Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Too many crashes to deal with

Started by beeakus , Jan 31 2005 10:50 PM

  • Please log in to reply

#1
beeakus
Posted 31 January 2005 - 10:50 PM

beeakus

    New Member

  • Member
  • Pip
  • 4 posts
I have more crashes lately than a busy intersection without stop signs. My windows explorer crashes, my internet explorer crashes, it happens constantly. I've tried AVG, Ad-aware SE (with all the recommended modifications), Trendmicro online scan, Pandasoft online scan, and Spybot S&D. I've come across a couple viruses, mostly trojan horse downloaders, but I thought I got them out of the picture. Ad-aware keeps picking up a running process but will not quarantine or delete anything. Hopefully my hijack this log will help.

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\TRL11.EXE
C:\PIXEL\RMTSTOCK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\COMMON FILES\KODAK\KODAK_DR\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PIXEL\RMTVPPV.EXE
C:\PIXEL\RMTPOWER.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\E_S0BIC1.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DSOUND54.EXE
C:\WINDOWS\SYSTEM\SECUR327.EXE
C:\WINDOWS\SYSTEM\EBAPI162.EXE
C:\WINDOWS\APPLICATION DATA\COHU.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AIM95\AIM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\SYSTEM\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\PROGRAM FILES\ESYNDICATE\ESYN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [I740Remote] C:\Pixel\DriBat32.exe
O4 - HKLM\..\Run: [10JP4ZQ8V] C:\WINDOWS\TEMP\10JP4ZQ8V.EXE
O4 - HKLM\..\Run: [Trl11] C:\WINDOWS\SYSTEM\TRL11.EXE
O4 - HKLM\..\Run: [ntechin] C:\WINDOWS\N20050308.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [MoviePlace] "C:\Program Files\MoviePlace\MoviePlace.exe" /H
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [KIOYPC] C:\WINDOWS\KIOYPC.exe
O4 - HKLM\..\Run: [DKN] C:\WINDOWS\DKN.exe
O4 - HKLM\..\Run: [AQTHXE] C:\WINDOWS\AQTHXE.exe
O4 - HKLM\..\Run: [psfef] C:\WINDOWS\psfef.exe
O4 - HKLM\..\Run: [LBILVIZJP] C:\WINDOWS\LBILVIZJP.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [dnfoub] C:\WINDOWS\jxuks.exe
O4 - HKLM\..\Run: [BootWarn] C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe /a
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [7mhw] C:\WINDOWS\TEMP\7MHW.EXE
O4 - HKLM\..\Run: [c426961a1280] C:\WINDOWS\SYSTEM\DSOUND54.exe
O4 - HKLM\..\Run: [8ed3e63a7f13] C:\WINDOWS\SYSTEM\SECUR327.exe
O4 - HKLM\..\Run: [175107c14d2d] C:\WINDOWS\SYSTEM\EBAPI162.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Common Files\Symantec Shared\cfgwiz.exe /GUID NIS /CMDLINE "REBOOT"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKCU\..\Run: [Aoce] C:\WINDOWS\Application Data\cohu.exe
O4 - HKCU\..\Run: [WNSA] C:\WINDOWS\SYSTEM\wnstssv.exe
O4 - HKCU\..\Run: [Yayi] C:\WINDOWS\SYSTEM\ustlyyq.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZCxdm338YYUS
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et0_x.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab
O16 - DPF: Yahoo! Checkers - http://download.game...nts/y/kt3_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.game...nts/y/wt0_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot4_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.game...nts/y/ft3_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst3_x.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...13.6/ttinst.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...lim/install.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {94837F90-A2CA-4A8A-9DA0-B5438EC563EA} - http://install.wildt...uncherSetup.cab
O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O20 - AppInit_DLLs: apitrap.dll;
  • 0

Advertisements

#2
Guest_thatman_*
Posted 01 February 2005 - 04:29 AM

Guest_thatman_*
  • Guest
Hi beeakus

Your log file is Incomplete Please post a full log.

Click Here download the latest version of Hijack This (1.99). It's better able to catch the latest threats.

We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.


Thank you

kc :tazz:
  • 0

#3
beeakus
Posted 01 February 2005 - 11:45 AM

beeakus

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Hey thanks for the help, I really do appreciate it. I will post another Hijack this log in a little bit. As for the Service Pack 1 update, I have Windows 98 SE, and have all of the critical updates. Sorry about the inconvenience with the hijack log.


Thanks Again

Beeakus
  • 0

#4
beeakus
Posted 01 February 2005 - 01:58 PM

beeakus

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Here's the full log:

Logfile of HijackThis v1.99.0
Scan saved at 2:50:39 PM, on 2/1/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\TRL11.EXE
C:\WINDOWS\N20050308.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\COMMON FILES\KODAK\KODAK_DR\KODAKCCS.EXE
C:\PIXEL\RMTSTOCK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\PIXEL\RMTPOWER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\E_S0BIC1.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DSOUND54.EXE
C:\WINDOWS\SYSTEM\SECUR327.EXE
C:\PIXEL\RMTVPPV.EXE
C:\WINDOWS\SYSTEM\EBAPI162.EXE
C:\WINDOWS\APPLICATION DATA\COHU.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AIM95\AIM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\THE CLEANER\TCA.EXE
C:\PROGRAM FILES\THE CLEANER\TCM.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\YT47056T\HIJACKTHIS[1].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\SYSTEM\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\PROGRAM FILES\ESYNDICATE\ESYN.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [I740Remote] C:\Pixel\DriBat32.exe
O4 - HKLM\..\Run: [10JP4ZQ8V] C:\WINDOWS\TEMP\10JP4ZQ8V.EXE
O4 - HKLM\..\Run: [Trl11] C:\WINDOWS\SYSTEM\TRL11.EXE
O4 - HKLM\..\Run: [ntechin] C:\WINDOWS\N20050308.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KodakCCS] C:\Program Files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Program Files\Common Files\KODAK\KODAK_DR\dcmnter.pdr"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [MoviePlace] "C:\Program Files\MoviePlace\MoviePlace.exe" /H
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [KIOYPC] C:\WINDOWS\KIOYPC.exe
O4 - HKLM\..\Run: [DKN] C:\WINDOWS\DKN.exe
O4 - HKLM\..\Run: [AQTHXE] C:\WINDOWS\AQTHXE.exe
O4 - HKLM\..\Run: [psfef] C:\WINDOWS\psfef.exe
O4 - HKLM\..\Run: [LBILVIZJP] C:\WINDOWS\LBILVIZJP.exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [dnfoub] C:\WINDOWS\jxuks.exe
O4 - HKLM\..\Run: [BootWarn] C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe /a
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [7mhw] C:\WINDOWS\TEMP\7MHW.EXE
O4 - HKLM\..\Run: [c426961a1280] C:\WINDOWS\SYSTEM\DSOUND54.exe
O4 - HKLM\..\Run: [8ed3e63a7f13] C:\WINDOWS\SYSTEM\SECUR327.exe
O4 - HKLM\..\Run: [175107c14d2d] C:\WINDOWS\SYSTEM\EBAPI162.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Common Files\Symantec Shared\cfgwiz.exe /GUID NIS /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [tcactive] C:\PROGRAM FILES\THE CLEANER\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\PROGRAM FILES\THE CLEANER\tcm.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKCU\..\Run: [Aoce] C:\WINDOWS\Application Data\cohu.exe
O4 - HKCU\..\Run: [WNSA] C:\WINDOWS\SYSTEM\wnstssv.exe
O4 - HKCU\..\Run: [Yayi] C:\WINDOWS\SYSTEM\ustlyyq.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZCxdm338YYUS
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et0_x.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab
O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab
O16 - DPF: Yahoo! Checkers - http://download.game...nts/y/kt3_x.cab
O16 - DPF: Yahoo! Word Racer - http://download.game...nts/y/wt0_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot4_x.cab
O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.game...nts/y/ft3_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst3_x.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...13.6/ttinst.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...lim/install.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {94837F90-A2CA-4A8A-9DA0-B5438EC563EA} - http://install.wildt...uncherSetup.cab
O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....738&clcid=0x409
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O20 - AppInit_DLLs: apitrap.dll;
  • 0

#5
Guest_thatman_*
Posted 03 February 2005 - 10:10 AM

Guest_thatman_*
  • Guest
Hi beeakus

(1) You may wish to print out a copy of these instructions to follow while you complete this procedure.

(2)Be sure you're able to view hidden files,

(3)Disk Cleanup:Unzip Disk Cleanup we will use it later

(4) Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\SYSTEM\SearchBar.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\PROGRAM FILES\ESYNDICATE\ESYN.DLL

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [10JP4ZQ8V] C:\WINDOWS\TEMP\10JP4ZQ8V.EXE

O4 - HKLM\..\Run: [Trl11] C:\WINDOWS\SYSTEM\TRL11.EXE

O4 - HKLM\..\Run: [ntechin] C:\WINDOWS\N20050308.EXE

O4 - HKLM\..\Run: [MoviePlace] "C:\Program Files\MoviePlace\MoviePlace.exe" /H

O4 - HKLM\..\Run: [KIOYPC] C:\WINDOWS\KIOYPC.exe

O4 - HKLM\..\Run: [DKN] C:\WINDOWS\DKN.exe

O4 - HKLM\..\Run: [AQTHXE] C:\WINDOWS\AQTHXE.exe

O4 - HKLM\..\Run: [psfef] C:\WINDOWS\psfef.exe

O4 - HKLM\..\Run: [LBILVIZJP] C:\WINDOWS\LBILVIZJP.exe

O4 - HKLM\..\Run: [dnfoub] C:\WINDOWS\jxuks.exe

O4 - HKLM\..\Run: [7mhw] C:\WINDOWS\TEMP\7MHW.EXE

O4 - HKLM\..\Run: [c426961a1280] C:\WINDOWS\SYSTEM\DSOUND54.exe

O4 - HKLM\..\Run: [8ed3e63a7f13] C:\WINDOWS\SYSTEM\SECUR327.exe

O4 - HKLM\..\Run: [175107c14d2d] C:\WINDOWS\SYSTEM\EBAPI162.exe

O4 - HKCU\..\Run: [Aoce] C:\WINDOWS\Application Data\cohu.exe

O4 - HKCU\..\Run: [WNSA] C:\WINDOWS\SYSTEM\wnstssv.exe

O4 - HKCU\..\Run: [Yayi] C:\WINDOWS\SYSTEM\ustlyyq.exe

O8 - Extra context menu item: &Search - http://bar.mywebsear...?p=ZCxdm338YYUS

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab

O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et0_x.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab

O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.s...og/y/fs10_x.cab

O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/pote_x.cab

O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab

O16 - DPF: Yahoo! Checkers - http://download.game...nts/y/kt3_x.cab

O16 - DPF: Yahoo! Word Racer - http://download.game...nts/y/wt0_x.cab

O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot4_x.cab

O16 - DPF: Yahoo! Tic-Tac-Toe - http://download.game...nts/y/ft3_x.cab

O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst3_x.cab

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredim...er/imloader.cab

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg...ol_v1-0-3-0.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab

O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toon...13.6/ttinst.cab

O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildt...lim/install.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab

O16 - DPF: {94837F90-A2CA-4A8A-9DA0-B5438EC563EA} - http://install.wildt...uncherSetup.cab

O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab

(5) Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).

Please use windows explorer to find the following Files and Folders

C:\PROGRAM FILES\ ESYNDICATE\ESYN.DLL<-Delete this folder

C:\Program Files\ Viewpoint\Viewpoint Manager\ViewMgr.exe <-Delete this folder

C:\Program Files\ MoviePlace\MoviePlace.exe <-Delete this folder

C:\Program Files\ AWS\WeatherBug\Weather.exe <-Delete this folder

C:\WINDOWS\TEMP\ 10JP4ZQ8V.EXE <-Delete this file

C:\WINDOWS\SYSTEM\ TRL11.EXE <-Delete this file

C:\WINDOWS\ N20050308.EXE <-Delete this file

C:\WINDOWS\ KIOYPC.exe <-Delete this file

C:\WINDOWS\ DKN.exe <-Delete this file

C:\WINDOWS\ AQTHXE.exe <-Delete this file

C:\WINDOWS\ psfef.exe <-Delete this file

C:\WINDOWS\ LBILVIZJP.exe <-Delete this file

C:\WINDOWS\ jxuks.exe <-Delete this file

C:\WINDOWS\TEMP\ 7MHW.EXE <-Delete this file

C:\WINDOWS\SYSTEM\ DSOUND54.exe <-Delete this file

C:\WINDOWS\SYSTEM\ SECUR327.exe <-Delete this file

C:\WINDOWS\SYSTEM\ EBAPI162.exe <-Delete this file

C:\WINDOWS\Application Data\ cohu.exe <-Delete this file

C:\WINDOWS\SYSTEM\ wnstssv.exe <-Delete this file

C:\WINDOWS\SYSTEM\ ustlyyq.exe <-Delete this file

(6) Please run Disk Cleanup

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working. ;)

kc :tazz:

Information for you

MediaCharger\MoviePlace
Dialer installed on the internet Installs DownloadWare, MediaCharger\MoviePlace, WebInstall, vitalix, and Macromedia. The fine print: 'USING THIS SERVICE WILL RESULT IN A ONE-TIME CHARGE OF $34.95 FROM 'ICS900.COM' FOR A 900 CALL ON YOUR NORMAL TELEPHONE BILL. THE CALL WILL APPEAR ON YOUR PHONE BILL AS A PREMIUM RATE CHARGE. Once connected to the service you will be directed to a Web page that will generate a unique username and password that allows you access to the Web site http://www.movieplace.net/ for a period of 30 days. Once you have accessed your username and password you MUST reconnect to your local ISP. At the end of the subscription period, the software will automatically prompt a renewal reminder. Your acceptance of the reminder re-subscribes you to the service and binds you to these terms and conditions. For billing questions or customer service inquiries please visit our customer service Web site that is located at http://www.ics900.com/.' http://fast.mediacharger.com/movieplace/d....=if⊂=2093.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP