[Calabasas]

Please help me get rid of this toolbar! Whenever I click on IE, it shows up. Right clicking on Properties gives me: http://search200.com...h/newpass2.html

I have done everything I can think of. I have (in the last 24 hours) downloaded and run AdAware 6.0 personal, Avast Antivirus, CW Shredder and Spy Sweeper. I have rid myself of lots of viruses and adware, but am still stuck with this toolbar which reads (on the first line) "Make Money; Music; Casino; Dating; Travel; Careers..."

Here is the latest HiJack This log:
Logfile of HijackThis v1.99.0
Scan saved at 7:07:50 PM, on 1/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\system32\ltmsg.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC09.exe
C:\Documents and Settings\michael sacks\Desktop\Adware Killers\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cafioramh...PhOiZjgCV4u.htm
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [x3mU32P] wifmgvw.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [VarWby] C:\documents and settings\michael sacks\local settings\temp\VarWby.exe
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pnpsvc_lock] C:\WINDOWS\System32\70963.exe
O4 - HKLM\..\Run: [peakactiveoozejunk] C:\Documents and Settings\All Users\Application Data\logo license peak active\Ace byte.exe
O4 - HKLM\..\Run: [multi online jump frag] C:\Documents and Settings\All Users\Application Data\Browse Glue Multi Online\burn peak.exe
O4 - HKLM\..\Run: [mrvinfo.exe] C:\WINDOWS\System32\mrvinfo.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [FYErvKOeG] C:\documents and settings\mara sacks\local settings\temp\FYErvKOeG.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKCU\..\Run: [Face cdrom] C:\DOCUME~1\MICHAE~1\APPLIC~1\OPENSE~1\gram rect.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akama...iTunesSetup.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Security Agent - Unknown - C:\WINDOWS\system32\scagent.exe (file missing)
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: VNC Server - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe

[Advertisements]

1. You Have a CoolWebSearch Infection.
Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants.

2. You have a trojan horse which tries to download next component from the internet and registers it as System Service with Security Agent name.

Removing:
This trojan horse is being executed by Security Agent system service. You need to disable this service first.

Click on "Start" button, choose "Run..." and write this command followed by Enter key:

services.msc

Services console is running now. Locate Security Agent service, click right mouse button on it and choose "Stop". Then double click on it and choose "Disable" in "Startup type" dropdown listbox. Close the dialog by pressing OK button.

Restart computer in safe mode (lightly tap the F8 button on start-up) and delete following files from your computer:

C:\WINDOWS\digfilt.dll
C:\WINDOWS\system32\scagent.exe
C:\WINDOWS\System32\matrixhere.exe
C:\Program Files\HP\hpcoretech
wifmgvw.exe
C:\WINDOWS\System32\70963.exe
C:\Documents and Settings\All Users\Application Data\logo license peak active
C:\Documents and Settings\All Users\Application Data\Browse Glue Multi Online\
C:\WINDOWS\System32\mrvinfo.exe

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cafioramh...PhOiZjgCV4u.htm

O4 - HKLM\..\Run: [x3mU32P] wifmgvw.exe

(Do you remote control your PC from somewhere else? If not, get rid of the same entry in 023)

O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [VarWby] C:\documents and settings\michael sacks\local settings\temp\VarWby.exe
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe

O4 - HKLM\..\Run: [pnpsvc_lock] C:\WINDOWS\System32\70963.exe
O4 - HKLM\..\Run: [peakactiveoozejunk] C:\Documents and Settings\All Users\Application Data\logo license peak active\Ace byte.exe
O4 - HKLM\..\Run: [multi online jump frag] C:\Documents and Settings\All Users\Application Data\Browse Glue Multi Online\burn peak.exe
O4 - HKLM\..\Run: [mrvinfo.exe] C:\WINDOWS\System32\mrvinfo.exe
O4 - HKLM\..\Run: [FYErvKOeG] C:\documents and settings\mara sacks\local settings\temp\FYErvKOeG.exe

O4 - HKCU\..\Run: [Face cdrom] C:\DOCUME~1\MICHAE~1\APPLIC~1\OPENSE~1\gram rect.exe (What is this? Please get rid of it if you don't know or don't need it, and get rid of it down below also.

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

O23 - Service: Security Agent - Unknown - C:\WINDOWS\system32\scagent.exe (file missing)
See note above concerning following:
O23 - Service: VNC Server - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\DOCUME~1\MICHAE~1\APPLIC~1\OPENSE~1

Reboot.

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and we'll remove what's left.

[coachwife6]

1. You Have a CoolWebSearch Infection.
Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants.

2. You have a trojan horse which tries to download next component from the internet and registers it as System Service with Security Agent name.

Removing:
This trojan horse is being executed by Security Agent system service. You need to disable this service first.

Click on "Start" button, choose "Run..." and write this command followed by Enter key:

services.msc

Services console is running now. Locate Security Agent service, click right mouse button on it and choose "Stop". Then double click on it and choose "Disable" in "Startup type" dropdown listbox. Close the dialog by pressing OK button.

Restart computer in safe mode (lightly tap the F8 button on start-up) and delete following files from your computer:

C:\WINDOWS\digfilt.dll
C:\WINDOWS\system32\scagent.exe
C:\WINDOWS\System32\matrixhere.exe
C:\Program Files\HP\hpcoretech
wifmgvw.exe
C:\WINDOWS\System32\70963.exe
C:\Documents and Settings\All Users\Application Data\logo license peak active
C:\Documents and Settings\All Users\Application Data\Browse Glue Multi Online\
C:\WINDOWS\System32\mrvinfo.exe

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cafioramh...PhOiZjgCV4u.htm

O4 - HKLM\..\Run: [x3mU32P] wifmgvw.exe

(Do you remote control your PC from somewhere else? If not, get rid of the same entry in 023)

O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [VarWby] C:\documents and settings\michael sacks\local settings\temp\VarWby.exe
O4 - HKLM\..\Run: [romahere] C:\WINDOWS\System32\matrixhere.exe

O4 - HKLM\..\Run: [pnpsvc_lock] C:\WINDOWS\System32\70963.exe
O4 - HKLM\..\Run: [peakactiveoozejunk] C:\Documents and Settings\All Users\Application Data\logo license peak active\Ace byte.exe
O4 - HKLM\..\Run: [multi online jump frag] C:\Documents and Settings\All Users\Application Data\Browse Glue Multi Online\burn peak.exe
O4 - HKLM\..\Run: [mrvinfo.exe] C:\WINDOWS\System32\mrvinfo.exe
O4 - HKLM\..\Run: [FYErvKOeG] C:\documents and settings\mara sacks\local settings\temp\FYErvKOeG.exe

O4 - HKCU\..\Run: [Face cdrom] C:\DOCUME~1\MICHAE~1\APPLIC~1\OPENSE~1\gram rect.exe (What is this? Please get rid of it if you don't know or don't need it, and get rid of it down below also.

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

O23 - Service: Security Agent - Unknown - C:\WINDOWS\system32\scagent.exe (file missing)
See note above concerning following:
O23 - Service: VNC Server - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\DOCUME~1\MICHAE~1\APPLIC~1\OPENSE~1

Reboot.

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and we'll remove what's left.