What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Old, Sick Computer

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have never posted anything on a forum, I hope I am doing this right.

I have tried to fix various problems on my dad's computer and HijackThis has been VERY helpful.

It has been 2 months since I last visited my dad and his computer is a mess. Even the McAfee spyware software I installed seems to be missing.

I am especially concerned about the DMHHGGA.DLL "filter".

I do not know where to start. Here is the current log:


Logfile of HijackThis v1.99.0
Scan saved at 10:34:45 PM, on 02/26/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\STANS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = winipcfg
O2 - BHO: (no name) - {CEC2B084-58B9-11D9-BD0D-0010516C4C6D} - C:\WINDOWS\SYSTEM\DMHHGGA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\cmd32.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Windows Shell Library Loader] checking shell32.dll /c /set
O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\SYSTEM\systime.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [windllsys32.exe] C:\WINDOWS\SYSTEM\windllsys32.exe
O4 - HKCU\..\Run: [romahere3] C:\WINDOWS\SYSTEM\J1GY7PCZLLD.EXE
O4 - HKCU\..\Run: [Obvbet] C:\WINDOWS\SYSTEM\xbfc.exe
O4 - HKCU\..\Run: [SysTime] C:\WINDOWS\SYSTEM\systime.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Aole] C:\WINDOWS\Application Data\ecri.exe
O4 - HKCU\..\Run: [Xbcmkk] C:\WINDOWS\SYSTEM\cve.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Download File - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\highlight.htm
O8 - Extra context menu item: Zoom &In - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomout.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O12 - Plugin for .com/VGApp/hnw/ImageGenerator?stmtIndexNum=2&outputType=4: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppdf32.dll
O12 - Plugin for .bat: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .scr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll
O12 - Plugin for .mov: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npqtplugin.dll
O12 - Plugin for .rm: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npra32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: WWW.STANSBERRYRESEARCH.COM
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,7…pdatePortal.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…416/mcfscan.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O18 - Filter: text/html - {CEC2B083-58B9-11D9-BD0D-0010DE85D419} - C:\WINDOWS\SYSTEM\DMHHGGA.DLL
O18 - Filter: text/plain - {CEC2B083-58B9-11D9-BD0D-0010DE85D419} - C:\WINDOWS\SYSTEM\DMHHGGA.DLL
Post #2
Hello bigduck and welcome to TomCoyote. :wavey:

Download FxAgentB.exe from HERE and save it to your desktop. After downloading, double-click the FxAgentB file to run it and the program will scan your entire hard drive - this may take a while. When it is done, it will generate a log file called FxAgentB.log - save that information as you will need to paste it here later. Reboot when done.

Next click HERE to download CWShredder and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 2.13. Reboot when done.

Then click HERE to download Ad-Aware SE and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Click "Start", select "Perform Full System scan" and "Next" to start the scan. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?". Reboot when done.

Please update to HijackThis 1.99.1. (Open HijackThis and click config.. < Misc. Tools and click Check for Update Online.)
Scan with HijackThis and post a new log here, together with the FxAgentB log.
Post #3
Sorry for the delay. This is my dad's computer and I have not visited for a while.

FxAgentB.log:

Symantec Backdoor.Agent.B Removal Tool 1.0.1.2

hidden viral process: fffe19ab (terminated)
process: MSTASK.EXE, thread: FFFDD21B (terminated)
process: EXPLORER.EXE, thread: FFFE97A3 (terminated)
process: TASKMON.EXE, thread: FFFDAF0B (terminated)
process: QTTASK.EXE, thread: FFFDAB17 (terminated)
process: MCAGENT.EXE, thread: FFFD83D7 (terminated)
process: LOADQM.EXE, thread: FFFDBDBF (terminated)
process: WZQKPICK.EXE, thread: FFC27AEF (terminated)
process: DDHELP.EXE, thread: FFC2E2A3 (terminated)
process: FXAGENTB.EXE, thread: FFC23057 (terminated)

registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce: *cdo (restored)

c:\WINDOWS\SYSTEM\LOGKKG.DLL: (will be deleted on next reboot)

The Backdoor.Agent.B removal was successful.
The system will delete 1 Backdoor.Agent.B files from your PC on next reboot.

Here is the report:

1 file(s) could not be deleted.
They will be deleted on next reboot.

The total number of the scanned files: 29970
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral threads terminated: 9
The number of registry entries fixed: 1

The tool initiated a system reboot.



Current HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:43:43 PM, on 03/12/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\STANS\SPYSUB.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\STANS\HIJACKTHIS2\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = winipcfg
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\cmd32.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\SYSTEM\systime.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [windllsys32.exe] C:\WINDOWS\SYSTEM\windllsys32.exe
O4 - HKCU\..\Run: [romahere3] C:\WINDOWS\SYSTEM\J1GY7PCZLLD.EXE
O4 - HKCU\..\Run: [Obvbet] C:\WINDOWS\SYSTEM\xbfc.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Aole] C:\WINDOWS\Application Data\ecri.exe
O4 - HKCU\..\Run: [Xbcmkk] C:\WINDOWS\SYSTEM\cve.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: SpySubtract.lnk = C:\Stans\SpySub.exe
O8 - Extra context menu item: &Download File - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\highlight.htm
O8 - Extra context menu item: Zoom &In - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomout.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O12 - Plugin for .com/VGApp/hnw/ImageGenerator?stmtIndexNum=2&outputType=4: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppdf32.dll
O12 - Plugin for .bat: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .scr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll
O12 - Plugin for .mov: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npqtplugin.dll
O12 - Plugin for .rm: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npra32.dll
O15 - Trusted Zone: WWW.STANSBERRYRESEARCH.COM
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,7…pdatePortal.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…416/mcfscan.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #4
Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\cmd32.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\SYSTEM\systime.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKCU\..\Run: [windllsys32.exe] C:\WINDOWS\SYSTEM\windllsys32.exe
O4 - HKCU\..\Run: [romahere3] C:\WINDOWS\SYSTEM\J1GY7PCZLLD.EXE
O4 - HKCU\..\Run: [Obvbet] C:\WINDOWS\SYSTEM\xbfc.exe
O4 - HKCU\..\Run: [Aole] C:\WINDOWS\Application Data\ecri.exe
O4 - HKCU\..\Run: [Xbcmkk] C:\WINDOWS\SYSTEM\cve.exe

O15 - Trusted Zone: WWW.STANSBERRYRESEARCH.COM << Remove if you did not add to the Trusted Zone.

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

* Double-click the My Computer icon on the Windows desktop.
* Click Folder Options. Select the View Tab.
* In the Advanced Settings box, under the "Hidden files" folder, click "Show all files".
* On the View tab, uncheck the "Hide file extensions for known file types" option.
* Click Yes to confirm. Click OK.

You will need to reverse this process when all steps are done.


Step 3
Please delete the following files:

C:\WINDOWS\SYSTEM\cmd32.exe
C:\WINDOWS\SYSTEM\systime.exe
C:\WINDOWS\SYSTEM\tibs3.exe
C:\WINDOWS\SYSTEM\windllsys32.exe
C:\WINDOWS\SYSTEM\J1GY7PCZLLD.EXE
C:\WINDOWS\SYSTEM\xbfc.exe
C:\WINDOWS\Application Data\ecri.exe
C:\WINDOWS\SYSTEM\cve.exe
C:\WINDOWS\TEMP\sp.dll

If you have any problem deleting these files, reboot into Safe Mode and try again.
* Restart the computer.
* As the computer restarts, press and hold down the F8 key until the Windows 98 startup menu appears.
* Choose Safe mode from the startup menu, and then press Enter. Windows starts in Safe mode.


Step 4
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications and how the computer is behaving.
Post #5
I had already enabled "Show all files" and deleted most (but not all) of the listed files. STANSBERRY… is a trusted site. The computer has been running better. My dad sprung for a new computer so I am in the process of setting it up and transferring the required files. I wanted to get this one clean so that I would not inadvertantly infect the new one. We will be running a whole suite of tools on the new computer.

Here is the latest HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 7:11:07 PM, on 03/19/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\STANS\SPYSUB.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\STANS\HIJACKTHIS2\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = winipcfg
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: SpySubtract.lnk = C:\Stans\SpySub.exe
O8 - Extra context menu item: &Download File - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\AddToTransferQueue.htm
O8 - Extra context menu item: &Highlight - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\highlight.htm
O8 - Extra context menu item: Zoom &In - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\PROGRAM FILES\WINFERNO\SECURE IE\Scripts\zoomout.htm
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\PROGRAM FILES\MARKETBROWSER\LMT\MarketBrowser_Launch.xpy
O12 - Plugin for .com/VGApp/hnw/ImageGenerator?stmtIndexNum=2&outputType=4: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppdf32.dll
O12 - Plugin for .bat: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .scr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll
O12 - Plugin for .mov: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npqtplugin.dll
O12 - Plugin for .rm: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npra32.dll
O15 - Trusted Zone: WWW.STANSBERRYRESEARCH.COM
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,7…pdatePortal.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…416/mcfscan.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
Post #6
Your new log is clean.:)


Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\Every username\Local Settings\Temp\
Also delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.


Now that everything is fixed, I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - Safer alternative to the Internet Explorer web browser.

AVG AntiVirus - Free antivirus program if you currently are not using one.
ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #7
As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link: (Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI