What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help!

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hey,

any quick help would be greatly appreciated

below is my log:



Logfile of HijackThis v1.98.2
Scan saved at 2:34:58 PM, on 9/23/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\System32\golumm\services.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\WINDOWS\System32\lsasrv05.exe
C:\Program Files\Windows SyncroAd\WinSync.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\documents and settings\brian\local settings\temp\pItGk.exe
C:\documents and settings\brian\local settings\temp\ZI5.exe
C:\WINDOWS\System32\IEHost.exe
C:\WINDOWS\System32\extnttriggers.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\System32\??oolsv.exe
C:\Documents and Settings\Brian\Application Data\gp???.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\WINDOWS\System32\jgeedia.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\CxtPls\CxtPls.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\America Online 9.0c\waol.exe
C:\Program Files\America Online 9.0c\shellmon.exe
C:\Program Files\Common Files\Aol\aoltpspd.exe
C:\Program Files\NetCaptor\NetCaptor.exe
C:\Documents and Settings\Brian\Desktop\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\dwwin.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Brian\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.coolsearch.biz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll (file missing)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\Downloaded Program Files\ipreg32.dll
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O2 - BHO: (no name) - {A6757B5C-F81A-675D-3C8B-3EDB07AA550C} - C:\WINDOWS\system32\winef.dll (file missing)
O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Brian\Local Settings\Temp\4WGPC9BD.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [i7.exe] c:\documents and settings\brian\local settings\temp\i7.exe
O4 - HKLM\..\Run: [R4lP.exe] C:\documents and settings\brian\local settings\temp\R4lP.exe
O4 - HKLM\..\Run: [W7R0fqJa.exe] C:\documents and settings\brian\local settings\temp\W7R0fqJa.exe
O4 - HKLM\..\Run: [bbf26729214d] C:\WINDOWS\System32\lsasrv05.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [pItGk.exe] C:\documents and settings\brian\local settings\temp\pItGk.exe
O4 - HKLM\..\Run: [ZI5.exe] C:\documents and settings\brian\local settings\temp\ZI5.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [4X@95ME57C5BM8] C:\WINDOWS\System32\IpuFmd.exe
O4 - HKLM\..\Run: [v34f3pP] extnttriggers.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kbdsf] C:\WINDOWS\System32\kbdsf.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Cnmsnbus] C:\WINDOWS\System32\??oolsv.exe
O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
O4 - HKCU\..\Run: [Aceu] C:\Documents and Settings\Brian\Application Data\gp???.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [e0vpRfj9P] jgeedia.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: ConferenceRoom Java Client - http://irc4.bondage.com:8080/java/cr.cab
O16 - DPF: v2cab - http://1583.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {00220752-F0EC-2664-8A44-6FDB1E7CB618} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {03B9138D-213D-02FA-4CED-3BD27F608490} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {03C98E8F-24CD-67B5-B68B-71311E4A27B3} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {04C751AC-D4B9-5DE7-46DB-57DA3C459301} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {05706FD4-24C9-7DAF-4A75-26EA31C35053} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl…22/ComCtl32.cab
O16 - DPF: {09BDFC1F-2FE7-5E6F-BAEF-351A7D24100E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0A775D38-3E39-2661-05D6-64EC2CE2F80B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0BC80ABB-FE28-3FA3-E68C-738D03B4683A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {0ED23195-B41C-321F-5875-7E907125548B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0FD22B9A-87C1-719F-A1D0-0B533FB3E2A5} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1267A06D-6794-30DA-4553-727B47DA5443} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {14C10B49-B81A-78D0-B645-50E94E0DB4AE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…d7510b28ebf1261
O16 - DPF: {18172F1C-BA4E-0D4F-3DBD-028B06F632C7} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {196E3BBB-B5EC-3284-B4C6-65FC0B638DF6} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1B179EF5-7995-51C6-3C33-738C3E86B72A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr…etup1.0.0.8.cab
O16 - DPF: {1D76FCDF-C4FB-7EFB-80B1-2F5C265025F2} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1DCD6B5D-A7B7-2D76-ABB5-302719983C72} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1DE20FB8-5651-3062-4ADD-131974E630A9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1F4525AA-5C83-4221-391B-32BE73FCC66E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2024E210-045F-568B-E4B2-34094D70E1AC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2163F9CD-2220-25C5-13EB-690E0CA41F47} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {23327754-118E-064C-C53D-62591FEDE0BF} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {23A0780C-08E5-0536-8405-291D44F4C52B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {241BA51D-9B32-08E0-610F-23B7632D5E3C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {25BFAA5D-4738-2E51-FC30-297B0A0A6DF2} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {275A7892-B76B-7AE7-9D39-7D5F1384F0E0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {285CE3D3-0CEB-7711-3E19-3657361C749D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {28FBB266-034B-6A1A-9E91-45611E40A236} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2F54AF14-71AF-5A48-58FC-65A1491A9C54} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {311ACCEF-1E3C-3F74-DEA6-1C1626E6A91F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {32570351-C59B-7539-0A79-4C552DEA683F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3299F671-D811-225B-E651-0310301B2489} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {330F6FBA-53BA-4729-C198-522606A5EA1E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {342F44D9-D1EA-1BEA-D068-20F72E71E797} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {35499120-7F71-517A-4B61-2A224878F6C8} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {35CB3DB9-0BF6-1611-741E-09534E37C1D4} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3AB12B8A-3E0B-7D3F-E67C-7D165FE27650} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3BD25E2C-82AF-3CBE-F26E-6D6D2C1C5E15} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3CAB7EAB-625B-0C2C-E535-4784515751DE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3CD50B91-2AE3-07EC-B647-6D610826D9B4} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3EC00F12-998F-1428-83D4-192209DDDD70} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3F2989FE-FE13-6BD0-1F3E-529B6282F479} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {40BE6A57-6D76-2329-02CF-72102DFC94C9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {42B36585-720F-7225-6915-35D91A72C612} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {43894279-F740-5E5D-E42A-7B725149F661} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {43B25480-B8C1-461D-BBE0-7AF5189A8C76} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {440F926F-0C8D-5B59-5B19-0A563201BD9D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {44676D87-D870-23FF-8EF3-5F2114F98647} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {44B1C738-E65C-6782-CD85-7EC4551B8C16} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {454E98E3-7CE6-79F2-992B-07E0020A787B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4653E279-15E8-631A-9C07-6D6568E91D6D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4BE2F2BC-46B9-15E2-75B5-727B47EC21E0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {4DEF715E-B8EC-5E08-269A-119179519C5E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4E989523-01F6-532D-15FC-476B46CF2913} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4EC31377-8D01-00FE-A5AB-662C29F9D997} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4ED12775-CBA2-547B-098B-2817431EEE3C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…72/mcinsctl.cab
O16 - DPF: {4F1A9D3C-918D-40C4-EB4E-1CF728B773D2} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {508DE044-1266-58DB-90C3-07283BECBECA} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {50DAFE72-ED6E-2402-F3A0-4A4E5EC772AB} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {51B0BC56-B51F-6F8F-B533-4F4A6D770FAF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {53BDF2FD-A1BF-7E0C-2FF6-5FE4057A9C66} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {56012DBB-3B8C-15C9-3227-31773B1587F8} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {584750C3-E83C-5242-ACC9-1686046A26FF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {58B00C47-15F2-705A-0FF4-518263B22476} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5AFD14D2-7E31-0656-3BE1-239876D8F1EC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5E4F0C63-4F95-513E-DFAB-25C623EA07FE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5FC28A9F-432F-7F02-3E00-118541754733} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {60436646-C1DA-5536-529D-2CE217747A06} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {631C7A25-F310-3C38-22EE-1FEB4E9AFF74} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64A22403-E892-58AE-ED09-10164F4D814E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {65ECF793-8516-3B16-73F0-4BB220E54E9C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {66AD08A6-21BB-2BF4-F4FE-638713748AA3} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {69B444D9-890A-3B2D-66AE-071C7267F19C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6AC1D1F0-B246-15BD-45F6-24D45590F2AF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6BA729C7-BBC8-660B-EFC1-0CD34DA39EDD} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CB67D93-0755-38A0-884E-62E556E4B50A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CC8EAAA-BF51-37EC-60E3-6E6775BB8372} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CDB011D-0750-2374-2CCA-6A8B2762DF65} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {715AF62F-35BA-7F4B-62DE-57C344A7FFA9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {72B39881-3D30-76D6-CEF9-4A7214EB7ED0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {72C641B0-B1BE-0365-4030-05531D078C9E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {757F2BF1-CD30-712A-B4E0-7EFD5321E7D9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {766C0576-BA19-042C-381D-62D859593398} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7DAB8448-8180-64F8-FD65-312B642ED284} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
O21 - SSODL: SARU - {FF5D8CC8-DE01-4964-89F1-648E43271415} - C:\WINDOWS\System32\mssaru.dll
Post #2
Greetings and welcome to TomCoyote.org!

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from http://security.kolla.de (This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot after running each program.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Move HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Then post a new log file in this thread. :)
Post #4
If this entry is still there:

O4 - HKLM\..\Run: [4X@95ME57C5BM8] C:\WINDOWS\System32\IpuFmd.exe

That means you still have a Peper trojan.

Download the Peper Uninstaller from the link in my signature.

You have to remain online to run it.

Run it.

Reboot.

Run it again.

Reboot and post a new Hijack This! log into this thread. :)
Post #5
just did the scans…

this is what i came up with…..

Logfile of HijackThis v1.98.2
Scan saved at 9:58:22 PM, on 9/23/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\System32\golumm\services.exe
C:\Program Files\Windows SyncroAd\SyncroAd.exe
C:\WINDOWS\System32\lsasrv05.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows SyncroAd\WinSync.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\System32\??oolsv.exe
C:\Documents and Settings\Brian\Application Data\gp???.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\WINDOWS\System32\dwwin.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.coolsearch.biz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\Downloaded Program Files\ipreg32.dll
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O2 - BHO: (no name) - {A6757B5C-F81A-675D-3C8B-3EDB07AA550C} - C:\WINDOWS\system32\winef.dll (file missing)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [i7.exe] c:\documents and settings\brian\local settings\temp\i7.exe
O4 - HKLM\..\Run: [R4lP.exe] C:\documents and settings\brian\local settings\temp\R4lP.exe
O4 - HKLM\..\Run: [W7R0fqJa.exe] C:\documents and settings\brian\local settings\temp\W7R0fqJa.exe
O4 - HKLM\..\Run: [bbf26729214d] C:\WINDOWS\System32\lsasrv05.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [pItGk.exe] C:\documents and settings\brian\local settings\temp\pItGk.exe
O4 - HKLM\..\Run: [ZI5.exe] C:\documents and settings\brian\local settings\temp\ZI5.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [81R.exe] C:\documents and settings\brian\local settings\temp\81R.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kbdsf] C:\WINDOWS\System32\kbdsf.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Cnmsnbus] C:\WINDOWS\System32\??oolsv.exe
O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
O4 - HKCU\..\Run: [Aceu] C:\Documents and Settings\Brian\Application Data\gp???.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: ConferenceRoom Java Client - http://irc4.bondage.com:8080/java/cr.cab
O16 - DPF: v2cab - http://1583.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {00220752-F0EC-2664-8A44-6FDB1E7CB618} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0214EFC5-ABD5-02DC-074F-79E238605BB9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {03B9138D-213D-02FA-4CED-3BD27F608490} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {03C98E8F-24CD-67B5-B68B-71311E4A27B3} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {04C751AC-D4B9-5DE7-46DB-57DA3C459301} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {05706FD4-24C9-7DAF-4A75-26EA31C35053} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl…22/ComCtl32.cab
O16 - DPF: {09BDFC1F-2FE7-5E6F-BAEF-351A7D24100E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0A775D38-3E39-2661-05D6-64EC2CE2F80B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0BC80ABB-FE28-3FA3-E68C-738D03B4683A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {0ED23195-B41C-321F-5875-7E907125548B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {0FD22B9A-87C1-719F-A1D0-0B533FB3E2A5} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1267A06D-6794-30DA-4553-727B47DA5443} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {14C10B49-B81A-78D0-B645-50E94E0DB4AE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…d7510b28ebf1261
O16 - DPF: {18172F1C-BA4E-0D4F-3DBD-028B06F632C7} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {196E3BBB-B5EC-3284-B4C6-65FC0B638DF6} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1B179EF5-7995-51C6-3C33-738C3E86B72A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr…etup1.0.0.8.cab
O16 - DPF: {1D76FCDF-C4FB-7EFB-80B1-2F5C265025F2} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1DCD6B5D-A7B7-2D76-ABB5-302719983C72} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1DE20FB8-5651-3062-4ADD-131974E630A9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {1F4525AA-5C83-4221-391B-32BE73FCC66E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2024E210-045F-568B-E4B2-34094D70E1AC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2163F9CD-2220-25C5-13EB-690E0CA41F47} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {23327754-118E-064C-C53D-62591FEDE0BF} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {23A0780C-08E5-0536-8405-291D44F4C52B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {241BA51D-9B32-08E0-610F-23B7632D5E3C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {25BFAA5D-4738-2E51-FC30-297B0A0A6DF2} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {275A7892-B76B-7AE7-9D39-7D5F1384F0E0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {285CE3D3-0CEB-7711-3E19-3657361C749D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {28FBB266-034B-6A1A-9E91-45611E40A236} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2F54AF14-71AF-5A48-58FC-65A1491A9C54} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {311ACCEF-1E3C-3F74-DEA6-1C1626E6A91F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {32570351-C59B-7539-0A79-4C552DEA683F} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3299F671-D811-225B-E651-0310301B2489} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {330F6FBA-53BA-4729-C198-522606A5EA1E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {342F44D9-D1EA-1BEA-D068-20F72E71E797} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {35499120-7F71-517A-4B61-2A224878F6C8} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {35CB3DB9-0BF6-1611-741E-09534E37C1D4} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3AB12B8A-3E0B-7D3F-E67C-7D165FE27650} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3BD25E2C-82AF-3CBE-F26E-6D6D2C1C5E15} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3CAB7EAB-625B-0C2C-E535-4784515751DE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3CD50B91-2AE3-07EC-B647-6D610826D9B4} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3EC00F12-998F-1428-83D4-192209DDDD70} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {3F2989FE-FE13-6BD0-1F3E-529B6282F479} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {40BE6A57-6D76-2329-02CF-72102DFC94C9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {42B36585-720F-7225-6915-35D91A72C612} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {43894279-F740-5E5D-E42A-7B725149F661} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {43B25480-B8C1-461D-BBE0-7AF5189A8C76} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {440F926F-0C8D-5B59-5B19-0A563201BD9D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {44676D87-D870-23FF-8EF3-5F2114F98647} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {44B1C738-E65C-6782-CD85-7EC4551B8C16} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {454E98E3-7CE6-79F2-992B-07E0020A787B} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4653E279-15E8-631A-9C07-6D6568E91D6D} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4BE2F2BC-46B9-15E2-75B5-727B47EC21E0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {4DEF715E-B8EC-5E08-269A-119179519C5E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4E989523-01F6-532D-15FC-476B46CF2913} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4EC31377-8D01-00FE-A5AB-662C29F9D997} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4ED12775-CBA2-547B-098B-2817431EEE3C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…72/mcinsctl.cab
O16 - DPF: {4F1A9D3C-918D-40C4-EB4E-1CF728B773D2} - http://69.50.188.54/1/rdgUS208.exe
O16 - DPF: {508DE044-1266-58DB-90C3-07283BECBECA} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {50DAFE72-ED6E-2402-F3A0-4A4E5EC772AB} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {51B0BC56-B51F-6F8F-B533-4F4A6D770FAF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {53BDF2FD-A1BF-7E0C-2FF6-5FE4057A9C66} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {56012DBB-3B8C-15C9-3227-31773B1587F8} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {584750C3-E83C-5242-ACC9-1686046A26FF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {58B00C47-15F2-705A-0FF4-518263B22476} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5AFD14D2-7E31-0656-3BE1-239876D8F1EC} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5E4F0C63-4F95-513E-DFAB-25C623EA07FE} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {5FC28A9F-432F-7F02-3E00-118541754733} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {60436646-C1DA-5536-529D-2CE217747A06} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {631C7A25-F310-3C38-22EE-1FEB4E9AFF74} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {64A22403-E892-58AE-ED09-10164F4D814E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {65ECF793-8516-3B16-73F0-4BB220E54E9C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {66AD08A6-21BB-2BF4-F4FE-638713748AA3} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {69B444D9-890A-3B2D-66AE-071C7267F19C} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6AC1D1F0-B246-15BD-45F6-24D45590F2AF} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6BA729C7-BBC8-660B-EFC1-0CD34DA39EDD} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CB67D93-0755-38A0-884E-62E556E4B50A} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CC8EAAA-BF51-37EC-60E3-6E6775BB8372} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {6CDB011D-0750-2374-2CCA-6A8B2762DF65} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {715AF62F-35BA-7F4B-62DE-57C344A7FFA9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {72B39881-3D30-76D6-CEF9-4A7214EB7ED0} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {72C641B0-B1BE-0365-4030-05531D078C9E} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {757F2BF1-CD30-712A-B4E0-7EFD5321E7D9} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {766C0576-BA19-042C-381D-62D859593398} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {7DAB8448-8180-64F8-FD65-312B642ED284} - http://69.50.188.54/1/gdnUS208.exe
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
Post #7
It's gone. Sometimes Spybot gets the Peper trojan, sometimes it doesn't.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.coolsearch.biz/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\Downloaded Program Files\ipreg32.dll

O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll

O2 - BHO: (no name) - {A6757B5C-F81A-675D-3C8B-3EDB07AA550C} - C:\WINDOWS\system32\winef.dll (file missing)

O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll

O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe

O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe

O4 - HKLM\..\Run: [i7.exe] c:\documents and settings\brian\local settings\temp\i7.exe

O4 - HKLM\..\Run: [R4lP.exe] C:\documents and settings\brian\local settings\temp\R4lP.exe

O4 - HKLM\..\Run: [W7R0fqJa.exe] C:\documents and settings\brian\local settings\temp\W7R0fqJa.exe

O4 - HKLM\..\Run: [bbf26729214d] C:\WINDOWS\System32\lsasrv05.exe

O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain

O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C

O4 - HKLM\..\Run: [pItGk.exe] C:\documents and settings\brian\local settings\temp\pItGk.exe

O4 - HKLM\..\Run: [ZI5.exe] C:\documents and settings\brian\local settings\temp\ZI5.exe

O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe

O4 - HKLM\..\Run: [81R.exe] C:\documents and settings\brian\local settings\temp\81R.exe

O4 - HKCU\..\Run: [kbdsf] C:\WINDOWS\System32\kbdsf.exe

O4 - HKCU\..\Run: [Cnmsnbus] C:\WINDOWS\System32\??oolsv.exe

O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe

O4 - HKCU\..\Run: [Aceu] C:\Documents and Settings\Brian\Application Data\gp???.exe

O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe

O15 - Trusted Zone: *.05p.com

O15 - Trusted Zone: *.scoobidoo.com

O15 - Trusted Zone: *.searchmiracle.com

O15 - Trusted Zone: *.skoobidoo.com

O15 - Trusted Zone: *.windupdates.com

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…d7510b28ebf1261

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr…etup1.0.0.8.cab

O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab

Check ALL the lines that start with:
O16
and have
69.50.188.54
in them.

Example:

O16 - DPF: {1F4525AA-5C83-4221-391B-32BE73FCC66E} - http://69.50.188.54/1/gdnUS208.exe

(Check all that are similar to that line above)

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\documents and settings\brian\local settings\temp <— Delete all files in this FOLDER
(Be sure to show hidden files)

c:\program files\windows syncroad <— FOLDER

c:\program files\web offer <— FOLDER

c:\windows\downloaded program files\ipreg32.dll <— file

c:\windows\system32\golumm\services.exe <— file

c:\windows\system32\kbdsf.exe <— file

c:\windows\system32\lsasrv05.exe <— file

c:\windows\system32\pcs <— FOLDER

c:\windows\system32\stlb2.dll <— file

e6f1873b.dll <— file
(use windows explorer to find)

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #10
whew….

did what you said…..several of the files that you asked me to manually delete could not be found or access denied when i tried to delete [services.exe,pcs folder]

below is the new log

thanks again for your patience



Logfile of HijackThis v1.98.2
Scan saved at 11:32:15 PM, on 9/23/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: ConferenceRoom Java Client - http://irc4.bondage.com:8080/java/cr.cab
O16 - DPF: v2cab - http://1583.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl…22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…72/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab
Post #12
Don't worry about the ones you can't find. As long as they're not active in the log file, they aren't a serious threat.

Some of the malware has returned.

As long as it is "active", windows won't let you delete it.

Let's try a slightly different approach this time.
Boot in "safe" mode FIRST.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe

O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe

O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab


Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\program files\windows syncroad <— FOLDER

c:\windows\system32\golumm\services.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #13
When we get your log cleaned up. I'll post my "wish list" of things you can do to help protect you. SP2 ISN'T one of them that I recommend.

I have worked many logs of people that have upgraded. Personally, I'm waiting a few months till they get the bugs out:

Known SP2 Problems
Post #14
ok…

hjt went fine

syncroad could notbe found and golumm file was empty…..

Logfile of HijackThis v1.98.2
Scan saved at 12:04:14 AM, on 9/24/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\maxspeed.exe (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: ConferenceRoom Java Client - http://irc4.bondage.com:8080/java/cr.cab
O16 - DPF: v2cab - http://1583.searchmiracle.com/cab/v2cab.cab
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl…22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.ipswitch.com/_installs/wsftp_le/setup.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…72/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
Post #15
You've done a great job!!!! :thumbup:

All the visible malware is gone!!!

We need to check one more thing.

Because your original log had this in it:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

You may have a hidden file that will make this return after a few reboots.

To check for this hidden file, please do this:

Download this zip.

http://tools.zerosrealm.com/pv.zip

Please unzip it to the desktop. It will not work if you run it from inside the zip.

After unzipped go to the desktop. Open the pv folder. Double click on the runme.bat

A dos window will open. Please select option 1 for explorer dll's by typing 1 and then pressing enter.

Notepad will open with a log in it. Please copy and paste the log into this post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI