[JohnJChang]

Hi, first time here; I am always getting popups regardless of whether a web browser or internet connection(the popups are blanks when it is this case..) is open. Among the popups is the URLlogic thing that other users have been experiencing. I've run adaware, cwshredder, spybot, and one of the virus checkers (i also have a symatec one too). So far, nothing has really helped... so here is my hijack log.

Thanks in advance
JC



Logfile of HijackThis v1.99.0
Scan saved at 3:23:51 PM, on 2/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Verizon Voyager\High Speed Internet Service\WinPoET\WrOS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\K-Lite Codec Pack\real\Update_OB\realsched.exe
C:\WINDOWS\System32\alrtfp.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\wuaw400.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hhnpkh.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Johnny Chang\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = ,
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = ,
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer customized for Verizon Voyager
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Documents and Settings\Johnny Chang\My Documents\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O6 "USB001" /M "Stylus C82"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mvdmodw] C:\WINDOWS\System32\mvdmodw.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Task Manager] C:\windows\system32\taskmgn.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliteuvo32.exe
O4 - HKLM\..\Run: [t35W3mi] alrtfp.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [ntechin] C:\windows\system32\n20050308.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [dnsrslvr] C:\WINDOWS\System32\dnsrslvr.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [c0u6RgGng] wuaw400.exe
O4 - Startup: Alarm Master Plus.lnk = C:\Program Files\BrigSoft\AlarmMasterPlus\AlarmMasterPlus.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Verizon Support Center.lnk = C:\Program Files\Support Center\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} (shizmoo Class) - http://www.shizmoo.c...ivex/web660.cab
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\Verizon Voyager\High Speed Internet Service\WinPoET\WrOS.EXE


I have a strong suspicion of the SED.exe and these processes:

C:\WINDOWS\System32\wuaw400.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alrtfp.exe

[Advertisements]

Hi JC

It might be an idea if you make a new folder for HijackThis and put the HijackThis file in it. It makes backups as you work with it and your desktop is not the best place to have them.

You may need to print this out or copy and paste into a Notepad file so you can keep track of what to do when you are not connected to the internet.

Disable System Restore by right-clicking the My Computer icon on the desktop > go to Properties and then the System Restore tab. Put a tick in the box "Turn off System Restore on all drives" Clcik Apply. OK.

Download LSPfix.exe from here http://cexx.org/lspfix.htm and save to your desktop.

Open LSPfix. Disconnect from the Internet and close all Internet Explorer Windows. Check the "I know what I'm doing" Button and remove these files:

aklsp.dll
dolsp.dll

Click on Finish. Close LSPfix. Do not reconnect to the internet.

Open HijackThis and click on "Open Misc Tools Section" and "Open Process Manager"

Check the processes in the list for these files - they may not all be listed. Select each one as you find it and click on "Kill Process". Read the names very carefully as there may be some names that are similar but that are genuine files.

alrtfp.exe
wuaw400.exe
hhnpkh.exe
mvdmodw.exe
sysupd.exe
eliteuvo32.exe
alrtfp.exe
SED.exe"
n20050308.exe
PowerReg SchedulerV2.exe

Then click on Back which will open the HijackThis Scan Screen. Click on Scan. When the scan is complete check all the following items. Close all open windows including this browser window and all instant messaging - Yahoo messenger, MSN messenger, ICQ and anything else that is not essential and click on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = ,
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = ,
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mvdmodw] C:\WINDOWS\System32\mvdmodw.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Task Manager] C:\windows\system32\taskmgn.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliteuvo32.exe
O4 - HKLM\..\Run: [t35W3mi] alrtfp.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [ntechin] C:\windows\system32\n20050308.exe
O4 - HKCU\..\Run: [dnsrslvr] C:\WINDOWS\System32\dnsrslvr.exe
O4 - HKCU\..\Run: [c0u6RgGng] wuaw400.exe
O4 - Startup: PowerReg SchedulerV2.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} (shizmoo Class) - http://www.shizmoo.c...ivex/web660.cab

Reboot into Safe Mode by continually tapping the F8 key as soon as the computer starts to boot up - straight after the beep. When the Windows XP Safe Mode menu comes up - Choose Safe Mode. You don't need any networking.

Open Windows Explorer and go to > Tools> Folder Options> View, select:*Show hidden files and folders
*Display the contents of system folders
Uncheck:*Hide protected operating system files
Delete all the files and folders noted in bold below. Some may not be there but use the search function in Windows Explorer to make sure.


Deletions - it is important that you find and delete what's listed.

c:\program files\ partypoker - Delete entire folder
C:\WINDOWS\System32\ mvdmodw.exe - file only
C:\WINDOWS\ sysupd.exe - file only
C:\windows\system32\ taskmgn.exe - file only
C:\windows\system32\ eliteuvo32.exe - file only
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ hhnpkh.exe file only
C:\Program Files\SED - Delete entire folder
C:\windows\system32\ n20050308.exe file only
C:\WINDOWS\System32\ dnsrslvr.exe file only
C:\WINDOWS\System32\ wuaw400.exe
C:\WINDOWS\System32\ alrtfp.exe
c:\windows\system32\ dolsp.dll
c:\windows\system32\ aklsp.dll

You will need to search for this one.
PowerReg SchedulerV2.exe

Click on Search > All files and folders > More advanced options and click.

Be sure the first three boxes are selected:*Search System folders
*Search Hidden Files and folders
*Search SubFolders
Delete all the files and folders noted in bold below. Some may not be there but use the search function in Windows Explorer to make sure.

Go to "Find all Files and Folders". Copy and paste this file name into the "All or Part of a File Name" and Select "Local Hard Drives" in the drop-down box. Delete each instance of it that is found

PowerReg SchedulerV2.exe

Remove all the unnecessary files from here:

c:\documents and settings\<your user name>\local settings

Delete the entire contents of your \temp folder and your \temporary internet files folder

You will need to do this for each user if there is are more than one user.

Right Click and Empty the Recycle bin.

Reboot into normal mode and do a fresh HijackThis log and post it for further checking.

[ilago]

Hi JC

It might be an idea if you make a new folder for HijackThis and put the HijackThis file in it. It makes backups as you work with it and your desktop is not the best place to have them.

You may need to print this out or copy and paste into a Notepad file so you can keep track of what to do when you are not connected to the internet.

Disable System Restore by right-clicking the My Computer icon on the desktop > go to Properties and then the System Restore tab. Put a tick in the box "Turn off System Restore on all drives" Clcik Apply. OK.

Download LSPfix.exe from here http://cexx.org/lspfix.htm and save to your desktop.

Open LSPfix. Disconnect from the Internet and close all Internet Explorer Windows. Check the "I know what I'm doing" Button and remove these files:

aklsp.dll
dolsp.dll

Click on Finish. Close LSPfix. Do not reconnect to the internet.

Open HijackThis and click on "Open Misc Tools Section" and "Open Process Manager"

Check the processes in the list for these files - they may not all be listed. Select each one as you find it and click on "Kill Process". Read the names very carefully as there may be some names that are similar but that are genuine files.

alrtfp.exe
wuaw400.exe
hhnpkh.exe
mvdmodw.exe
sysupd.exe
eliteuvo32.exe
alrtfp.exe
SED.exe"
n20050308.exe
PowerReg SchedulerV2.exe

Then click on Back which will open the HijackThis Scan Screen. Click on Scan. When the scan is complete check all the following items. Close all open windows including this browser window and all instant messaging - Yahoo messenger, MSN messenger, ICQ and anything else that is not essential and click on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = ,
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = ,
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mvdmodw] C:\WINDOWS\System32\mvdmodw.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Task Manager] C:\windows\system32\taskmgn.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliteuvo32.exe
O4 - HKLM\..\Run: [t35W3mi] alrtfp.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [ntechin] C:\windows\system32\n20050308.exe
O4 - HKCU\..\Run: [dnsrslvr] C:\WINDOWS\System32\dnsrslvr.exe
O4 - HKCU\..\Run: [c0u6RgGng] wuaw400.exe
O4 - Startup: PowerReg SchedulerV2.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\IEExtension.dll
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} (shizmoo Class) - http://www.shizmoo.c...ivex/web660.cab

Reboot into Safe Mode by continually tapping the F8 key as soon as the computer starts to boot up - straight after the beep. When the Windows XP Safe Mode menu comes up - Choose Safe Mode. You don't need any networking.

Open Windows Explorer and go to > Tools> Folder Options> View, select:*Show hidden files and folders
*Display the contents of system folders
Uncheck:*Hide protected operating system files
Delete all the files and folders noted in bold below. Some may not be there but use the search function in Windows Explorer to make sure.


Deletions - it is important that you find and delete what's listed.

c:\program files\ partypoker - Delete entire folder
C:\WINDOWS\System32\ mvdmodw.exe - file only
C:\WINDOWS\ sysupd.exe - file only
C:\windows\system32\ taskmgn.exe - file only
C:\windows\system32\ eliteuvo32.exe - file only
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ hhnpkh.exe file only
C:\Program Files\SED - Delete entire folder
C:\windows\system32\ n20050308.exe file only
C:\WINDOWS\System32\ dnsrslvr.exe file only
C:\WINDOWS\System32\ wuaw400.exe
C:\WINDOWS\System32\ alrtfp.exe
c:\windows\system32\ dolsp.dll
c:\windows\system32\ aklsp.dll

You will need to search for this one.
PowerReg SchedulerV2.exe

Click on Search > All files and folders > More advanced options and click.

Be sure the first three boxes are selected:*Search System folders
*Search Hidden Files and folders
*Search SubFolders
Delete all the files and folders noted in bold below. Some may not be there but use the search function in Windows Explorer to make sure.

Go to "Find all Files and Folders". Copy and paste this file name into the "All or Part of a File Name" and Select "Local Hard Drives" in the drop-down box. Delete each instance of it that is found

PowerReg SchedulerV2.exe

Remove all the unnecessary files from here:

c:\documents and settings\<your user name>\local settings

Delete the entire contents of your \temp folder and your \temporary internet files folder

You will need to do this for each user if there is are more than one user.

Right Click and Empty the Recycle bin.

Reboot into normal mode and do a fresh HijackThis log and post it for further checking.