[gambit293]

Hi all,

I've been trying to heal my parents' PC, which runs on ME. It had a ton of spyware and other malware/viruses on it. I have run:

-CleanUp 4.0
-Ad-Aware 1.06
-Spybot 1.4
-AVG Free 7.0.338
-Trojan Hunter trial

Cleanware removed 200+ mb of junk. Ad-Aware found a lot of stuff but was unable to remove several, including BookedSpace. Spybot did very well, removing another half-dozen or so, but always refound BookedSpace and Pacimedia. AVG always refinds a dozen trojans in a C:\_RESTORE\temp directory and is always unable to delete/clean those files. Trojan Hunter pointed out the file PSof1.exe as a potential trojan. (I believe PSof1 is part of Pacimedia)

PSof1 had been causing run-time errors on startup. Just to experiment, I renamed the file (c:\windows\system\PSof1.exe) to PSof1.bckp. Oddly enough, the errors stopped after doing this. Should I just outright delete the file?

After running all these programs, I noticed that the following malware processes are no longer running:

-sfita
-sf
-PSof1

However, I also noticed a process casclient, which may be related to a casino ad/spyware. So far, none of the scanners have highlighted casclient as a threat. There is a folder on the system: C:\program files\cas\client which contains the executable and an uninstall executable and a couple of text files with a bunch of URLs in them.

Throughout this entire process, I kept the patient disconnected from the Internet to prevent spreading or picking up something new. All scanners were updated manually using files downloaed on my other computer. I am reluctant to connect it back to the Internet until I am sure it's not going to start downloading all sorts of crap again.

What should my next step be? My HijackThis log is pasted at the end of this.

Thanks a ton for your time and help!!!!
-Andrew

Logfile of HijackThis v1.99.1
Scan saved at 9:39:13 PM, on 7/27/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\Tools_95\Register\REMIND.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\B'S CLIP\BSCLIP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\CAS\CLIENT\CASCLIENT.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\QUICKENW\QWDLLS.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F1 - win.ini: load=C:\TOOLS_95\REGISTER\remind.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\SYSTEM\VBRUNDLL.DLL (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
O4 - HKLM\..\Run: [MadExe] C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\LaunchRA.exe -boot
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\BSCLIP.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [AutoLoaderpz5d1JWTcJIX] "C:\WINDOWS\SYSTEM\LZ3RMT.EXE"
O4 - HKLM\..\Run: [p4mX37j] LZ3RMT.EXE
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKCU\..\Run: [QAGENT] C:\QUICKENW\QAGENT.EXE
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\RunDLL32.exe C:\PROGRA~1\OFOTO\OFOTONOW\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Tools_95\imgicon.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5020} - C:\CSFBDIRECT\FLOWHOOK.DLL

[Advertisements]

Hello, welcome to the GeekstoGo Forums!

My name is Justin, and I will be helping you clean up your system. Lets get started!

Please set your system to show
all files; please see here if you're unsure how to do this.

Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Please reopen HiJackThis and scan your computer. Please place a check mark next to the following entries. Be sure to select only the entries that are listed below, as deleting the wrong file could cause harm to your system.

R3 - Default URLSearchHook is missing
F1 - win.ini: load=C:\TOOLS_95\REGISTER\remind.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\SYSTEM\VBRUNDLL.DLL (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [AutoLoaderpz5d1JWTcJIX] "C:\WINDOWS\SYSTEM\LZ3RMT.EXE"
O4 - HKLM\..\Run: [p4mX37j] LZ3RMT.EXE
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)


Next, please close all programs except for HiJackThis, and select Fix Checked.
Reboot your computer and boot into safe mode.

To boot into safe mode turn your computer on and press f8, continiously, until a menu appears. At this menu please select safemode

Next, open Windows Explorer. The easiest way to do this is:Click Start
Select Run
Type in Explorer
While in Windows Explorer, please delete the following Files, if they are found. Please note thay you may not find the files, please let me know if you do not find them.

C:\WINDOWS\SYSTEM\PSof1.exe
C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
C:\WINDOWS\CFGMGR52.DLL
C:\WINDOWS\SYSTEM\LZ3RMT.EXE
LZ3RMT.EXE


In Windows Exploer, please delete the following Folders, if they are found.

C:\Program Files\Cas


Next, please open Ewido.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")[/list]
Please set your system to hide
hidden files; please see here if you're unsure how to do this.

Please exit Windows Explorer and reboot you computer normally.
In your next reply, please post a new HiJackThis log, as well as the log from your ewido scan

[Justin]

Hello, welcome to the GeekstoGo Forums!

My name is Justin, and I will be helping you clean up your system. Lets get started!

Please set your system to show
all files; please see here if you're unsure how to do this.

Please download ewido security suite it is a free version of the program.

• Install ewido security suite
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should be an icon on your desktop, double-click it.
• The program will now open to the main screen.
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates

Please reopen HiJackThis and scan your computer. Please place a check mark next to the following entries. Be sure to select only the entries that are listed below, as deleting the wrong file could cause harm to your system.

R3 - Default URLSearchHook is missing
F1 - win.ini: load=C:\TOOLS_95\REGISTER\remind.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\SYSTEM\VBRUNDLL.DLL (file missing)
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [AutoLoaderpz5d1JWTcJIX] "C:\WINDOWS\SYSTEM\LZ3RMT.EXE"
O4 - HKLM\..\Run: [p4mX37j] LZ3RMT.EXE
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)


Next, please close all programs except for HiJackThis, and select Fix Checked.
Reboot your computer and boot into safe mode.

To boot into safe mode turn your computer on and press f8, continiously, until a menu appears. At this menu please select safemode

Next, open Windows Explorer. The easiest way to do this is:Click Start
Select Run
Type in Explorer
While in Windows Explorer, please delete the following Files, if they are found. Please note thay you may not find the files, please let me know if you do not find them.

C:\WINDOWS\SYSTEM\PSof1.exe
C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE
C:\WINDOWS\CFGMGR52.DLL
C:\WINDOWS\SYSTEM\LZ3RMT.EXE
LZ3RMT.EXE


In Windows Exploer, please delete the following Folders, if they are found.

C:\Program Files\Cas


Next, please open Ewido.

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.**
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop.

Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")[/list]
Please set your system to hide
hidden files; please see here if you're unsure how to do this.

Please exit Windows Explorer and reboot you computer normally.
In your next reply, please post a new HiJackThis log, as well as the log from your ewido scan

[gambit293]

Hey Justin,

Thanks a ton for your reply. I'm stepping away for a bit, but I will follow your directions either later today or tomorrow.

One question. On the "Must Read This First" posting, the instructions say that Ewido is for XP and 2000 only. I have ME on the infected computer. Should I proceed with Ewido?

Thanks.

-Andrew

[Justin]

Hello,

Sorry about Ewido, I had a minor brain fart.

Run both of these online scans

Housecall<<<Put on 'Autoclean' and delete what it can't clean.

Panda ActiveScan<<<Accept default settings, save and post the log

Run those scans after you fix the above in HiJackThis. Then reply with a new HiJackThis log and the log from PandaScan.

[gambit293]

Hi Justin,

I stupidly misread your instructions and then connected to the Internet and ran Housecall first. Afterwards, I disconnected from the Internet, and reran Clean Up, Spybot, AdAware, and AVG.

I created another Hijack log at this point:

Logfile of HijackThis v1.99.1
Scan saved at 10:12:53 PM, on 7/31/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\Tools_95\Register\REMIND.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\B'S CLIP\BSCLIP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\CAS\CLIENT\CASCLIENT.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\QUICKENW\QWDLLS.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F1 - win.ini: load=C:\TOOLS_95\REGISTER\remind.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\SYSTEM\VBRUNDLL.DLL (file missing)
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
O4 - HKLM\..\Run: [MadExe] C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\LaunchRA.exe -boot
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\BSCLIP.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [AutoLoaderpz5d1JWTcJIX] "C:\WINDOWS\SYSTEM\LZ3RMT.EXE"
O4 - HKLM\..\Run: [p4mX37j] LZ3RMT.EXE
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKCU\..\Run: [QAGENT] C:\QUICKENW\QAGENT.EXE
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\RunDLL32.exe C:\PROGRA~1\OFOTO\OFOTONOW\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Tools_95\imgicon.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5020} - C:\CSFBDIRECT\FLOWHOOK.DLL

... continued on next post...

[gambit293]

...I then followed your Hijack This instructions. I checked the following:

R3 - Default URLSearchHook is missing
F1 - win.ini: load=C:\TOOLS_95\REGISTER\remind.exe
O2 - BHO: VBRunDLL Class - {197B8CA4-E215-46DD-8F33-E0544A80E5C4} - C:\WINDOWS\SYSTEM\VBRUNDLL.DLL (file missing)
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\CFGMGR52.DLL,DllRun
O4 - HKLM\..\Run: [AutoLoaderpz5d1JWTcJIX] "C:\WINDOWS\SYSTEM\LZ3RMT.EXE"
O4 - HKLM\..\Run: [p4mX37j] LZ3RMT.EXE
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)

But could no longer find:
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\CFGMGR52.DLL
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\SYSTEM\VIDCTRL\VIDCTRL.EXE

Perhaps the online scan removed this already?

I rebooted into safe mode, but could not find any of the files to delete. The only thing I did delete was the C:\program files\cas folder.

I rebooted again, and here is the latest Hijack This log. I will run the two online scans tomorrow.

Thanks!

Logfile of HijackThis v1.99.1
Scan saved at 10:38:00 PM, on 7/31/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\B'S CLIP\BSCLIP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE
C:\QUICKENW\QAGENT.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\QUICKENW\QWDLLS.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\PROGRAM FILES\TM1184\CONTROLUTILITY\CONTROLUTILITY.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
O4 - HKLM\..\Run: [MadExe] C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\LaunchRA.exe -boot
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\BSCLIP.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKCU\..\Run: [QAGENT] C:\QUICKENW\QAGENT.EXE
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\RunDLL32.exe C:\PROGRA~1\OFOTO\OFOTONOW\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Tools_95\imgicon.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5020} - C:\CSFBDIRECT\FLOWHOOK.DLL

[Justin]

Hi!

Things are looks a lot better.

After you run the online scans, post a new HJT log for me to look at.

Thanks.

[gambit293]

I was getting pop-ups while running both online scans. Here is the Panda log:


Incident Status Location
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\GWDEF.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CUFG95.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WDI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SHMSCRPT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ALICAP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HXDCI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\QRUT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LGAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PND.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MJNP32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WGASERVC.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OQSSQ400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WXNINET.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lvgif80n.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\SYSTEM\QBUninstaller.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PHFMGR.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CBTDLL.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Cache\Installer.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Pabole32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ABV01W9X.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\viar332.dll
Adware:Adware/Searchforit No disinfected C:\WINDOWS\SYSTEM\ca2.dll
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Brwjtn.exe
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Lhyzbk.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HQSJMCRO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LAAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MEACM.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MWRSERV.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\JDSH400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\imv16.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Stp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ldtif11n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2005.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2063.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2172.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2173.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav3165.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4184.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41C5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D0.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D4.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E1.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4200.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4202.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4243.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4244.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4250.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4251.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4252.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4254.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4255.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav42BC.TMP
Adware:Adware/BookedSpace No disinfected C:\WINDOWS\cfgmgr52.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\banner.dll
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe
....and here is another HIJ log:

Logfile of HijackThis v1.99.1
Scan saved at 6:02:48 PM, on 8/1/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\B'S CLIP\BSCLIP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\QUICKENW\QWDLLS.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
O4 - HKLM\..\Run: [MadExe] C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\LaunchRA.exe -boot
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\BSCLIP.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [QAGENT] C:\QUICKENW\QAGENT.EXE
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\RunDLL32.exe C:\PROGRA~1\OFOTO\OFOTONOW\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Tools_95\imgicon.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5020} - C:\CSFBDIRECT\FLOWHOOK.DLL


Are we winning?
THANKS!!!
-Andrew

[Justin]

Hello!

We are definately winning this battle!

Something odd has happened here. Adaware shows the Look2Me Infection, but you HiJackThis log does not, which is really odd.

So lets check to see if you have the infection!

Download FindIt9xME.

Unzip the contents to a folder. When it has unzipped, open that folder and double click on Find.bat. It will run for a while, so be patient, and then produce a log (ignore any File not found messages on the screen, it should continue anyway).

Please copy and paste that log here.

From the moment you post your list, until you see a detailed fix written up, DO NOT reboot your system or log off. If you do, the files will have changed and the fix provided will not work.

Edited by Jfcap, 01 August 2005 - 04:42 PM.

[gambit293]

Hi Justin,

Here is the findit log:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System Directory -------


Volume in drive C has no label
Volume Serial Number is 07D0-0C0C
Directory of C:\WINDOWS\SYSTEM

CUFG95 DLL 405,504 07-31-05 7:36p CUFG95.DLL
LGAD50 DLL 405,504 07-31-05 7:36p LGAD50.DLL
LTAWD80N DLL 405,504 07-31-05 7:36p ltawd80n.dll
GWDEF DLL 405,504 07-03-05 7:07p GWDEF.DLL
WDI DLL 405,504 07-03-05 7:07p WDI.DLL
SHMSCRPT DLL 405,504 07-03-05 7:07p SHMSCRPT.DLL
ALICAP DLL 405,504 07-03-05 7:07p ALICAP.DLL
HXDCI DLL 405,504 07-03-05 7:07p HXDCI.DLL
QRUT DLL 405,504 07-03-05 7:07p QRUT.DLL
MJNP32 DLL 405,504 07-03-05 7:07p MJNP32.DLL
WGASERVC DLL 405,504 07-03-05 7:07p WGASERVC.DLL
OQSSQ400 DLL 405,504 07-03-05 7:07p OQSSQ400.DLL
WXNINET DLL 405,504 07-03-05 7:07p WXNINET.DLL
LVGIF80N DLL 405,504 07-03-05 7:07p lvgif80n.dll
PHFMGR DLL 405,504 07-03-05 7:07p PHFMGR.DLL
CBTDLL DLL 405,504 07-03-05 7:07p CBTDLL.DLL
PABOLE32 DLL 405,504 07-03-05 7:07p Pabole32.dll
ABV01W9X DLL 405,504 07-03-05 7:07p ABV01W9X.DLL
VIAR332 DLL 405,504 07-03-05 7:07p viar332.dll
HQSJMCRO DLL 405,504 07-03-05 7:07p HQSJMCRO.DLL
LAAD50 DLL 405,504 07-03-05 7:07p LAAD50.DLL
MEACM DLL 405,504 07-03-05 7:07p MEACM.DLL
MWRSERV DLL 405,504 07-03-05 7:07p MWRSERV.DLL
JDSH400 DLL 405,504 07-03-05 7:07p JDSH400.DLL
IMV16 DLL 405,504 07-03-05 7:07p imv16.dll
STP DLL 405,504 07-03-05 7:07p Stp.dll
26 file(s) 10,543,104 bytes
0 dir(s) 3,156.77 MB free

------- Hidden Files in System Directory -------


Volume in drive C has no label
Volume Serial Number is 07D0-0C0C
Directory of C:\WINDOWS\SYSTEM

VIDCTRL <DIR> 06-12-05 10:11p vidctrl
FOLDER HTT 23,155 06-27-00 1:48p FOLDER.HTT
DESKTOP INI 271 06-27-00 1:48p DESKTOP.INI
2 file(s) 23,426 bytes
1 dir(s) 3,156.76 MB free

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{B610C3C1-97CC-B4EA-C6D4-2593E62B2630}"=""

------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
gwdef.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
cufg95.dll Sun Jul 31 2005 7:36:54p ..S.R 405,504 396.00 K
wdi.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
shmscrpt.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
alicap.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
hxdci.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
qrut.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
lgad50.dll Sun Jul 31 2005 7:36:54p ..S.R 405,504 396.00 K
mjnp32.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
wgaservc.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
oqssq400.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
wxninet.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
lvgif80n.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
phfmgr.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
cbtdll.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
pabole32.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
abv01w9x.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
viar332.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
hqsjmcro.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
laad50.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
meacm.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
mwrserv.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
jdsh400.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
imv16.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
stp.dll Sun Jul 3 2005 7:07:48p ..S.R 405,504 396.00 K
ltawd80n.dll Sun Jul 31 2005 7:36:54p ..S.R 405,504 396.00 K

26 items found: 26 files, 0 directories.
Total of file sizes: 10,543,104 bytes 10.05 M

------------ Strings.exe Qoologic Results ------------

C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.P
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.N
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.I
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.H
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.E
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.D
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.G
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.C
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.B
C:\WINDOWS\VPTNFILE.753: TROJ_QOOLOGIC.A
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.P
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.N
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.I
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.H
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.E
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.D
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.G
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.C
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.B
C:\WINDOWS\lpt$vpn.753: TROJ_QOOLOGIC.A

-------------- Strings.exe Aspack Results -------------

C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00

----------------- HKLM Run Key ------------------

-------------- Strings.exe Umonitor Results -------------
C:\WINDOWS\SYSTEM\GWDEF.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\GWDEF.DLL: UMonitor
C:\WINDOWS\SYSTEM\GWDEF.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\CUFG95.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\CUFG95.DLL: UMonitor
C:\WINDOWS\SYSTEM\CUFG95.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\WDI.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\WDI.DLL: UMonitor
C:\WINDOWS\SYSTEM\WDI.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\SHMSCRPT.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\SHMSCRPT.DLL: UMonitor
C:\WINDOWS\SYSTEM\SHMSCRPT.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\ALICAP.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\ALICAP.DLL: UMonitor
C:\WINDOWS\SYSTEM\ALICAP.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\HXDCI.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\HXDCI.DLL: UMonitor
C:\WINDOWS\SYSTEM\HXDCI.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\QRUT.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\QRUT.DLL: UMonitor
C:\WINDOWS\SYSTEM\QRUT.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\LGAD50.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\LGAD50.DLL: UMonitor
C:\WINDOWS\SYSTEM\LGAD50.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\PND.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\PND.DLL: UMonitor
C:\WINDOWS\SYSTEM\PND.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\MJNP32.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\MJNP32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MJNP32.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\WGASERVC.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\WGASERVC.DLL: UMonitor
C:\WINDOWS\SYSTEM\WGASERVC.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\OQSSQ400.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\OQSSQ400.DLL: UMonitor
C:\WINDOWS\SYSTEM\OQSSQ400.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\WXNINET.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\WXNINET.DLL: UMonitor
C:\WINDOWS\SYSTEM\WXNINET.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\lvgif80n.dll: InitUMonitor
C:\WINDOWS\SYSTEM\lvgif80n.dll: UMonitor
C:\WINDOWS\SYSTEM\lvgif80n.dll: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\PHFMGR.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\PHFMGR.DLL: UMonitor
C:\WINDOWS\SYSTEM\PHFMGR.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\CBTDLL.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\CBTDLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\CBTDLL.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\Pabole32.dll: InitUMonitor
C:\WINDOWS\SYSTEM\Pabole32.dll: UMonitor
C:\WINDOWS\SYSTEM\Pabole32.dll: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\ABV01W9X.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\ABV01W9X.DLL: UMonitor
C:\WINDOWS\SYSTEM\ABV01W9X.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\viar332.dll: InitUMonitor
C:\WINDOWS\SYSTEM\viar332.dll: UMonitor
C:\WINDOWS\SYSTEM\viar332.dll: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\HQSJMCRO.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\HQSJMCRO.DLL: UMonitor
C:\WINDOWS\SYSTEM\HQSJMCRO.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\LAAD50.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\LAAD50.DLL: UMonitor
C:\WINDOWS\SYSTEM\LAAD50.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\MEACM.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\MEACM.DLL: UMonitor
C:\WINDOWS\SYSTEM\MEACM.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\MWRSERV.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\MWRSERV.DLL: UMonitor
C:\WINDOWS\SYSTEM\MWRSERV.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\JDSH400.DLL: InitUMonitor
C:\WINDOWS\SYSTEM\JDSH400.DLL: UMonitor
C:\WINDOWS\SYSTEM\JDSH400.DLL: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\imv16.dll: InitUMonitor
C:\WINDOWS\SYSTEM\imv16.dll: UMonitor
C:\WINDOWS\SYSTEM\imv16.dll: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\Stp.dll: InitUMonitor
C:\WINDOWS\SYSTEM\Stp.dll: UMonitor
C:\WINDOWS\SYSTEM\Stp.dll: /cgi-bin/UMonitorV2
C:\WINDOWS\SYSTEM\ltawd80n.dll: InitUMonitor
C:\WINDOWS\SYSTEM\ltawd80n.dll: UMonitor
C:\WINDOWS\SYSTEM\ltawd80n.dll: /cgi-bin/UMonitorV2




...and here is another Hijack log, run immediately after Findit. The system is sitting idle right now, still on but not connected to the Internet. Please let me know your thoughts. Thanks!

-Andrew

Logfile of HijackThis v1.99.1
Scan saved at 9:40:12 PM, on 8/1/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\RXMON9X.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOTIVE\MOTMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\B'S CLIP\BSCLIP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\QUICKENW\QWDLLS.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [RxMon] C:\Program Files\Dell\Resolution Assistant\Common\bin\RxMon9x.exe
O4 - HKLM\..\Run: [MadExe] C:\PROGRAM FILES\DELL\RESOLUTION ASSISTANT\COMMON\BIN\LaunchRA.exe -boot
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\BSCLIP.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [QAGENT] C:\QUICKENW\QAGENT.EXE
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\RunDLL32.exe C:\PROGRA~1\OFOTO\OFOTONOW\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Resolution Assistant.lnk = C:\Program Files\Dell\Resolution Assistant\MotiveAssistant\bin\matcli.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O4 - Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: Iomega Disk Icons.lnk = C:\Tools_95\imgicon.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: Dell Control Utility.lnk = C:\Program Files\TM1184\ControlUtility\ControlUtility.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - C:\Program Files\Net2Phone\Net2fone.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.worldnet.att.net
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: flowto - {C7101FB0-28FB-11D5-883A-204C4F4F5020} - C:\CSFBDIRECT\FLOWHOOK.DLL

[Justin]

Hello!

I found an easy way to fix the VX2 infection on a 9x machine. It used to be really hard.

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

3) Once in Safe Mode, please run Killbox.

4) Select "Delete on Reboot".

5) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\SYSTEM\GWDEF.DLL
C:\WINDOWS\SYSTEM\CUFG95.DLL
C:\WINDOWS\SYSTEM\WDI.DLL
C:\WINDOWS\SYSTEM\SHMSCRPT.DLL
C:\WINDOWS\SYSTEM\ALICAP.DLL
C:\WINDOWS\SYSTEM\HXDCI.DLL
C:\WINDOWS\SYSTEM\QRUT.DLL
C:\WINDOWS\SYSTEM\LGAD50.DLL
C:\WINDOWS\SYSTEM\PND.DLL
C:\WINDOWS\SYSTEM\MJNP32.DLL
C:\WINDOWS\SYSTEM\WGASERVC.DLL
C:\WINDOWS\SYSTEM\OQSSQ400.DLL
C:\WINDOWS\SYSTEM\WXNINET.DLL
C:\WINDOWS\SYSTEM\lvgif80n.dll
C:\WINDOWS\SYSTEM\QBUninstaller.exe
C:\WINDOWS\SYSTEM\PHFMGR.DLL
C:\WINDOWS\SYSTEM\CBTDLL.DLL
C:\WINDOWS\SYSTEM\Cache\Installer.exe
C:\WINDOWS\SYSTEM\Pabole32.dll
C:\WINDOWS\SYSTEM\ABV01W9X.DLL
C:\WINDOWS\SYSTEM\viar332.dll
C:\WINDOWS\SYSTEM\ca2.dll
C:\WINDOWS\SYSTEM\Brwjtn.exe
C:\WINDOWS\SYSTEM\Lhyzbk.exe
C:\WINDOWS\SYSTEM\HQSJMCRO.DLL
C:\WINDOWS\SYSTEM\LAAD50.DLL
C:\WINDOWS\SYSTEM\MEACM.DLL
C:\WINDOWS\SYSTEM\MWRSERV.DLL
C:\WINDOWS\SYSTEM\JDSH400.DLL
C:\WINDOWS\SYSTEM\imv16.dll
C:\WINDOWS\SYSTEM\Stp.dll
C:\WINDOWS\SYSTEM\ldtif11n.dll
C:\WINDOWS\TEMP\pav2005.TMP
C:\WINDOWS\TEMP\pav2063.TMP
C:\WINDOWS\TEMP\pav2172.TMP
C:\WINDOWS\TEMP\pav2173.TMP
C:\WINDOWS\TEMP\pav3165.TMP
C:\WINDOWS\TEMP\pav4184.TMP
C:\WINDOWS\TEMP\pav41C5.TMP
C:\WINDOWS\TEMP\pav41D0.TMP
C:\WINDOWS\TEMP\pav41D4.TMP
C:\WINDOWS\TEMP\pav41D5.TMP
C:\WINDOWS\TEMP\pav41E1.TMP
C:\WINDOWS\TEMP\pav41E2.TMP
C:\WINDOWS\TEMP\pav41E3.TMP
C:\WINDOWS\TEMP\pav41F2.TMP
C:\WINDOWS\TEMP\pav41F3.TMP
C:\WINDOWS\TEMP\pav41F5.TMP
C:\WINDOWS\TEMP\pav4200.TMP
C:\WINDOWS\TEMP\pav4202.TMP
C:\WINDOWS\TEMP\pav4243.TMP
C:\WINDOWS\TEMP\pav4244.TMP
C:\WINDOWS\TEMP\pav4250.TMP
C:\WINDOWS\TEMP\pav4251.TMP
C:\WINDOWS\TEMP\pav4252.TMP
C:\WINDOWS\TEMP\pav4254.TMP
C:\WINDOWS\TEMP\pav4255.TMP
C:\WINDOWS\TEMP\pav42BC.TMP
C:\WINDOWS\cfgmgr52.dll
C:\WINDOWS\banner.dll
C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe
C:\Windows\system\guard.tmp

6) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

7) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.


Then run Panda Active Scan again and post the log.
Panda ActiveScan<<<Accept default settings, save and post the log

Edited by Jfcap, 02 August 2005 - 12:33 AM.

[gambit293]

Hi Justin,

I noticed that killbot didn't seem to want to accept certain files to delete. For example, everytime I pasted the list of files in, C:\Windows\system\guard.tmp was always missing from the list in killbot. I couldn't find C:\Windows\system\guard.tmp using explorer (in safe mode with hide hidden disabled) so maybe it automatically filters out files that are already gone?

Anyway, here is the log. As I was running Panda, at first there were few and seldom pop-ups. They seemed to increase towards the end of the scan, so perhaps the spyware was installing more stuff as Panda was running?

I notice that Panda can sort of be run offline. You can start it, disconnect once it's started, and then reconnect to the Internet to get the results. Should I try this?

Thanks!

Panda log:

Incident Status Location

Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\GWDEF.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SSGE.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CUFG95.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WDI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SHMSCRPT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ALICAP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HXDCI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\QRUT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LGAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PND.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MJNP32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WGASERVC.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OQSSQ400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WXNINET.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lvgif80n.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\SYSTEM\QBUninstaller.exe
Adware:adware/portalscan No disinfected C:\WINDOWS\SYSTEM\winupdt.bin
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PHFMGR.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CBTDLL.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Cache\Installer.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Pabole32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ABV01W9X.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\viar332.dll
Adware:Adware/Searchforit No disinfected C:\WINDOWS\SYSTEM\ca2.dll
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Brwjtn.exe
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Lhyzbk.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HQSJMCRO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LAAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MEACM.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MWRSERV.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\JDSH400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\imv16.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Stp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ltawd80n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2005.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2063.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2172.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2173.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav3165.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4184.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41C5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D0.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D4.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E1.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4200.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4202.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4243.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4244.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4250.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4251.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4252.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4254.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4255.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav42BC.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2362.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav5172.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav5284.TMP
Adware:adware/weirdontheweb No disinfected C:\WINDOWS\Favorites\WeirdOnTheWeb.url
Adware:Adware/BookedSpace No disinfected C:\WINDOWS\cfgmgr52.dll
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\banner.dll
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IW50_QC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MIREPL35.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\HCSJ1695.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\BPOWSEUI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MZDOCS.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WONETMGR.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\RZLMAIN.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LDTIF11N.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LHTIF80N.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1124.CAB[W0657908.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1127.CAB[W0659080.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1130.CAB[W0663218.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1133.CAB[W0663254.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1138.CAB[W0663284.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1135.CAB[W0663264.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1144.CAB[W0664384.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1140.CAB[W0663296.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1147.CAB[W0665399.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1150.CAB[W0667399.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1153.CAB[W0668405.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1158.CAB[W0668440.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1155.CAB[W0668418.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1168.CAB[W0669890.CPY]
Spyware:Spyware/BetterInet No disinfected C:\_RESTORE\ARCHIVE\FS1166.CAB[A0088113.CPY]
Spyware:Spyware/Dyfuca No disinfected C:\_RESTORE\ARCHIVE\FS1166.CAB[A0088130.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088238.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088239.CPY]
Adware:Adware/DealHelper No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088258.CPY]
Virus:Trj/Favadd.G No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088279.CPY]
Adware:Adware/Apropos No disinfected C:\_RESTORE\ARCHIVE\FS1172.CAB[W0670066.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1170.CAB[W0669973.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1175.CAB[W0670266.CPY]
Virus:Trj/Qoologic.D No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088729.CPY]
Virus:Trj/Qoologic.E No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088731.CPY]
Virus:Trj/Qoologic.F No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088733.CPY]
Spyware:Spyware/ShopNav No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088735.CPY]
Virus:Trj/Agent.ABE No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088737.CPY]
Virus:Trj/Clicker.FV No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088739.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088741.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088743.CPY]
Spyware:Spyware/ISTbar No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088745.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088747.CPY]
Adware:Adware/eZula No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088753.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1178.CAB[W0671287.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1184.CAB[W0673444.CPY]
Adware:Adware/Pacimedia No disinfected C:\_RESTORE\ARCHIVE\FS1188.CAB[A0090929.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1187.CAB[W0673534.CPY]
Adware:Adware/Apropos No disinfected C:\_RESTORE\ARCHIVE\FS1193.CAB[A0091193.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1193.CAB[A0091195.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1192.CAB[W0673746.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1189.CAB[W0673612.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1195.CAB[W0674020.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1200.CAB[W0675137.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1197.CAB[W0674048.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091290.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091291.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091292.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1202.CAB[W0675154.CPY]
Virus:Trj/Dropper.DT No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076193.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076205.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076247.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076267.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076268.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076353.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076354.CPY]
Adware:Adware/WinTools No disinfected C:\_RESTORE\ARCHIVE\FS1116.CAB[W0653543.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1115.CAB[A0076355.CPY]
Virus:Trj/Downloader.BYN No disinfected C:\_RESTORE\ARCHIVE\FS1115.CAB[A0076367.CPY]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe

[Justin]

Hello! Lets try this again, dont worry about running PandaScan how you mentioned above. 9x systems do not have guard.tmp on the system, so we included it the first time just to be safe.

Boot your computer into safemode.

Once in Safe Mode, please run Killbox.
Select "Delete on Reboot".

Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:(you can highlight every thing, as KillBox will automatically pull the file names out of the line)

Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\GWDEF.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SSGE.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CUFG95.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WDI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SHMSCRPT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ALICAP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HXDCI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\QRUT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LGAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PND.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MJNP32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WGASERVC.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OQSSQ400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WXNINET.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lvgif80n.dll
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\SYSTEM\QBUninstaller.exe
Adware:adware/portalscan No disinfected C:\WINDOWS\SYSTEM\winupdt.bin
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\PHFMGR.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CBTDLL.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Cache\Installer.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Pabole32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ABV01W9X.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\viar332.dll
Adware:Adware/Searchforit No disinfected C:\WINDOWS\SYSTEM\ca2.dll
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Brwjtn.exe
Adware:Adware/DealHelper No disinfected C:\WINDOWS\SYSTEM\Lhyzbk.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\HQSJMCRO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LAAD50.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MEACM.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MWRSERV.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\JDSH400.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\imv16.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Stp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ltawd80n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2005.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2063.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2172.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2173.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav3165.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4184.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41C5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D0.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D4.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41D5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E1.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41E3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F2.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F3.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav41F5.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4200.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4202.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4243.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4244.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4250.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4251.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4252.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4254.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav4255.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav42BC.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav2362.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav5172.TMP
Adware:Adware/Look2Me No disinfected C:\WINDOWS\TEMP\pav5284.TMP
Adware:adware/weirdontheweb No disinfected C:\WINDOWS\Favorites\WeirdOnTheWeb.url
Adware:Adware/BookedSpace No disinfected C:\WINDOWS\cfgmgr52.dll
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\banner.dll
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\IW50_QC.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MIREPL35.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\HCSJ1695.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\BPOWSEUI.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\MZDOCS.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\WONETMGR.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\RZLMAIN.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LDTIF11N.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\TEMP\LHTIF80N.0
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1124.CAB[W0657908.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1127.CAB[W0659080.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1130.CAB[W0663218.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1133.CAB[W0663254.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1138.CAB[W0663284.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1135.CAB[W0663264.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1144.CAB[W0664384.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1140.CAB[W0663296.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1147.CAB[W0665399.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1150.CAB[W0667399.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1153.CAB[W0668405.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1158.CAB[W0668440.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1155.CAB[W0668418.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1168.CAB[W0669890.CPY]
Spyware:Spyware/BetterInet No disinfected C:\_RESTORE\ARCHIVE\FS1166.CAB[A0088113.CPY]
Spyware:Spyware/Dyfuca No disinfected C:\_RESTORE\ARCHIVE\FS1166.CAB[A0088130.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088238.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088239.CPY]
Adware:Adware/DealHelper No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088258.CPY]
Virus:Trj/Favadd.G No disinfected C:\_RESTORE\ARCHIVE\FS1167.CAB[A0088279.CPY]
Adware:Adware/Apropos No disinfected C:\_RESTORE\ARCHIVE\FS1172.CAB[W0670066.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1170.CAB[W0669973.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1175.CAB[W0670266.CPY]
Virus:Trj/Qoologic.D No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088729.CPY]
Virus:Trj/Qoologic.E No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088731.CPY]
Virus:Trj/Qoologic.F No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088733.CPY]
Spyware:Spyware/ShopNav No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088735.CPY]
Virus:Trj/Agent.ABE No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088737.CPY]
Virus:Trj/Clicker.FV No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088739.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088741.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088743.CPY]
Spyware:Spyware/ISTbar No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088745.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088747.CPY]
Adware:Adware/eZula No disinfected C:\_RESTORE\ARCHIVE\FS1179.CAB[A0088753.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1178.CAB[W0671287.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1184.CAB[W0673444.CPY]
Adware:Adware/Pacimedia No disinfected C:\_RESTORE\ARCHIVE\FS1188.CAB[A0090929.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1187.CAB[W0673534.CPY]
Adware:Adware/Apropos No disinfected C:\_RESTORE\ARCHIVE\FS1193.CAB[A0091193.CPY]
Adware:Adware/DelFinMedia No disinfected C:\_RESTORE\ARCHIVE\FS1193.CAB[A0091195.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1192.CAB[W0673746.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1189.CAB[W0673612.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1195.CAB[W0674020.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1200.CAB[W0675137.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1197.CAB[W0674048.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091290.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091291.CPY]
Adware:Adware/ConsumerAlertSystemNo disinfected C:\_RESTORE\ARCHIVE\FS1199.CAB[A0091292.CPY]
Adware:Adware/Look2Me No disinfected C:\_RESTORE\ARCHIVE\FS1202.CAB[W0675154.CPY]
Virus:Trj/Dropper.DT No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076193.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076205.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076247.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076267.CPY]
Adware:Adware/EliteBar No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076268.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076353.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1114.CAB[A0076354.CPY]
Adware:Adware/WinTools No disinfected C:\_RESTORE\ARCHIVE\FS1116.CAB[W0653543.CPY]
Virus:Trj/Downloader.BJG No disinfected C:\_RESTORE\ARCHIVE\FS1115.CAB[A0076355.CPY]
Virus:Trj/Downloader.BYN No disinfected C:\_RESTORE\ARCHIVE\FS1115.CAB[A0076367.CPY]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe

Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt

Let the computer reboot.

Then run PandaScan again and post the log for me. Once you post the log it is important that you do not reboot your computer, as the files could change with each reboot.

Edited by Jfcap, 02 August 2005 - 12:15 PM.

[gambit293]

Hi Justin,

A few notes before I proceed with killbox again.

-I'm not able to simply paste the list in as is. I have to remove the text before the file path/name (using search/replace in textpad) before killbox accepts it. I'm just letting you know in case we're working off different versions of killbox or something. (mine is 2.0.0.175)

-For the cab files, such as:
C:\_RESTORE\ARCHIVE\FS1124.CAB[W0657908.CPY]

... should the entry in killbox simply look like C:\_RESTORE\ARCHIVE\FS1124.CAB

-Are the pavXXXX.tmp files in the C:\windows\temp directory from malware? Or are they possibly from legit programs or Panda as well? Because there are several thousand additional pavXXXX.tmp files in that directory in addition to the ones listed by Panda. I could use cleanup or even killbox's own Delete Temp Files feature. In the past that has wiped out several hundred megs of files in the windows/temp folder.

Let me know your thoughts. Thanks!

-Andrew

[Justin]

Hello!

Sorry about that, someone told me that it would work, and I guess it doesnt.

Go ahead and clear your temp folders, and then run panda scan again. And post me the log from panda scan. Once you post the log do not reboot.

You do not have to KB those files, I will sort them out for you after the next PandaScan log.