What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can't Make Sense Of This!

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Screw the mods. I'm on one of their fool computers as we speak and I kicked him out of the office to boot. Management has its privileges.

10:30? This is too late to be working on this project, frankly. Where are you hailing from anyhoot? You mentioned St. Louis in a post, but I'm going to venture that is not your town - at least not now.

If not US, then know that tomorrow is Thankgiving and I'll be out of the office then. Unfortunately, while the rest take Friday off, I'll be in here working with some accounts. Management has its downside too.

As far as the HJT file - I think I know the problem. I unzip the file with winzip everytime I use it. Perhaps then it creates another temp folder to put it into. Otherwise, I am a bloody idiot.

This is Comp C - sorry, was forced to do them out of order.

Logfile of HijackThis v1.98.2
Scan saved at 5:43:31 PM, on 11/24/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\OfficeScan NT\pccntmon.exe
C:\WINNT\System32\wwvlll.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\JIm\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
O2 - BHO: MultiMPPObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINNT\multimpp.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [yzsbbvxkab] C:\WINNT\System32\wwvlll.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

Wherever you hail, have a great Thursday, I will be watching this from home (and most possibly doing the same thing to my computer there).
Post #17 last edited
I meant the mods on this board, but nevermind that When you go to extract the file in winzip, at the top, it defaults to the temp file. Just type in C:\HijackThis and it will make that folder I'm in St Louis Mo, USA. Where are you that it's 10:30? I just talked to my GF, and I'll be online for about another half hour or so. I'll try to check back throughout the weekend. Ok, now the matter at hand Go to Add/Remove Programs, and remove these if they are present BlazeFind Internet Explorer Search Bar Windows SA or Windows Search Assistant Windows Search Functions When you are uninstalling 'Windows Search Functions', you will get three pop ups to confirm your action. You must click YES to the first two pop ups and NO to the 3rd one. If you do not click NO to the third pop up, the program will not be removed. You should reboot your computer after making a change to make sure it will be saved. Place a check next to these entries, if they still exist: O2 - BHO: MultiMPPObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINNT\multimpp.dll O4 - HKLM\..\Run: [yzsbbvxkab] C:\WINNT\System32\wwvlll.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - Then close ALL windows and click on "Fix Checked" Reboot into Safe Mode and go to C:\WINNT and delete this file multimpp.dll Go to C:\WINNT\System32 and delete this file wwvlll.exe Reboot and post another log
Post #18
Its not 11:00 here, it's not 11:00 there. I got my information from the bottom of your post that said: "This post has been edited by DumbTerminal on Nov 24 2004, 11:09 PM" Never once did I think to look at the time of my own posts which state the same thing. Sometimes so smart…. and sometimes I just ain't the brightest bulb in the lightbulb box. Plus, I don't know what mods are. I just figured it was some term for my idiot coworkers from whatever time zone you were from. But, I am guessing it doesn't in Central Time. So, officially, I change my happy Thursday to have a great Thanksgiving (of course, only if you choose to celebrate it - gotta stay PC). Remind me, when this is all said and done to send you some homemade walnut liqueur. I'll be bottling it tomorrow - so far five months time invested in it. As far as the fixes, I'll be doing them on Friday morning. With nobody in the office it sould work well. Thanks again.
Post #19
By the by, I am in Charlotte, NC.

Here we go…. round 2 on Comp C.

Did (to the best of my ability) everything you suggested. Though it meant shutting the computer down a few more times than probably necessary.

Could not locate in add/remove programs:
Blazefind
Internet Explorer Search Bar
Windows SA
Windows Search Assistant
Windows Search Functions

I even did a search on the harddrive afterward, but nothing. About a week ago I did remove (on this and Comp B) some programs that were or are similar to those above on add/remove. I saw it in a forum somewhere. What they were, I do not know, as I didn't document them.

Did delete all three entries on HJT.

Couldn't boot in safe mode - Windows 2000 seems to have a hard time doing that. Hope this isn't a problem.

Did delete multippl.dll and wwvlll.exe. Just had to do it in Windows Explorer.

Here's the next log. I swear to you it is coming from it's own folder. Either way. When we are said and done, I'll just delete everything and every computer that has anything to do with HJT or Hijackthis.

Logfile of HijackThis v1.98.2
Scan saved at 2:27:23 PM, on 11/26/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Documents and Settings\JIm\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

Thanks again.
Post #21
Good job, Ironboot. This one looks clean now also. Don't forget SpywareBlaster and IESpyad, even thought I believe you told me earlier that you already did that. One more computer to go!!! I do advise that you do empty out your cookies and temp files sooner or later. This will help speed up your web browsing also
Post #23
Feels good to be making a dent in what I saw was a huge problem. I'll not be able to thank you enough DT. I have yet to put SpywareBlaster and IESpyad on that Computer (or the last one), as I was waiting until I had whatever problem cleared. I'll do it Monday. I don't understand the 'edit button' reply, but I will read the link you sent. As far as Mr. Eagle…. I am not sure what you mean… please elaborate. Is it that I started another thread a day before I started this one. If so, I tried to close it twice, but couldn't figure out how. If you can tell me how to do that - or tell me how to 'merge them' I will gladly follow thorugh. I would not like to upset the equalibrium of this very helpful site. If you mean something else… I haven't the foggiest… and, once again, you'll have to elaborate. I will be please to oblige. Or, did you just tell me that you merged the two threads. Frankly, I don't understand most of this lingo - I just know how to do what I am told - and, if not, I document. So if I am missing something here, please advise. Lastly, back to DT, where can I go to learn the stuff you folks know. I'd love to be of help to someone the way you all have been to me.
Post #24
At the bottom of the posts by any author there is a button that says "PM" Click on the one under little Eagles post in this thread and ask him for details on how to sign up for the HijackThis classroom. I believe he is a mod. If not, I'm sure he can tell you where to go and if they are still accepting students
Post #25
I've sent information to Little Eagle and they directed me to the class area. I sent an email and maybe they'll dcide to teach me maybe not. I am sending Comp B (last one) info in just a few seconds.
Post #26
And, here we go…. last computer….

Logfile of HijackThis v1.98.2
Scan saved at 9:06:57 AM, on 11/29/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Mark\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch

Hope you had a great long weekend.
Post #27 last edited
It looks like that one is clean. Any problems on that machine?
Here is a link for a safer computing environment
Click here
Hopefully everything will be back to normal.

Be sure and visit Windows Update and make sure all machines are updated with all of the Critical Updates
Post #28
That computer (Comp B) was actually the worst of the bunch, believe it or not - and where I spend most of my time before I realized I was fighting a battle too hard for me to win alone. Some of the stuff I did with that machine I guess at with what I had read on these forums - before I ever wrote in. I probably made some errors too, but, based on what you see, perhaps I did more good than bad. I guess that is it then… you made it look far too easy. I appreciate your help to no end. If I can ever be of any help please hit me with a message. If it is within my power, than consider it done. PS - how do I close this forum?
Post #30
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI