What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

About:blank

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello Fellow Techs,

It has been a real tough nut to crack - this about:blank - but I sense that I am close to finishing it off. I have windows ME OS and I have done the "obvious" things per review of other posts regarding this rather tenacious issue: installed all windblows critical updates, Ran Spybot S&D, Ran Panda AV Titanium, Ran Ad-Aware, Ran cwshredder, Ran Avast AV, Ran Bazooka, (are my legs tired), both in standard and safe mode. Stubborn little about:blank still tries to load but spybot teatime kicks out a warning that "guess who" want to change my registry setting. There is a story going round that a couple of dlls one discernable by methods still unclear to me and the other one - very well hidden and difficult to eradicate are at the core of the problem. So here I am - on bended knee(s). Your kind assistance is humbly requested - Here is my hjt log … I await your luminescence… ixi

(It's 1AM here now so I will check back in 9 hours and we can go from there… buona notte!)

Logfile of HijackThis v1.98.2
Scan saved at 11:26:54 PM, on 8/25/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\WINDOWS.000\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS.000\SYSTEM\RPCSS.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\WINDOWS.000\PCTVOICE.EXE
C:\PROGRAM FILES\HP CD-WRITER\MMENU\HPCDTRAY.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\WINDOWS.000\SYSTEM\S3APPHK.EXE
C:\WINDOWS.000\SOUNDMAN.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS.000\SYSTEM\DDHELP.EXE
C:\WINDOWS.000\SYSTEM\IRMON.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BACKWEB-8876480.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS.000\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0A\AOLTRAY.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSOL08.EXE
C:\WINDOWS.000\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSTS08.EXE
C:\DOWNLOAD\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [HP CD-Writer] C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [IrMon] irmon.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS.000\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS.000\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS.000\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Panda Preventium+ Service] "C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2004\PREVSRV.EXE"
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Startup: Quicken Scheduled Updates.lnk = C:\QUICKEN\bagent.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.000\SYSTEM\Shdocvw.dll
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdcco…ad/IbmEgath.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #2
Hello TC Tech Team, Am back on line to monitor your response to my previous (first) post… Observing Fantastic support regarding other posts on this about:blank topic but for XP. My OS is WinME… Your assistance is appreciated. Regards, ixi
Post #3
Download StartDreck from here. Unzip to its own folder and start the program:

Press 'Config'
Press 'Unmark All'

Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes

Press 'Ok'. Press 'Save' and select the location to save the log file (default is the same folder as the application). Post the log in this thread.
Post #4
Hello (Avatar) Daemon, Thank you so much for helping me. Had serveral spybot teatime warnings that registery was being change ( about:blank ) the persistant little bugger! Please notice I installed Mozilla browser in an attempt to work around it. Also now getting error that avast AV cannot update (last updated 8/24/04)… Here is the StartDreck log: StartDreck (build 2.1.7 public stable) - 2004-08-27 @ 19:28:59 (GMT -07:00) Platform: Windows ME (Win 4.90.3000 ) Internet Explorer: 6.0.2800.1106 Logged in as . at P3Z2B4 »Registry »Run Keys »Current User »Run *LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe *SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe »RunOnce »Default User »Run *LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe *SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe »RunOnce »Local Machine »Run *ScanRegistry=C:\WINDOWS.000\scanregw.exe /autorun *TaskMonitor=C:\WINDOWS.000\taskmon.exe *SystemTray=SysTray.Exe *MMTray=C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe *PCHealth=C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *PCTVOICE=pctvoice.exe *HP CD-Writer=C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe *zBrowser Launcher=C:\Program Files\Logitech\iTouch\iTouch.exe *S3apphk=S3apphk.exe *SoundMan=SOUNDMAN.EXE *RealTray=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER *CountrySelection=pctptt.exe *IrMon=irmon.exe *Zone Labs Client="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" +OptionalComponents +IMAIL *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe *BCDetect=C:\WINDOWS.000\SYSTEM\BCDetect.exe defer **StateMgr=C:\WINDOWS.000\System\Restore\StateMgr.exe *StillImageMonitor=C:\WINDOWS.000\SYSTEM\STIMON.EXE *AolAcsDaemon1="C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE" *TrueVector=C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE -service *Panda Preventium+ Service="C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2004\PREVSRV.EXE" *avast!=C:\Program Files\Alwil Software\Avast4\ashServ.exe »RunServicesOnce **xi=rundll32 C:\WINDOWS.000\SYSTEM\MSKJ.DLL,StreamingDeviceSetup »RunOnceEx »RunServicesOnceEx »Files »System/Drivers »Running Processes +FFEFA58D=C:\WINDOWS.000\SYSTEM\KERNEL32.DLL +FFFFE32D=C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE +FFFFF149=C:\WINDOWS.000\SYSTEM\mmtask.tsk +FFFE09E1=C:\WINDOWS.000\SYSTEM\MPREXE.EXE +FFFEB8A9=C:\WINDOWS.000\SYSTEM\MSTASK.EXE +FFFED2C5=C:\WINDOWS.000\SYSTEM\STIMON.EXE +FFE13479=C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE +FFFE9FA5=C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE +FFE101CD=C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE +FFE19AC1=C:\WINDOWS.000\RUNDLL32.EXE +FFFEF775=C:\WINDOWS.000\EXPLORER.EXE +FFE20659=C:\WINDOWS.000\SYSTEM\RPCSS.EXE +FFE28195=C:\WINDOWS.000\TASKMON.EXE +FFE291FD=C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE +FFE508DD=C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE +FFE46641=C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE +FFE535E9=C:\WINDOWS.000\PCTVOICE.EXE +FFE0D03D=C:\PROGRAM FILES\HP CD-WRITER\MMENU\HPCDTRAY.EXE +FFE43A8D=C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE +FFE58B1D=C:\WINDOWS.000\SYSTEM\S3APPHK.EXE +FFE44D51=C:\WINDOWS.000\SOUNDMAN.EXE +FFE56CC1=C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE +FFE529AD=C:\WINDOWS.000\SYSTEM\DDHELP.EXE +FFE5E3E1=C:\WINDOWS.000\SYSTEM\IRMON.EXE +FFE4CEC9=C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE +FFE77C05=C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BACKWEB-8876480.EXE +FFE75B09=C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE +FFE786E5=C:\WINDOWS.000\SYSTEM\WMIEXE.EXE +FFE7F2F9=C:\PROGRAM FILES\AMERICA ONLINE 9.0A\AOLTRAY.EXE +FFE64829=C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE +FFE6A43D=C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSOL08.EXE +FFE979C9=C:\WINDOWS.000\SYSTEM\SPOOL32.EXE +FFE84E39=C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE +FFEAD711=C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSTS08.EXE +FFED4259=C:\PROGRAM FILES\AMERICA ONLINE 9.0\WAOL.EXE +FFECE58D=C:\WINDOWS.000\SYSTEM\RNAAPP.EXE +FFEC4AE1=C:\PROGRAM FILES\AMERICA ONLINE 9.0\SHELLMON.EXE +FFEC96B1=C:\WINDOWS.000\SYSTEM\TAPISRV.EXE +FB994CED=C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE +FFEB2515=C:\DOWNLOAD\STARTDRECK\STARTDRECK.EXE »Application specific
Post #5
Download Win98Fix.zip from here.

Unzip to its own folder. Open Folder and double click on RunFix.reg file. Hit 'Yes' to merge it into your registry. Restart your computer. The bad file should now be visible so you can delete it.

Browse to c:\windows\system\MSKJ.DLL then delete it. Click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59.1 Reboot when done. Rescan with HJT and post a new log in your next reply.
Post #6 last edited
Hello SuperMod,

Thank you for your generous support… per your instructions -
1. Downloaded and ran Win98fix.zip
2. Restarted system, found MSKJ.DLL, and deleted it.
3. Ran CWShredder 1.59.1 but was unable to update (server has been down for the last few days?)
4. Ran hjt and here is the log:

Logfile of HijackThis v1.98.2
Scan saved at 1:25:37 AM, on 8/28/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\SYSTEM\KERNEL32.DLL
C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE
C:\WINDOWS.000\SYSTEM\SPOOL32.EXE
C:\WINDOWS.000\SYSTEM\MPREXE.EXE
C:\WINDOWS.000\SYSTEM\MSTASK.EXE
C:\WINDOWS.000\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS.000\SYSTEM\mmtask.tsk
C:\WINDOWS.000\SYSTEM\RPCSS.EXE
C:\WINDOWS.000\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS.000\EXPLORER.EXE
C:\WINDOWS.000\TASKMON.EXE
C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MUSICMATCH\MUSICMATCH JUKEBOX\MM_TRAY.EXE
C:\WINDOWS.000\PCTVOICE.EXE
C:\PROGRAM FILES\HP CD-WRITER\MMENU\HPCDTRAY.EXE
C:\PROGRAM FILES\LOGITECH\ITOUCH\ITOUCH.EXE
C:\WINDOWS.000\SYSTEM\S3APPHK.EXE
C:\WINDOWS.000\SOUNDMAN.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS.000\SYSTEM\DDHELP.EXE
C:\WINDOWS.000\SYSTEM\WMIEXE.EXE
C:\WINDOWS.000\SYSTEM\IRMON.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\PROGRAM\BACKWEB-8876480.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0A\AOLTRAY.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSOL08.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOEVM08.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOSTS08.EXE
C:\DOWNLOAD\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS.000\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS.000\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS.000\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [HP CD-Writer] C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [IrMon] irmon.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS.000\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS.000\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS.000\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [AolAcsDaemon1] "C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE"
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Panda Preventium+ Service] "C:\PROGRAM FILES\PANDA SOFTWARE\PANDA TITANIUM ANTIVIRUS 2004\PREVSRV.EXE"
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Startup: Quicken Scheduled Updates.lnk = C:\QUICKEN\bagent.exe
O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - Startup: officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.000\SYSTEM\Shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS.000\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS.000\SYSTEM\MSJAVA.DLL
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www.ibm.com/pc/support/access/sdcco…ad/IbmEgath.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
Post #8
Hello SuperMod, Purrs like a little kitten! Thank you so much! I sincerely appriciate your expertise and generous support. I am sooo impressed! ^5 ixi
Post #9
You're welcome - glad to help :D

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI