Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Pop ups, etc. HELP PLEASE. [RESOLVED]

Started by C0mputerIlliterate , Sep 29 2005 08:18 AM

This topic is locked

#1
C0mputerIlliterate

Posted 29 September 2005 - 08:18 AM

Member

Member
15 posts

First off, I know nothing about computers. :tazz:

I've been getting a lot of pop ups lately. I usually use Moxilla Firefox but even that started to have pop ups so now I'm using my MSN bowser. I've also gotten the WinFixer thing that keeps popping out of nowhere. I had E2G also but I think I just got rid of it, finally.
But please if anybody could just look at my logfile and tell me if you see anything. Also, I think I need an anti-virus program since I only have the free AVG one. I have SpySweeper for spyware.. but still, I keep getting pop ups. I on't know what to do anymore. So please help me. I need suggestions on what anti-virus program I should get.. and other security stuff.

Logfile of HijackThis v1.99.1
Scan saved at 10:09:47 AM, on 9/29/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYS98.EXE
C:\WINDOWS\MS04541905439.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\PTRU.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R3 - URLSearchHook: (no name) - {4F973FE9-BE81-6F96-8A49-B5A29C2D90D0} - C:\WINDOWS\Mbiakvyn.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBARBHO.DLL
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O2 - BHO: PopupManager Class - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL
O2 - BHO: SDWin32 Class - {8AB8E03C-926C-415A-A5CC-868A31FF6A50} - C:\WINDOWS\SYSTEM\OXINR.DLL
O2 - BHO: SDWin32 Class - {222BB75F-9204-44C2-B81D-6026E6D4C564} - C:\WINDOWS\SYSTEM\DEJSS.DLL
O2 - BHO: (no name) - {3989ADB4-3008-1F84-2974-38B6094DF59E} - C:\WINDOWS\SYSTEM\ESCFWBW.DLL
O2 - BHO: (no name) - {65B4E560-7552-7BF1-32C4-33281D416AED} - C:\WINDOWS\Mbiakvyn.dll
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O2 - BHO: CPub Object - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\SYSTEM\ADCOM.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [YourMonitor] C:\WINDOWS\SYS98
O4 - HKLM\..\Run: [ms04541905439] C:\WINDOWS\ms04541905439.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4dsx4d.exe reg_run
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Startup: ptru.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay10...es/MsnPUpld.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...534/mcfscan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

#2
Buckeye_Sam

Posted 03 October 2005 - 08:24 PM

Malware Expert

Member
10,019 posts

Hi and welcome to GeeksToGo! My name is Sam and I will be helping you. :tazz:

Before we can get started on fixing your problem you must change the location of Hijackthis. It should not run directly from your desktop or a temp directory. Please create a directory on your c: drive called c:\hijackthis and download and unzip hijackthis into that directory. Run the program from that directory from now on. It is essential that you follow these steps or certain important features of the program will not function correctly.

Once you have Hijackthis running from a permanent folder, please reboot and post a new hijackthis log.

#3
C0mputerIlliterate

Posted 04 October 2005 - 03:26 PM

Member

Topic Starter
Member
15 posts

Thanks for the reply.. I did what you said (I think) and here is the new logfile.

Logfile of HijackThis v1.99.1
Scan saved at 5:31:48 PM, on 10/4/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYS98.EXE
C:\WINDOWS\MS04541905439.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\MY DOCUMENTS\DOWNLOAD\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R3 - URLSearchHook: (no name) - {4F973FE9-BE81-6F96-8A49-B5A29C2D90D0} - C:\WINDOWS\Mbiakvyn.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBARBHO.DLL
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O2 - BHO: PopupManager Class - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL
O2 - BHO: SDWin32 Class - {8AB8E03C-926C-415A-A5CC-868A31FF6A50} - C:\WINDOWS\SYSTEM\OXINR.DLL
O2 - BHO: SDWin32 Class - {222BB75F-9204-44C2-B81D-6026E6D4C564} - C:\WINDOWS\SYSTEM\DEJSS.DLL
O2 - BHO: (no name) - {3989ADB4-3008-1F84-2974-38B6094DF59E} - C:\WINDOWS\SYSTEM\ESCFWBW.DLL (file missing)
O2 - BHO: (no name) - {65B4E560-7552-7BF1-32C4-33281D416AED} - C:\WINDOWS\Mbiakvyn.dll
O2 - BHO: CPub Object - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\SYSTEM\ADCOM.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKLM\..\Run: [YourMonitor] C:\WINDOWS\SYS98
O4 - HKLM\..\Run: [ms04541905439] C:\WINDOWS\ms04541905439.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\RunServices: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay10...es/MsnPUpld.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...534/mcfscan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

#4
Buckeye_Sam

Posted 04 October 2005 - 07:17 PM

Malware Expert

Member
10,019 posts

First we need to download and prepare some tools that we will need to fix your problem.

Please download CWShredder but don't run it yet.
Please download Adaware SE 1.06
Install Adaware and check for updates, but don't run it yet.
Please download CleanUp 4.0
Install CleanUp, but don't run it yet.

==============

Now that you have the right tools we can start fixing your problem.

Please make sure that you can View Hidden Files

Please print out these instructions as the rest of this fix must be done in Safe mode and you won't be able to access the Internet.

Please reboot your computer in SafeMode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

* if you have trouble getting into Safe mode go here for more info.

=============

Once in Safe mode, follow these steps:

Run CWShredder, making sure to click on "Fix".
Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

R3 - URLSearchHook: (no name) - {4F973FE9-BE81-6F96-8A49-B5A29C2D90D0} - C:\WINDOWS\Mbiakvyn.dll
O2 - BHO: SDWin32 Class - {8AB8E03C-926C-415A-A5CC-868A31FF6A50} - C:\WINDOWS\SYSTEM\OXINR.DLL
O2 - BHO: SDWin32 Class - {222BB75F-9204-44C2-B81D-6026E6D4C564} - C:\WINDOWS\SYSTEM\DEJSS.DLL
O2 - BHO: (no name) - {3989ADB4-3008-1F84-2974-38B6094DF59E} - C:\WINDOWS\SYSTEM\ESCFWBW.DLL (file missing)
O2 - BHO: (no name) - {65B4E560-7552-7BF1-32C4-33281D416AED} - C:\WINDOWS\Mbiakvyn.dll
O2 - BHO: CPub Object - {D7950AB4-67F5-458e-A37D-9F2DE7F250AC} - C:\WINDOWS\SYSTEM\ADCOM.DLL
O4 - HKLM\..\Run: [YourMonitor] C:\WINDOWS\SYS98
O4 - HKLM\..\Run: [ms04541905439] C:\WINDOWS\ms04541905439.exe
Delete these files (Do not be concerned if they do not exist);

C:\WINDOWS\SYSTEM\OXINR.DLL
C:\WINDOWS\SYSTEM\DEJSS.DLL
C:\WINDOWS\SYSTEM\ESCFWBW.DLL
C:\WINDOWS\Mbiakvyn.dll
C:\WINDOWS\SYSTEM\ADCOM.DLL
C:\WINDOWS\SYS98.exe
C:\WINDOWS\ms04541905439.exe
Now run CleanUp
IMPORTANT!
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp
Open Ad-aware and do a full scan. Remove everything that it finds.
Reboot back into normal mode.
Please run this online virus scan - Panda Virus Scan
- Make sure it is set to clean automatically.
- There may be files that this scan will not remove. Please save that information to include in your next post.
Reboot your computer and post the following information in your next reply:
- A new Hijackthis log
- The log from Panda online virus scan

Let me know how things are running and what problems you are still having.

#5
C0mputerIlliterate

Posted 05 October 2005 - 05:10 PM

Member

Topic Starter
Member
15 posts

The new Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 7:13:14 PM, on 10/5/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\MY DOCUMENTS\DOWNLOAD\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBARBHO.DLL
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O2 - BHO: PopupManager Class - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\RunServices: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay10...es/MsnPUpld.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...534/mcfscan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab

-----

(I don't know if I did this right).... from Panda online virus scan:

Incident Status Location

Adware:Adware/Naupoint No disinfected C:\PROGRAM FILES\COMMON FILES\VERIZON ONLINE\SFP\VZBB.DLL
Adware:adware/wupd No disinfected C:\WINDOWS\SYSTEM\ide21201.vxd
Adware:adware/navipromo No disinfected C:\WINDOWS\SYSTEM\msegcompid.dll
Adware:adware/iedriver No disinfected C:\WINDOWS\SYSTEM\Searchx.htm
Adware:adware/searchresults No disinfected C:\WINDOWS\SYSTEM\qlink32.dll
Adware:adware/ncase No disinfected C:\TEMP\salm.log
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Adware:adware/adurl No disinfected C:\WINDOWS\icont.exe
Adware:adware/statblaster No disinfected C:\PROGRAM FILES\WildArcade
Adware:adware/ist.istbar No disinfected C:\PROGRAM FILES\Daily Weather Forecast
Adware:adware/consumeralertsystemNo disinfected C:\PROGRAM FILES\CasStub
Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\InetGet
Adware:adware/e2give No disinfected Windows Registry
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\QLGR.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MENDEX.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MPXBSE35.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MLVIDEO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Cgqscan.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SPSTHUNK.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\IS_NDI.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OOE2CONV.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\pjwma.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ROCHED32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\RVASETUP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MKAWT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SIDOCLC.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\UXDM32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LENKINFO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WUVDMOD.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\LWNKINFO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\myvcr71.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OQE2DISP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Ccqscan.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OPEACCRC.DLL
Virus:Trj/Prutec.O Disinfected C:\WINDOWS\SYSTEM\conntr.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CWNTAB32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\OTBCCP32.DLL
Virus:Trj/Downloader.AYV Disinfected C:\WINDOWS\SYSTEM\2bundle.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MCWSTR10.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WCPDINFO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MIWSTR10.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\DEVVOX.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\dumasf.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\coaiicur.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MESWCH.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CGOL.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\RAASERV.DLL
Dialer:Dialer.CWI No disinfected C:\WINDOWS\SYSTEM\msclock32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\sbnsapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\DTCVW_32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\mdpatcha.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\sznsapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\IHSRMT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MUVBVM60.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MHJET35.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\USNP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MQJET35.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\mdvcr71.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CWBVIEW.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\dEd8.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\FUPWPP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\IHMUPG.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lqgif11n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lepsd11n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\mcxml3a.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\mnxml4r.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MYRATING.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\Msstery.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\IEROP.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\COAIRES.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\cnfview.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\SBEM0409.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\AHD.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MKCD30.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\cmaiicur.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\DKNPUT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MQPIX.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WYPDINFO.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\DMMM.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MNHTML.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WCNMM.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\NFSWAN16.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\MKC42ENU.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\DCVMGR32.DLL
Spyware:Spyware/UrlSpy No disinfected C:\WINDOWS\SYSTEM\IEHost30.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\ojhlp30e.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\mhc42loc.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\szrof32.dll
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\dbmtur.exe
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CNMMTB32.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\WWVDMOD.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\NRMKCERT.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\STDOCLC.DLL
Virus:Trj/Downloader.AYV Disinfected C:\WINDOWS\SYSTEM\newexp
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\IXWPHBK.DLL
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\cmaiclr.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\lhbmp11n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\SYSTEM\CWMDLG32.DLL
Spyware:Spyware/UrlSpy No disinfected C:\WINDOWS\SYSTEM\pinstaller.exe
Virus:Trj/Prutec.O Disinfected C:\WINDOWS\SYSTEM\jgmcpx.exe
Virus:Trj/Prutec.O Disinfected C:\WINDOWS\SYSTEM\mtxcom.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\olehtm.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\msrcfg.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\cmpmca.exe
Virus:Trj/Downloader.AYV Disinfected C:\WINDOWS\SYSTEM\pre.exe
Virus:Exploit/ByteVerify Disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-28222fd8-612dd374.zip[BlackBox.class]
Virus:Exploit/ByteVerify Disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-28222fd8-612dd374.zip[VerifierBug.class]
Virus:Exploit/ByteVerify Disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-28222fd8-612dd374.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-28222fd8-612dd374.zip[Beyond.class]
Adware:Adware/IST.ISTBar No disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-5472b609.zip[InstallerApplet.class]
Adware:Adware/Naupoint No disinfected C:\Program Files\Common Files\Verizon Online\SFP\vzbb.dll
Adware:Adware/PurityScan No disinfected C:\Program Files\eted\rree.exe
Adware:Adware/ConsumerAlertSystemNo disinfected C:\Program Files\Cas\Client\Uninstall.exe
Adware:Adware/StartPage.AHW No disinfected C:\My Documents\download\backups\backup-20051005-181653-452.dll
Adware:Adware/WinAD No disinfected C:\temp\MediaAccessInstPack.exe
Adware:Adware/E2Give No disinfected C:\dwlois2.exe
Adware:Adware/AlwaysupdatednewsNo disinfected C:\shopinst.exe
Virus:Trj/Delmed.A Disinfected C:\d140113.a.Stub.exe
Virus:Trj/Downloader.AYV Disinfected C:\VB2.exe
Adware:Adware/BigTrafficNet No disinfected C:\btnetw3_187354.exe
Virus:Trj/Downloader.AYV Disinfected C:\Pop2.exe
Virus:Trj/Downloader.BJG Disinfected C:\MTE2ODI6ODoxNg.exe
Adware:Adware/ISearch No disinfected C:\MTE2NzY6ODoxNg.exe
Adware:Adware/QoolShown No disinfected C:\installer.exe
Adware:Adware/QoolShown No disinfected C:\installer2.exe
Virus:Trj/Downloader.AYV Disinfected C:\cornseedB.exe
Adware:Adware/E2Give No disinfected C:\pi1_51.exe
Adware:Adware/StartPage.AHW No disinfected C:\venturab_installer.exe
Virus:Trj/Downloader.EZG Disinfected C:\30016.exe
Virus:Trj/Downloader.AYV Disinfected C:\YCWT.exe
Virus:W32/Mytob.AS.worm Disinfected [document.zip][document.htm .exe]
Virus:W32/Mytob.AS.worm Disinfected [message.zip][message.scr]

#6
Buckeye_Sam

Posted 05 October 2005 - 06:49 PM

Malware Expert

Member
10,019 posts

That's perfect! It shows me just what we needed to see.

Download the Pocket Killbox.

Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.

Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:
- C:\PROGRAM FILES\COMMON FILES\VERIZON ONLINE\SFP\VZBB.DLL
  C:\WINDOWS\SYSTEM\ide21201.vxd
  C:\WINDOWS\SYSTEM\msegcompid.dll
  C:\WINDOWS\SYSTEM\Searchx.htm
  C:\WINDOWS\SYSTEM\qlink32.dll
  C:\TEMP\salm.log
  C:\WINDOWS\cfgmgr52.ini
  C:\WINDOWS\icont.exe
  C:\WINDOWS\SYSTEM\msclock32.dll
  C:\WINDOWS\SYSTEM\IEHost30.exe
  C:\WINDOWS\SYSTEM\dbmtur.exe
  C:\WINDOWS\SYSTEM\pinstaller.exe
  C:\WINDOWS\SYSTEM\jgmcpx.exe
  C:\WINDOWS\SYSTEM\mtxcom.exe
  C:\WINDOWS\SYSTEM\olehtm.exe
  C:\WINDOWS\SYSTEM\msrcfg.exe
  C:\WINDOWS\SYSTEM\cmpmca.exe
  C:\WINDOWS\SYSTEM\pre.exe
  C:\Program Files\eted\rree.exe
  C:\Program Files\Cas\Client\Uninstall.exe
  C:\My Documents\download\backups\backup-20051005-181653-452.dll
  C:\temp\MediaAccessInstPack.exe
  C:\dwlois2.exe
  C:\shopinst.exe
  C:\d140113.a.Stub.exe
  C:\VB2.exe
  C:\btnetw3_187354.exe
  C:\Pop2.exe
  C:\MTE2ODI6ODoxNg.exe
  C:\MTE2NzY6ODoxNg.exe
  C:\installer.exe
  C:\installer2.exe
  C:\cornseedB.exe
  C:\pi1_51.exe
  C:\venturab_installer.exe
  C:\30016.exe
  C:\YCWT.exe
Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Your system will reboot now.

Next please delete these folders.

C:\Program Files\eted
C:\Program Files\Cas
C:\PROGRAM FILES\WildArcade
C:\PROGRAM FILES\Daily Weather Forecast
C:\PROGRAM FILES\CasStub
C:\PROGRAM FILES\COMMON FILES\InetGet

Please download L2m9xfix here:
http://swandog46.gee...om/l2m9xfix.exe

Save it to the desktop and run it. Extract the files, and then open the l2m9xfix folder you just created and run RunThis.bat.

A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.

Then please restart your computer, and post a new HijackThis log as well as the entire text of the log.txt file which should be in the same folder as RunThis.bat.

#7
C0mputerIlliterate

Posted 06 October 2005 - 04:56 PM

Member

Topic Starter
Member
15 posts

HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 7:01:20 PM, on 10/6/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\MY DOCUMENTS\DOWNLOAD\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBARBHO.DLL
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O2 - BHO: PopupManager Class - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\RunServices: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay10...es/MsnPUpld.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...534/mcfscan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab

---------

log.txt file:

Log of L2M9XFix v1.01a

************

Running from directory:
C:\My Documents\l2m9xfix

************

Files found:

C:\WINDOWS\system\AHD.DLL
C:\WINDOWS\system\Ccqscan.dll
C:\WINDOWS\system\CGOL.DLL
C:\WINDOWS\system\Cgqscan.dll
C:\WINDOWS\system\cmaiclr.dll
C:\WINDOWS\system\cmaiicur.dll
C:\WINDOWS\system\cnfview.dll
C:\WINDOWS\system\CNMMTB32.DLL
C:\WINDOWS\system\coaiicur.dll
C:\WINDOWS\system\COAIRES.DLL
C:\WINDOWS\system\CWBVIEW.DLL
C:\WINDOWS\system\CWMDLG32.DLL
C:\WINDOWS\system\CWNTAB32.DLL
C:\WINDOWS\system\DCVMGR32.DLL
C:\WINDOWS\system\dEd8.dll
C:\WINDOWS\system\DEVVOX.DLL
C:\WINDOWS\system\DKNPUT.DLL
C:\WINDOWS\system\DMMM.DLL
C:\WINDOWS\system\DTCVW_32.DLL
C:\WINDOWS\system\dumasf.dll
C:\WINDOWS\system\FUPWPP.DLL
C:\WINDOWS\system\IEROP.DLL
C:\WINDOWS\system\IHMUPG.DLL
C:\WINDOWS\system\IHSRMT.DLL
C:\WINDOWS\system\IS_NDI.DLL
C:\WINDOWS\system\IXWPHBK.DLL
C:\WINDOWS\system\LENKINFO.DLL
C:\WINDOWS\system\lepsd11n.dll
C:\WINDOWS\system\lhbmp11n.dll
C:\WINDOWS\system\lqgif11n.dll
C:\WINDOWS\system\LWNKINFO.DLL
C:\WINDOWS\system\MCWSTR10.DLL
C:\WINDOWS\system\mcxml3a.dll
C:\WINDOWS\system\mdpatcha.dll
C:\WINDOWS\system\mdvcr71.dll
C:\WINDOWS\system\MENDEX.DLL
C:\WINDOWS\system\MESWCH.DLL
C:\WINDOWS\system\mhc42loc.dll
C:\WINDOWS\system\MHJET35.DLL
C:\WINDOWS\system\MIWSTR10.DLL
C:\WINDOWS\system\MKAWT.DLL
C:\WINDOWS\system\MKC42ENU.DLL
C:\WINDOWS\system\MKCD30.DLL
C:\WINDOWS\system\MLVIDEO.DLL
C:\WINDOWS\system\MNHTML.DLL
C:\WINDOWS\system\mnxml4r.dll
C:\WINDOWS\system\MPXBSE35.DLL
C:\WINDOWS\system\MQJET35.DLL
C:\WINDOWS\system\MQPIX.DLL
C:\WINDOWS\system\Msstery.dll
C:\WINDOWS\system\MUVBVM60.DLL
C:\WINDOWS\system\MYRATING.DLL
C:\WINDOWS\system\myvcr71.dll
C:\WINDOWS\system\NFSWAN16.DLL
C:\WINDOWS\system\NRMKCERT.DLL
C:\WINDOWS\system\ojhlp30e.dll
C:\WINDOWS\system\OOE2CONV.DLL
C:\WINDOWS\system\OPEACCRC.DLL
C:\WINDOWS\system\OQE2DISP.DLL
C:\WINDOWS\system\OTBCCP32.DLL
C:\WINDOWS\system\pjwma.dll
C:\WINDOWS\system\QLGR.DLL
C:\WINDOWS\system\RAASERV.DLL
C:\WINDOWS\system\ROCHED32.DLL
C:\WINDOWS\system\RVASETUP.DLL
C:\WINDOWS\system\SBEM0409.DLL
C:\WINDOWS\system\sbnsapi.dll
C:\WINDOWS\system\SIDOCLC.DLL
C:\WINDOWS\system\SPSTHUNK.DLL
C:\WINDOWS\system\STDOCLC.DLL
C:\WINDOWS\system\sznsapi.dll
C:\WINDOWS\system\szrof32.dll
C:\WINDOWS\system\USNP.DLL
C:\WINDOWS\system\UXDM32.DLL
C:\WINDOWS\system\WCNMM.DLL
C:\WINDOWS\system\WCPDINFO.DLL
C:\WINDOWS\system\WUVDMOD.DLL
C:\WINDOWS\system\WWVDMOD.DLL
C:\WINDOWS\system\WYPDINFO.DLL

************

Registry entries found:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{8B2AEB1B-5807-C509-DD66-1A655B9A5CDF}"=""

************

Killing Explorer
Done!

Killing Rundll32
Done!

Removing malicious CLSID(s)
Done!

Restarting Explorer
Done!

Deleting malicious files
Done!

Finished!

#8
Buckeye_Sam

Posted 06 October 2005 - 05:10 PM

Malware Expert

Member
10,019 posts

Please run a new scan with Panda and post the log here in your next reply.

How are things working for you now?

#9
C0mputerIlliterate

Posted 06 October 2005 - 05:50 PM

Member

Topic Starter
Member
15 posts

Thanks for helping me. No popups so far! Hehe. Although the startup has been really slow and Explorer keeps getting that "Not Responding" error. But I figured it's probably just because this computer is getting old.

Panda log:

Incident Status Location

Adware:Adware/Naupoint No disinfected C:\PROGRAM FILES\COMMON FILES\VERIZON ONLINE\SFP\VZBB.DLL
Adware:adware/wupd No disinfected C:\WINDOWS\SYSTEM\ide21201.vxd
Adware:adware/navipromo No disinfected C:\WINDOWS\SYSTEM\msegcompid.dll
Adware:adware/iedriver No disinfected C:\WINDOWS\SYSTEM\Searchx.htm
Adware:adware/searchresults No disinfected C:\WINDOWS\SYSTEM\qlink32.dll
Adware:adware/ncase No disinfected C:\TEMP\salm.log
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Adware:adware/adurl No disinfected C:\WINDOWS\icont.exe
Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\Windows
Adware:adware/consumeralertsystemNo disinfected Windows Registry
Dialer:Dialer.CWI No disinfected C:\WINDOWS\SYSTEM\msclock32.dll
Spyware:Spyware/UrlSpy No disinfected C:\WINDOWS\SYSTEM\IEHost30.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\dbmtur.exe
Spyware:Spyware/UrlSpy No disinfected C:\WINDOWS\SYSTEM\pinstaller.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\olehtm.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\msrcfg.exe
Adware:Adware/SearchTheWeb No disinfected C:\WINDOWS\SYSTEM\cmpmca.exe
Adware:Adware/IST.ISTBar No disinfected C:\WINDOWS\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3cc46f89-5472b609.zip[InstallerApplet.class]
Adware:Adware/Naupoint No disinfected C:\Program Files\Common Files\Verizon Online\SFP\vzbb.dll
Adware:Adware/StartPage.AHW No disinfected C:\My Documents\download\backups\backup-20051005-181653-452.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\AHD.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\Ccqscan.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\CGOL.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\Cgqscan.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\cmaiclr.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\cmaiicur.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\cnfview.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\CNMMTB32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\coaiicur.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\COAIRES.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\CWBVIEW.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\CWMDLG32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\CWNTAB32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\DCVMGR32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\dEd8.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\DEVVOX.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\DKNPUT.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\DMMM.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\DTCVW_32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\dumasf.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\FUPWPP.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\IEROP.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\IHMUPG.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\IHSRMT.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\IS_NDI.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\IXWPHBK.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\LENKINFO.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\lepsd11n.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\lhbmp11n.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\lqgif11n.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\LWNKINFO.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MCWSTR10.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\mcxml3a.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\mdpatcha.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\mdvcr71.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MENDEX.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MESWCH.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\mhc42loc.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MHJET35.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MIWSTR10.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MKAWT.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MKC42ENU.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MKCD30.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MLVIDEO.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MNHTML.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\mnxml4r.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MPXBSE35.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MQJET35.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MQPIX.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\Msstery.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MUVBVM60.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\MYRATING.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\myvcr71.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\NFSWAN16.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\NRMKCERT.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\ojhlp30e.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\OOE2CONV.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\OPEACCRC.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\OQE2DISP.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\OTBCCP32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\pjwma.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\QLGR.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\RAASERV.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\ROCHED32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\RVASETUP.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\SBEM0409.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\sbnsapi.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\SIDOCLC.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\SPSTHUNK.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\STDOCLC.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\sznsapi.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\szrof32.dll
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\USNP.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\UXDM32.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\WCNMM.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\WCPDINFO.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\WUVDMOD.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\WWVDMOD.DLL
Adware:Adware/Look2Me No disinfected C:\My Documents\l2m9xfix\backups\WYPDINFO.DLL
Adware:Adware/PurityScan No disinfected C:\RECYCLED\Dc4\rree.exe
Adware:Adware/ConsumerAlertSystemNo disinfected C:\RECYCLED\Dc5\Client\Uninstall.exe
Adware:Adware/WinAD No disinfected C:\temp\MediaAccessInstPack.exe
Adware:Adware/E2Give No disinfected C:\dwlois2.exe
Adware:Adware/AlwaysupdatednewsNo disinfected C:\shopinst.exe
Adware:Adware/StartPage.AHW No disinfected C:\!KillBox\venturab_installer.exe
Adware:Adware/E2Give No disinfected C:\!KillBox\pi1_51.exe
Adware:Adware/QoolShown No disinfected C:\!KillBox\installer2.exe
Adware:Adware/QoolShown No disinfected C:\!KillBox\installer.exe
Adware:Adware/ISearch No disinfected C:\!KillBox\MTE2NzY6ODoxNg.exe
Adware:Adware/BigTrafficNet No disinfected C:\!KillBox\btnetw3_187354.exe
Adware:Adware/AlwaysupdatednewsNo disinfected C:\!KillBox\shopinst.exe
Adware:Adware/E2Give No disinfected C:\!KillBox\dwlois2.exe
Adware:Adware/WinAD No disinfected C:\!KillBox\MediaAccessInstPack.exe
Adware:Adware/StartPage.AHW No disinfected C:\!KillBox\backup-20051005-181653-452.dll
Adware:Adware/ConsumerAlertSystemNo disinfected C:\!KillBox\Uninstall.exe
Adware:Adware/PurityScan No disinfected C:\!KillBox\rree.exe
Adware:Adware/SearchTheWeb No disinfected C:\!KillBox\cmpmca.exe
Adware:Adware/SearchTheWeb No disinfected C:\!KillBox\msrcfg.exe
Adware:Adware/SearchTheWeb No disinfected C:\!KillBox\olehtm.exe
Spyware:Spyware/UrlSpy No disinfected C:\!KillBox\pinstaller.exe
Adware:Adware/SearchTheWeb No disinfected C:\!KillBox\dbmtur.exe
Spyware:Spyware/UrlSpy No disinfected C:\!KillBox\IEHost30.exe
Dialer:Dialer.CWI No disinfected C:\!KillBox\msclock32.dll
Adware:Adware/Naupoint No disinfected C:\!KillBox\vzbb.dll
Adware:Adware/BigTrafficNet No disinfected C:\btnetw3_187354.exe
Adware:Adware/ISearch No disinfected C:\MTE2NzY6ODoxNg.exe
Adware:Adware/QoolShown No disinfected C:\installer.exe
Adware:Adware/QoolShown No disinfected C:\installer2.exe
Adware:Adware/E2Give No disinfected C:\pi1_51.exe
Adware:Adware/StartPage.AHW No disinfected C:\venturab_installer.exe

#10
Buckeye_Sam

Posted 07 October 2005 - 12:36 PM

Malware Expert

Member
10,019 posts

There's still a few things that Panda is picking up on that might be slowing you down.

Please make sure that you can View Hidden Files

Click Start -> My Computer
Select Tools -> Folder options
Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
Also make sure that 'Display the contents of system folders' is checked.
For more info on how to show hidden files click here.

Please delete these files by navigating to their location and manually deleting them:

C:\PROGRAM FILES\COMMON FILES\VERIZON ONLINE\SFP\VZBB.DLL
C:\WINDOWS\SYSTEM\ide21201.vxd
C:\WINDOWS\SYSTEM\msegcompid.dll
C:\WINDOWS\SYSTEM\Searchx.htm
C:\WINDOWS\SYSTEM\qlink32.dll
C:\WINDOWS\cfgmgr52.ini
C:\WINDOWS\icont.exe
C:\WINDOWS\SYSTEM\msclock32.dll
C:\WINDOWS\SYSTEM\IEHost30.exe
C:\WINDOWS\SYSTEM\dbmtur.exe
C:\WINDOWS\SYSTEM\pinstaller.exe
C:\WINDOWS\SYSTEM\olehtm.exe
C:\WINDOWS\SYSTEM\msrcfg.exe
C:\WINDOWS\SYSTEM\cmpmca.exe
C:\temp\MediaAccessInstPack.exe
C:\TEMP\salm.log
C:\dwlois2.exe
C:\shopinst.exe
C:\btnetw3_187354.exe
C:\MTE2NzY6ODoxNg.exe
C:\installer.exe
C:\installer2.exe
C:\pi1_51.exe
C:\venturab_installer.exe

Is Spysweeper current and updated? If so, please run a scan with Spysweeper and post the log from the scan in your reply along with a new hijackthis log. If Spysweeper is not current, let me know and just post a new hijackthis log.

#11
C0mputerIlliterate

Posted 07 October 2005 - 09:28 PM

Member

Topic Starter
Member
15 posts

Thank you again!
Spysweeper is updated.. but this is the log that I got:

11:13 PM: |··· Start of Session, Friday, October 07, 2005 ···|
11:13 PM: Spy Sweeper started
11:13 PM: Sweep initiated using definitions version 551
11:13 PM: Starting Memory Sweep
11:13 PM: Warning: Failed to load image: C:\WINDOWS\SYSTEM\MSGSRV32.EXE
11:14 PM: Warning: Failed to load image: C:\WINDOWS\SYSTEM\MMTASK.TSK
11:16 PM: Memory Sweep Complete, Elapsed Time: 00:02:17
11:16 PM: Starting Registry Sweep
11:17 PM: Registry Sweep Complete, Elapsed Time:00:01:28
11:17 PM: Starting Cookie Sweep
11:17 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
11:17 PM: Starting File Sweep
11:17 PM: Warning: Failed to open file "c:\°__". The system cannot find the file specified
11:17 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process
11:23 PM: File Sweep Complete, Elapsed Time: 00:05:35
11:23 PM: Full Sweep has completed. Elapsed time 00:09:23
11:23 PM: Traces Found: 0

------

And the new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:32:48 PM, on 10/7/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\MY DOCUMENTS\DOWNLOAD\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\pti6mlq2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBARBHO.DLL
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O2 - BHO: PopupManager Class - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\RunServices: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .html: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.n...tivePreQual.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay10...es/MsnPUpld.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} - http://www.icannnews.../ST/ActiveX.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcaf...534/mcfscan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab

EDIT: I couldn't delete C:\PROGRAM FILES\COMMON FILES\VERIZON ONLINE\SFP\VZBB.DLL because it's "in use."

Edited by C0mputerIlliterate, 07 October 2005 - 09:50 PM.

#12
Buckeye_Sam

Posted 08 October 2005 - 08:25 AM

Malware Expert

Member
10,019 posts

You can leave that file. I'm not sure why Panda id'd it. Were you able to delete all of the other files?

How is your computer running now?

#13
C0mputerIlliterate

Posted 08 October 2005 - 10:29 AM

Member

Topic Starter
Member
15 posts

No more pop ups. :tazz:

TY. Startup is not that slow but whenever I click on something (like Firefox), I'd have to click Ctrl+Alt+Delete because of the Explorer Not Responding thing. It happens everytime after startup. Other than that, all is well. TY again. And again.

#14
Buckeye_Sam

Posted 08 October 2005 - 12:52 PM

Malware Expert

Member
10,019 posts

That sounds like an operating system issue. Windows ME isn't exactly the best version of Windows. You may want to start a thread here and see if one of the experts there can sort that out for you.

http://www.geekstogo...p?act=SF&s=&f=3

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Renable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

A tutorial on installing & using this product can be found here:

Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

A tutorial on installing & using this product can be found here:

Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.