Where To Start?

OK Mandy, This is what I want your to do. I am also going to remove the 016 DPF files which are ActiveX Controls. If you visit any of the sites again, you will be prompted to download the control again. After we are done, you need to run your system maintenance tools, scan disk and defrag.

Open Task Manager (Ctrl, Alt, Delete at the same time) Locate, highlite and end process on these items:
BullGuard Virus Shield
BDMCon
BGNewsAgent
BullGuard Scan Server
BullGuard Communicator
BullGuard Live! Init
avast!
Make sure all BullGuard and Avast items have running process ended.

Open HijackThis and SCAN, the check the box in fron of each line item:

O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
(this does not need to be in your trusted zone)
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…290/mcfscan.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.bigfishgames.com/online/zuma/popcaploader_v5.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/…loadcontrol.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Right click on Start, then click on Explore. Find these folders and delete them. If you can't find any of them make sure you have hidden files enabled.

C:\Program Files\BullGuard\ >>> folder

C:\Program Files\Alwil Software\ >>> folder

Empty the recycle bin and restart the computer. Post a new log so I can see if we got it all.

Here is the latest scan. Please tell me what I have to do to get rid of the last of BullGuard. No! sorry, I posted too fast.

Hello Mandy, Yes you got them all. Your log is clean. Pat yourself on the back, we got off to a rocky start but you did good. The very first thing we need to do is get a firewall in place. I am going to ask you to use ZoneAlarm, it is a good firewall, I use it and later if you wish you can uninstall it and use another. When you download ZoneAlarm, allow it to RUN when it asks in the beginning do you wish to save it or run in. ZA will put the program in your C:\Programs. So you will know, a firewall blocks traffic into and out of your computer. You will have to learn how to program it by viewing the tutorial. Many programs need to get in and out because your computer will not work without them. In the beginning ZA will set a default setting so it can start keeping you safe right away. It will put a icon near your clock that looks like this: ZA in red and yellow. When traffic is moving in and out you will see the little slider moving, one side is in one is out. If you take the time to study the tutorial, you will understand how to fine tune your firewall to your specific needs. You should not be online without a firewall for any longer than necessary.
ZoneAlarm download site:
http://www.zonelabs.com/store/content/comp…reeDownload.jsp
You do not need to scan for spyware, you are clean. Choose Download Free ZoneAlarm. When ZA is installed and running, it will leave the tutorial on the desktop. You must spend a little time viewing this tutorial and when more time permits, study it so you will know it. After you close the ZA the icon in the tray near the clock can be clicked on to open it again. You will also have a shortcut on the desktop if you allow that during installation. If you choose the Overview tab the tutorial will be to the top right with a box that will tell you when updates are needed right under it.

Tutorial to help you set up and understand a firewall, after your antivirus program, this is your second most important security tool. http://www.protectedcomputer.com/settingupafirewall.htm

There are a couple of programs running at startup that you may not need. When time permits you can use http://www.google.com/ to search for information about the running programs (remember that many must run, if you stop them the computer will not work) and the information in this link will help you understand what to so about the ones you do not wish to run at startup. http://netsquirrel.com/msconfig/

Have you managed to remove the chat item you did not want in Downloaded Program Files? Remember that we removed the DPF ActiveX plugins that you were using and you would be be prompted to download the .cab files again the first time you go to the site. You did have an issue with your ActiveX setting when trying to use the free online scans. The links below will help you set those properly for maximum protection and still so you can access websites you should be able to go to. The information from Grinler will be important for this.

Now that your computer is clean of malware, I have some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online.
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

I personally consider these free programs very important to your security. When you download, always do one then wait and watch as all programs will not run on all computers. If you download several at once and you have an issue, you do not know what program may be causing it. I am going to include tutorials with the information and the download links are there also. After your antivirus and firewall programs, these are programs I believe should be used. You will see the same suggestions in the above links.
Spybot
http://www.bleepingcomputer.com/forums/tutorial43.html
Ad-aware
http://www.bleepingcomputer.com/forums/tutorial48.html
SpywareBlaster
http://www.bleepingcomputer.com/forums/tutorial49.html
SpywareGuard:
http://www.bleepingcomputer.com/forums/tutorial50.html
IE-Spyad
http://www.bleepingcomputer.com/forums/tutorial53.html

This link will stay open for a couple of days in case you have questions, If it is a securiity issue include a new log with the question. Good luck and safe surfing.
Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.

I still have a couple of problems. I cannot delete anything from the 'My Downloaded Programs' folder. When I go into Windows Explorer / Programs / My Downloaded Programs , I wanted to delete a couple of items. But when I highlight one, and either hit 'delete' or right click and 'delete', the page freezes and I have to 'alt-ctrl-del' to end task. I have 5 programs there I would like to delete and can't. One of them is AdAware SE. When I try to install this program, it tells me it is checking for previously installed components, and then it goes away, and nothing happens. If I try to delete it, it freezes the 'exploring' page. I cannot use the Start-Find feature, it freezes when I search for anything, so I can't see if AdAWare is on my computer. I think our problem is further back, when I tried to use CWShredder. I deleted it off my machine this morning, and went to unzip the download. It unzipped to file c:\unzipped\cwshredder. I double clicked on that, and it says "You have a variant of the Coolwebsearch trojan (CWS.Smartsearch.2) that has attempted to close CWShredder. To counter this, CWShredder is now starting with a random string of text in the title bar. CWShredder is still functioning fine, it has not been corrupted. If you feel you should not be getting this error and you are not infected, restart CWShredder and this warning should not appear again. OK " I clicked ok, and I got the main page of CWShredder, where it says 'scan only' 'check for update' or 'fix'. If I click 'update', it says a newer version is available. If I chose 'download and open the update, it brings up winzip. First it wants to know if I want it add it to my favorites, then it says "unzip or install from cwshredder.zip" or "update cwshredder.zip" or "create a new zip file" I don't know which one to do. If I go back to CWShredder main page, and instead of saying 'check for update' I click 'fix', it says 'close all other windows' so I did. Then it starts running a list, until it gets to the last item 'cleaning misc files' - when it freezes, and does not finish. I have to alt-ctrl-del' to end task. I let it sit for 10 - 12 minutes before I did this.

Hello Mandy, let's look at your questions.

I cannot delete anything from the 'My Downloaded Programs' folder.

Try this: Open Internet Explorer, then Tools at the top and the Internet Options. On the GeneraL tab center right click on the Settings Tab. Locate the VIEW OBJECTS and click on it. You should be able to highlite and delete from there. If you can't you have problems that are not spyware related as your log is clean. I suggest a complete system maintenance, scan disk, defrag and all.
Please remember Mandy, if the DPF is running you won't be able to delete it. That might also freeze your computer…just trying. If you have not done routine maintenance in a long while that will freeze it also. You may also have to do it in safe mode which is also the best way to run maintenance. Here is the information:
http://service1.symantec.com/SUPPORT/tsgen…src=sec_doc_nam

I have 5 programs there I would like to delete and can't. One of them is AdAware SE. When I try to install this program, it tells me it is checking for previously installed components, and then it goes away, and nothing happens. If I try to delete it, it freezes the 'exploring' page.

I will say Ad-aware is important to your system security. If you manage to get it uninstalled, I would download it again and keep it and run it often. You should be able to Uninstall programs in Add-Remove OR like in the case of Ad-aware, go to Ad-aware in your Start Programs list and click Ad-aware. There is an uninstaller right there and this may be the case for the other prgrams you wish to rid yourself of. Give me the list of programs, maybe I know something about them. Good luck, pskelley

I cannot use the Start-Find feature, it freezes when I search for anything, so I can't see if AdAWare is on my computer.

Sounds like maintenance or resource problems. How much RAM do you have on this computer. Have you considered a new one. I retired my Windows 98SE computer two years ago and use it for a backup. Places like Dell are offering new 2400's for $400.00, with good credit months to pay. Just a thought.

Hey..you are a Authentic Member now. Good luck, pskelley

When I open ie (first it gets hijacked to 'Diaryland members page) go to tools, internet options, settings, view objects I get 7 icons. 1 - {31564D57-0000- … 2 - Java Runtime Environment 1.4.2 3 - Java Runtime Environment 1.4.2 4 - QuickTime Object (just showed up a few days ago) 5 - Shockwave ActiveX Control 6 - Shockwave Flash Object 7 - Update Class no programs that I want to delete.

OK, Mandy, We have gotten way off of malware issues which is technically all I am supposted to help you with. I will make this my last post and give you a link to where you can ask these Windows 98SE questions. It is not important if you have a Dell or not, the folks at this forum answer all questions about Windows 98SE, here is that link, join free and ask away.
http://forums.us.dell.com/supportforums/bo…ard.id=sw_win98

I will finish with advice for these last questions:

When I open ie (first it gets hijacked to 'Diaryland members page)

Go to IE > Tools > Internet Options > General Tab. At the top you can set any home page you want. I have found the easiest way it to type the home page in the search line of IE first to get to the page you want, then while that page is displayed, open IE to the General Tab and click on Use Current. That will set your home page to the one currectly displayed on IE.

1 - {31564D57-0000- …
2 - Java Runtime Environment 1.4.2
3 - Java Runtime Environment 1.4.2
4 - QuickTime Object (just showed up a few days ago)
5 - Shockwave ActiveX Control
6 - Shockwave Flash Object
7 - Update Class


1) not enough information
2/3) leave it alone, many featurs depend on this Java item and will not function without it.
4) Uninstall QuickTime viewer if you do not wish to use it, either via the uninstaller in Start, Programs, QuickTime Player (or whatever) or Add Remove Programs.
5/6) leave it alone, many games and other functions will not work without this.
7) not enough information

Good luck…pskelley

My homepage is set to my website. Even though that is typed in there, it is being redirected to www.diaryland.com. I gave you the details of what happens when I use cwshredder, which clearly says I have a version of the coolwebsearch trojan on my machine. I will copy it here again. I think our problem is further back, when I tried to use CWShredder. I deleted it off my machine this morning, and went to unzip the download. It unzipped to file c:\unzipped\cwshredder. I double clicked on that, and it says "You have a variant of the Coolwebsearch trojan (CWS.Smartsearch.2) that has attempted to close CWShredder. To counter this, CWShredder is now starting with a random string of text in the title bar. CWShredder is still functioning fine, it has not been corrupted. If you feel you should not be getting this error and you are not infected, restart CWShredder and this warning should not appear again. OK " I clicked ok, and I got the main page of CWShredder, where it says 'scan only' 'check for update' or 'fix'. If I click 'update', it says a newer version is available. If I chose 'download and open the update, it brings up winzip. First it wants to know if I want it add it to my favorites, then it says "unzip or install from cwshredder.zip" or "update cwshredder.zip" or "create a new zip file" I don't know which one to do. If I go back to CWShredder main page, and instead of saying 'check for update' I click 'fix', it says 'close all other windows' so I did. Then it starts running a list, until it gets to the last item 'cleaning misc files' - when it freezes, and does not finish. I have to alt-ctrl-del' to end task. I let it sit for 10 - 12 minutes before I did this. Maybe if you explain how to use cwshredder, I can get further.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.