What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Pop Ups And Malicious Processes

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Part 1 - the first two files it just said "File does not seem to exist" The last two report deleted. This does not sound like I should go for the missing file, but I wanted to be sure??
Post #18
Here is the latest log. I ran it once before this and the '01' entries were still there. I clicked to fix them, rebooted and ran again and this is it.
I was not able to send the info to the e-mail left. It was returned to me as undeliverable. I do have that data ready to go if there is al aternative.




Logfile of HijackThis v1.98.2
Scan saved at 3:03:41 PM, on 11/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HiJack This 1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.localtoolbox.com/lakesregion
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://*.pandasoftware.com
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc…76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg…,16/mcgdmgr.cab
Post #20
It seems a lot better. I have not seen any popups, but did notice when trying to browse to ebay, typing in ebay.com in the url bar, there was some other url at the beginning of the address momentarily before connecting to ebay. It was something like multimedia …. ? I also ran a scan with norton and it identified several files that I thought we had gotten rid of and I deleted those but there were some that it said could not be deleted. I will get that list and post it here as well. That will be a while as I have to re-run the scan. I did re-send the files that were deleted by killbox, but I suspect they still will not get through my mail server. Thanks for all your help with this. I am not sure what I would have done without it. I will get that other list up as soon as I can.
Post #21
I cannot cut & paste the list, but the following three files are listed as threats but not infected and delete failed. f13751015.exe Adware.Binet Adware Found Hbinst.exe Adware.Hotbar Adware Found ikw.exe Adware.CommonName Adware Found I am not sure what if anything I can do to get rid of these as well and have a fresh start. Thanks again!!!
Post #23
I have used killbox on them and still see them when I run Norton. That does not tell me where they are found. Is it ok if I delete the !submit folder, in case that is where it is finding them? I also still see AdGuard and AdWare & SpyWare in my Add or remove programs. I tried to remove them and AdGuard just takes a progress bar 98% across, stops and never completes. AdWare & SpyWare takes me to a website to buy protection from spyware!!!
Post #24
Did you search for the files using Window Explorer? You can delete the !submit folder now. Also do this and then check if the files still show up: 1. Right-click My Computer>Click Properties>Click the System Restore tab>Check the box next to 'Turn off System Restore on all drives'>Click Apply>Click OK. 2. Reboot. 3. Repeat the process but this time remove the check from the box. Let me know
Post #25
That got rid of those reported threats with the Norton scan. I am still seeing some things in Add/Remove Programs that are bad, 180 Search Assistant, ADGuard and AdWare & Spyware, but I guess they are not currently having any negative affect, so will just move on for now. Thank you very much for all your help. I am not sure how you do it without charge, but I certainly appreciate it!!!
Post #27
That took care of all but the AdGuard entry in Add/remove Programs. I re-ran reg cleaner and it does not see it anymore. I am not sure if there is still some entry in the registry about it. I removed a bunch of things in the siftware list that I did not recognize also. AdGuard was still in the list for add/remove programs though?
Post #28
Please go to http://www.billsway.com/vbspage/ and scroll down to Registry Search Tool. Download, unzip and run RegSrch.vbs (you may need to enable your antivirus program to run the file).

Copy and paste this in the dialog box: AdGuard

After a while a prompt will come up. Click OK to write the results to wordpad and post them.
Post #29
I cannot run the vbs. I get a Windows SCript Error. Line: 7 Char: 11 Error: ClassFactory cannot supply requested class Code: 80040111 Source: (null) That is with or with virus enabled.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI