What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This-log

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
I'm not sure I follow your instructions

"Download: hosts.zip http://www.mvps.org/winhelp2002/hosts.zip
[right-click - Select: Save Target As] [Updated 01-23-05]
Unzip in a "temp" folder and place in the appropriate installed location:

Win 98\ME = C:\WINDOWS

I downloaded the file to my desk top…. unziped it into a new folder by itself (named it temp2) and draged it into C:\windows…. then rebooted.

Should I have named the folder "temp" and replaced the "temp" folder that already exists in C:\windows??

Did the rest of the fixes as well here are two logs (findit is still running)

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\udp10.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

992 items found: 992 files (2 H/S), 0 directories.
Total of file sizes: 183,921,340 bytes 175.40 M

——————–End log———————

HJT log

Logfile of HijackThis v1.99.0
Scan saved at 8:46:50 AM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll

Thanks!
Post #47
Findit log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM TBPS INI 438 01-20-05 6:50a TBPS.ini UDP10 DLL 217,088 01-18-05 7:45p udp10.dll WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll 3 file(s) 434,614 bytes 0 dir(s) 1,100.17 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 379D-79AF Directory of C:\WINDOWS\SYSTEM VX0 NLS 8,192 01-19-05 6:40a VX0.NLS VX3 NLS 8,192 01-19-05 6:40a VX3.NLS VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS VX2 NLS 8,192 01-19-05 6:40a VX2.NLS VX1 NLS 8,192 01-19-05 6:40a VX1.NLS VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS 0 NLS 8,192 01-08-05 7:51p 0.NLS 2X NLS 8,192 01-08-05 7:51p 2X.NLS 3 NLS 8,192 01-08-05 7:50p 3.NLS 2 NLS 8,192 01-08-05 7:50p 2.NLS 3X NLS 8,192 01-08-05 7:50p 3X.NLS 1 NLS 8,192 01-08-05 7:50p 1.NLS 1X NLS 8,192 01-08-05 7:50p 1X.NLS HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID FIZ3 12,830 12-31-03 10:57a fiz3 FIZ2 30,062 12-30-03 6:15p fiz2 FIZ1 308 12-19-03 10:22a fiz1 SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID 19 file(s) 175,144 bytes 0 dir(s) 1,100.16 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ udp10.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K 1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K 3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K 3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K 0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K 2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K 17 items found: 17 files, 0 directories. Total of file sizes: 549,302 bytes 536.43 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\udp10.dll: UMonitor C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="c:\\windows\\scanregw.exe /autorun" "SystemTray"="SysTray.Exe" "EM_EXEC"="c:\\mouse\\system\\em_exec.exe" "OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "EnsoniqMixer"="starter.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe" "MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe" "VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask" "VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\"" "StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "vcmpin"="C:\\WINDOWS\\BUNDLES\\ADL_MTESTSTUB.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 
Post #48

I downloaded the file to my desk top…. unziped it into a new folder by itself (named it temp2) and draged it into C:\windows…. then rebooted.

Should I have named the folder "temp" and replaced the "temp" folder that already exists in C:\windows??

When you unzip it, the file name should be something like Host. Just copy the new file into the Windows directory. Don't rename the file.


First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)




click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\udp10.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.

In the Full Path of File to Delete box, copy and paste this entry:
C:\\WINDOWS\\BUNDLES\\ADL_MTESTSTUB.EXE
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.


Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [vcmpin] C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked

Delete this folder
C:\WINDOWS\BUNDLES


Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #49
Still getting popups….

Went to empty recycle bin after I deleted "C:\WINDOWS\BUNDLES" got an error message

"Cannot delete adl_mtestub:Access is denied
Make sure the disk is not full or write-protected and that files are not currently in use."


pasted file "hosts" into c:\windows

new dll log….

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\ctypt32.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

992 items found: 992 files (2 H/S), 0 directories.
Total of file sizes: 183,921,340 bytes 175.40 M

——————–End log———————

new hjt log…
Logfile of HijackThis v1.99.0
Scan saved at 9:43:03 AM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll


Findit log still running will post asp
Post #50
Findit log

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
CTYPT32 DLL 217,088 01-18-05 7:45p CTYPT32.DLL
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
3 file(s) 434,614 bytes
0 dir(s) 1,100.88 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 1,100.87 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
ctypt32.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

17 items found: 17 files, 0 directories.
Total of file sizes: 549,302 bytes 536.43 K

———— Strings.exe Qoologic Results ————

C:\WINDOWS\hosts: 127.0.0.1 u.clkoptimizer.com #[Trojan-Downloader.Win32.Qoologic.f]
C:\WINDOWS\hosts: 127.0.0.1 qoologic.com
C:\WINDOWS\hosts: 127.0.0.1 adsrv.qoologic.com
C:\WINDOWS\hosts: 127.0.0.1 updates.qoologic.com
C:\WINDOWS\hosts: 127.0.0.1 www.qoologic.com

————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\CTYPT32.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McUpdate.exe"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


Post #51
One at a time :rant2:


First, Disconnect from the Internet!!

(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)




click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\SYSTEM\udp10.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.


Finally, in the Full Path of File to Delete, copy and paste the following:
C:\WINDOWS\SYSTEM\wvpui.dll
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
____
Run Hijack This again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

Close ALL windows and browsers except HijackThis and click "Fix checked


Restart your computer in Safe Mode.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.



Delete this file
C:\WINDOWS\SYSTEM\wvpui.dll

Empty Recycle Bin

Reboot:

Make Sure Internet Explorer is NOT open when trying this)

Launch HijackThis, Select None of the above, Click Config, click the 'Open'Misc Tools'Section -> 'Open hosts file manager'. Delete every line (select each line and click 'Delete line(s)') except the very first top lines beginning with # and: 127.0.0.1 localhost


Once finished, click the 'Open in Notepad' button. It should look like this:


QUOTE
# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost




Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #52
1st I could not delete "C:\WINDOWS\SYSTEM\wvpui.dll" in safe mode. It said it was being used by windows.

2nd this is what my host manager file looked like after I deleted all non-essential lines.

# This MVPS HOSTS file is a free download from: #
# http://www.mvps.org/winhelp2002/ #
# #
# Notes: the browser does not read this "#" symbol #
# You can create your own notes, after the # symbol #
# This *must* be the first line: 127.0.0.1 localhost #
# ********************************************************#
# ——————Updated: 01-23-05———————#
# ********************************************************#
# Entries marked with Parasite or Trojan comments should #
# be placed in the Internet Explorer Restricted Zone. #
# http://mvps.org/winhelp2002/restricted.htm #
# #
# Entries with other comments are searchable via Google. #
# #
# Disclaimer: this file is free to use, however it is NOT #
# permitted to post on any other site without permission. #

127.0.0.1 localhost

#start of lines added by WinHelp2002
# [Misc Add-ons][A - Z]

Logs to follow soon.
Post #53
HJT log…

Logfile of HijackThis v1.99.0
Scan saved at 11:01:12 AM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll


Dll log…

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\ebdaz32.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
C:\WINDOWS\SYSTEM\wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
________________________________________________

992 items found: 992 files (2 H/S), 0 directories.
Total of file sizes: 183,921,340 bytes 175.40 M

——————–End log———————

Findit log on its way…
Post #54
Findit log


Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
EBDAZ32 DLL 217,088 01-18-05 7:45p EBDAZ32.DLL
WVPUI DLL 217,088 01-18-05 7:45p wvpui.dll
3 file(s) 434,614 bytes
0 dir(s) 1,096.84 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 1,096.83 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
ebdaz32.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.dll Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

17 items found: 17 files, 0 directories.
Total of file sizes: 549,302 bytes 536.43 K

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\EBDAZ32.DLL: UMonitor
C:\WINDOWS\SYSTEM\wvpui.dll: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\MCUPDATE.EXE"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


Post #55
Lets try this:

Restart your computer.

Press the F8 key until the startup menu appears.

Choose the Command Prompt option then press Enter.

At the C:\ Do this;

CD\Windows\SYSTEM\ (tap enter key)

At C:\Windows\SYSTEM\ type in DEL wvpui.dll (tap enter key)


One other thing we can look at:

At C:\Windows\SYSTEM\ type in dir *.dll (tap enter key)

We are looking for ALL .dll files with this size 217,088
This is what I'd would do, for every one of them that are this size
217,088.

Example:

At C:\Windows\SYSTEM\ type in: REN wvpui.dll wvpui.old (tap eneter key)

see if this will work. Then post a new log.
Post #56
Followed your instructions…. I could not "del wvpui.dll" it said file not found….

I did "C:\Windows\SYSTEM\ type in: REN wvpui.dll wvpui.old"

but I did not understand what else you wanted me to do with the files at 217,088.

BUT rebooted and did a new dll compare log and …..

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

O^E says: "There were no files found :)"
________________________________________________

990 items found: 990 files, 0 directories.
Total of file sizes: 183,487,164 bytes 174.98 M

——————–End log———————

HJT log….
Logfile of HijackThis v1.99.0
Scan saved at 11:51:23 AM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll


I got some errands to do so I will be away from the computer until this p.m.
Thanks for helping me out.
Post #58
Back in business…. no pop ups as of yet.

Findit log…..

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

TBPS INI 438 01-20-05 6:50a TBPS.ini
WVPUI OLD 217,088 01-18-05 7:45p WVPUI.OLD
2 file(s) 217,526 bytes
0 dir(s) 1,109.34 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 379D-79AF
Directory of C:\WINDOWS\SYSTEM

VX0 NLS 8,192 01-19-05 6:40a VX0.NLS
VX3 NLS 8,192 01-19-05 6:40a VX3.NLS
VX3X NLS 8,192 01-19-05 6:40a VX3X.NLS
VX2X NLS 8,192 01-19-05 6:40a VX2X.NLS
VX2 NLS 8,192 01-19-05 6:40a VX2.NLS
VX1 NLS 8,192 01-19-05 6:40a VX1.NLS
VX1X NLS 8,192 01-19-05 6:40a VX1X.NLS
0 NLS 8,192 01-08-05 7:51p 0.NLS
2X NLS 8,192 01-08-05 7:51p 2X.NLS
3 NLS 8,192 01-08-05 7:50p 3.NLS
2 NLS 8,192 01-08-05 7:50p 2.NLS
3X NLS 8,192 01-08-05 7:50p 3X.NLS
1 NLS 8,192 01-08-05 7:50p 1.NLS
1X NLS 8,192 01-08-05 7:50p 1X.NLS
HPF83T23 GID 8,628 06-25-04 1:54p HPF83t23.GID
FIZ3 12,830 12-31-03 10:57a fiz3
FIZ2 30,062 12-30-03 6:15p fiz2
FIZ1 308 12-19-03 10:22a fiz1
SA3DCPL3 GID 8,628 11-26-99 2:40p sa3dcpl3.GID
19 file(s) 175,144 bytes
0 dir(s) 1,109.33 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{1A8C76C5-29FC-4E9A-8B3A-6673D0C5C074}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
tbps.ini Thu Jan 20 2005 6:50:36a ..S.R 438 0.43 K
wvpui.old Tue Jan 18 2005 7:45:02p ..S.R 217,088 212.00 K
vx1.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1x.nls Sat Jan 8 2005 7:50:46p …HR 8,192 8.00 K
vx1x.nls Wed Jan 19 2005 6:40:10a …HR 8,192 8.00 K
1.nls Sat Jan 8 2005 7:50:52p …HR 8,192 8.00 K
vx2x.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
vx2.nls Wed Jan 19 2005 6:40:14a …HR 8,192 8.00 K
3x.nls Sat Jan 8 2005 7:50:54p …HR 8,192 8.00 K
3.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
2.nls Sat Jan 8 2005 7:50:58p …HR 8,192 8.00 K
0.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
2x.nls Sat Jan 8 2005 7:51:00p …HR 8,192 8.00 K
vx3.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx3x.nls Wed Jan 19 2005 6:40:18a …HR 8,192 8.00 K
vx0.nls Wed Jan 19 2005 6:40:28a …HR 8,192 8.00 K

16 items found: 16 files, 0 directories.
Total of file sizes: 332,214 bytes 324.43 K

———— Strings.exe Qoologic Results ————


————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\WVPUI.OLD: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"OEMCLEANUP"="C:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"EnsoniqMixer"="starter.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"MCUpdateExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\MCUPDATE.EXE"
"MCAgentExe"="C:\\PROGRA~1\\MCAFEE.COM\\AGENT\\McAgent.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\MCMNHDLR.EXE\" /checktask"
"VirusScan Online"="\"C:\\PROGRA~1\\MCAFEE.COM\\VSO\\mcvsshld.exe\""
"StillImageMonitor"="C:\\WINDOWS\\SYSTEM\\STIMON.EXE"
"QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"



Post #59
Do you know what this one is?

O12 -Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll


I suggest you do this:

Run HijackThis again and put a check by these.

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete this file:

C:\WINDOWS\SYSTEM\WVPUI.OLD


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.



Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #60
Hello LD

The "o12 plugin" I think was apart of an old file that we no longer use and can be deleted.

deleted "C:\WINDOWS\SYSTEM\WVPUI.OLD" no problems with pop ups!

Logfile of HijackThis v1.99.0
Scan saved at 7:56:14 PM, on 1/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COOKIE WASHER\AOLWASHER.EXE
C:\WINDOWS\SYSTEM\SYSMONNT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.adelphia.net/index.php
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [OEMCLEANUP] C:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\McAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ccWasher] C:\Program Files\Cookie Washer\aolwasher.exe /0
O4 - HKCU\..\Run: [SYSMONNT] C:\WINDOWS\SYSTEM\SYSMONNT
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .edu/bendor/groupmem/Dongmao/List_of_reference/SERS_Biomolecules/R: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll


Do you need any of the other logs posted?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI