What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help Desperately!

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.97.7
Scan saved at 12:21:35 PM, on 8/29/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\WIN98\EXPLORER.EXE
C:\PROGRAM FILES\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\RESTORE\STMGR.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\DANIELLE'S STUFF\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.agnwbabvpkinsawk.info/tRGJgJgbI…jTL2aMZUe0.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jhcoioycxwhxcoxjbspljjm.com/tRG…WdUJEN0zB4A.htm
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {35385878-ACA6-75FB-76A2-2850B2046730} - C:\PROGRAM FILES\PARTKEEP\WINDOWFIVE.EXE
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Seri (Copy 2)] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P30 "EPSON Stylus C84 Seri (Copy 2)" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [gridacid] C:\PROGRA~1\MATHBL~1\Delete Glue.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WIN98\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: ICQ 4.1 (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8209.7933101852
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab

PLZ HELP! i've tried everything that i could think of and nothing is helping!! :(
Post #2
danielle1314 – Thanks for sending your HijackThis logfile.

You are running an old version of HijackThis.

Please delete the old version and download the latest version of HijackThis(v1.98.2) and unzip it into "C:\MY DOCUMENTS\DANIELLE'S STUFF\".

Run the new version and create a new logfile, then repost into this thread.

I'll be automatically alerted when that happens.

Thanks
daveai
Post #3
Logfile of HijackThis v1.98.2
Scan saved at 1:01:13 PM, on 8/29/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\WIN98\EXPLORER.EXE
C:\PROGRAM FILES\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\RESTORE\STMGR.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.agnwbabvpkinsawk.info/tRGJgJgbI…jTL2aMZUe0.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ymkwxvjtatuiahhyupe.com/tRGJgJg…dUJEN0zB4A.html
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {35385878-ACA6-75FB-76A2-2850B2046730} - C:\PROGRAM FILES\PARTKEEP\WINDOWFIVE.EXE
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Seri (Copy 2)] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P30 "EPSON Stylus C84 Seri (Copy 2)" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [gridacid] C:\PROGRA~1\MATHBL~1\Delete Glue.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WIN98\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab

ok done and done!
Post #4
danielle1314 – Thanks for sending your HijackThis log.

I am going to include steps to delete Messenger Plus. This is why. But, it is an optional fix, so you may choose to keep it.

Go ahead and print these instructions, or save them to your desktop, to help keep track of the steps.

To start, allow yourself to view "Hidden files". Open Windows Explorer and go to "Tools" => "Folder Options" => "View" then click on the "Show Hidden Files and Folders" option, and un-check "Hide extensions for known file types" and "Hide protected operating system files" options. Then click the "Apply To All Folders" button.

1 – Reboot into Safe Mode (How do I boot into "Safe" mode?).

2 – Next, use Control Panel > Add/Remove Programs to remove any of the following malware that it finds:

Messenger Plus (optional fix)

3 – Run HijackThis, and press Scan, and put a check against the following entries, if they still show up. Make sure all browsers and program windows are closed except for HijackThis.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.agnwbabvpkinsawk.info/tRGJgJgbI…jTL2aMZUe0.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ymkwxvjtatuiahhyupe.com/tRGJgJg…dUJEN0zB4A.html

O2 - BHO: (no name) - {35385878-ACA6-75FB-76A2-2850B2046730} - C:\PROGRAM FILES\PARTKEEP\WINDOWFIVE.EXE

O4 - HKLM\..\Run: [gridacid] C:\PROGRA~1\MATHBL~1\Delete Glue.exe

This next is an optional fix:

I recommend uninstalling Messenger Plus. See this post. These are the items to fix in HJT:

O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart


Once you have selected all the items for HJT to fix, make sure all browsers and program windows are closed except for HijackThis, and click fix checked.

4 – While still in safe mode, use Windows Explorer to delete the following lists of program files and folders, if they still exist.

C:\PROGRAM FILES\PARTKEEP\ <– this folder
C:\PROGRAM FILES\MATHBL~1\ <– this folder (use "Start > Search" to find "MATHBL")

C:\Program Files\Messenger Plus! 3\ <– this folder (optional fix)

Please let me know about any problems with the file/folder deletes.

5 – Next, clean out all the temporary files and cookies on your system. Go to Start > Run and enter: cleanmgr. Let it scan your system for files to remove. Check these three boxes and then press ok to remove: Temporary Files, Temporary Internet Files, Recycle Bin.


Now, reboot normally, and we'll take another look at your system.

Please run HijackThis to create a new logfile. Repost it here, and if you had any problems with the steps outlined above, please let us know what they were. Your response and the new logfile will determine the next steps for this fix.

Thanks
daveai
Post #5
Experiencing a bit of a problem with safe mode… i boot my computer into safe mode, and i started to do the steps you told me too, but about 1 minute after safe mode had loaded my computer unexpectedly shut down and restarted itself, i tried booting into safe mode again bbbut the same problem keeps happening everytime and i can't get anything done…..Help :(
Post #6
Thanks danielle1314 That's a new one on me. Go ahead and run the fix without using Safe Mode, then post a new logfile. Thanks daveai
Post #7
Ok i removed all the recommended entries and here's my new logfile

Logfile of HijackThis v1.98.2
Scan saved at 3:11:28 PM, on 8/29/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\SYSTEM\RESTORE\STMGR.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\MY DOCUMENTS\DANIELLE'S STUFF\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {35385878-ACA6-75FB-76A2-2850B2046730} - C:\PROGRAM FILES\PARTKEEP\WINDOWFIVE.EXE (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Seri (Copy 2)] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P30 "EPSON Stylus C84 Seri (Copy 2)" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MSConfigReminder] C:\WIN98\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WIN98\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
Post #8
Thanks danielle1314

Were you able to delete the files? If not, tell me the error message you are getting.

Also, I'm not sure your system is uptodate on Windows security fixes. Please start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there to ensure you are uptodate on all critical security patches for windows.

Thanks
daveai
Post #9
Hi, when i went to remove the files i had no problems that i was aware of, the only thing was i couldn't find the file C:\PROGRAM FILES\MATHBL~1 i ran a search and there were no folders named that, only smaller RESTORE files, that i wasn't sure if i should remove or not. I also did a check for critical windows updates and there are none that i needed. When i was looking at my new hijacklog i noticed that one of the files you had said to remove was still there, either that it had reloaded itself or i had just not clicked on it to remove it.
Post #10
Thanks for the reply. Your system is looking pretty clean to me. The important question is: How is your system running? Are your problems cleared up?

Responding to your last post:

1 – The O2 that came back is:

O2 - BHO: (no name) - {35385878-ACA6-75FB-76A2-2850B2046730} - C:\PROGRAM FILES\PARTKEEP\WINDOWFIVE.EXE (file missing)

but, the file appears to be gone. Good work :)

You can go ahead and delete the O2 via HJT.

2 – The folder we are after starts with the letters "MATHBL" but is not named "MATHBL~1", which is old windows shorthand for names longer than 8 characters. The file associated with it is not being invoked at startup, but it would be sstill good to find the folder if you can and delete it.

There are a few some efficiency fixes you can make, to eliminate known resource hogs. If interested, let me know.


Other than that, please allow me to suggest some prevention steps to keep your computer clean and secure going forward. You may have already taken a few of the steps, but it never hurts to take a quick look :)

1 – Use an AntiVirus Software, and be sure you update it at least once a week. There are several very good free programs available. Grinler offers an outstanding overview at Virus, Spyware, and Malware Protection and Removal Resources

2 – To reduce re-infection potential for malware in the future, I strongly recommend installing three free programs: SpywareBlaster, SpywareGuard, and IE/Spyad.

3 – Use AdAware SE and Spybot S&D; to regularly to scan your system.

4 – It is very important to make sure that both Internet Explorer and XP are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

5 – Consider using a Firewall. Just by using a Firewall in its default configuration can lower your risk greatly. Check out what Lawrence Abrams has to say at Understanding and Using Firewalls

An excellent overview is: So how did I get infected in the first place?. Be sure to visit the browser test link at the end of the article to really see how secure your system is!!

Thanks
daveai
Post #11
Hey! thanks so much daveai for helping me out so far, the computer seems to be running alright, except the fact that my mouse seems to go haywire on me at times, like i can't control where it clicks and it exits programs on me when i don't want to, i dont know if thats a sign of a hijacker or a virus, it really has me stumped. if you have any advice on what to do, that would be appericated!
Post #12
Thanks danielle1314 Please tell me more about this mouse problem. What programs are being terminated? Is this repeatable? Does the mouse cursor move when your are not touching the mouse at all? Does the same thing happen more than once? Or, are the problems more random? I am not aware of any discussion in the anti-spyware community about malware that takes over the mouse. And, I probably would have read about it if there was a "mouse attack" since the boards I contribute to recieve thousands of HJT logs per week, and host some very active technical discussion forums about this stuff. But, you never know :) Give me some more details and I'll get some more expert opinions. I'm glad to hear your systemis running better. daveai
Post #13
Hey, my mouse cursor moves when i'm not touching the mouse at all, and it seems to like to close out my browser when i'm searching the web, and also change the shape and position of windows that are open, it's extremely annoying. It doesn't close out my programs all the time, it's a random thing, it doesn't really matter what i'm doing it just seems to happen, and it occurs quite often.
Post #14 last edited
Thanks for the clarification. We need to work through some basic troubleshooting steps, and this will take several posts. I'll stay with the problem until we understand what's going on and how to fix it.

Please run the online trojan scan at: http://www.windowsecurity.com/trojanscan/ and delete any problem it finds. Then, let me know if anything was found.

Then, I'd appreciate your sending another HijackThis log. We're sure to be asked for one by anyone who helps on this.

Now some more Q and A:

What type of mouse (optical, wireless, number of buttons, make/model, etc.) is it? And, are you using any special mouse drivers, or cursor pointer software?

Did this mouse problem ever occur before you reported the following to me?

Experiencing a bit of a problem with safe mode… i boot my computer into safe mode, and i started to do the steps you told me too, but about 1 minute after safe mode had loaded my computer unexpectedly shut down and restarted itself, i tried booting into safe mode again bbbut the same problem keeps happening everytime and i can't get anything done…..


And to clarify my question about it moving on its own: When the mouse cursor moves on its own, without you touching it, is the activity puposeful? That is, the cursor re-sizes windows, or shuts down the browser, when you are not touching the mouse?

There could be several things that cause this problem, and we'll need to eliminate them one by one.

It would also be good if you can swap the mouse for another one (if you have a spare) to eliminate the first piece of hardware in this puzzle. If that's not doable right now, don't worry…just let me know.

Lastly (for now), this is decent discussion of non-malware cause for these sorts of problems: http://ask-leo.com/my_mouse_is_super_sensi…at_do_i_do.html


Thanks
daveai
Post #15
Hey, i did the trojan scan on my computer and it came back with nothing so i think we can eliminate that,
here is my new logfile
Logfile of HijackThis v1.98.2
Scan saved at 12:45:15 PM, on 8/30/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WIN98\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WIN98\SYSTEM\WINOA386.MOD
C:\MY DOCUMENTS\DANIELLE'S STUFF\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [EPSON Stylus C84 Seri (Copy 2)] C:\WIN98\SYSTEM\E_S4I2D1.EXE /P30 "EPSON Stylus C84 Seri (Copy 2)" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MSConfigReminder] C:\WIN98\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WIN98\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab



i also read that site you gave me about the mouse, and my problem is pretty much exactly the same as what they said on that site…..i cleaned my mouse, and i checked the wire connection and they seem to be fine, and yes my mouse was having problems before i reported about the safe mode not working properly….
i am using a logitech mouse it has 3 buttons right click left click and a scroller…
i hope that's enough info for now :S

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI