I'm not very knowledgable as to what might be happening, but my system is not operating properly. I have run SpybotSD and Ad Adware SE Personal and after that HJackThis - log attached
When I run these programs they do detect items which I then delete (had to run Ad Adware twice). Surprisingly, however, the programs it said it deleted still seem to be there. I don't get it.
System will not allow me to:
* go to the internet. Generally, but not always, I get an error message: "adp module: bargins.exe - Application Error". Otherwise its only a white page.
* gain access other drives when I go "my computer" unless I start system in Safe Mode
When I go to shut down the following always comes up:
* End Program - Explorer.exe
* End Program - Connections Tray
Appreicate any help with this - thanks in advance
Logfile of HijackThis v1.97.7
Scan saved at 11:36:45 PM, on 12/15/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
hello Rio,
Before we start, please go to your Add/Remove Programs panel- Look for this program and uninstall it if present:
WinTools
Windows AdControl
"Web Search Toolbar" and "Win-Tools Easy Installer
if any of the above are present uninstall then reboot computer
next:
Make sure your PC is configured to show hidden files
Double click my computers & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
Scan with HijackThis and place an check next to the following entries,close all windows,then press *fix checked*
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [TBPS] Toolbar\TBPS.exe\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
———————————————————————————-
ok now boot into safe mode by tapping F8 key at start up, chose SAFE MODE from the options. once in safe mode:
find and delete:
entire folders for these:
WinTools\WToolsS.exe>>located here:>>C:\Program Files\Common Files\
WinTools\WSup.exe>>located here>>C:\Program Files\Common Files\
Toolbar\TBPS.exe>>located >>C:\PROGRA~1\Toolbar
\tsa\tsl.exe>>located here>>C:\PROGRA~1\COMMON (program files\common files)
also in safe mode;
Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
Click Start>Run then type %temp%
Hit OK. Delete all the files you can, some wont delete.
———————————————————————————————–
reboot normally, sure that the entire HJT log? looks short, also there is a newer version ot HJT out now.
post new HJt log…….shelf life
Ok did what you said. Did the cleanmgr, %temp%, cleanmgr procedure for each user on the system. For kicks, I even ran AdAware SE and SpybotSD again.
AdAware SE program says its 95 days old, but I downloaded it from one of the links on this site. I am not sure how to run the WebUpdate feature on the system I'm trying to have fixed since it can not access the Web. When I ran Ad-Aware SE, after doing everything mentioned, it still came up with 82 Critical Objects (63 BarginBuddy, 9 Possible Browser Hjack attempt, 1 WinAd, 6 MRU List and 1 Other). I removed them before the HJT log attached.
After doing the above only very modest changes. To the Good: 1) I can get to other drives now through Windows Explorer or My Computer, and 2) I get more than a blank IE page - now it shows "The page cannot be displayed" (Connection is strong, yet I'm not able to connect). To the Bad: Sometimes now when I close down a 'Hidden Fax Window" box comes up. Otherwise its the Exploer.exe and Connections Tray windows continue to come up.
Maybe short, but the complete HJT log after all the above is attached.
Logfile of HijackThis v1.99.0
Scan saved at 9:26:52 PM, on 12/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
hello Rio,
looking better.
Scan with HijackThis and place an check next to the following entries,close all windows,then press *fix checked*
O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe
boot into SAFE MODE by tapping F8 key at restart, chose safe mode form options.
once in safe mode find and delete ;
angelex.exe only located here>>C:\WINDOWS\System32
————————————————————-
Ran Ad Aware SE and SpybotSD first. I can't believe it! The exact same items I pointed out in my last posting and fixed were there again. I fixed it again just now. BarginBudddy doesn't know when its time to leave.
Went to Add/Remove programs listing and saw TV Media and The BullsEye Network. I had removed these yesturday before sending you the HJT log. There back???? I removed TV Media (at least its taken off the listing), but The BullsEye Network wants to take me through an uninstall process that asks a lot of questions about my using the product. I have not done this since it would likely open up me to even more of their friends - right? Rather, I opened in safe mode and deleted the folder. I have also done this before and it keeps coming back.
After I sent my posting last night, the system was shut down. Turned back on this morning and played Grand Theft Auto III game off the CD. Thats it. Is it possible that the game is putting this stuff back on my system?
Noticed the following files under my C:\ directory. Some look suspicious. Anything to do with these?
404SeachSetup_MS54.exe <—- ???
Boot.INI <— ok
BootSecT.Dos <—- ok
CONFIG.sys <–ok
Crash.txt <— ????
EXADVERTISING.exe <— ??????
Hpfr5100.log <–ok this is my printer
INSTALL>LOG <— ??
IO.sys <— ok
July 14_loader.exe <—-???
MSDOS.SYS <— ok
NTDETECT.COM <— ok
NTLDR <— ok
nvlog.txt <—???
Overpro323.exe <—???
pagefile.sys <—-ok
SystemInfor.ini <— ??
updatedInstall_112.exe <—???
Sorry for all this, but maybe something here is a problem as well.
Did what you said. "Only" deleted angelex.exe. Ran Cleanmgr afterwards to get rid of it. Search also showed file: ANGELEX.EXE-3553D668.pf which I did not delete based on your instructions.
Ok having done everything above, I ran Ad Adware SE one more time just to check. Surprise same stuff even though I ran it an hour ago and fixed the problems. Wow! Fixed it again and ran HJT.
New HJT log attached.
Logfile of HijackThis v1.99.0
Scan saved at 1:57:52 PM, on 12/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
hello Rio,
could be finding this stuff in your restore archives. lets try making new restore points.
1. Turn off System Restore. (deletes old possibly infected restore point)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.(new restore points on a clean system)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK, then reboot
rescan with ad aware and spybot search and destroy.
post new log……………shelf life
Had system off since I sent last posting. Turned it on to perform the steps you provided.
Ad Aware SE showed 124 Critical Objects (1 404search, 2 ClearSearch, 109 Tracking Cookie, 2 IBIS Toolbar, 1 StatBlaster, 4 PeopleOnPage, 1 Win32.Turown.h, 2 eUniverse, 1 Lycos Sidesearch). Fixed all.
SpybotSD showed DSO Exploit (5 entries). Fixed.
Checked C:\directory files after above and noted following:
* 404SearchSetup_MS54.exe remains. Ad Aware SE found something with a similar name above.
* CStv.log now shows up <– looks suspicious
* EXACTADVERTISING.exe is gone
* July 14_loader.exe is gone
* pagefile.sys is gone
Haven't gotten boxes during log off today.
New HJT log attached.
Logfile of HijackThis v1.99.0
Scan saved at 10:52:34 PM, on 12/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
SpybotSD: Found 3 problems (eXact Advertising.BargainsBuddy, DSO Exploit, and DyFuCA.InternetOptimizer). BargainsBuddy took two tries, but Fixed all
New HJT log
Logfile of HijackThis v1.99.0
Scan saved at 1:33:02 AM, on 12/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Should I delete the following from my C:\ directory? These programs look suspicious.
CStv.log
404SearchSetup_MS54.exe
crash.txt
Really want to avoid anything from coming back.
Appreciate all your help. Many Thanks
If you need this topic reopened, please request this by sending an email to us at the following link (Click for address) Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
To help keep you clean follow the recommendations in Tony's article here: So how did I get infected in the first place?
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
