What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help!midaddle Problem-- Here Is My Correct Hjt Log

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.98.2
Scan saved at 2:20:08 PM, on 8/24/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\system32\crypserv.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\inetsrv\inetinfo.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Microsoft Hardware\Mouse\point32.exe
E:\WINNT\system32\wfxsnt40.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
E:\documents and settings\todd etna\local settings\temp\mcuXGw.exe
E:\documents and settings\todd etna\local settings\temp\KMJr6.exe
E:\WINNT\system32\schconv.exe
E:\WINNT\system32\kbdstab.exe
E:\PROGRA~1\Web Offer\wo.exe
E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
E:\WINNT\system32\TalVhZ.exe
E:\WINNT\system32\EmoY0lW.exe
E:\Documents and Settings\Todd Etna\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F1 - win.ini: run=E:\WINNT\..\PROGRA~1\COMMON~1\MICROS~1\MSInfo\msinfo.exe
O1 - Hosts: 66.230.146.42 gator.com #cooklop
O1 - Hosts: 66.230.146.42 tripod.com #cooklop
O1 - Hosts: 66.230.146.42 www.tripod.com #cooklop
O1 - Hosts: 66.230.146.42 geocities.com #cooklop
O1 - Hosts: 66.230.146.42 www.geocities.com #cooklop
O1 - Hosts: 66.230.146.42 adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 www.adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 cj.com #cooklop
O1 - Hosts: 66.230.146.42 www.cj.com #cooklop
O1 - Hosts: 66.230.146.42 paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 www.paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 www.worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 free6.com #cooklop
O1 - Hosts: 66.230.146.42 trafficmp.com #cooklop
O1 - Hosts: 66.230.146.42 www.trafficmp.com #cooklop
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - E:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - E:\Documents and Settings\Todd Etna\Local Settings\Temp\ganJX.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [mcuXGw] E:\documents and settings\todd etna\local settings\temp\mcuXGw.exe
O4 - HKLM\..\Run: [KMJr6] E:\documents and settings\todd etna\local settings\temp\KMJr6.exe
O4 - HKLM\..\Run: [33JSJ7Z4TBYLE6] E:\WINNT\system32\VgmTO8q.exe
O4 - HKLM\..\Run: [WinTools] E:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [p4mW37T] schconv.exe
O4 - HKCU\..\Run: [Y356RXf7P] kbdstab.exe
O4 - HKCU\..\Run: [eZWO] E:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra 'Tools' menuitem: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.nventures.com
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…81/mcinsctl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,19/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://eccadcam.webex.com/client/v_mywebex…bex/ieatgpc.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
O19 - User stylesheet: (file missing)
Post #2
Todd – Thanks for sending your HijackThis log. It is being analyzed and a response will be sent shortly. Meanwhile, please do not start multiple threads for the same problem. Continue to respond on this thread only. Thanks daveai
Post #3
Todd – Your logfile shows an infection by the Peper Trojan (among other problems) and we'll tackle that first. It is a very stubborn infection which requires two different tools to remove. Please follow these instructions in order:

1. Download Newuninst.exe.

2. Run it with an active internet connection.

3. Reboot to finish removing the entries it found.

4. Run the tool a second time (again with an active internet connection).

5. Reboot to finish removing the entries it found.


For the second tool:

1. Please Download PeperFix.exe,

2. Start the tool and click Find and Fix.

3. Reboot to finish removing what it found.

4. Run the tool a second time (again with an active internet connection).

5. Reboot to finish removing the entries.

Then, run the Housecall On-Line Virus Scan from Trend Micro, and clean any problems found.

Then, run the online trojan scan at: http://www.windowsecurity.com/trojanscan/ and delete any problem it finds.

Now, let's take another look at your system.

Please run HijackThis to create a new logfile. Repost it here, and if you had any problems with the steps outlined above, please let us know what they were. Your response and the new logfile will determine the next steps for this fix.

Thanks
daveai
Post #4
Thanks for your help up to this point. I went through all of your steps. Here is my new log file.

Logfile of HijackThis v1.98.2
Scan saved at 8:30:53 AM, on 8/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\system32\crypserv.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\inetsrv\inetinfo.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Microsoft Hardware\Mouse\point32.exe
E:\WINNT\system32\wfxsnt40.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
E:\documents and settings\todd etna\local settings\temp\mcuXGw.exe
E:\documents and settings\todd etna\local settings\temp\KMJr6.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
E:\WINNT\system32\nwacli.exe
E:\WINNT\system32\os2im700.exe
E:\PROGRA~1\Web Offer\wo.exe
E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
E:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CxtPls\CxtPls.exe
E:\WINNT\system32\cmd.exe
E:\Documents and Settings\Todd Etna\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F1 - win.ini: run=E:\WINNT\..\PROGRA~1\COMMON~1\MICROS~1\MSInfo\msinfo.exe
O1 - Hosts: 66.230.146.42 gator.com #cooklop
O1 - Hosts: 66.230.146.42 tripod.com #cooklop
O1 - Hosts: 66.230.146.42 www.tripod.com #cooklop
O1 - Hosts: 66.230.146.42 geocities.com #cooklop
O1 - Hosts: 66.230.146.42 www.geocities.com #cooklop
O1 - Hosts: 66.230.146.42 adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 www.adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 cj.com #cooklop
O1 - Hosts: 66.230.146.42 www.cj.com #cooklop
O1 - Hosts: 66.230.146.42 paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 www.paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 www.worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 free6.com #cooklop
O1 - Hosts: 66.230.146.42 trafficmp.com #cooklop
O1 - Hosts: 66.230.146.42 www.trafficmp.com #cooklop
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\CxtPls\CxtPls.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - E:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - E:\Documents and Settings\Todd Etna\Local Settings\Temp\2HbJq0RZq.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [mcuXGw] E:\documents and settings\todd etna\local settings\temp\mcuXGw.exe
O4 - HKLM\..\Run: [KMJr6] E:\documents and settings\todd etna\local settings\temp\KMJr6.exe
O4 - HKLM\..\Run: [WinTools] E:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [p4mW37T] nwacli.exe
O4 - HKCU\..\Run: [Y356RXf7P] os2im700.exe
O4 - HKCU\..\Run: [eZWO] E:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra 'Tools' menuitem: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.nventures.com
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…81/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,19/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://eccadcam.webex.com/client/v_mywebex…bex/ieatgpc.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
O19 - User stylesheet: (file missing)
Post #5
tetna33 – Thanks for sending you HijackThis log. Great job on the peperfix! Now we can go after Wintools and the other malware infections on your system.

A question: Your problems are spread accross both the E:\ and the C:\ drives. Are you running a dual-boot system or anything like that? The answer will influence how we proceed to help you out here. Help us understand your configuration.

You are running MyWay/My Bar. This is not technically malware, but it is thought to be bad by many experts and it will bring malware with it. There are safer alternatives available such as the Google toolbar. I recommend that you remove it, and have included instructions to do so in this fix. They are identified as "(Optional fix entries for MYWay)".

Go ahead and print these instructions, or save them to your desktop, to help keep track of the steps.

To start, allow yourself to view "Hidden files". Open Windows Explorer and go to "Tools" => "Folder Options" => "View" then click on the "Show Hidden Files and Folders" option, and un-check "Hide extensions for known file types" and "Hide protected operating system files" options. Then click the "Apply To All Folders" button.

1 – Reboot into Safe Mode (How do I boot into "Safe" mode?).

2 – Click on "Start" => "Control Panel" => "Administrative Tools" => "Services". Look for a service called "Wintools for IE Service" => Double-click it to open, then click on the Stop button and change the "Startup type" to Disabled. Do not worry if the service is not listed.

3 – Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for any of the following: "WtoolsA.exe", "WToolsS.exe" and "WSup.exe". If you find any of the files, click on them, and then click End Process. Exit the Task Manager when done.

4 – Next, use Control Panel > Add/Remove Programs to remove any of the following malware that it finds:

'AM Server' and 'POP'.
‘Lycos Sidesearch’
midaddle
WEB OFFERS
Web Search Toolbar
Win-Tools Easy Installer (may be multiples)
any other Wintools entry you see

MyWay Speed Bar' (Optional fix entries for MYWay – see note above)

5 – Now, open a command prompt by clicking on "Start" => "Run" and type in "cmd" and click on "OK". At the prompt, type regsvr32 /u /s "E:\Program Files\Toolbar\toolbar.dll" (Quotation marks must be typed in on the preceeding command) then press . Type exit to close the command prompt window.

6 – Run HijackThis, from its new location, and press Scan, and put a check against the following entries, if they still show up. Make sure all browsers and program windows are closed except for HijackThis.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

F1 - win.ini: run=E:\WINNT\..\PROGRA~1\COMMON~1\MICROS~1\MSInfo\msinfo.exe

O1 - Hosts: 66.230.146.42 gator.com #cooklop
O1 - Hosts: 66.230.146.42 tripod.com #cooklop
O1 - Hosts: 66.230.146.42 www.tripod.com #cooklop
O1 - Hosts: 66.230.146.42 geocities.com #cooklop
O1 - Hosts: 66.230.146.42 www.geocities.com #cooklop
O1 - Hosts: 66.230.146.42 adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 www.adultfriendfinder.com #cooklop
O1 - Hosts: 66.230.146.42 cj.com #cooklop
O1 - Hosts: 66.230.146.42 www.cj.com #cooklop
O1 - Hosts: 66.230.146.42 paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 www.paypopup.com #cooklop
O1 - Hosts: 66.230.146.42 worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 www.worldsex.com #cooklop
O1 - Hosts: 66.230.146.42 free6.com #cooklop
O1 - Hosts: 66.230.146.42 trafficmp.com #cooklop
O1 - Hosts: 66.230.146.42 www.trafficmp.com #cooklop

O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\CxtPls\CxtPls.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - E:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: WinPage Affiliate - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - E:\Documents and Settings\Todd Etna\Local Settings\Temp\2HbJq0RZq.dll

O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)

O4 - HKLM\..\Run: [mcuXGw] E:\documents and settings\todd etna\local settings\temp\mcuXGw.exe
O4 - HKLM\..\Run: [KMJr6] E:\documents and settings\todd etna\local settings\temp\KMJr6.exe
O4 - HKLM\..\Run: [WinTools] E:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [p4mW37T] nwacli.exe
O4 - HKCU\..\Run: [Y356RXf7P] os2im700.exe
O4 - HKCU\..\Run: [eZWO] E:\PROGRA~1\Web Offer\wo.exe

O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab

O19 - User stylesheet: (file missing)

Did you add this to your trusted zone?? If not then fix it in HJT:

O15 - Trusted Zone: http://www.nventures.com

(Optional fix entries for MYWay – see note above)

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - E:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL

Once you have selected all the items for HJT to fix, make sure all browsers and program windows are closed except for HijackThis, and click fix checked.

7 – While still in safe mofe, use Windows Explorer to delete the following lists of program files and folders, if they still exist. b]Be sure to scan both C:\ and E:\:

E:\WINNT\..\PROGRA~1\COMMON~1\MICROS~1\MSInfo\msinfo.exe <– this file

E:\WINNT\system32\nwacli.exe <– this file
E:\WINNT\system32\os2im700.exe <– this file

C:\Program Files\CxtPls\ <– this folder
C:\Program Files\AutoUpdate\ <– this folder

E:\Program Files\Web Offer\ <– this folder
E:\Program Files\Toolbar\ <– this folder
E:\Program Files\Common files\WinTools\ <– this folder

(Optional fix entries for MYWay – see note above)

E:\Program Files\MyWay\ <– this folder

Please let me know about any problems with the file/folder deletes.

8 – Then use "Start > Run" and type in "%temp%" (without the quotes). Delete the entire contents of that "temp" folder (use "Edit > Select All" then press the "Delete" key).

Then, Delete/Empty your Temporary Internet Cache completely. Close all instances of Outlook and and Internet Explorer, then use "Control Panel > Internet Options > General tab" and click the "Delete File" button. When prompted place a check in: "Delete all offline content", then click OK.

Then, use Windows Explorer to clean out ALL the other temp folders on your system Be sure to scan both C:\ and E:\:

* C:\Documents and Settings\\Local Settings\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\
* C:\Documents and Settings\\Local Settings\Temp\
* Empty your "Recycle Bin".

Please let me know about any problems with the temp file deletes. Be sure not to miss "E:\Documents and Settings\Todd Etna\Local Settings\".

9 – To prevent remnants of the problems from hiding out in your restore files, please disable Windows System Restore, (URL=http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam]"How to turn off or turn on Windows XP System Restore")

10 – Then reboot normally, and let's run a battery of general scans to give your system a "good scrubbing". Be sure to scan both C:\ and E:\:
  • Download and run the latest version of Ad-Aware. Please see How to use Ad-Aware to remove Spyware for instructions on how to download, install and then use this software.
  • Download and run the latest version of Spybot Search and Destroy. Please see How to use Spybot to remove Spyware for instructions on how to download, install and then use this software, which may catch things that Ad-Aware misses.
  • Then, run the Housecall On-Line Virus Scan from Trend Micro, and clean any problems found.
  • Then, run the online trojan scan at: http://www.windowsecurity.com/trojanscan/ and delete any problem it finds.
Please let me know if anything can not be cleaned by these utilities.

11 – Reboot, a last time and re-enable Windows System Restore by following the instructions above.

Whew :) Now let's take another look at your system.

Please run HijackThis to create a new logfile. Repost it here, and if you had any problems with the steps outlined above, please let us know what they were. Your response and the new logfile will determine the next steps for this fix.

Thanks
daveai
Post #6
Quick answer to your first question: I do have a partition on my pc. It was created using Partition Magic I think. My C: drive is almost never used. It has Windows 98 on it. My e: drive is the drive I use and it has Windows 2000 pro. on it.
Post #7
Thanks for the reply. It looks like both sides have malware in them. After running the long fix and reposting a new HJT log from Win-ME, please reboot into Win-98 and run us a log from that side as well. I'll review both logs as we go forward. Thanks daveai
Post #8
Here is my log after going through the latest steps you gave me. Here are some notes about the process as well:
Step 7: couldn't find msinfo.exe
Step 8: There wasn't a documents and setting folder in the c: drive
Step 9: I couldn't figure out to disable the Windows system restore and still can't
Step10: All scans were fine except Ad-Aware found a bunch of reg. keys and files that were called peopleonpage.


Here is my recent log. i won't do anything until I hear back from you. Thanks for your help thus far…

Logfile of HijackThis v1.98.2
Scan saved at 1:34:35 PM, on 8/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\system32\crypserv.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\System32\mspmspsv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\inetsrv\inetinfo.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Microsoft Hardware\Mouse\point32.exe
E:\WINNT\system32\wfxsnt40.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
E:\Documents and Settings\Todd Etna\Desktop\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = E:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra 'Tools' menuitem: Start WebEx One-Click Meeting - {80947ADC-151D-490B-87F1-7C8CE1B46220} - E:\WINNT\DOWNLO~1\WebEx\324\atonecli.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…81/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,19/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://eccadcam.webex.com/client/v_mywebex…bex/ieatgpc.cab
Post #9
tetna33 – Thanks for the reply and the notes.

Step 7: couldn't find msinfo.exe

No problem

Step 8: There wasn't a documents and setting folder in the c: drive

Okay…thanks.

Step 9: I couldn't figure out to disable the Windows system restore and still can't

My bad…I gave you Win XP directions.

Here's how for Win ME


Step10: All scans were fine except Ad-Aware found a bunch of reg. keys and files that were called peopleonpage.

Good…PonP was one of the misc malwares you deleted inthe last go round.

The logfile looks free of malware. You did a great job on Wintools and the others! Way to go :)

There's one item you can still clean out using HJT. You know how.

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

I'd like for you to send me an HJT log from the Windows-98 side now, please.



While I'm going over that, please take a few moments to look over the following suggestions to to keep your computer clean and secure. You may have already taken a few of the steps, but it never hurts to take a quick look :)

1 – Use an AntiVirus Software, and be sure you update it at least once a week. There are several very good free programs available. Grinler offers an outstanding overview at Virus, Spyware, and Malware Protection and Removal Resources

2 – To reduce re-infection potential for malware in the future, I strongly recommend installing three free programs: SpywareBlaster, SpywareGuard, and IE/Spyad.

3 – Use AdAware SE and Spybot S&D; to regularly to scan your system.

4 – It is very important to make sure that both Internet Explorer and XP are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

5 – Consider using a Firewall. Simply using a Firewall in its default configuration can lower your risk greatly. Check out what Lawrence Abrams has to say at Understanding and Using Firewalls

An excellent overview is: So how did I get infected in the first place?. Be sure to visit the browser test link at the end of the article to really see how secure your system is!!

Thanks
daveai
Post #10
Daveai, I tried to reboot to Windows 98 and I got an error message. Needless to say, I was thinking that it might just be easier to completely delete the windows 98 drive. I never use it anyway. Is that something you think would be o.k- deleting that drive and freeing up the space to use on the 2000 drive (E:) that only use. The one thing I don't want to screw up is my directories. Everything I use is on my E: drive now and if that changes to c:, I don't want it to be a big problem. What do you suggest. Also, note tha the partition was created using partition magic which I no longer own and the guy that set it up isn't around anymore. Regards, Todd
Post #11
Hey Todd. Thanks for the reply. There's alot I don't know about Windows drive-letter-management-internals, but I'll give you my thoughts and then suggest a way to find more expetise on the subject.

My thought is to go ahead and use the C partition as is, and you'll get additional space without deleting the partition. That way the E-drive is not affected, and you can use C-drive for whatever. Path of least resistance and all that.

If you delete the C-drive, all you really gain is the Win-98 space, since the rest of the C-drive is available to you anyway. So you can add/delete/modify files/folders on it; use it for back-up space; install new programs or games; whatever.

You can even delete the files/folders that Win-98 is using, and regain that space, but you'll never be able to boot into it again. If you do this, start with "C:\Program Files", since your malware seemed to graviate to that one.

On the other hand, if I really wanted to delete the C-drive partition, then I'd surely use google to educate myself first.

Just search for technical support forums that discuss this sort of thing. I just tried "disk partitions windows drive letter" and "windows drive letter" and of course, "dual boot windows". But you get the idea.

Heh…the last two searchs gave enough pertinent links that I'd surely start reading, get lost in it, and totally forget all about deleting the partition. :D

Lastly, it might be fun to solve the Win-98 booting problem…but that's just me B) I could actually use a Win-98 box to check out some of this malware stuff.

Hope that helps
daveai
Post #12
Thank you for all of your help. I think I will just delete a bunch of files from my C: drive and use for extra space. Sorry for sounding uninformed, but how is it that I can get this type of help from you for free? Is there something I can do to promote your services? Regards, Todd
Post #13
Thanks Todd

This service is voluntary…but you CAN donate to the site to help keep it running.

Click Here

And, if you would like to do some of this yourself, consider joining us in "The Great Spyware Wars". It's pretty interesting, if you like technical stuff. Let me know if your interested.

I got involved about 7 weeks ago, and am having a ball. :D Heh…it takes all kinds!!

Anyway, it's a pleassure to help out.
daveai
Post #14
Glad we could be of assistance. This topic is now closed. If you wish it
reopened, please send us an email (Click here to email) with a link to your thread.

Donations in support of this Web Site are always appreciated

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI