[barneshazmat]

I have some pop up ads that keep coming up wether I'm on line or not. Also the dial up connection box keeps coming up when I don't want to connect. I've tried the normal cleaning methods (Spybot, Ad-Aware, Crusher) but no good.

My Hijack this log is belowLogfile of HijackThis v1.99.1
Scan saved at 8:17:29 AM, on 9/5/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\XUNENWEL.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\VMFSDWVK\COMMAND.EXE
C:\WINDOWS\SYSTEM\NSVSVC\NSVSVC.EXE
C:\WINDOWS\SYSTEM\AUEVLW.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\CFGWIZ32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msnmember.msn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [xunenwel] c:\windows\system\xunenwel.exe
O4 - HKLM\..\Run: [NI.UWFX5] "C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5NETINSTALLER.EXE"/BEFOREINSTALL
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [Command] C:\WINDOWS\VmFsdWVk\command.exe
O4 - HKLM\..\Run: [dnam] C:\D140113.A.STUB.EXE
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\SYSTEM\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [1PLOA4] "C:\CXTPLS_LOADER.EXE" /PC=CP.AOP2
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\KKRVDW.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\AUEVLW.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Emrl] C:\Program Files\disl\sara.exe
O4 - HKCU\..\Run: [Ocaa] C:\Program Files\wrac\atae.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://msnmember.msn.com
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.pho...hxStudent15.CAB
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.../ST/ActiveX.ocx

[Advertisements]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[Buckeye_Sam]

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you.

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.

[barneshazmat]

Thanks for the help, and yes I still need it. I'm helping my Dad in NY try to solve the problem (I'm in CA now). The HJT log posted is still good, he hasn't used the computer since I ran it.

[Buckeye_Sam]

Ok, let's see what we can do for you.

Please make sure that you can View Hidden Files

• Click Start -> My Computer
• Select Tools -> Folder options
• Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
• Also make sure that 'Display the contents of system folders' is checked.

For more info on how to show hidden files click here.



Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\SYSTEM\PSof1.exe
O4 - HKLM\..\Run: [xunenwel] c:\windows\system\xunenwel.exe
O4 - HKLM\..\Run: [NI.UWFX5] "C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5NETINSTALLER.EXE"/BEFOREINSTALL
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [Command] C:\WINDOWS\VmFsdWVk\command.exe
O4 - HKLM\..\Run: [dnam] C:\D140113.A.STUB.EXE
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\SYSTEM\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [1PLOA4] "C:\CXTPLS_LOADER.EXE" /PC=CP.AOP2
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\KKRVDW.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\AUEVLW.exe
O4 - HKCU\..\Run: [Emrl] C:\Program Files\disl\sara.exe
O4 - HKCU\..\Run: [Ocaa] C:\Program Files\wrac\atae.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present



Please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

* if you have trouble getting into Safe mode go here for more info.




Once in Safe mode, delete these files or directories (Do not be concerned if they do not exist):

C:\D140113.A.STUB.EXE
C:\CXTPLS_LOADER.EXE
C:\WINDOWS\CERES.DLL
C:\WINDOWS\AUNPS2.DLL
C:\WINDOWS\SYSTEM\KKRVDW.exe
C:\WINDOWS\SYSTEM\AUEVLW.exe
C:\WINDOWS\SYSTEM\PSof1.exe
C:\WINDOWS\SYSTEM\xunenwel.exe
C:\WINDOWS\DOWNLOADED PROGRAM FILES\UWFX5NETINSTALLER.EXE
C:\WINDOWS\VmFsdWVk <-- delete this folder
C:\WINDOWS\SYSTEM\nsvsvc <-- delete this folder
C:\Program Files\disl <-- delete this folder
C:\Program Files\wrac <-- delete this folder


Reboot your computer to go back to normal mode.



Please run Panda Online Virus Scan

• Make sure it is set to clean automatically.
• There may be files that this scan will not remove.
• Please include that information in your next post.

Reboot and post a new hijackthis log and the info from your virus scan.

[barneshazmat]

Thanks, I'll relay the instructions to my Dad. It may take a couple days to get back to you.

[Buckeye_Sam]

No problem. Post when you can.
I'll be around.

[barneshazmat]

I talked my Dad through the instructions and it seemed to go well. He wasn't able to do the Panda Virus Scan (He's a novice and that was too much for him to handle). Since then he hasn't had any pop-ups, and things seem to be OK. The most recent HJT log is below.

Thanks for your help and your patience,

Eric Barnes

Logfile of HijackThis v1.99.1
Scan saved at 6:41:15 PM, on 9/13/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\ATAE.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\BULLSEYE NETWORK\BIN\BARGAINS.EXE
C:\PROGRAM FILES\NAVISEARCH\BIN\NLS.EXE
C:\PROGRAM FILES\CASHBACK\BIN\CASHBACK.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msnmember.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [xunenwel] c:\windows\system\xunenwel.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://msnmember.msn.com
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.pho...hxStudent15.CAB
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.../ST/ActiveX.ocx

[Buckeye_Sam]

There's still a few problems showing up in the log.

Go to Control Panel -> Add/Remove Programs and uninstall the following programs:

Bullseye Network
Cashback
Navisearch


Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [xunenwel] c:\windows\system\xunenwel.exe



Delete these files, if present:

C:\WINDOWS\SYSTEM\MSBE.DLL
C:\WINDOWS\SYSTEM\NVMS.DLL
C:\WINDOWS\SYSTEM\MSCB.DLL
C:\WINDOWS\CERES.DLL
C:\Program Files\BullsEye Network <-- delete this folder
C:\Program Files\NaviSearch <-- delete this folder
C:\Program Files\CashBack <-- delete this folder
c:\windows\system\xunenwel.exe



Please download the trial version of WebRoot SpySweeper

• Click the Free Trial link under to "SpySweeper" to download the program.
• Install it.
• Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into your next reply.

Reboot your computer and post a new hijackthis log and the log from Spysweeper.

[barneshazmat]

Thanks, it'll take a few days to back to you. (Darn, I thought we had it licked).
Eric

[Buckeye_Sam]

That's ok. Sometimes it can take several steps. This should do it though.

Just post back when you can.

[barneshazmat]

We couldn't remove the Bullseye Network, Cashback Buddy, and Navisearch programs via the Add/Remove Program method (It went to the Uninstall Wizard and kept requiring a survey to be filled out before uninstalling). We didn't do the survey, just deleted the program files through the file manager. While we were attempting to remove the programs, he was getting pop-ups again, but these weren't the same as before. These were mostly asking him to connect to the internet.

Let me know if there are any bad items in the HJT log. Sorry, but my Dad couldn't do the WebRoot SpySweeper.

Eric

Logfile of HijackThis v1.99.1
Scan saved at 4:18:55 PM, on 9/22/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\CONCSA.EXE
C:\PROGRAM FILES\AUTOUPDATE\AUTOUPDATE.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RPCECL.EXE
C:\WINDOWS\SYSTEM\CMUWSELC.EXE
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTSTRAY.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\RPCECL.EXE
C:\PROGRAM FILES\COMMON FILES\WINDOWS\SERVICES32.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://msnmember.msn.com
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\PROGRAM FILES\APRPS\CXTPLS.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [oF8V37j] CONCSA.EXE
O4 - HKLM\..\Run: [AutoUpdater] "c:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Ocaa] C:\Program Files\wrac\atae.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [RPCECL] C:\WINDOWS\SYSTEM\RPCECL.exe
O4 - HKCU\..\Run: [Zor9RXHpX] CMUWSELC.EXE
O4 - HKCU\..\RunOnce: [RPCECL] C:\WINDOWS\SYSTEM\RPCECL.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://msnmember.msn.com
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.pho...hxStudent15.CAB
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.../ST/ActiveX.ocx

[Buckeye_Sam]

You've got a whole slew of new issues(at least 9) in your latest log. In my opinion it is going to be impossible to clean this up without the use of some of these automated programs. Running Spysweeper or Panda online scan is a vital step at this point.

What is the reason that these can't be run?

[barneshazmat]

I'm talking my Dad through the steps remotely (I'm in Cal, He's in NY). He's 82 and not very computer savy, hence the problem. Also, he's on dialup, so I can't talk him through the Panda or Spysweeper installation steps while he's on-line. He's going to run AdAware and Spybot that I already installed for him if that helps any.

I'm surprised there are so many new problems, my Dad hasn't been on-line except to e-mail me his HJT log. He's wasn't having any pop-ups after your first instructions. They didn't reappear until he tried to remove those programs, do some of them re-install things when you try to do that?

I realize all steps are important; I may have to put it on hold until one of my sisters visits them so I relay the instructions through her.

My Dad and I really appreciate your help, sorry to tie your hands

Eric

[Buckeye_Sam]

I understand completely. I thought that might be the case, just wanted to confirm.

Running Adaware and Spybot will help somewhat. Just make sure that he downloads the updates for each of them first.

But I think there's something more sinister going on. With each log there are new instances of malware. This indicates a trojan virus that is downloading these programs each time he connects to the internet. That's not surprising considering that he is not running an antivirus program or a firewall.

First I would advise you that if he does any banking or has personal financial information stored on that computer he should consider it comprimised and take immediate steps with his financial institutions.

Next I would download and install a good firewall. An excellent free one is Zone Alarm and can be downloaded from here.

http://www.zonelabs....reeDownload.jsp

This will allow him to stop any programs(malware) on his computer from accessing the internet, and vice versa. Until you are sure the machine is clean he should disconnect the phone wire from the wall(or shut down the computer) when he is not using the computer. This will prevent dialers from dialing out.



Next I would install an antivirus program and run a full scan. It's sure to find plenty. An excellent free solution is AVG and can be downloaded here.

http://free.grisoft.com/doc/1

AVG is very user friendly and much easier on an older computer than something like Norton or Mcafee.



Let me know how you want to proceed. I'll be glad to help you in any way that I can as long as you want my assistance.

[barneshazmat]

I think sinister is the right word. Actually my Dad does have Norton installed (I think they're worthless), and while I didn't check it, I assumed he had the standard Windows Firewall enabled. He had a computer guy come out last year who fixed something and recommended he get the Norton Anti Virus.

He doesn't do any on-line banking, and has never bought anything on-line using a credit card so there's no personal financial data on the computer. Also he doesn't leave the computer on when he's not using it.

I'll get back to you after I see if we can get some of the programs loaded.

Thanks,

Eric