOWS\ADDUG.EXE
C:\WINDOWS\SYSZS32.EXE
C:\WINDOWS\WINFG.EXE
C:\WINDOWS\SYSTEM\MSIE.EXE
C:\WINDOWS\JAVAQB.EXE
C:\WINDOWS\IEBI.EXE
C:\WINDOWS\SYSTEM\CROH32.EXE
C:\WINDOWS\SYSTEM\D3QH.EXE
C:\WINDOWS\JAVAIF.EXE
C:\WINDOWS\SYSTEM\SDKMX32.EXE
C:\WINDOWS\ATLLG.EXE
C:\WINDOWS\SYSTEM\WINYL.EXE
C:\WINDOWS\SYSTEM\ATLCI32.EXE
C:\WINDOWS\APPKC.EXE
C:\WINDOWS\IPDZ.EXE
C:\WINDOWS\APPJR.EXE
C:\WINDOWS\CRAV.EXE
C:\WINDOWS\SYSMY32.EXE
C:\WINDOWS\ADDWF.EXE
C:\WINDOWS\SYSTEM\ATLRH32.EXE
C:\WINDOWS\ATLVC.EXE
C:\WINDOWS\IPQK.EXE
C:\WINDOWS\APPZR.EXE
C:\WINDOWS\CRKF.EXE
C:\WINDOWS\IEWB32.EXE
C:\WINDOWS\SYSWJ32.EXE
C:\WINDOWS\SYSTEM\D3JP32.EXE
C:\WINDOWS\CRTL.EXE
C:\WINDOWS\SYSTEM\IEBK32.EXE
C:\WINDOWS\JAVAIV.EXE
C:\WINDOWS\ATLBJ.EXE
C:\WINDOWS\WINIU32.EXE
C:\WINDOWS\SYSTEM\ATLAL32.EXE
C:\WINDOWS\SYSTEM\MSAY32.EXE
C:\WINDOWS\SYSTEM\NETPJ32.EXE
C:\WINDOWS\SYSTEM\IPFP32.EXE
C:\WINDOWS\SDKCW32.EXE
C:\WINDOWS\SYSTEM\IEJZ32.EXE
C:\WINDOWS\SYSLG.EXE
C:\WINDOWS\SYSTEM\SYSHT32.EXE
C:\WINDOWS\SYSAT.EXE
C:\WINDOWS\SYSTEM\IPQR32.EXE
C:\WINDOWS\IPNM.EXE
C:\WINDOWS\MFCTR.EXE
C:\WINDOWS\SYSTEM\WINCE.EXE
C:\WINDOWS\JAVATM.EXE
C:\WINDOWS\IEJV.EXE
C:\WINDOWS\MFCIH.EXE
C:\WINDOWS\IEHI32.EXE
C:\WINDOWS\SYSTEM\IPVJ.EXE
C:\WINDOWS\SYSTEM\CRJB32.EXE
C:\WINDOWS\SYSSY32.EXE
C:\WINDOWS\MSVC.EXE
C:\WINDOWS\SYSTEM\NTJG32.EXE
C:\WINDOWS\APPLX.EXE
C:\WINDOWS\SYSTEM\IPXE.EXE
C:\WINDOWS\IEIM32.EXE
C:\WINDOWS\APIIO32.EXE
C:\WINDOWS\SYSTEM\APIXR.EXE
C:\WINDOWS\ATLDC32.EXE
C:\WINDOWS\IEPM32.EXE
C:\WINDOWS\SYSTEM\NTQE.EXE
C:\WINDOWS\SYSVJ.EXE
C:\WINDOWS\NTEN32.EXE
C:\WINDOWS\NETDJ.EXE
C:\WINDOWS\MFCWG.EXE
C:\WINDOWS\SYSTEM\D3QX32.EXE
C:\WINDOWS\NETWL.EXE
C:\WINDOWS\SYSTEM\SDKWR32.EXE
C:\WINDOWS\SYSTEM\SDKDD32.EXE
C:\WINDOWS\CRLA32.EXE
C:\WINDOWS\ADDXK32.EXE
C:\WINDOWS\NETST32.EXE
C:\WINDOWS\SYSBF32.EXE
C:\WINDOWS\SYSTEM\MFCEJ.EXE
C:\WINDOWS\SYSTEM\SDKSV.EXE
C:\WINDOWS\APPTB.EXE
C:\WINDOWS\SYSTEM\MSEQ32.EXE
C:\WINDOWS\SYSTEM\SDKFN32.EXE
C:\WINDOWS\MSZI32.EXE
C:\WINDOWS\IPSB32.EXE
C:\WINDOWS\SYSTEM\MSZA.EXE
C:\WINDOWS\SYSTEM\APPHP32.EXE
C:\WINDOWS\SYSTEM\D3AN.EXE
C:\WINDOWS\MSQY.EXE
C:\WINDOWS\SYSTEM\D3HX.EXE
C:\WINDOWS\NTZF32.EXE
C:\WINDOWS\SYSTEM\SYSVJ32.EXE
C:\WINDOWS\IPUB32.EXE
C:\WINDOWS\D3FF.EXE
C:\WINDOWS\MFCPH32.EXE
C:\WINDOWS\SYSTEM\APILY32.EXE
C:\WINDOWS\ATLGF32.EXE
C:\WINDOWS\NETSE32.EXE
C:\WINDOWS\SYSTEM\SYSZN.EXE
C:\WINDOWS\SYSTEM\WINSA.EXE
C:\WINDOWS\SYSTEM\ATLZG32.EXE
C:\WINDOWS\SYSTEM\JAVADR.EXE
C:\WINDOWS\SYSTEM\ATLSH.EXE
C:\WINDOWS\SYSTEM\JAVAWN.EXE
C:\WINDOWS\MFCQM32.EXE
C:\WINDOWS\IEFX32.EXE
C:\WINDOWS\SYSYI32.EXE


Delete these folders:

C:\PROGRAM FILES\VIEWPOINT\
C:\PROGRAM FILES\SPYWARE STORMER\


Run CleanUp! and click on CleanUp! button. Once it's done, you may click the Close button. When asked if you want to logoff, choose No.

Restart and run a new HijackThis scan. Save the log file and post it here.
  • 0

#3
mcbeng

mcbeng

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Ok, completed the steps. Here is the latest logfile. Thanks for taking a look.

Logfile of HijackThis v1.99.1
Scan saved at 11:00:10 PM, on 6/15/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\SYSTEM\ADDSB.EXE
C:\WINDOWS\SYSTEM\NTTJ.EXE
C:\WINDOWS\ATLVI.EXE
C:\WINDOWS\MFCEU32.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\NTUL32.EXE
C:\WINDOWS\WINJO.EXE
C:\WINDOWS\MSHW32.EXE
C:\WINDOWS\SYSTEM\NTWH32.EXE
C:\WINDOWS\JAVAEQ32.EXE
C:\WINDOWS\SYSTEM\JAVARW32.EXE
C:\WINDOWS\APIRJ.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\SYSTEM\NTTJ.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\PROGRAM FILES\HP PHOTOSMART\C500 CAMERA\HPI_MONITOR.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\SUPPORT.COM\BIN\TGCMD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {0AF77FF4-8FB1-508A-3515-0B5C99F8C5B7} - C:\WINDOWS\SYSTEM\WINUU32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_7_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [HP PhotoSmart C500 Camera Monitor] C:\Program Files\HP PhotoSmart\C500 Camera\Hpi_Monitor.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [APIRJ.EXE] C:\WINDOWS\APIRJ.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ADDSB.EXE] C:\WINDOWS\SYSTEM\ADDSB.EXE /s
O4 - HKLM\..\RunServices: [NTTJ.EXE] C:\WINDOWS\SYSTEM\NTTJ.EXE /s
O4 - HKLM\..\RunServices: [ATLVI.EXE] C:\WINDOWS\ATLVI.EXE /s
O4 - HKLM\..\RunServices: [MFCEU32.EXE] C:\WINDOWS\MFCEU32.EXE /s
O4 - HKLM\..\RunServices: [SYSPN.EXE] C:\WINDOWS\SYSPN.EXE /s
O4 - HKLM\..\RunServices: [NTUL32.EXE] C:\WINDOWS\NTUL32.EXE /s
O4 - HKLM\..\RunServices: [WINJO.EXE] C:\WINDOWS\WINJO.EXE /s
O4 - HKLM\..\RunServices: [MSHW32.EXE] C:\WINDOWS\MSHW32.EXE /s
O4 - HKLM\..\RunServices: [NTWH32.EXE] C:\WINDOWS\SYSTEM\NTWH32.EXE /s
O4 - HKLM\..\RunServices: [JAVAEQ32.EXE] C:\WINDOWS\JAVAEQ32.EXE /s
O4 - HKLM\..\RunServices: [JAVARW32.EXE] C:\WINDOWS\SYSTEM\JAVARW32.EXE /s
O4 - Startup: Reminder-hpc40416.lnk = C:\Program Files\HP PhotoSmart\C500 Camera\Registration\Remind32.exe
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...84/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.c...aploader_v6.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,21/mcgdmgr.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...4.47/ttinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/z...s/heartbeat.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/.../GrooveAX27.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
  • 0

#4
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I want you to delete the AboutBuster you have there and download it again (see link below).

For those R0/R1 entries, make sure you fix them no matter what filenames it is. It may have changed each time. So fix whatever the new filename is for all those R0/R1 entries.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. OK, before we go on, I want you to take note of this first. This program will wipe out all files in your Temporary folders, any file extensions that have a tilde (~) in it, .bak files, .chk files, .tmp files and index.dat files. Most of you should be ok with this, but there may be some who need these files. If you are one of them, do not follow this step. Post back a reply telling us about this. So if that's ok, then download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Download AboutBuster http://www.greyknigh...AboutBuster.zip and unzip the files to a folder on your Desktop. Run AboutBuster and click OK. Click Update button to see if there are any updates. Close the program now.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\wxanq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {0AF77FF4-8FB1-508A-3515-0B5C99F8C5B7} - C:\WINDOWS\SYSTEM\WINUU32.DLL
O4 - HKLM\..\Run: [APIRJ.EXE] C:\WINDOWS\APIRJ.EXE
O4 - HKLM\..\RunServices: [ADDSB.EXE] C:\WINDOWS\SYSTEM\ADDSB.EXE /s
O4 - HKLM\..\RunServices: [NTTJ.EXE] C:\WINDOWS\SYSTEM\NTTJ.EXE /s
O4 - HKLM\..\RunServices: [ATLVI.EXE] C:\WINDOWS\ATLVI.EXE /s
O4 - HKLM\..\RunServices: [MFCEU32.EXE] C:\WINDOWS\MFCEU32.EXE /s
O4 - HKLM\..\RunServices: [SYSPN.EXE] C:\WINDOWS\SYSPN.EXE /s
O4 - HKLM\..\RunServices: [NTUL32.EXE] C:\WINDOWS\NTUL32.EXE /s
O4 - HKLM\..\RunServices: [WINJO.EXE] C:\WINDOWS\WINJO.EXE /s
O4 - HKLM\..\RunServices: [MSHW32.EXE] C:\WINDOWS\MSHW32.EXE /s
O4 - HKLM\..\RunServices: [NTWH32.EXE] C:\WINDOWS\SYSTEM\NTWH32.EXE /s
O4 - HKLM\..\RunServices: [JAVAEQ32.EXE] C:\WINDOWS\JAVAEQ32.EXE /s
O4 - HKLM\..\RunServices: [JAVARW32.EXE] C:\WINDOWS\SYSTEM\JAVARW32.EXE /s


Run AboutBuster and click Begin Removal button. Once that's done, just hit the OK button. Click Exit once you are done. Click the OK button and it should exit. Open up the 'Ab LogFile.txt' (which was created in the same folder as AboutBuster) and post the log here.

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\SYSTEM\ADDSB.EXE
C:\WINDOWS\SYSTEM\NTTJ.EXE
C:\WINDOWS\ATLVI.EXE
C:\WINDOWS\MFCEU32.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\NTUL32.EXE
C:\WINDOWS\WINJO.EXE
C:\WINDOWS\MSHW32.EXE
C:\WINDOWS\SYSTEM\NTWH32.EXE
C:\WINDOWS\JAVAEQ32.EXE
C:\WINDOWS\SYSTEM\JAVARW32.EXE
C:\WINDOWS\APIRJ.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\SYSPN.EXE
C:\WINDOWS\SYSTEM\NTTJ.EXE
C:\WINDOWS\SYSTEM\WINUU32.DLL


Run CleanUp! and click on CleanUp! button. Once it's done, you may click the Close button. When asked if you want to logoff, choose No.

Restart and run a new HijackThis scan. Save the log file and post it here. Post the AboutBuster log here also.
  • 0

#5
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP