What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Me With My Hijack Log

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've seen the instructions to copy my log and paste it here and wait for a response because I could delete the wrong files on my computer. Here is my log:

Logfile of HijackThis v1.97.7
Scan saved at 3:40:35 PM, on 10/20/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TEMP\IKD149.EXE
C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE
C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\HKIPYP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P2LY20P8\HIJACKTHIS[1].EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.courtinfo.ca.gov/courts/trial/courtlist.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\LOCALNRD.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StartAOL] C:\Program Files\America Online 7.0a\RBM.exe -runonce
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [SMS Win9x Message Agent] C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wpbuyu.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [abvfpkc] C:\WINDOWS\SYSTEM\vhjlsauq.exe
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe"
O4 - HKLM\..\RunServices: [SMS Client Service] C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Installer] C:\WINDOWS\SYSTEM\WINST.EXE
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background
O4 - Startup: hkipyp.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\PLUS!\CMPAGENT.EXE
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Net2Phone (HKLM)
O9 - Extra 'Tools' menuitem: Net2Phone (HKLM)
O13 - WWW. Prefix: http://
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - https://gamingclub.microgaming.com/gamingclub/FlashAX.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://imagesvr/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://imagesvr/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://imagesvr/officescan/clientinstall/setupini.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8197.4400347222
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB

What should I fix? I keep getting pop ups for vegas (recently visited sites in vegas to get married) and soft-porn. I've cleared my cookies, temp files and history folder.

Thanks for your help!
Post #2
Greetings and welcome to TomCoyote.org!

Please download the latest version of Hijack This!

Links to Hijack This! v 1.98.2:

http://tools.radiosplace.com/HijackThis.exe
http://spywarewarrior.com/files/HijackThis.exe
http://tomcoyote.org/hjt/HijackThis.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\LOCALNRD.DLL

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wpbuyu.exe

O4 - HKLM\..\Run: [abvfpkc] C:\WINDOWS\SYSTEM\vhjlsauq.exe

O4 - HKLM\..\RunServices: [Installer] C:\WINDOWS\SYSTEM\WINST.EXE

O4 - Startup: hkipyp.exe

O13 - WWW. Prefix: http://

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai.net/7/224/52/20010620…meInstaller.exe

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\windows\localnrd.dll <— file

c:\windows\start menu\programs\startup\hkipyp.exe <— file

c:\windows\system\vhjlsauq.exe <— file

c:\windows\system\winst.exe <— file

c:\windows\temp\ikd149.exe <— file

c:\windows\wpbuyu.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #3
Alright, here is my new log.

Logfile of HijackThis v1.97.7
Scan saved at 9:40:32 AM, on 10/21/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TEMP\FP7535.EXE
C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE
C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\5093IZBG\HIJACKTHIS[1].EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.courtinfo.ca.gov/courts/trial/courtlist.htm
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StartAOL] C:\Program Files\America Online 7.0a\RBM.exe -runonce
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [SMS Win9x Message Agent] C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\SYSTEM\pc32.exe bg
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe"
O4 - HKLM\..\RunServices: [SMS Client Service] C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Net2Phone (HKLM)
O9 - Extra 'Tools' menuitem: Net2Phone (HKLM)
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://imagesvr/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://imagesvr/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://imagesvr/officescan/clientinstall/setupini.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8197.4400347222
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB


I noticed when I was in safe mode that winsock.dll was in my c:\windows file. I remember hearing about a virus by this name but wasn't sure if it was one of those legit warnings or a hoax warning and winsock.dll is a necessary file so I did not delete it. Should I delete it?

And thanks for your help!!
Post #4
You've picked up two new entries:

C:\WINDOWS\TEMP\FP7535.EXE

O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\SYSTEM\pc32.exe bg

The last one is definitely a virus. :o

Please try these free online virus scans of your system:

Trend-Micro Housecall

Panda Activescan

Etrust Security Advisor

Choose "fix" or "clean".

Let them remove any infections found. Reboot after each scan.

It would be a good idea to get Spybot and Adaware on your side as well.

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from http://security.kolla.de (This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download (This is the NEW Build 1.05)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot after running each program.

Post a new log, in this thread, when finished. :)
Post #5
Micah, thanks again.

Here's the latest log:
Logfile of HijackThis v1.97.7
Scan saved at 10:40:34 AM, on 10/22/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TEMP\OL739A.EXE
C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE
C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P2LY20P8\HIJACKTHIS[1].EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.courtinfo.ca.gov/courts/trial/courtlist.htm
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StartAOL] C:\Program Files\America Online 7.0a\RBM.exe -runonce
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [SMS Win9x Message Agent] C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe"
O4 - HKLM\..\RunServices: [SMS Client Service] C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://imagesvr/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://imagesvr/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://imagesvr/officescan/clientinstall/setupini.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8197.4400347222
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab


The first time I ran a scan I saw C:\Windows\Temp\dkill.exe and read up that it was spyware. Anything that has "kill" in its name has got to be bad.

I do have Ad-Aware and Spybot however I did not have them configured correctly, thank you for that link. Spybot found nothing and Ad-Aware found 4 objects but they were all cookies.

I do have something in my Temp files called O1739a.exe and it has a puppy as the icon. this puppy has shown up on a few different things but for some reason everytime I restart the name of the file changes. These do not show up on my logs and I can't delete them. In normal mode I try to delete and I get a notice that the file is being used by Windows. In safe mode the file doesn't even show up (and I have selected "show all files").

Is there anything else I need to do? How often should I run spybot, hijack this, and ad-aware?

What a PITA. LOL.

Tori
Post #7
Logfile of HijackThis v1.97.7
Scan saved at 1:23:36 PM, on 10/25/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TEMP\YHFF4E.EXE
C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE
C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P2LY20P8\HIJACKTHIS[1].EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\ODPWIN9X.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.courtinfo.ca.gov/courts/trial/courtlist.htm
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StartAOL] C:\Program Files\America Online 7.0a\RBM.exe -runonce
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [SMS Win9x Message Agent] C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe"
O4 - HKLM\..\RunServices: [SMS Client Service] C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://imagesvr/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://imagesvr/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://imagesvr/officescan/clientinstall/setupini.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8197.4400347222
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #9
:rofl: yes that little bugger in my temp folder is driving me nuts. It keeps changing it's name. I deleted the entire temp file in safe mode but I checked to see the contents first. While in safe mode, that file does not show up and I made sure all the hidden files were there.

In normal mode it won't let me delete the file, I get a note saying this file cannot be deleted because it's running in windows. I hit ctrl+alt+del to see what I'm running and it doesn't show up so I can close it.

Oh and the link to Hijack This on the Tom Coyote site is still the previous version, just an FYI. Here's the new log (with a name change to the mystery file :ph34r: ):

Logfile of HijackThis v1.98.2
Scan saved at 8:45:17 AM, on 10/26/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\TEMP\CJ14C7.EXE
C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\P2LY20P8\HIJACKTHIS[2].EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.courtinfo.ca.gov/courts/trial/courtlist.htm
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [StartAOL] C:\Program Files\America Online 7.0a\RBM.exe -runonce
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [SMS Win9x Message Agent] C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe"
O4 - HKLM\..\RunServices: [SMS Client Service] C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Matrox QuickDesk] C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe
O4 - HKCU\..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe /background
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://imagesvr/officescan/clientinstall/setup.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://imagesvr/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://imagesvr/officescan/clientinstall/setupini.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #10
Other than the mysterious name changing file in the temp folder, are you having any problems (pop-ups, redirection to unwanted web pages, system slowness)? :unsure:
Post #11
I have popups come up all the time. Before I fixed the first report I would get Las Vegas pop ups everytime I viewed my aol mail. Computer is sometimes slow but I think that's just because it's old. I'm only running Windows 98…this is a work computer and they are too cheap to upgrade our computers. I had to practically beg them to upgrade from Windows 95 just two months ago and that's when they also installed Spybot and Ad-Aware. I'm concerned that this may be some sort of spyware and that my passwords and bank account information will be picked up and sent along to a not-so-nice individual.
Post #12
Have you tried the online virus scans I suggested? :unsure:

Here's one more:

Bitdefender http://www.bitdefender.com/scan/licence.php

Can you tell me what web sites the pop-ups are bout?

I am almost certain you don't have to worry about "password stealing", and things like that.

This appears to be a "browser" infection only.

I was wondering if you can attach the latest random EXE in the temp file to an email, and send it here. Please put "Tom Coyote" in the email subject so I'll recognize it.

I'm going to "disassemble" it and look for clues.

I haven't forgotten about you, but I also haven't got any solid leads on just what you have infecting you either. :(
Post #13
Micah, the pop ups are about going to vegas or getting webcams. Mostly I dont' pay attention, I just close the window. Will send you the file if I can. Tori
Post #14
I got the file. :thumbup:

Download Startdreck

Unzip and run StartDreck.exe
Hit: -config
hit: -Unmark all
Check these boxes only:
*Registry->run keys
*Registry->Browser helper objects
*System/drivers> Running processes
hit >ok.
Use the "save" tab, to save, name and post the log in this thread. :)
Post #15
StartDreck (build 2.1.7 public stable) - 2004-11-02 @ 11:31:29 (GMT -08:00) Platform: Windows 98 SE (Win 4.10.2222 A) Internet Explorer: 6.0.2800.1106 Logged in as victoria mcgunagle at ZOAKLSELU85665 »Registry »Run Keys »Current User »Run *Matrox QuickDesk=C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe *MSMSGS=C:\Program Files\Messenger\msmsgs.exe /background »RunOnce »Default User »Run *Matrox QuickDesk=C:\Program Files\Matrox MGA PowerDesk\QDesk\mgaqdesk.exe *MSMSGS=C:\Program Files\Messenger\msmsgs.exe /background »RunOnce »Local Machine »Run *QuickTime Task="C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime *LoadQM=loadqm.exe *EM_EXEC=c:\mouse\system\em_exec.exe *StartAOL=C:\Program Files\America Online 7.0a\RBM.exe -runonce *OfficeScan95="C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" -HideWindow *SMS Win9x Message Agent=C:\WINDOWS\MS\SMS\core\bin\SMSMsg.exe *ScanRegistry=C:\WINDOWS\scanregw.exe /autorun *TaskMonitor=C:\WINDOWS\taskmon.exe *SystemTray=SysTray.Exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *CriticalUpdate=C:\WINDOWS\SYSTEM\wucrtupd.exe -startup *TkBellExe="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot »RunOnce »RunServices *OfficeScan95="C:\PROGRAM FILES\OFFICESCAN 95\pccwin97.exe" *SMS Client Service=C:\WINDOWS\MS\SMS\core\bin\clisvc95.exe *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SchedulingAgent=mstask.exe »RunServicesOnce »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) *RealDownload.BrowserHelper.1/{EBCDDA60-2A68-11D3-8A43-0060083CFB9C} `InprocServer32=C:\WINDOWS\SYSTEM\NZDD.DLL *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL »Files »System/Drivers »Running Processes +FF0FE287=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFF9563=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFFA9D7=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFE489F=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFE523B=C:\PROGRAM FILES\OFFICESCAN 95\PCCWIN97.EXE +FFFEE533=C:\WINDOWS\MS\SMS\CORE\BIN\CLISVC95.EXE +FFFE9E7F=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFDDA17=C:\WINDOWS\TEMP\VR626E.EXE +FFFDA6C3=C:\WINDOWS\MS\SMS\CLICOMP\APA\BIN\SMSAPM32.EXE +FFFC76EB=C:\WINDOWS\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE +FFFC883F=C:\WINDOWS\MS\SMS\CLICOMP\SWDIST32\BIN\SMSMON32.EXE +FFFACB5B=C:\WINDOWS\EXPLORER.EXE +FFF9591F=C:\WINDOWS\SYSTEM\QTTASK.EXE +FFFAA0DF=C:\WINDOWS\LOADQM.EXE +FFFAB58F=C:\MOUSE\SYSTEM\EM_EXEC.EXE +FFFA73F7=C:\WINDOWS\TASKMON.EXE +FFF97623=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFF9CCDF=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF9F017=C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE +FFF87327=C:\WINDOWS\SYSTEM\WMIEXE.EXE +FD0BBC4B=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFF9C23F=C:\COREL\SUITE8\PROGRAMS\WPWIN8.EXE +FD07F163=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OUTLOOK.EXE +FFF9BA4B=C:\WINDOWS\SYSTEM\MAPISP32.EXE +FFF8669F=C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE +FD097F0B=C:\COREL\SUITE8\PROGRAMS\PFPPOP80.EXE +FD0B937B=C:\WINDOWS\RUNDLL32.EXE +FD0941E7=C:\PROGRAM FILES\WINZIP\WINZIP32.EXE +FD0B1117=C:\WINDOWS\TEMP\STARTDRECK.EXE »Application specific

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI