Here is another Hijack log.
Please check it again because there may be some changes from previous log…
Thanks
Logfile of HijackThis v1.98.2
Scan saved at 8:43:12 PM, on 12/17/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\C\WINXP\System32\smss.exe
C:\C\WINXP\system32\winlogon.exe
C:\C\WINXP\system32\services.exe
C:\C\WINXP\system32\lsass.exe
C:\C\WINXP\system32\svchost.exe
C:\C\WINXP\System32\svchost.exe
C:\C\WINXP\system32\spoolsv.exe
C:\C\WINXP\System32\svchost.exe
C:\Program Files\Trend Micro2004\Tmntsrv.exe
C:\Program Files\Trend Micro2004\tmproxy.exe
C:\C\WINXP\Explorer.EXE
C:\Program Files\Trend Micro2004\PccPfw.exe
C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE
C:\Program Files\Trend Micro2004\pccguide.exe
C:\Program Files\Trend Micro2004\PCClient.exe
C:\Program Files\Trend Micro2004\TMOAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\C\WINXP\Explorer.EXE
C:\Program Files\Hijack this\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.theglobeandmail.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ———>Weatherbee**
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB003" /M "Stylus C64"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro2004\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro2004\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro2004\TMOAgent.exe" /run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 EPSON Stylus C64 Series /M Stylus C64 /EF HKCU
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Downloads - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
http://download.mcafee.com/molbin/shared/m…74/mcinsctl.cab
O16 - DPF: {5DF6FB84-749D-4AAE-AE37-708DE09B0588} -
http://213.229.160.219/dialers/dialnew.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} -
http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) -
http://secure2.comned.com/signuptemplates/ActiveSecurity.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://142.176.20.26/islandcam/AxisCamControl.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {CA797B15-445F-4AA9-9828-8A88502F560F} (Uninstall Control) - http://www.worldwinner.com/games/shared/uninstall.cab
O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) -
https://img.web.de/v/fotoalbum/activex/upload_1119.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} -
http://download.abacast.com/download/files/abasetup141.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
http://us.dl1.yimg.com/download.companion….ebio5_1_6_0.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) -
http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) -
http://download.paltalk.com/webregtest/RegDloa
Log for VX2.BetterInternet File Finder (msg126)
Files Found—
Additional Files—
Keys Under Notify—
CSCSettings
Guardian Key— is called:
Asynchronous 000
DllName
Impersonate 000
Logon WinLogon
Logoff WinLogoff
Shutdown WinShutdown
User Agent String—
{79566745-D0FB-48AE-AF41-6713B6D718E8}
Warning! This utility will find legitimate files in addition
to malware.
Do not remove anything unless you are sure you know
what you're doing.
——- System Files in System32 Directory ——-
Warning! This utility will find legitimate files in addition
to malware.
Do not remove anything unless you are sure you know
what you're doing.
——- System Files in System32 Directory ——-
Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36
Directory of C:\C\WINXP\System32
12/17/2004 08:27 PM 225,642 maxml3a.dll
12/17/2004 08:25 PM 224,777 n44s0eh7eh4.dll
12/17/2004 08:23 PM 225,642 hr6805jue.dll
12/15/2004 05:41 AM 223,522 lv8s09l7e.dll
12/14/2004 05:50 AM 223,993 k062lajo1doc.dll
12/13/2004 05:51 AM 223,913 l08mlal11dq.dll
12/11/2004 08:29 AM 222,572 lv2s09f7e.dll
12/10/2004 05:05 PM 225,702 da16gt.dLL
12/10/2004 05:48 AM 222,605 s4rs0e97eh.dll
12/09/2004 07:37 AM 222,467 absnt.dll
12/09/2004 05:49 AM 222,467 kurnel32.dll
12/09/2004 05:49 AM 223,707 azau0ef9eh2.dll
12/08/2004 01:07 PM 224,371 az1olaf31d2.dll
12/07/2004 11:39 PM 225,849 d0j00a1med.dll
12/07/2004 01:38 PM 224,737 enrql1951.dll
12/07/2004 01:14 PM 223,762 h0l2la3o1d.dll
12/07/2004 11:11 AM 224,037 ir0ql5d51.dll
12/07/2004 07:03 AM 223,502 s0pu0a79ed.dll
12/07/2004 06:56 AM 224,168 azaolaf31d2.dll
12/07/2004 05:49 AM 223,026 p4r40e9qeh.dll
12/06/2004 12:11 PM 223,447 hrju0519e.dll
12/05/2004 08:54 AM 223,186 q6nulg5916.dll
12/05/2004 08:46 AM 225,638 s4880eluehq80.dll
12/04/2004 07:15 PM 225,763 mv00l9dm1.dll
12/04/2004 10:32 AM 223,429 dpmsvinn.dll
12/04/2004 10:32 AM 223,627 m8rm0i91e8.dll
12/02/2004 09:15 PM 222,901 m4640ejqehoe0.dll
12/01/2004 07:42 PM 225,525 l42s0ef7eh2.dll
12/01/2004 07:50 AM 225,550 lv4s09h7e.dll
11/30/2004 05:56 AM 225,944 gp4ml3h11.dll
11/29/2004 09:59 PM 225,435 l4l60e3seh.dll
11/29/2004 08:52 PM 225,985 l48mlel11hq.dll
11/29/2004 07:44 PM 225,720 lvju0919e.dll
11/27/2004 07:23 PM 223,115 l4j8le1u1h.dll
11/27/2004 06:03 AM 225,277 h02olaf31d2.dll
11/26/2004 07:25 PM 225,164 p64ulgh9164.dll
11/26/2004 05:34 PM 225,159 en4ul1h91.dll
11/25/2004 06:43 PM 223,944 n42u0ef9eh2.dll
11/24/2004 06:24 PM 223,033 enn6l15s1.dll
09/08/2004 12:56 PM dllcache
08/13/2003 01:52 PM 32
{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 11:12 PM Microsoft
09/30/1999 06:21 PM 166,672 mstext35.dll
09/28/1999 08:42 PM 1,050,896 msjet35.dll
09/09/1999 09:06 PM 168,720 msltus35.dll
09/09/1999 09:06 PM 252,688 msexcl35.dll
08/25/1999 01:57 PM 415,504 msrepl35.dll
06/07/1999 05:59 PM 250,128 mspdox35.dll
04/25/1999 04:00 PM 287,504 Msxbse35.dll
47 File(s) 11,340,447 bytes
2 Dir(s) 12,732,157,440 bytes free
——- Hidden Files in System32 Directory ——-
Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36
Directory of C:\C\WINXP\System32
11/16/2004 12:50 PM 19 winrscpxd.ini
09/08/2004 12:56 PM dllcache
08/19/2003 11:12 PM GroupPolicy
08/13/2003 01:52 PM 32
{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 06:05 PM 488 logonui.exe.manifest
08/02/2003 06:05 PM 488
WindowsLogon.manifest
08/02/2003 06:05 PM 749 sapi.cpl.manifest
08/02/2003 06:05 PM 749 cdplayer.exe.manifest
08/02/2003 06:05 PM 749 nwc.cpl.manifest
08/02/2003 06:05 PM 749 ncpa.cpl.manifest
08/02/2003 06:05 PM 749 wuaucpl.cpl.manifest
09/04/1992 02:26 PM 44,669 Pleap.wav
10 File(s) 49,441 bytes
2 Dir(s) 12,732,157,440 bytes free
———- Files Named "Guard" ————-
Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36
Directory of C:\C\WINXP\System32
——— Temp Files in System32 Directory ——–
Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36
Directory of C:\C\WINXP\System32
—————- User Agent ————
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\C
urrentVersion\Internet Settings\User Agent\Post
Platform]
"{79566745-D0FB-48AE-AF41-6713B6D718E8}"=""
———— Keys Under Notify ————
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\CSCSettings]
"Asynchronous"=dword:00000000
"DllName"="C:\\C\\WINXP\\system32\\hr6805jue.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
—————- Xfind Locked Files —————–
C:\C\WINXP\System32\HR6805~1.DLL +++ File read error
————– XFind Qoologic Results ————–
C:\C\WINXP\System32\HR6805~1.DLL +++ File read error
————– XFind Aspack Results —————
C:\C\WINXP\System32\HR6805~1.DLL +++ File read error
————– Locate.com Results —————
C:\C\WINXP\SYSTEM32\
absnt.dll Thu Dec 9 2004 7:37:08a ..S.R
222,467 217.25 K
az1ola~1.dll Wed Dec 8 2004 1:07:04p ..S.R
224,371 219.11 K
azaola~1.dll Tue Dec 7 2004 6:56:52a ..S.R
224,168 218.91 K
azau0e~1.dll Thu Dec 9 2004 5:49:10a ..S.R
223,707 218.46 K
d0j00a~1.dll Tue Dec 7 2004 11:39:52p ..S.R
225,849 220.55 K
da16gt.dll Fri Dec 10 2004 5:05:22p ..S.R
225,702 220.41 K
dpmsvinn.dll Sat Dec 4 2004 10:32:14a ..S.R
223,429 218.19 K
en4ul1~1.dll Fri Nov 26 2004 5:34:06p ..S.R
225,159 219.88 K
enn6l1~1.dll Wed Nov 24 2004 6:24:36p ..S.R
223,033 217.80 K
enrql1~1.dll Tue Dec 7 2004 1:38:50p ..S.R
224,737 219.47 K
gp4ml3~1.dll Tue Nov 30 2004 5:56:26a ..S.R
225,944 220.65 K
h02ola~1.dll Sat Nov 27 2004 6:03:08a ..S.R
225,277 219.99 K
h0l2la~1.dll Tue Dec 7 2004 1:14:16p ..S.R
223,762 218.52 K
hr6805~1.dll Fri Dec 17 2004 8:23:32p ..S.R
225,642 220.35 K
hrju05~1.dll Mon Dec 6 2004 12:11:52p ..S.R
223,447 218.21 K
ir0ql5~1.dll Tue Dec 7 2004 11:11:34a ..S.R
224,037 218.79 K
k062la~1.dll Tue Dec 14 2004 5:50:12a ..S.R
223,993 218.74 K
kurnel32.dll Thu Dec 9 2004 5:49:10a ..S.R
222,467 217.25 K
l08mla~1.dll Mon Dec 13 2004 5:51:12a ..S.R
223,913 218.66 K
l42s0e~1.dll Wed Dec 1 2004 7:42:32p ..S.R
225,525 220.24 K
l48mle~1.dll Mon Nov 29 2004 8:52:56p ..S.R
225,985 220.69 K
l4j8le~1.dll Sat Nov 27 2004 7:23:28p ..S.R
223,115 217.88 K
l4l60e~1.dll Mon Nov 29 2004 9:59:58p ..S.R
225,435 220.15 K
lv2s09~1.dll Sat Dec 11 2004 8:29:50a ..S.R
222,572 217.36 K
lv4s09~1.dll Wed Dec 1 2004 7:50:12a ..S.R
225,550 220.26 K
lv8s09~1.dll Wed Dec 15 2004 5:41:28a ..S.R
223,522 218.28 K
lvju09~1.dll Mon Nov 29 2004 7:44:12p ..S.R
225,720 220.43 K
m4640e~1.dll Thu Dec 2 2004 9:15:54p ..S.R
222,901 217.68 K
m8rm0i~1.dll Sat Dec 4 2004 10:32:14a ..S.R
223,627 218.38 K
maxml3a.dll Fri Dec 17 2004 8:27:06p ..S.R
225,642 220.35 K
mv00l9~1.dll Sat Dec 4 2004 7:15:26p ..S.R
225,763 220.47 K
n42u0e~1.dll Thu Nov 25 2004 6:43:36p ..S.R
223,944 218.70 K
n44s0e~1.dll Fri Dec 17 2004 8:25:34p ..S.R
224,777 219.51 K
p4r40e~1.dll Tue Dec 7 2004 5:49:28a ..S.R
223,026 217.80 K
p64ulg~1.dll Fri Nov 26 2004 7:25:48p ..S.R
225,164 219.89 K
q6nulg~1.dll Sun Dec 5 2004 8:54:06a ..S.R
223,186 217.95 K
s0pu0a~1.dll Tue Dec 7 2004 7:03:58a ..S.R
223,502 218.26 K
s4880e~1.dll Sun Dec 5 2004 8:46:16a ..S.R
225,638 220.35 K
s4rs0e~1.dll Fri Dec 10 2004 5:48:02a ..S.R
222,605 217.39 K
winrsc~1.ini Tue Nov 16 2004 12:50:04p …H.
19 0.02 K
40 items found: 40 files, 0 directories.
Total of file sizes: 8,748,322 bytes 8.34 M
I am having problems with spyware "wwwcoolwebsearch" and It keeps locking me off of the internet. If I run spybot it finds several wwwcoolwebsearch entries and will fix them for awhile but they just come back the next day or so 
2nd problem or maybe the same ?? I keep getting pop ups or search redirects to "http://www.ad-w-a-r-e.com/cgi-bin/KeywordV2?query=wwwcoolwebsearch"
I have Trend Micro Internet Security 11 set to block it and it blocks it but will not get rid of it.
I have scanned with spybot, cwshredder and spyware doctor but can't get rid of them completle they all seem to detect them but will not fix it …?
I have hijackthis and will post log with your permission.
Thanks
……….Trake52 
