What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This-log

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Here is the most recent Hijack this log….

Logfile of HijackThis v1.99.0
Scan saved at 5:13:04 PM, on 1/25/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
C:\WINDOWS\SYSTEM\JHRRVTH.EXE
C:\WINDOWS\SYSTEM\ADL_ZENO.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\APPLICATION DATA\CCUU.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\SYSTEM\WINFDDE32.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [Windows] c:\msdos98.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\Run: [App32dll] C:\WINDOWS\SYSTEM\ADL_ZENO.EXE 0
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [Umss] C:\WINDOWS\Application Data\ccuu.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Startup: STRINGS.EXE
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedCont…c/bin/cabsa.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4025.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://qp.wnyric.org/qp2.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/143b281ce8b789e63d23/…ip/RdxIE601.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m…77/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/…ad/tgctlins.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404…meInstaller.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://ns-cncrooks.wnyric.org/iNotes6.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,7…pdatePortal.cab

Thanks!
Post #18
VX2 Finder Log…. Log for VX2.BetterInternet File Finder Files Found— User Agent String— {30ECC364-4102-44E5-B514-E2E4CE5A6275} Thanks!
Post #20
* DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM\rccmqsvr.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K C:\WINDOWS\SYSTEM\dlnwsock.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K C:\WINDOWS\SYSTEM\mrco30.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K ________________________________________________ 995 items found: 995 files (4 H/S), 0 directories. Total of file sizes: 184,687,292 bytes 176.13 M ——————–End log———————
Post #22
Hello, Thanks for sticking with me… between work and the pop ups I get while i'm online… oh well here is the findit log…. Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM TBPS INI 438 01-20-05 6:50a TBPS.ini RCCMQSVR DLL 217,088 01-18-05 7:45p RCCMQSVR.DLL MLVCP60 DLL 217,088 01-18-05 7:45p MLVCP60.DLL WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll MRCO30 DLL 217,088 01-18-05 7:45p MRCO30.DLL ZKV EXE 401,408 01-11-05 9:13a zkv.exe 6 file(s) 1,270,198 bytes 0 dir(s) 784.79 MB free ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM TBPS INI 438 01-20-05 6:50a TBPS.ini RCCMQSVR DLL 217,088 01-18-05 7:45p RCCMQSVR.DLL MLVCP60 DLL 217,088 01-18-05 7:45p MLVCP60.DLL WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll MRCO30 DLL 217,088 01-18-05 7:45p MRCO30.DLL ZKV EXE 401,408 01-11-05 9:13a zkv.exe 6 file(s) 1,270,198 bytes 0 dir(s) 728.59 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM VX0 NLS 8,192 01-19-05 6:40a VX0.NLS VX3 NLS 8,192 01-19-05 6:40a VX3.NLS VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS VX2 NLS 8,192 01-19-05 6:40a VX2.NLS VX1 NLS 8,192 01-19-05 6:40a VX1.NLS VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS ZKV EXE 401,408 01-11-05 9:13a zkv.exe 0 NLS 8,192 01-08-05 7:51p 0.NLS 2X NLS 8,192 01-08-05 7:51p 2X.NLS 3 NLS 8,192 01-08-05 7:50p 3.NLS 2 NLS 8,192 01-08-05 7:50p 2.NLS 3X NLS 8,192 01-08-05 7:50p 3X.NLS 1 NLS 8,192 01-08-05 7:50p 1.NLS 1X NLS 8,192 01-08-05 7:50p 1X.NLS HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID FIZ3 12,830 12-31-03 10:57a fiz3 FIZ2 30,062 12-30-03 6:15p fiz2 FIZ1 308 12-19-03 10:22a fiz1 SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID 20 file(s) 576,552 bytes 0 dir(s) 784.78 MB free —————- User Agent ———— ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM VX0 NLS 8,192 01-19-05 6:40a VX0.NLS VX3 NLS 8,192 01-19-05 6:40a VX3.NLS VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS VX2 NLS 8,192 01-19-05 6:40a VX2.NLS VX1 NLS 8,192 01-19-05 6:40a VX1.NLS VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS ZKV EXE 401,408 01-11-05 9:13a zkv.exe 0 NLS 8,192 01-08-05 7:51p 0.NLS 2X NLS 8,192 01-08-05 7:51p 2X.NLS 3 NLS 8,192 01-08-05 7:50p 3.NLS 2 NLS 8,192 01-08-05 7:50p 2.NLS 3X NLS 8,192 01-08-05 7:50p 3X.NLS 1 NLS 8,192 01-08-05 7:50p 1.NLS 1X NLS 8,192 01-08-05 7:50p 1X.NLS HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID FIZ3 12,830 12-31-03 10:57a fiz3 FIZ2 30,062 12-30-03 6:15p fiz2 FIZ1 308 12-19-03 10:22a fiz1 SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID 20 file(s) 576,552 bytes 0 dir(s) 728.59 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{30ECC364-4102-44E5-B514-E2E4CE5A6275}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ rccmqsvr.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K mlvcp60.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K zkv.exe Tue Jan 11 2005 9:13:40a ..SHR 401,408 392.00 K mrco30.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K 1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K 3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K 3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K 2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K 20 items found: 20 files, 0 directories. Total of file sizes: 1,384,886 bytes 1.32 M —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ rccmqsvr.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K mlvcp60.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K zkv.exe Tue Jan 11 2005 9:13:40a ..SHR 401,408 392.00 K mrco30.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K 1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K 3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K 3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K 2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K 20 items found: 20 files, 0 directories. Total of file sizes: 1,384,886 bytes 1.32 M ———— Strings.exe Qoologic Results ———— ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\RCCMQSVR.DLL: UMonitor C:\WINDOWS\SYSTEM\MLVCP60.DLL: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor C:\WINDOWS\SYSTEM\MRCO30.DLL: UMonitor ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\RCCMQSVR.DLL: UMonitor C:\WINDOWS\SYSTEM\MLVCP60.DLL: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor C:\WINDOWS\SYSTEM\MRCO30.DLL: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows"="c:\\msdos98.exe" "ScanRegistry"="c:\\windows\\scanregw.exe /autorun" "SystemTray"="SysTray.Exe" "EM_EXEC"="c:\\mouse\\system\\em_exec.exe" "OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "EnsoniqMixer"="starter.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\MCUPDATE.EXE" "MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe" "VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask" "VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\"" "StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "jhrrvth"="c:\\windows\\system\\jhrrvth.exe" "CleanUp"="C:\\PROGRA~1\\MCAFEE.COM\\SHARED\\MCAPPINS.EXE /v=3 /cleanup" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1"  And here is the qoologic log…. ECHO is off PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— Finished Thanks!!!
Post #23
Please follow these steps

Disconnect from the internet while doing it.

Delete these files with killbox as per previous instructions

c:\\windows\\system\\jhrrvth.exe
C:\WINDOWS\SYSTEM\rccmqsvr.dll
C:\WINDOWS\SYSTEM\mlvcp60.dll
C:\WINDOWS\SYSTEM\wvpui.dll
C:\WINDOWS\SYSTEM\mrco30.dll
C:\WINDOWS\SYSTEM\zkv.exe

Then scan with hijackthis and put a check beside these lines and choose FIX.

R3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O4 - HKLM\..\Run: [Windows] c:\msdos98.exe
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\Run: [App32dll] C:\WINDOWS\SYSTEM\ADL_ZENO.EXE 0
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKCU\..\Run: [Umss] C:\WINDOWS\Application Data\ccuu.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: STRINGS.EXE
ALL 016's

Go to Add/Remove Programs and look for
WINTOOLS and remove if present.

Then reboot to safe mode and delete these

Delete Folders
C:\Progra~1\CSBB
C:\WINDOWS\BUNDLES


Delete Files
C:\WINDOWS\SYSTEM\ADL_ZENO.EXE
C:\WINDOWS\Application Data\ccuu.exe
STRINGS.EXE

Then reboot.

Please download hoster from the link below.

http://members.aol.com/toadbee/hoster.zip

Unzip Hoster.zip
Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.

Then reboot and post a new hijackthis log please
Post #24
Followed the instructions in your last post….. here is the HJT Log

Logfile of HijackThis v1.99.0
Scan saved at 9:59:43 PM, on 1/26/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\JHRRVTH.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
Post #26
I keep getting something called coollove which seems to hijack my browser, I ran Hijack This with the new version and removed it but it always returns as you can see below.

Thanks in advance.



Logfile of HijackThis v1.99.0
Scan saved at 10:06:43 PM, on 1/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Intuit\QAgent\QAGENT.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\mrtMngr.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0FDAA798-4A82-E32D-BDD2-A292AFAD8E32} - C:\DOCUME~1\DANAG~1.WIL\APPLIC~1\CREATI~1\Rule Platform.exe
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [QAGENT] C:\Program Files\Intuit\QAgent\QAGENT.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Startsoftpokeweb] C:\Documents and Settings\All Users\Application Data\Cool Junk Start Soft\Dumb Hole.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [coollove] C:\DOCUME~1\DANAG~1.WIL\APPLIC~1\DOWNLO~1\Upload trans aim.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
Post #27
Computerklutz DO NOT POST IN ANOTHER PERSONS THREAD. If you need assistance you can start your own thread in this link.

http://forums.tomcoyote.org/index.php?showforum=27
Post #28
Had to reboot here is the newest findit log and the hjt log

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
UCIDRV DLL 217,088 01-18-05 7:45p UCIDRV.DLL
VKMDBG DLL 217,088 01-18-05 7:45p VKMDBG.DLL
CNMMDLG DLL 217,088 01-18-05 7:45p CNMMDLG.DLL
IM_NDI DLL 217,088 01-18-05 7:45p IM_NDI.DLL
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
TUNLIB20 DLL 217,088 01-18-05 7:45p TunLib20.dll
7 file(s) 1,302,966 bytes
0 dir(s) 695.04 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 695.03 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
ucidrv.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vkmdbg.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
cnmmdlg.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
im_ndi.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tunlib20.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

21 items found: 21 files, 0 directories.
Total of file sizes: 1,417,654 bytes 1.35 M

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\UCIDRV.DLL: UMonitor
C:\WINDOWS\SYSTEM\VKMDBG.DLL: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\CNMMDLG.DLL: UMonitor
C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z
C:\WINDOWS\SYSTEM\IM_NDI.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor
C:\WINDOWS\SYSTEM\TunLib20.dll: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"
"jhrrvth"="c:\\windows\\system\\jhrrvth.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"





Logfile of HijackThis v1.99.0
Scan saved at 10:33:23 PM, on 1/26/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\JHRRVTH.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll



Thanks!
Post #29
I would suggest that you disable Spysweeper first as it can stop fixes sometimes.

Have killbox delete these files

c:\\windows\\system\\jhrrvth.exe
C:\WINDOWS\SYSTEM\UCIDRV.DLL
C:\WINDOWS\SYSTEM\VKMDBG.DLL
C:\WINDOWS\SYSTEM\UpdInstall.exe
C:\WINDOWS\SYSTEM\UpdInstall.exe
C:\WINDOWS\SYSTEM\CNMMDLG.DLL
C:\WINDOWS\SYSTEM\ipebase12.dll
C:\WINDOWS\SYSTEM\IM_NDI.DLL
C:\WINDOWS\SYSTEM\wvpui.dll
C:\WINDOWS\SYSTEM\TunLib20.

Then scan with hijackthis and put a check beside these lines and choose FIX

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe

Then reboot to safe mode and delete this file

c:\windows\system\jhrrvth.exe

Then reboot and post a new log.
Post #30
Here is the new HJT log…..

Logfile of HijackThis v1.99.0
Scan saved at 11:13:23 PM, on 1/26/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll

Will run findit log now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI