What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Your Assistance!

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi Team -
I need your help -
:rant2:

Logfile of HijackThis v1.97.7
Scan saved at 8:57:51 AM, on 11/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\css-avs.exe
C:\Program Files\Common Files\Command Software Shared\Communication\css_1630.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
C:\Program Files\Command Software\F-prot\f-agent.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\dvpapi.exe
C:\windows\temp\H70HHs.exe
C:\WINDOWS\uptodate.exe
C:\Program Files\Common Files\Dpi\dpi.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\System32\elzwyjz.exe
C:\documents and settings\ddebord\local settings\temp\m.exe
C:\documents and settings\ddebord\local settings\temp\c3wRnpOaJ.exe
C:\WINDOWS\System32\dp-him.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\racaclen.exe
C:\WINDOWS\System32\SSDMM.exe
C:\WINDOWS\System32\NSTCATI.exe
C:\WINDOWS\System32\playsvrd.exe
C:\WINDOWS\System32\WPRVS.exe
C:\WINDOWS\System32\DBCTRACO.exe
C:\WINDOWS\System32\sbuiu.exe
C:\WINDOWS\System32\HCPSAPID.exe
C:\WINDOWS\System32\xdllregd.exe
C:\WINDOWS\System32\_28594C.exe
C:\WINDOWS\System32\SRCOINAU.exe
C:\WINDOWS\System32\GMD400J.exe
C:\WINDOWS\System32\OLBACTC.exe
C:\WINDOWS\System32\CRNSAVES.exe
C:\WINDOWS\System32\LECLIO.exe
C:\WINDOWS\System32\PHLPAPII.exe
C:\WINDOWS\System32\LEANMGRC.exe
C:\WINDOWS\System32\sjdbc10m.exe
C:\WINDOWS\System32\XSSOI.exe
C:\WINDOWS\System32\Lbg38.exe
C:\WINDOWS\System32\Odjtq.exe
C:\WINDOWS\System32\PSU.exe
C:\WINDOWS\System32\MCOMPATA.exe
C:\WINDOWS\System32\ELOGR.exe
C:\WINDOWS\System32\ODCTRL.exe
C:\WINDOWS\System32\LE2NLSO.exe
C:\WINDOWS\System32\PRINTNT.exe
C:\WINDOWS\System32\CAAPII.exe
C:\WINDOWS\System32\BC32GTOD.exe
C:\WINDOWS\System32\tiicdxxa.exe
C:\WINDOWS\System32\HKNTFSC.exe
C:\WINDOWS\System32\SFSIPCA.exe
C:\WINDOWS\System32\tunst2ss.exe
C:\WINDOWS\System32\EXECR.exe
C:\WINDOWS\System32\ETUPS.exe
C:\WINDOWS\System32\pnathlpi.exe
C:\WINDOWS\System32\INHLP32W.exe
C:\WINDOWS\System32\_437C.exe
C:\WINDOWS\System32\RYPTNETC.exe
C:\WINDOWS\System32\emdspifO.exe
C:\WINDOWS\System32\tiiiexxa.exe
C:\WINDOWS\System32\ogagentl.exe
C:\WINDOWS\System32\tridtxxa.exe
C:\WINDOWS\System32\TLANMANN.exe
C:\WINDOWS\System32\SHTMLERM.exe
C:\WINDOWS\System32\PCUPSA.exe
C:\WINDOWS\System32\IDP.exe
C:\WINDOWS\System32\SFLWBOXS.exe
C:\WINDOWS\System32\HRPUBWS.exe
C:\WINDOWS\System32\bisurfv.exe
C:\WINDOWS\System32\MVDMOEW.exe
C:\WINDOWS\System32\OISEN.exe
C:\WINDOWS\System32\3d9d.exe
C:\WINDOWS\System32\lzwyjze.exe
C:\WINDOWS\System32\TREAMCIS.exe
C:\WINDOWS\System32\ESETR.exe
C:\WINDOWS\System32\BDBEK.exe
C:\WINDOWS\System32\LNP!3N.exe
C:\WINDOWS\System32\LNTSVRPT.exe
C:\WINDOWS\System32\SJTES40M.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\System32\OWRPROFP.exe
C:\WINDOWS\System32\2EMBEDT.exe
C:\WINDOWS\System32\BDPLK.exe
C:\WINDOWS\System32\SDDDT.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\efsmdm.exe
C:\Documents and Settings\DDeBord\Application Data\urpo.exe
C:\WINDOWS\System32\d?dplay.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Handspring\HOTSYNC.EXE
C:\Program Files\CxtPls\CxtPls.exe
C:\HJT\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32/left.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.2020search.com/9885/search/r…000001219621&s;=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.ht…count_id=144440
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.2020search.com/9885/search/r…000001219621&s;=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://pop.popuptoast.com/9885/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\Lycos\IEagent\CSIE.DLL (file missing)
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8 - (no file)
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\CxtPls\CxtPls.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4C - (no file)
O2 - BHO: (no name) - {087173EF-9829-4F49-8340-A524177D3F60} - C:\WINDOWS\System32\inetp60.dll
O2 - BHO: (no name) - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O2 - BHO: (no name) - {14b3d246-6274-40b5-8d50-6c2ade2ab29b} - C:\Program Files\Srng\SNHelper.dll
O2 - BHO: (no name) - {3DF76A0A-9A15-7ACE-D452-675509F82939} - C:\WINDOWS\System32\yxfopo.dll
O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~2.DLL (file missing)
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-0623 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-06238 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386B - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F0 - (no file)
O2 - BHO: (no name) - {80672997-D58C-4190-9843-C6C61AF8FE97} - C:\WINDOWS\rundll16.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: SearchSquire3 - {907CA0E5-CE84-11D6-9508-02608CDD2846} - C:\WINDOWS\System32\SEARCH~1.DLL
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: (no name) - {CD209A08-98B5-4669-AF9F-447AC5253356} - C:\WINDOWS\System32\CSapp.dll
O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\DDeBord\Local Settings\Temp\wiO9Gfh6S.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem218.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dvprpt] C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
O4 - HKLM\..\Run: [F-agent] C:\Program Files\Command Software\F-prot\f-agent.exe
O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe
O4 - HKLM\..\Run: [SearchSquire33] C:\WINDOWS\System32\SearchUpdate33.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [H70HHs] C:\windows\temp\H70HHs.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\PkrO0Z54.exe
O4 - HKLM\..\Run: [RunWindowsUpdate] C:\WINDOWS\uptodate.exe
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKLM\..\Run: [srng] \Program Files\Srng\Srng.exe
O4 - HKLM\..\Run: [Rundll32_8] rundll32.exe C:\WINDOWS\System32\inetp60.dll,DllRunServer
O4 - HKLM\..\Run: [Rundll16] C:\WINDOWS\rundll16.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [ynpiwy] C:\WINDOWS\System32\elzwyjz.exe
O4 - HKLM\..\Run: [WhenUSearch] C:\PROGRA~1\WHENUS~1\Search.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [ClrSchLoader] C:\PROGRA~1\Lycos\IEagent\Loader.exe
O4 - HKLM\..\Run: C:\documents and settings\ddebord\local settings\temp\s.exe
O4 - HKLM\..\Run: [m] C:\documents and settings\ddebord\local settings\temp\m.exe
O4 - HKLM\..\Run: [c3wRnpOaJ] C:\documents and settings\ddebord\local settings\temp\c3wRnpOaJ.exe
O4 - HKLM\..\Run: [zvd4CUVx2] C:\documents and settings\ddebord\local settings\temp\zvd4CUVx2.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-him.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [73EW3nj] racaclen.exe
O4 - HKLM\..\Run: [SSDMM] C:\WINDOWS\System32\SSDMM.exe
O4 - HKLM\..\Run: [NSTCATI] C:\WINDOWS\System32\NSTCATI.exe
O4 - HKLM\..\Run: [playsvrd] C:\WINDOWS\System32\playsvrd.exe
O4 - HKLM\..\Run: [WPRVS] C:\WINDOWS\System32\WPRVS.exe
O4 - HKLM\..\Run: [DBCTRACO] C:\WINDOWS\System32\DBCTRACO.exe
O4 - HKLM\..\Run: [sbuiu] C:\WINDOWS\System32\sbuiu.exe
O4 - HKLM\..\Run: [HCPSAPID] C:\WINDOWS\System32\HCPSAPID.exe
O4 - HKLM\..\Run: [xdllregd] C:\WINDOWS\System32\xdllregd.exe
O4 - HKLM\..\Run: [_28594C] C:\WINDOWS\System32\_28594C.exe
O4 - HKLM\..\Run: [SRCOINAU] C:\WINDOWS\System32\SRCOINAU.exe
O4 - HKLM\..\Run: [GMD400J] C:\WINDOWS\System32\GMD400J.exe
O4 - HKLM\..\Run: [OLBACTC] C:\WINDOWS\System32\OLBACTC.exe
O4 - HKLM\..\Run: [CRNSAVES] C:\WINDOWS\System32\CRNSAVES.exe
O4 - HKLM\..\Run: [LECLIO] C:\WINDOWS\System32\LECLIO.exe
O4 - HKLM\..\Run: [PHLPAPII] C:\WINDOWS\System32\PHLPAPII.exe
O4 - HKLM\..\Run: [LEANMGRC] C:\WINDOWS\System32\LEANMGRC.exe
O4 - HKLM\..\Run: [sjdbc10m] C:\WINDOWS\System32\sjdbc10m.exe
O4 - HKLM\..\Run: [XSSOI] C:\WINDOWS\System32\XSSOI.exe
O4 - HKLM\..\Run: [PSU] C:\WINDOWS\System32\PSU.exe
O4 - HKLM\..\Run: [MCOMPATA] C:\WINDOWS\System32\MCOMPATA.exe
O4 - HKLM\..\Run: [ELOGR] C:\WINDOWS\System32\ELOGR.exe
O4 - HKLM\..\Run: [LE2NLSO] C:\WINDOWS\System32\LE2NLSO.exe
O4 - HKLM\..\Run: [ODCTRL] C:\WINDOWS\System32\ODCTRL.exe
O4 - HKLM\..\Run: [PRINTNT] C:\WINDOWS\System32\PRINTNT.exe
O4 - HKLM\..\Run: [CAAPII] C:\WINDOWS\System32\CAAPII.exe
O4 - HKLM\..\Run: [BC32GTOD] C:\WINDOWS\System32\BC32GTOD.exe
O4 - HKLM\..\Run: [tiicdxxa] C:\WINDOWS\System32\tiicdxxa.exe
O4 - HKLM\..\Run: [EXECR] C:\WINDOWS\System32\EXECR.exe
O4 - HKLM\..\Run: [HKNTFSC] C:\WINDOWS\System32\HKNTFSC.exe
O4 - HKLM\..\Run: [tunst2ss] C:\WINDOWS\System32\tunst2ss.exe
O4 - HKLM\..\Run: [SFSIPCA] C:\WINDOWS\System32\SFSIPCA.exe
O4 - HKLM\..\Run: [ETUPS] C:\WINDOWS\System32\ETUPS.exe
O4 - HKLM\..\Run: [pnathlpi] C:\WINDOWS\System32\pnathlpi.exe
O4 - HKLM\..\Run: [INHLP32W] C:\WINDOWS\System32\INHLP32W.exe
O4 - HKLM\..\Run: [_437C] C:\WINDOWS\System32\_437C.exe
O4 - HKLM\..\Run: [emdspifO] C:\WINDOWS\System32\emdspifO.exe
O4 - HKLM\..\Run: [RYPTNETC] C:\WINDOWS\System32\RYPTNETC.exe
O4 - HKLM\..\Run: [tiiiexxa] C:\WINDOWS\System32\tiiiexxa.exe
O4 - HKLM\..\Run: [ogagentl] C:\WINDOWS\System32\ogagentl.exe
O4 - HKLM\..\Run: [tridtxxa] C:\WINDOWS\System32\tridtxxa.exe
O4 - HKLM\..\Run: [TLANMANN] C:\WINDOWS\System32\TLANMANN.exe
O4 - HKLM\..\Run: [SHTMLERM] C:\WINDOWS\System32\SHTMLERM.exe
O4 - HKLM\..\Run: [PCUPSA] C:\WINDOWS\System32\PCUPSA.exe
O4 - HKLM\..\Run: [IDP] C:\WINDOWS\System32\IDP.exe
O4 - HKLM\..\Run: [SFLWBOXS] C:\WINDOWS\System32\SFLWBOXS.exe
O4 - HKLM\..\Run: [HRPUBWS] C:\WINDOWS\System32\HRPUBWS.exe
O4 - HKLM\..\Run: [bisurfv] C:\WINDOWS\System32\bisurfv.exe
O4 - HKLM\..\Run: [MVDMOEW] C:\WINDOWS\System32\MVDMOEW.exe
O4 - HKLM\..\Run: [OISEN] C:\WINDOWS\System32\OISEN.exe
O4 - HKLM\..\Run: [3d9d] C:\WINDOWS\System32\3d9d.exe
O4 - HKLM\..\Run: [lzwyjze] C:\WINDOWS\System32\lzwyjze.exe
O4 - HKLM\..\Run: [ESETR] C:\WINDOWS\System32\ESETR.exe
O4 - HKLM\..\Run: [TREAMCIS] C:\WINDOWS\System32\TREAMCIS.exe
O4 - HKLM\..\Run: [BDBEK] C:\WINDOWS\System32\BDBEK.exe
O4 - HKLM\..\Run: [LNP!3N] C:\WINDOWS\System32\LNP!3N.exe
O4 - HKLM\..\Run: [LNTSVRPT] C:\WINDOWS\System32\LNTSVRPT.exe
O4 - HKLM\..\Run: [SJTES40M] C:\WINDOWS\System32\SJTES40M.exe
O4 - HKLM\..\Run: [OWRPROFP] C:\WINDOWS\System32\OWRPROFP.exe
O4 - HKLM\..\Run: [2EMBEDT] C:\WINDOWS\System32\2EMBEDT.exe
O4 - HKLM\..\Run: [BDPLK] C:\WINDOWS\System32\BDPLK.exe
O4 - HKLM\..\Run: [SDDDT] C:\WINDOWS\System32\SDDDT.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [M0x6RhHti] efsmdm.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\DDeBord\Application Data\urpo.exe
O4 - HKCU\..\Run: [Pxhtpx] C:\WINDOWS\System32\d?dplay.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://ad.searchsquire.com
O15 - Trusted Zone: http://search.searchsquire.com
O15 - Trusted Zone: http://update.searchsquire.com
O15 - Trusted Zone: http://www.searchsquire.com
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5…b?1083599435744
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwfa.ops.placeware.com/etc/place/…quicksilver.cab
O16 - DPF: {5312804A-1FA4-11D5-8E6A-002035FE9FB3} (WebRFQ_Express.WebRFQExpress) - https://secure.freightliner.com/supplieronl…RFQ_Express.CAB
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50151/QDow_AS2.cab
O16 - DPF: {907CA0E5-CE84-11D6-9508-02608CDD2846} (Squire Class) - http://update.searchsquire.com/SearchSquire33.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8110.4057060185
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O17 - HKLM\Software\..\Telephony: DomainName = TMBIndustries.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TMBIndustries.com
Post #2
Greetings and welcome to TomCoyote.org!

You do seem to have an over abundance of malware in the log. :(

Let's see if we can cut down some of it with some "off the shelf" software. :thumbup:

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from http://security.kolla.de
(This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download
(This is the NEW Build 1.05)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot after running each program.

Next try these free online virus scans of your system:

Trend-Micro Housecall

Panda Activescan

Etrust Security Advisor

Choose "fix" or "clean".

Let them remove any infections found. Reboot after each scan.

Please download the newest version of Hijack This!:

Links to Hijack This! v 1.98.2:

http://tools.radiosplace.com/HijackThis.exe
http://spywarewarrior.com/files/HijackThis.exe
http://tomcoyote.org/hjt/HijackThis.exe

Make a new log file, and "copy/paste" it into this thread. :)
Post #3
Micah 6:8

Thank you for your assistance. I ran through your requested series of steps there and here is what I came back with.
(I tried to downloaded the latest HJT but it came back as 1.97.7 instead of 1.98.2)

This has already helped out a bunch but if there is anything you see that I still need to get rid of - let me know.

Thanks a million!!!
:wavey:
Logfile of HijackThis v1.97.7
Scan saved at 6:26:35 PM, on 11/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\css-avs.exe
C:\Program Files\Common Files\Command Software Shared\Communication\css_1630.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
C:\Program Files\Command Software\F-prot\f-agent.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\dvpapi.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\DDeBord\Application Data\urpo.exe
C:\WINDOWS\System32\d?dplay.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Handspring\HOTSYNC.EXE
C:\WINDOWS\System32\NlaBI.exe
C:\WINDOWS\System32\Pws1B4.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32/left.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8 - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4C - (no file)
O2 - BHO: (no name) - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-0623 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-06238 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386B - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F0 - (no file)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: (no name) - {CD209A08-98B5-4669-AF9F-447AC5253356} - C:\WINDOWS\System32\CSapp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dvprpt] C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
O4 - HKLM\..\Run: [F-agent] C:\Program Files\Command Software\F-prot\f-agent.exe
O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [H70HHs] C:\windows\temp\H70HHs.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\GnsDj.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: C:\documents and settings\ddebord\local settings\temp\s.exe
O4 - HKLM\..\Run: [m] C:\documents and settings\ddebord\local settings\temp\m.exe
O4 - HKLM\..\Run: [c3wRnpOaJ] C:\documents and settings\ddebord\local settings\temp\c3wRnpOaJ.exe
O4 - HKLM\..\Run: [zvd4CUVx2] C:\documents and settings\ddebord\local settings\temp\zvd4CUVx2.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [M0x6RhHti] efsmdm.exe
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\DDeBord\Application Data\urpo.exe
O4 - HKCU\..\Run: [Pxhtpx] C:\WINDOWS\System32\d?dplay.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5…b?1083599435744
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwfa.ops.placeware.com/etc/place/…quicksilver.cab
O16 - DPF: {5312804A-1FA4-11D5-8E6A-002035FE9FB3} (WebRFQ_Express.WebRFQExpress) - https://secure.freightliner.com/supplieronl…RFQ_Express.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099329344028
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {907CA0E5-CE84-11D6-9508-02608CDD2846} - http://update.searchsquire.com/SearchSquire33.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8110.4057060185
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O17 - HKLM\Software\..\Telephony: DomainName = TMBIndustries.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TMBIndustries.com
Post #4
Here is the new version - :blink:

Logfile of HijackThis v1.98.2
Scan saved at 6:31:44 PM, on 11/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\svchost.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\css-avs.exe
C:\Program Files\Common Files\Command Software Shared\Communication\css_1630.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
C:\Program Files\Command Software\F-prot\f-agent.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\dvpapi.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\DDeBord\Application Data\urpo.exe
C:\WINDOWS\System32\d?dplay.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Handspring\HOTSYNC.EXE
C:\WINDOWS\System32\NlaBI.exe
C:\WINDOWS\System32\Pws1B4.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\DDeBord\Local Settings\Temporary Internet Files\Content.IE5\794U1HMR\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32/left.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8 - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4 - (no file)
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4C - (no file)
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file)
O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-0623 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-06238 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386B - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8 - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F - (no file)
O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F0 - (no file)
O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O2 - BHO: CSObj Class - {CD209A08-98B5-4669-AF9F-447AC5253356} - C:\WINDOWS\System32\CSapp.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dvprpt] C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
O4 - HKLM\..\Run: [F-agent] C:\Program Files\Command Software\F-prot\f-agent.exe
O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [H70HHs] C:\windows\temp\H70HHs.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\GnsDj.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: C:\documents and settings\ddebord\local settings\temp\s.exe
O4 - HKLM\..\Run: [m] C:\documents and settings\ddebord\local settings\temp\m.exe
O4 - HKLM\..\Run: [c3wRnpOaJ] C:\documents and settings\ddebord\local settings\temp\c3wRnpOaJ.exe
O4 - HKLM\..\Run: [zvd4CUVx2] C:\documents and settings\ddebord\local settings\temp\zvd4CUVx2.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [M0x6RhHti] efsmdm.exe
O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\DDeBord\Application Data\urpo.exe
O4 - HKCU\..\Run: [Pxhtpx] C:\WINDOWS\System32\d?dplay.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwfa.ops.placeware.com/etc/place/…quicksilver.cab
O16 - DPF: {5312804A-1FA4-11D5-8E6A-002035FE9FB3} (WebRFQ_Express.WebRFQExpress) - https://secure.freightliner.com/supplieronl…RFQ_Express.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099329344028
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {907CA0E5-CE84-11D6-9508-02608CDD2846} - http://update.searchsquire.com/SearchSquire33.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O17 - HKLM\Software\..\Telephony: DomainName = TMBIndustries.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O18 - Protocol hijack: mhtml -
Post #5 last edited
Whew!!!

That's looking a little better….

By the way, you're in the running for "Ugliest Log of the Year".. A "dubious" honor at best….

I'm only joking!!! :D

You have a Peper Trojan (amomg other things).

Please download the Peper Uninstaller

You have to remain online to run it.

Run it, then reboot

Run it again, and reboot once more

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32/left.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - SOFTWARE - (no file)

O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8 - (no file)

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B - (no file)

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE - (no file)

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0 - (no file)

O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF - (no file)

O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1 - (no file)

O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C - (no file)

O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4 - (no file)

O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4C - (no file)

O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\System32\stlb2.dll

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159 - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5 - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E7 - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E77 - (no file)

O2 - BHO: (no name) - {65C8C1F5-230E-4DC9-9A0D-F3159A5E777 - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-0623 - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-06238 - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386 - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386B - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8 - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F - (no file)

O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F0 - (no file)

O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

O2 - BHO: CSObj Class - {CD209A08-98B5-4669-AF9F-447AC5253356} - C:\WINDOWS\System32\CSapp.dll

O3 - Toolbar: (no name) - {80E81A0E-9741-4FBC-8EE3-3B78C04ADA1D} - (no file)

O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll

O4 - HKLM\..\Run: [ToPicks Starter] C:\Program Files\ToPicks\Bin\Idhost.exe

O4 - HKLM\..\Run: [H70HHs] C:\windows\temp\H70HHs.exe

O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\GnsDj.exe

O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

O4 - HKLM\..\Run: C:\documents and settings\ddebord\local settings\temp\s.exe

O4 - HKLM\..\Run: [m] C:\documents and settings\ddebord\local settings\temp\m.exe

O4 - HKLM\..\Run: [c3wRnpOaJ] C:\documents and settings\ddebord\local settings\temp\c3wRnpOaJ.exe

O4 - HKLM\..\Run: [zvd4CUVx2] C:\documents and settings\ddebord\local settings\temp\zvd4CUVx2.exe

O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C

O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain

O4 - HKCU\..\Run: [M0x6RhHti] efsmdm.exe

O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\DDeBord\Application Data\urpo.exe

O4 - HKCU\..\Run: [Pxhtpx] C:\WINDOWS\System32\d?dplay.exe

O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe

O16 - DPF: {907CA0E5-CE84-11D6-9508-02608CDD2846} - http://update.searchsquire.com/SearchSquire33.CAB

O18 - Protocol hijack: mhtml -

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:
(the Peper uninstaller will have deleted a few of these, so you won't find them all. Just find and delete the ones you can find)

c:\documents and settings\ddebord\application data\urpo.exe <— file

c:\documents and settings\ddebord\local settings\temp\c3wrnpoaj.exe <— file

c:\documents and settings\ddebord\local settings\temp\m.exe <— file

c:\documents and settings\ddebord\local settings\temp\s.exe <— file

c:\documents and settings\ddebord\local settings\temp\zvd4cuvx2.exe <— file

c:\installer\id53.exe <— file

c:\program files\topicks <— FOLDER

c:\program files\webhancer <— FOLDER

c:\windows\svchost.exe <— file
DELETE THE ONE IN THE "WINDOWS" FOLDER ONLY!!!

This one is the "legitimate" one, leave it alone:
C:\WINDOWS\system32\svchost.exe

c:\windows\system32\csapp.dll <— file

c:\windows\system32\gnsdj.exe <— file

c:\windows\system32\msmc.exe <— file

c:\windows\system32\nlabi.exe <— file

c:\windows\system32\pws1b4.exe <— file

c:\windows\system32\stlb2.dll <— file

c:\windows\temp\h70hhs.exe <— file

e6f1873b.dll <— file
(use windows explorer to find)

efsmdm.exe <— file
(use windows explorer to find)

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #6
Micah 6:8
Thanks for all your help again - I think we are making progress!
:thumbup:


Logfile of HijackThis v1.98.2
Scan saved at 9:50:15 AM, on 11/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\css-avs.exe
C:\Program Files\Common Files\Command Software Shared\Communication\css_1630.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
C:\Program Files\Command Software\F-prot\f-agent.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\dvpapi.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Handspring\HOTSYNC.EXE
C:\Documents and Settings\DDeBord\Local Settings\Temporary Internet Files\Content.IE5\794U1HMR\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dvprpt] C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
O4 - HKLM\..\Run: [F-agent] C:\Program Files\Command Software\F-prot\f-agent.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwfa.ops.placeware.com/etc/place/…quicksilver.cab
O16 - DPF: {5312804A-1FA4-11D5-8E6A-002035FE9FB3} (WebRFQ_Express.WebRFQExpress) - https://secure.freightliner.com/supplieronl…RFQ_Express.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099329344028
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O17 - HKLM\Software\..\Telephony: DomainName = TMBIndustries.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O18 - Protocol hijack: mhtml -
Post #7
Just 2 items left to deal with. :thumbup:

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1

O18 - Protocol hijack: mhtml -

Then click "Fix checked".

Reboot and "copy/paste" a new log file into this thread. :)
Post #8
Things are working better already - :D

Logfile of HijackThis v1.98.2
Scan saved at 1:19:52 PM, on 11/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\css-avs.exe
C:\Program Files\Common Files\Command Software Shared\Communication\css_1630.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\AccessDirect\DadTray.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
C:\Program Files\Command Software\F-prot\f-agent.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Command Software Shared\Scanner\dvpapi.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Handspring\HOTSYNC.EXE
C:\WINDOWS\system32\userinit.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Dvprpt] C:\PROGRA~1\COMMON~1\COMMAN~1\Scanner\dvprpt.exe
O4 - HKLM\..\Run: [F-agent] C:\Program Files\Command Software\F-prot\f-agent.exe
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://vapwfa.ops.placeware.com/etc/place/…quicksilver.cab
O16 - DPF: {5312804A-1FA4-11D5-8E6A-002035FE9FB3} (WebRFQ_Express.WebRFQExpress) - https://secure.freightliner.com/supplieronl…RFQ_Express.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099329344028
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TMBIndustries.com
O17 - HKLM\Software\..\Telephony: DomainName = TMBIndustries.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TMBIndustries.com
Post #9
Looks like you've defeated all the malware, Ma'am. :thumbup:

GOD bless you and yours!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.
(Personally, I'm NOT recommending SP2 for XP at this time)

Post #11
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI