Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

look-today toolbar removal

Started by jabuts , Dec 01 2004 08:50 PM

  • Please log in to reply

#1
jabuts
Posted 01 December 2004 - 08:50 PM

jabuts

    New Member

  • Member
  • Pip
  • 4 posts
The log posted below is from hijack this. I have been dealing with this unwanted toolbar (look-today) from some time and am having difficulty deleting it. I am new to this site but would be most appreciative if someone can look at this log and tell me what I need to do to get rid of this or other unwanted stuff. Thanks

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Grid debug this soap] C:\Documents and Settings\All Users\Application Data\Four Idol Grid Debug\Adminante.exe
O4 - HKLM\..\Run: [TPFWall] C:\Program Files\Trustix\Trustix Personal Firewall\TPFWall.exe
O4 - HKLM\..\Run: [ante does option download] C:\Documents and Settings\All Users\Application Data\SaveEggsAnteDoes\Second glue.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [boltchic] C:\DOCUME~1\user\APPLIC~1\INTERN~1\Burn support wipe.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring2\HOTSYNC.EXE
O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebu...ams/swicdad.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla...ller/dwnldr.cab
  • 0

Advertisements

#2
Smokey
Posted 01 December 2004 - 09:16 PM

Smokey

    Member 1K

  • Retired Staff
  • 1,423 posts
Could you please post the entire log (including top)? Thanks. <_<
  • 0

#3
jabuts
Posted 01 December 2004 - 09:18 PM

jabuts

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Logfile of HijackThis v1.98.2
Scan saved at 9:41:14 PM, on 12/1/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\STOPzilla!\Stopzilla.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe
C:\Program Files\Handspring2\HOTSYNC.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dlacnpytu...W4Ne1T0ZA5.html
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Grid debug this soap] C:\Documents and Settings\All Users\Application Data\Four Idol Grid Debug\Adminante.exe
O4 - HKLM\..\Run: [TPFWall] C:\Program Files\Trustix\Trustix Personal Firewall\TPFWall.exe
O4 - HKLM\..\Run: [ante does option download] C:\Documents and Settings\All Users\Application Data\SaveEggsAnteDoes\Second glue.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [boltchic] C:\DOCUME~1\user\APPLIC~1\INTERN~1\Burn support wipe.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring2\HOTSYNC.EXE
O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebu...ams/swicdad.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) -
  • 0

#4
Smokey
Posted 01 December 2004 - 09:39 PM

Smokey

    Member 1K

  • Retired Staff
  • 1,423 posts
You may wish to print out a copy of these instructions to follow while you complete this procedure. Please move Hijack This to a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please Download LSPFix from http://www.cexx.org/lspfix.htm and run the program. Disconnect from the internet and close all Internet Explorer windows. Check the "I know what I'm doing" Button and remove all traces of [netdog.dll].

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/
  • 0

#5
jabuts
Posted 01 December 2004 - 10:10 PM

jabuts

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
smokey - thanks for your advice and post. One question - after downloading and running the LSPfix, I could not get back into the internet. <_< So I went back into safe mode, and restored the settings to previous time of day. The toolbar is now gone, but if I run LSPfix again, the netdog.dll is still there (because I restored the settings?)

The toolbar is gone, but should I run the LSPfix again??

Thanks again.

Jim
  • 0

#6
coachwife6
Posted 02 December 2004 - 03:59 AM

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
It will do that sometimes. Run the other recommendations Smokey suggested and post a new log.
  • 0

#7
jabuts
Posted 06 December 2004 - 09:23 PM

jabuts

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
My latest log is below. I still have the look-today toolbar.

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\STOPzilla!\szntsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\ahead\InCD\InCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodManager.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\STOPzilla!\Stopzilla.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\The Cleaner\tca.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\The Cleaner\tcm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Handspring2\HOTSYNC.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.scgiizukb..._W4Ne1T0ZA5.asp
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Grid debug this soap] C:\Documents and Settings\All Users\Application Data\Four Idol Grid Debug\Adminante.exe
O4 - HKLM\..\Run: [TPFWall] C:\Program Files\Trustix\Trustix Personal Firewall\TPFWall.exe
O4 - HKLM\..\Run: [ante does option download] C:\Documents and Settings\All Users\Application Data\SaveEggsAnteDoes\Second glue.exe
O4 - HKLM\..\Run: [tcactive] C:\Program Files\The Cleaner\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\Program Files\The Cleaner\tcm.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [boltchic] C:\DOCUME~1\user\APPLIC~1\INTERN~1\Burn support wipe.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring2\HOTSYNC.EXE
O4 - Global Startup: Instant Wireless Configuration Utility.lnk = C:\Program Files\Linksys\WPC11 Config Utility\WPC11Cfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program files\trustix\trustix personal firewall\netdog.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebu...ams/swicdad.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla...ller/dwnldr.cab
  • 0

#8
Metallica
Posted 07 December 2004 - 05:36 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Is there something wrong with the Trustix firewall?
Sorry if I missed that, but if there isn't there is no reason to remove the dll from the LSP stack. And I would expect any decent firewall to protect itself in there.

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.scgiizukb..._W4Ne1T0ZA5.asp

O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)

O4 - HKLM\..\Run: [Grid debug this soap] C:\Documents and Settings\All Users\Application Data\Four Idol Grid Debug\Adminante.exe

O4 - HKLM\..\Run: [ante does option download] C:\Documents and Settings\All Users\Application Data\SaveEggsAnteDoes\Second glue.exe

O4 - HKCU\..\Run: [boltchic] C:\DOCUME~1\user\APPLIC~1\INTERN~1\Burn support wipe.exe

Reboot into safe mode
and delete:
C:\Documents and Settings\All Users\Application Data\Four Idol Grid Debug <= entire folder
C:\Documents and Settings\All Users\Application Data\SaveEggsAnteDoes <= entire folder
C:\Documents and Settings\user\Application Data\INTERN~1 <= the entire folder that holds Burn support wipe.exe

Regards,

Pieter
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP