Help With Log

Here is the MicroWorld scan. The hijack this and find_it are right behind. File C:\Documents and Settings\All Users\Application Data\AOL Downloads\updateni_setup90\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads\lpitunes_setupSTUS\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\NoAdwareBackup\WinTools\WSup.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\NoAdwareBackup\WinTools\WToolsA.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\NoAdwareBackup\WSup.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\NoAdwareBackup\WToolsA.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\temp.frC599\WSup.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\GC\Local Settings\Temp\temp.frC599\WToolsA.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken. File C:\Program Files\America Online 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0a\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0b\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0c\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0d\backup\restore\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0d\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Common Files\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\Internet Explorer\twnloa.exe infected by "Trojan-Downloader.Win32.Harnig.am" Virus. Action Taken: No Action Taken. File C:\Program Files\Internet Explorer\ymwitwbb.exe infected by "Trojan-Downloader.Win32.Harnig.am" Virus. Action Taken: No Action Taken. File C:\Program Files\Windows Media Player\wmplayer.exe.tmp infected by "TrojanDownloader.Win32.Small.wj" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\sl.ocx infected by "Trojan-Downloader.Win32.Agent.ex" Virus. Action Taken: No Action Taken.

Find_It Log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Documents and Settings\[removed]\Desktop\Find It NT-2K-XP\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 12/30/2004 04:57 PM DLLCACHE 12/04/2003 12:26 PM Microsoft 0 File(s) 0 bytes 2 Dir(s) 29,949,517,824 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 12/30/2004 04:57 PM DLLCACHE 11/15/2004 03:41 PM 488 logonui.exe.manifest 11/15/2004 03:41 PM 488 WindowsLogon.manifest 11/15/2004 03:41 PM 749 nwc.cpl.manifest 11/15/2004 03:41 PM 749 sapi.cpl.manifest 11/15/2004 03:41 PM 749 ncpa.cpl.manifest 11/15/2004 03:41 PM 749 wuaucpl.cpl.manifest 11/15/2004 03:41 PM 749 cdplayer.exe.manifest 7 File(s) 4,721 bytes 1 Dir(s) 29,949,517,824 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 01/03/2005 07:52 PM 56 guard.tmp 1 File(s) 56 bytes 0 Dir(s) 29,949,517,824 bytes free ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 5C27-CD3B Directory of C:\WINDOWS\System32 01/03/2005 07:52 PM 56 guard.tmp 07/16/2003 12:25 PM 2,577 CONFIG.TMP 06/19/2002 05:39 PM 384 ~GLH001a.TMP 06/19/2002 03:39 PM 25,088 ~GLH001b.TMP 4 File(s) 28,105 bytes 0 Dir(s) 29,949,513,728 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{0F34C91C-904E-436F-A518-A1D52A47968C}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsUpdate] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\gp4ol3h31.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 —————— Locate.com Results —————— C:\WINDOWS\SYSTEM32\ cdplay~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K logonu~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K ncpacp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K nwccpl~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K sapicp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K window~1.man Mon Nov 15 2004 3:41:42p A..HR 488 0.48 K wuaucp~1.man Mon Nov 15 2004 3:41:32p A..HR 749 0.73 K 7 items found: 7 files, 0 directories. Total of file sizes: 4,721 bytes 4.61 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe" "Logitech Utility"="Logi_MwX.Exe" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\"" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "VSOCheckTask"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcmnhdlr.exe\" /checktask" "VirusScan Online"="\"c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe\"" "MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe" "MCUpdateExe"="C:\\PROGRA~1\\McAfee.com\\Agent\\mcupdate.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" 

Please download the trial version of Trojan Hunter from the link below. Make sure that you update it before you run it. Scan your system and allow it to clean what it finds. If it is not able to clean someting please post the path of it.

Thank you for the info. Which link has the trial version of Trojan Hunter? I have been unable to find it.

Sorry, tired here it is

http://www.trojanhunter.com/

Here is what it said. Unable to clean trojan file C:\Program Files\NoAdware\NoAdwareBackup\11,11,2004_15,53,23.zip/s3q.WSup.exe because it is contained in an archive Unable to clean trojan file C:\Program Files\NoAdware\NoAdwareBackup\11,11,2004_15,53,23.zip/toolbar.dll because it is contained in an archive Unable to clean trojan file C:\Program Files\NoAdware\NoAdwareBackup\11,11,2004_15,53,23.zip/WSup.exe because it is contained in an archive Unable to clean trojan file C:\Program Files\NoAdware\NoAdwareBackup\11,11,2004_15,53,23.zip/WToolsA.exe because it is contained in an archive Trojan cleaning finished.

How is it running?

The computer is actually running great right now. If there are no problems with what the Troajan Hunter found, you can probably close this thread down. I really appreciate all your help. The instructions were extremely easy for someone that isn't a computer expert to follow. The only question I have is whether I need to change any of the setting changes etc. that I made back to how they were, or if they are fine to leave as is? I made a donation to the site, but if you have your own pay pal account, I'd be happy to make a small donation to that as well. Thanks again.

Looks good Just glad I could help.

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

For a couple of weeks my computer ran great. Then about a week ago, the screen started jumping all over the pace on any page with a scroll bar. This was going on before, but seemed to stop after you helped me with the previous problems, but maybe that is a coincedence. I have run AdAware and Spybot and they aren't finding anything. Whenever I'm on a page with a scrollbar the computer works fine for a minute or two and then the page, usually a web page, starts scrolling up and down intermittently and erratically. If I unplug the mouse and navigate with the keyboard this does not happen. I'm thinking the mouse might be the problem, but it works fine on anything where there isn't a scroll bar. Have you seen this problem caused by some hijacker, virus etc. or is my best bet to go and buy a new mouse and see if that fixes the problem? I really appreciate any advice you might have.

Post a hijackthis log and lets take a look.

Download THIS file to your desktop.

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection.

Then post a new log please.