What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Mom Told Me To Keep It Clean

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Good morning kind volunteers. I happened to stumble (?) on a site that open all sorts of windows which my pop up killer could not handle. As a result my browser won't go to default. I have run Spysweeper, Adware, and Spybot as well as AVG antivirus. I have removed coolwwwsearch.googlems and DSO exploit several times, but it comes back. The AV found a trojan which I did not record and have removed it as well. Here is my log for you to help me rid my self of this plague! Logfile of HijackThis v1.98.2 Scan saved at 3:58:54 PM, on 11/27/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\IEXB.EXE C:\WINDOWS\APIUE.EXE C:\WINDOWS\IESI32.EXE C:\WINDOWS\IEZC.EXE C:\WINDOWS\ATLUS.EXE C:\WINDOWS\SYSTEM\CRZL32.EXE C:\WINDOWS\WINLD32.EXE C:\WINDOWS\SYSTEM\NETJO32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\POPUP KILLER\POPUPKILLER.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE C:\PROGRAM FILES\ADSUBTRACT\ADSUB.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\HIJACK\HIJACKTHIS.EXE R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: Class - {40085E62-C8C2-5EB8-A6B0-0E40313EDEB3} - C:\WINDOWS\JAVAUB.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [PopUpKiller] C:\PROGRAM FILES\POPUP KILLER\POPUPKILLER.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [IEZC.EXE] C:\WINDOWS\IEZC.EXE O4 - HKLM\..\RunServices: [IEXB.EXE] C:\WINDOWS\IEXB.EXE O4 - HKLM\..\RunServices: [APIUE.EXE] C:\WINDOWS\APIUE.EXE O4 - HKLM\..\RunServices: [IESI32.EXE] C:\WINDOWS\IESI32.EXE O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [CRZL32.EXE] C:\WINDOWS\SYSTEM\CRZL32.EXE O4 - HKLM\..\RunServices: [WINLD32.EXE] C:\WINDOWS\WINLD32.EXE O4 - HKLM\..\RunServices: [NETJO32.EXE] C:\WINDOWS\SYSTEM\NETJO32.EXE O4 - HKLM\..\RunServices: [ATLUS.EXE] C:\WINDOWS\ATLUS.EXE O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - Startup: AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe O4 - User Startup: AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe O8 - Extra context menu item: LimeShop Preferences - file://c:\Program Files\topMoxie\TEMP\limeshop_script.htm O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.217.0.3,24.217.0.4 BTW: I have read all your sticky's as you request. Gracias Ricardo
Post #2
Greetings and welcome to TomCoyote.org!

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {40085E62-C8C2-5EB8-A6B0-0E40313EDEB3} - C:\WINDOWS\JAVAUB.DLL

O4 - HKLM\..\RunServices: [IEZC.EXE] C:\WINDOWS\IEZC.EXE

O4 - HKLM\..\RunServices: [IEXB.EXE] C:\WINDOWS\IEXB.EXE

O4 - HKLM\..\RunServices: [APIUE.EXE] C:\WINDOWS\APIUE.EXE

O4 - HKLM\..\RunServices: [IESI32.EXE] C:\WINDOWS\IESI32.EXE

O4 - HKLM\..\RunServices: [CRZL32.EXE] C:\WINDOWS\SYSTEM\CRZL32.EXE

O4 - HKLM\..\RunServices: [WINLD32.EXE] C:\WINDOWS\WINLD32.EXE

O4 - HKLM\..\RunServices: [NETJO32.EXE] C:\WINDOWS\SYSTEM\NETJO32.EXE

O4 - HKLM\..\RunServices: [ATLUS.EXE] C:\WINDOWS\ATLUS.EXE

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\windows\apiue.exe <— file

c:\windows\atlus.exe <— file

c:\windows\iesi32.exe <— file

c:\windows\iexb.exe <— file

c:\windows\iezc.exe <— file

c:\windows\javaub.dll <— file
(should already be deleted - be sure!)

c:\windows\system\crzl32.exe <— file

c:\windows\system\netjo32.exe <— file

c:\windows\winld32.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #3
I can not believe all the stuff you indicated. I am eternally grateful. Did not see a donate section? OK here is my new log as you requested: Logfile of HijackThis v1.98.2 Scan saved at 6:15:37 AM, on 11/29/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\POPUP KILLER\POPUPKILLER.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE C:\PROGRAM FILES\ADSUBTRACT\ADSUB.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\HIJACK\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=AdSubtract:4444 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [PopUpKiller] C:\PROGRAM FILES\POPUP KILLER\POPUPKILLER.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - Startup: AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe O4 - User Startup: AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.217.0.3,24.217.0.4 Thanks for the help. I have not used IE from that computer since I posted. Followed your instructions to the "T". Regards, Ricardo
Post #4
The log looks good. :thumbup:

At the bottom of each of my posts there is a "Support this forum" link, if you wish to donate.

GOD bless!!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.
(Persoanlly, I'm NOT recommending SP2 for XP at this time)

Post #5
Thank you for all your help. Everything is working fine. I would have had to pay someone to clean this up. I encourage all who benefit from the hours of this boards' work to donate something as I did. God bless all those who share their knowledge to benefit others!!
Post #6
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI