[umsilver]

Can someone please help me with my Hijack This log file below. I am having problems with Spybot removing DSO and cleveriehooker.jeired. I also have a rediculous search bar at the bottom of my IE that I can't get rid of.

Thank you in advance.
Chad

Logfile of HijackThis v1.99.0
Scan saved at 9:27:33 AM, on 12/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPTBC.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPVSTOP.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPINUPDT.EXE
C:\PROGRAM FILES\MAIL.COM\MCALERT.EXE
C:\PROGRAM FILES\THEWEATHERNETWORK\WEATHEREYE\WEATHEREYE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\COMMON FILES\INTUIT\QUICKBOOKS\QBUPDATE\QBUPDATE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\TV MEDIA\TvmBho.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [PP2000 Taskbar Control] C:\PROGRA~1\PROTEC~1\PPTbc.EXE
O4 - HKLM\..\Run: [PP2000 Real-time Scan] C:\PROGRA~1\PROTEC~1\PPVstop.exe
O4 - HKLM\..\Run: [PP2000 InstaUpdate] C:\PROGRA~1\PROTEC~1\PPInupdt.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [VERBATIM STORE 'N' G] c:\program files\verbatim store n go\verbatim store 'n' go.exe sys_auto_run C:\PROGRAM FILES\VERBATIM STORE N GO
O4 - HKLM\..\Run: [Free Log Readme Noun] C:\WINDOWS\Application Data\Iso Axis Free Log\Driveuser.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\Run: [Mail.com] C:\Program Files\mail.com\mcalert.exe -auto
O4 - HKCU\..\Run: [WeatherEye] C:\program files\TheWeatherNetwork\WeatherEye\WeatherEye
O4 - HKCU\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServicesOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

[Advertisements]

First follow instructions here:
http://support.micro...om/?kbid=886590

Then look here:
http://www.majorgeek...wnload4392.html

Then post a new HijackThis log along with any complaints that are left to take care off.

Regards,

Pieter

[Metallica]

First follow instructions here:
http://support.micro...om/?kbid=886590

Then look here:
http://www.majorgeek...wnload4392.html

Then post a new HijackThis log along with any complaints that are left to take care off.

Regards,

Pieter

[umsilver]

Hello,

Tried running the 1st program you mentioned and got these 2 errors:

"The TVMCLN.EXE file is linked to missing export SHELL32.DLL:SHGetFolderPathA"

and

"Error creating process <C:\windows\temp\IXP000.TMP\TVMCln.exe> Reason: A device attached to the system is not functioning"

And I already have Spybot loaded on my computer. It still finds my 2 previously mentioned problems.

This doesn't seem good. Do you have any suggestions?

Chad

[Metallica]

Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\TV MEDIA\TvmBho.dll

O4 - HKLM\..\Run: [Free Log Readme Noun] C:\WINDOWS\Application Data\Iso Axis Free Log\Driveuser.exe

O4 - HKLM\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE

O4 - HKCU\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServicesOnce: [TV Media] C:\TV MEDIA\TVM.EXE

Reboot after doing so, preferably into safe mode and delete:
C:\TV MEDIA <= entire folder

Please reread the article at majorgeeks.
I know you have Spybot S&D since the DSO Exploit is a false positive by that program.

Regards,

Pieter

[umsilver]

Thank you! Everything is clean now.

[Metallica]

Glad we could help.

Safe surfing,

Pieter