What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This-log

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Findit log…. Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM TBPS INI 438 01-20-05 6:50a TBPS.ini WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll DGACTFRM DLL 217,088 01-18-05 7:45p dgactfrm.dll TUNLIB20 DLL 217,088 01-18-05 7:45p TunLib20.dll 4 file(s) 651,702 bytes 0 dir(s) 733.34 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM VX0 NLS 8,192 01-19-05 6:40a VX0.NLS VX3 NLS 8,192 01-19-05 6:40a VX3.NLS VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS VX2 NLS 8,192 01-19-05 6:40a VX2.NLS VX1 NLS 8,192 01-19-05 6:40a VX1.NLS VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS 0 NLS 8,192 01-08-05 7:51p 0.NLS 2X NLS 8,192 01-08-05 7:51p 2X.NLS 3 NLS 8,192 01-08-05 7:50p 3.NLS 2 NLS 8,192 01-08-05 7:50p 2.NLS 3X NLS 8,192 01-08-05 7:50p 3X.NLS 1 NLS 8,192 01-08-05 7:50p 1.NLS 1X NLS 8,192 01-08-05 7:50p 1X.NLS HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID FIZ3 12,830 12-31-03 10:57a fiz3 FIZ2 30,062 12-30-03 6:15p fiz2 FIZ1 308 12-19-03 10:22a fiz1 SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID 19 file(s) 175,144 bytes 0 dir(s) 733.34 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K dgactfrm.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K tunlib20.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K 3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K 3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K 2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K 18 items found: 18 files, 0 directories. Total of file sizes: 766,390 bytes 748.43 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\UCIDRV.DLL: UMonitor C:\WINDOWS\SYSTEM\VKMDBG.DLL: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z C:\WINDOWS\SYSTEM\IM_NDI.DLL: UMonitor C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor C:\WINDOWS\SYSTEM\dgactfrm.dll: UMonitor C:\WINDOWS\SYSTEM\TunLib20.dll: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="c:\\windows\\scanregw.exe /autorun" "SystemTray"="SysTray.Exe" "EM_EXEC"="c:\\mouse\\system\\em_exec.exe" "OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "EnsoniqMixer"="starter.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe" "MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe" "VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask" "VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\"" "StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "jhrrvth"="c:\\windows\\system\\jhrrvth.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 
Post #32
New DllCompare log… * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K C:\WINDOWS\SYSTEM\dzix.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K C:\WINDOWS\SYSTEM\tunlib20.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K ________________________________________________ 997 items found: 997 files (3 H/S), 0 directories. Total of file sizes: 185,121,468 bytes 176.54 M ——————–End log——————— I've had to reboot since the last posts…. should I post new logs as well? Thanks!
Post #33
Hello BuffaloBob,

Siggyx has asked me to help out :thumbup:

I've had to reboot since the last posts…. should I post new logs as well?

Yes please post new ones.
Post #34
Well thank you…. I just finished running ad-aware, S&D here is the latest.

Findit log…..

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
2 file(s) 217,526 bytes
0 dir(s) 735.83 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 735.82 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

16 items found: 16 files, 0 directories.
Total of file sizes: 332,214 bytes 324.43 K

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\CXFG95.DLL: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z
C:\WINDOWS\SYSTEM\DKLAY.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor
C:\WINDOWS\SYSTEM\LSCMP70n.DLL: UMonitor
C:\WINDOWS\SYSTEM\HIFCSA.DLL: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"
"CSV10P70"="\\Progra~1\\CSBB\\CSV10P070.EXE"
"jhrrvth"="c:\\windows\\system\\jhrrvth.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


DLL Compare…….

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

996 items found: 996 files (1 H/S), 0 directories.
Total of file sizes: 184,904,380 bytes 176.34 M

——————–End log———————

HJT log….
Logfile of HijackThis v1.99.0
Scan saved at 8:52:17 PM, on 1/27/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\JHRRVTH.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
Post #35 last edited
First, Disconnect from the Internet!!

Next, Open NotePad. Copy and paste the information in blue below to notepad. Save it to your desktop as type "all files" and name it remove.reg. Doubleclick it and grant it permission to add the registry entries.



REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=-



click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Do the same as above for each of the files that follow, and select No when asked to reboot! Press the button with a red circle and a white X.

c:\\windows\\system\\jhrrvth.exe
C:\WINDOWS\SYSTEM\CXFG95.DLL
C:\WINDOWS\SYSTEM\UpdInstall.exe
C:\WINDOWS\SYSTEM\ipebase12.dll
C:\WINDOWS\SYSTEM\DKLAY.DLL
C:\WINDOWS\SYSTEM\wvpui.dll
C:\WINDOWS\SYSTEM\LSCMP70n.DLL
C:\WINDOWS\SYSTEM\HIFCSA.DLL
C:\Progra~1\CSBB\CSV10P070.EXE
c:\windows\system\jhrrvth.exe

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [CSV10P70] \Progra~1\CSBB\CSV10P070.EXE
O4 - HKLM\..\Run: [jhrrvth] c:\windows\system\jhrrvth.exe

Close ALL windows and browsers except HijackThis and click "Fix checked

Empty Recycle Bin

Reboot and "copy/paste" a new log files into this thread.
Also please describe how your computer behaves at the moment.
Post #36
Hello…. While disconnected from internet computer was still attempting to connect… came online to post still geting pop ups…

Findit log …..

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
FZXLIB DLL 217,088 01-18-05 7:45p FZXLIB.DLL
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
3 file(s) 434,614 bytes
0 dir(s) 1,089.01 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 1,089.00 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
fzxlib.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

17 items found: 17 files, 0 directories.
Total of file sizes: 549,302 bytes 536.43 K

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\CXFG95.DLL: UMonitor
C:\WINDOWS\SYSTEM\FZXLIB.DLL: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\UpdInstall.exe: UMonitor
C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z
C:\WINDOWS\SYSTEM\DKLAY.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor
C:\WINDOWS\SYSTEM\HIFCSA.DLL: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"




HJT log….
Logfile of HijackThis v1.99.0
Scan saved at 10:28:54 PM, on 1/27/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll

and Dll Compare log….

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\fzxlib.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

996 items found: 996 files (2 H/S), 0 directories.
Total of file sizes: 184,904,380 bytes 176.34 M

——————–End log———————


Thanks!
Post #37
First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)




click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Do the same as above for each of the files that follow, and select No when asked to reboot! Press the button with a red circle and a white X.

C:\WINDOWS\SYSTEM\CXFG95.DLL
C:\WINDOWS\SYSTEM\UpdInstall.exe
C:\WINDOWS\SYSTEM\ipebase12.dll
C:\WINDOWS\SYSTEM\DKLAY.DLL
C:\WINDOWS\SYSTEM\LSCMP70n.DLL
C:\WINDOWS\SYSTEM\HIFCSA.DLL
C:\Progra~1\CSBB\CSV10P070.EXE
c:\windows\system\FZXLIB.DLL

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O9 - Extra button: (no name) - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)

O9 - Extra 'Tools' menuitem: &AltaVista Home - {06FE5D00-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)

O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)

O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/babelfish (file missing)

O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)

O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/linksearch (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)

O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/hostsearch (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked


Search for and delete this file if found:
C:\WINDOWS\SYSTEM\UpdInstall.exe


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.



Reboot and "copy/paste" a new log files into this thread.
Also please describe how your computer behaves at the moment.
Post #38
Hello… no attemps to connect while off line… but as soon as I clicked onto internet explorer… pop ups….

two logs

Dll…..

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\drskcopy.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

996 items found: 996 files (2 H/S), 0 directories.
Total of file sizes: 184,904,380 bytes 176.34 M

Findit log takes 20 min. will start running now.

——————–End log———————

HJT….

Logfile of HijackThis v1.99.0
Scan saved at 11:10:46 PM, on 1/27/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home
O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search
O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
Post #40
Findit Log…. Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM TBPS INI 438 01-20-05 6:50a TBPS.ini DRSKCOPY DLL 217,088 01-18-05 7:45p DRSKCOPY.DLL WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll 3 file(s) 434,614 bytes 0 dir(s) 1,089.34 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM VX0 NLS 8,192 01-19-05 6:40a VX0.NLS VX3 NLS 8,192 01-19-05 6:40a VX3.NLS VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS VX2 NLS 8,192 01-19-05 6:40a VX2.NLS VX1 NLS 8,192 01-19-05 6:40a VX1.NLS VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS 0 NLS 8,192 01-08-05 7:51p 0.NLS 2X NLS 8,192 01-08-05 7:51p 2X.NLS 3 NLS 8,192 01-08-05 7:50p 3.NLS 2 NLS 8,192 01-08-05 7:50p 2.NLS 3X NLS 8,192 01-08-05 7:50p 3X.NLS 1 NLS 8,192 01-08-05 7:50p 1.NLS 1X NLS 8,192 01-08-05 7:50p 1X.NLS HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID FIZ3 12,830 12-31-03 10:57a fiz3 FIZ2 30,062 12-30-03 6:15p fiz2 FIZ1 308 12-19-03 10:22a fiz1 SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID 19 file(s) 175,144 bytes 0 dir(s) 1,089.33 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ drskcopy.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K 3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K 3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K 2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K 17 items found: 17 files, 0 directories. Total of file sizes: 549,302 bytes 536.43 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\CXFG95.DLL: UMonitor C:\WINDOWS\SYSTEM\DRSKCOPY.DLL: UMonitor C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z C:\WINDOWS\SYSTEM\DKLAY.DLL: UMonitor C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor C:\WINDOWS\SYSTEM\HIFCSA.DLL: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="c:\\windows\\scanregw.exe /autorun" "SystemTray"="SysTray.Exe" "EM_EXEC"="c:\\mouse\\system\\em_exec.exe" "OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "EnsoniqMixer"="starter.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\MCUPDATE.EXE" "MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe" "VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask" "VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\"" "StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 
Post #41
I'm trying to do this from work, so bear with me.
Do you have the Hoster.fix file?

First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)




click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

Do the same as above for each of the files that follow, and select No when asked to reboot! Press the button with a red circle and a white X.

C:\WINDOWS\SYSTEM\DRSKCOPY.DLL
C:\WINDOWS\SYSTEM\CXFG95.DLL
C:\WINDOWS\SYSTEM\ipebase12.dll
C:\WINDOWS\SYSTEM\DKLAY.DLL
C:\WINDOWS\SYSTEM\LSCMP70n.DLL
C:\WINDOWS\SYSTEM\HIFCSA.DLL

Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch


Close ALL windows and browsers except HijackThis and click "Fix checked


Search for and delete these files if found:
C:\WINDOWS\SYSTEM\DRSKCOPY.DLL
C:\WINDOWS\SYSTEM\wvpui.dll
C:\WINDOWS\SYSTEM\CXFG95.DLL
C:\WINDOWS\SYSTEM\ipebase12.dll
C:\WINDOWS\SYSTEM\DKLAY.DLL
C:\WINDOWS\SYSTEM\LSCMP70n.DLL
C:\WINDOWS\SYSTEM\HIFCSA.DLL

1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.



Reboot and "copy/paste" a new log files into this thread.
Also please describe how your computer behaves at the moment.
Post #42
Hello… I'm at work as well… I don't think I have the Holster.fix file. I won't get to my computer until tonight or tomorrow a.m. FYI… my Killbox program does not give me the option to "reboot." A message pops up saying "will replace at next reboot" and I click ok and continue on. I don't think its a problem… I just exit out of Killbox and reboot the normal way. Thanks for helping me out.
Post #44
Hello….

Completed your fix… the only file that I could not delete was the "C:\WINDOWS\SYSTEM\wvpui.dll" file. A message appered saying the the file could not be deleted because it was being used by windows.

HJT log after Holster.exe…..

Logfile of HijackThis v1.99.0
Scan saved at 8:05:03 AM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll



DLL Compare log…

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\mftext40.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

992 items found: 992 files (2 H/S), 0 directories.
Total of file sizes: 183,921,340 bytes 175.40 M

——————–End log———————


Findit log….

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
MFG4DMOD DLL 217,088 01-18-05 7:45p MFG4DMOD.DLL
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
3 file(s) 434,614 bytes
0 dir(s) 1,105.11 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 1,105.10 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
mfg4dmod.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

17 items found: 17 files, 0 directories.
Total of file sizes: 549,302 bytes 536.43 K

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\MFG4DMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\MCUPDATE.EXE"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"
"winupdtl"="C:\\WINDOWS\\SYSTEM\\winupdtl.exe"
"vcmpin"="C:\\WINDOWS\\BUNDLES\\ADL_MTESTSTUB.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"



Thanks!
Post #45
Looks like we are down to 2 bad guys. They sure don't like to die,


First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)


Click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\MFG4DMOD.DLL
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.


Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe

Close ALL windows and browsers except HijackThis and click "Fix checked

Delete this file
C:\WINDOWS\SYSTEM\winupdtl.exe

Download: hosts.zip http://www.mvps.org/winhelp2002/hosts.zip
[right-click - Select: Save Target As] [Updated 01-23-05]
Unzip in a "temp" folder and place in the appropriate installed location:

Win 98\ME = C:\WINDOWS



Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI