little eagle
looks clean 
Spyware / Malware / Virus Removal
Dso Exploit
4 min read
Jew127
still getting a searchbar+pop up when I start IE and it's making melooks clean
little eagle
The following have randomly named file names, and as such are normally malware, follow their process tree.
Right click on the file and go to Properties. Then go to the Version tab to see what company name it's from:
If it's from some name you never heard of or if it's blank, please check for removal also.
O4 - HKLM\..\Run: [Anti bows sixth rect] C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Reboot afterwards in SAFE MODE. Delete the following file
C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Right click on the file and go to Properties. Then go to the Version tab to see what company name it's from:
If it's from some name you never heard of or if it's blank, please check for removal also.
O4 - HKLM\..\Run: [Anti bows sixth rect] C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Reboot afterwards in SAFE MODE. Delete the following file
C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Jew127
The following have randomly named file names, and as such are normally malware, follow their process tree.
Right click on the file and go to Properties. Then go to the Version tab to see what company name it's from:
If it's from some name you never heard of or if it's blank, please check for removal also.
O4 - HKLM\..\Run: [Anti bows sixth rect] C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Reboot afterwards in SAFE MODE. Delete the following file
C:\Documents and Settings\All Users\Application Data\bintheantibows\traymulti.exe
Checked the file, no company name, just blank. Deleted it in safe mode.
Below is the new log. See that another one has returned:
O4 - HKCU\..\Run: [DeleteAmok] C:\DOCUME~1\Jordy\APPLIC~1\PLATFO~1\Objmealinter.exe
And what is this:
O4 - HKLM\..\Run: [File view film bib] C:\Documents and Settings\All Users\Application Data\two anti file view\Mp3 plus.exe
Logfile of HijackThis v1.98.2
Scan saved at 13:08:16, on 1-11-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\MsgPlus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl\msnappau.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Unzipped\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cpczzurvbmnzyxqy.org/1hkFwOFTWN…ApMaV9WDMF.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.nl/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Tools\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WebTools\WS_FTP\wsbho2k0.dll
O2 - BHO: (no name) - {8A0DF22B-B48F-E72B-9E6B-535B26B6E10C} - C:\DOCUME~1\Jordy\APPLIC~1\StopSpam\Activegram.exe
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\nl\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\nl\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\QuickTime6\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS\System32\LVComS.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [File view film bib] C:\Documents and Settings\All Users\Application Data\two anti file view\Mp3 plus.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl\msnappau.exe"
O4 - HKCU\..\Run: [DeleteAmok] C:\DOCUME~1\Jordy\APPLIC~1\PLATFO~1\Objmealinter.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://www.nfq.de/hb/plugin/mssurvid.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
little eagle
Getting some help hopefuly.
dan loop.
dan loop.
Galadriel
*Galadriel steps in to provide a little help* 
Hello,
The reason everything comes back is that everything related to the nasty (lop) has to be removed. Messenger Plus! is the main culprit/reason for this infection, so I strongly suggest you remove it (uninstall through add/remove programs).
Once that is done, restart your computer in safe mode.
Open Hijack This and run a new scan. Have it fix all of the following by placing a check in the appropriate boxes and hitting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cpczzurvbmnzyxqy.org/1hkFwOFTWN…ApMaV9WDMF.html
O2 - BHO: (no name) - {8A0DF22B-B48F-E72B-9E6B-535B26B6E10C} - C:\DOCUME~1\Jordy\APPLIC~1\StopSpam\Activegram.exe
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [File view film bib] C:\Documents and Settings\All Users\Application Data\two anti file view\Mp3 plus.exe
O4 - HKCU\..\Run: [DeleteAmok] C:\DOCUME~1\Jordy\APPLIC~1\PLATFO~1\Objmealinter.exe
Once done, find and delete the following:
Folders:
C:\Documents and Settings\All Users\Application Data\two anti file view\ <– whole folder
C:\Documents and Settings\All Users\Application Data\PLATFO~1\ <– this folder will start with the letters Platfo and will have more letters… so look carefully. Delete entire folder when found.
Restart in normal mode and see if that does it.
Good luck,
Gal
Hello,
The reason everything comes back is that everything related to the nasty (lop) has to be removed. Messenger Plus! is the main culprit/reason for this infection, so I strongly suggest you remove it (uninstall through add/remove programs).
Once that is done, restart your computer in safe mode.
Open Hijack This and run a new scan. Have it fix all of the following by placing a check in the appropriate boxes and hitting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cpczzurvbmnzyxqy.org/1hkFwOFTWN…ApMaV9WDMF.html
O2 - BHO: (no name) - {8A0DF22B-B48F-E72B-9E6B-535B26B6E10C} - C:\DOCUME~1\Jordy\APPLIC~1\StopSpam\Activegram.exe
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [File view film bib] C:\Documents and Settings\All Users\Application Data\two anti file view\Mp3 plus.exe
O4 - HKCU\..\Run: [DeleteAmok] C:\DOCUME~1\Jordy\APPLIC~1\PLATFO~1\Objmealinter.exe
Once done, find and delete the following:
Folders:
C:\Documents and Settings\All Users\Application Data\two anti file view\ <– whole folder
C:\Documents and Settings\All Users\Application Data\PLATFO~1\ <– this folder will start with the letters Platfo and will have more letters… so look carefully. Delete entire folder when found.
Restart in normal mode and see if that does it.
Good luck,
Gal
Jew127
Thanks for all the help you guys it finally worked!
Little Eagel, Galadriel
little eagle
Glad we could help.
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI