What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Nasty Toolbars How Do I Get Rid Of Them?

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've been invaded by all sorts of spyware/ ads etc and having used Spybot S&D and CW Shredder seem to have gotrid of a lot.

However, I still have a blue bar at bottom every time I go on-line. I can get rid of it with Shredder, but thi is so annoying. At the top I have two "extra" tool bars - one in Spanish called "Mi Busqueda" and another which just says search and changes according to what I am looking at.
When I start up the computer I get a message saying something about Rundll file - this I close up and it doesn't give me any more problems.

I'm so useless with pcs yet I can't live without mine. please help.
I ran the Hi-jack program and this is the result:

Logfile of HijackThis v1.99.1
Scan saved at 16:37:13, on 28/02/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\MSTASK.EXE
C:\ARCHIVOS DE PROGRAMA\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\AMON.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\NOD32CC.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ESET\POP3SCAN.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\DDHELP.EXE
C:\WIN98\ESCRITORIO\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mkkcadmwxfjbkssrkrlhwx.com/BIDy…VgTAyWNIfc.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\ARCHIVOS DE PROGRAMA\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\ARCHIVOS DE PROGRAMA\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Amon] "C:\ARCHIVOS DE PROGRAMA\ESET\AMON.EXE"
O4 - HKLM\..\Run: [Nod32CC] "C:\Archivos de programa\Eset\nod32cc.exe" -DONTSHOW
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\ARCHIV~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [NOD32POP3] "C:\ARCHIVOS DE PROGRAMA\ESET\POP3SCAN.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\way okay.exe
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe
O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Software - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\pillasoft-com\index.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe

Is this what I'm supposed to do??

Help please.

Di
Post #2
Hello dianelt and welcome to TomCoyote. :wavey:

MessengerPlus 3 - third party MSN Messenger extension that adds a number of useful features. It also bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that "sponsor program"!

This is the cause for some of your problems. It is optional but I strongly recommend that you go to Add/Remove Programs and remove Messenger Plus 3. After the computer is cleaned you can install it again without the sponsor program.


You are running MyWebSearch (or MyBar). This is not technically malware, but it is thought to be bad by many experts and it will bring malware with it. There are safer alternatives available such as the Google toolbar. I recommend that you remove it with Add/Remove Programs.
Look for any of these in Add/Remove Programs to remove MyWebSearch.
My Search Bar
MyWay Speed Bar
My Web Search Bar


Scan with HijackThis. Post the new log as a reply to this thread.
Post #3
Thanks Alan
I've done as you told me and these are the results:
Logfile of HijackThis v1.99.1
Scan saved at 2:08:32, on 07/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\HPZIPM12.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.beudppzbolpogzkblzdxixtwf.net/B…8VgTAyWNIfc.jpg
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\ARCHIV~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\way okay.exe
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe
O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: Software - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\pillasoft-com\index.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab

Found and deleted My Search Bar, but still got Two more I don't want.

Thanks again for all your help - much appreciated

Di
Post #4
Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.beudppzbolpogzkblzdxixtwf.net/B…8VgTAyWNIfc.jpg
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)

O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE

O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\way okay.exe
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe

O9 - Extra button: Software - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\pillasoft-com\index.html

O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe

Optional items to check with HijackThis for improved performance.
Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required anyway.
O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

* Double-click My Computer.
* Click the Tools menu, and then click Folder Options.
* Click the View tab.
* Clear "Hide file extensions for known file types."
* Under the "Hidden files" folder, select "Show hidden files and folders."
* Clear "Hide protected operating system files."
* Click Apply, and then click OK.


Step 3
Please delete the following files/folders:

C:\WIN98\Application Data\Peakantisecondenc
C:\WIN98\Application Data\CDROMM~1 << Folder with name starting with CDROMM


Step 4
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications and how the computer is behaving.
Post #5
Alan you're a dream! Dunno how I can ever thank you enough! NASTY TOOLBARS GONE!!

I did as I was told . Only one thing: The first item on the list to be deleted didn't coincide with what the file showed, but was similar. So I have deleted HKCU\Software\Microsoft\Internet Explorer\\Main,Search Bar = http://www.afgoxduyduviyljlice.net…(couldn't see the rest) instead of …..www.beuppzbolpogzkblzxixwf.net….. Hope I did right.

Oh one more thing. As I was deleting MessengerPlus3 last night a Trojan Horse warning appeared on the screen, amd before I could decide what action to take it disappeared - has it been removed???

Now I've just run another scan and here are the results:
Logfile of HijackThis v1.99.1
Scan saved at 12:52:36, on 07/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\HPZIPM12.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\ARCHIV~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab

You've done a wonderful job, and if I could, I'd take you out for a drink tonight!
As I can't, I'll make a donation, and I'll be back to let you know how my pc is responding.

Thanks a million

Di
Post #6
Your new log is clean.:)

The first item on the list to be deleted didn't coincide with what the file showed, but was similar. So I have deleted HKCU\Software\Microsoft\Internet Explorer\\Main,Search Bar = http://www.afgoxduyduviyljlice.net…(couldn't see the rest) instead of …..www.beuppzbolpogzkblzxixwf.net….. Hope I did right.

You did great. These were all part of a LOP infection.

Now that everything is fixed, I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - Safer alternative to the Internet Explorer web browser.

ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #7
Help Alan!!!! The Toolbars are back!! My pc is going slow!! Last night it decided to switch itself off completely while I was connected, and I had to start all over again. I've got Zone Alarm, Spyblaster (though I'm not sure how to use it), AVG, Ad-se Personal and Spybots&d all installed and I run them more frequently than normal. If nothing came up in the log , then what is wrong? Where is the nasty nuisance hiding? Oh dear! And just when I thought everything was perfect…. Sorry to be such a pain, but please help me Di
Post #8
Please post a new HijackThis log. For Spyware Blaster, once it has been downloaded and installed click "enable all protection". Then all you need to do is check for updates occasionally. It runs in the background blocking known bad ActiveX entries and Cookies.
Post #9
Thanks Alan!

Got Spyblaster all enabled, and I just did another HijackThhis log with these results:

Logfile of HijackThis v1.99.1
Scan saved at 16:45:50, on 10/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\HPZIPM12.EXE
C:\WIN98\SYSTEM\PSTORES.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vslhidggmnaxk.net/BIDyR8Z8dbTxJ…MVgTAyWNIfc.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\ARCHIV~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\Upload balm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab

Hope there's something there I can remove!

Di
Post #10 last edited
LOP's back. :rant2:

Let's try a new approach.

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vslhidggmnaxk.net/BIDyR8Z8dbTxJ…MVgTAyWNIfc.php

O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE

O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\Upload balm.exe
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

* Double-click My Computer.
* Click the Tools menu, and then click Folder Options.
* Click the View tab.
* Clear "Hide file extensions for known file types."
* Under the "Hidden files" folder, select "Show hidden files and folders."
* Clear "Hide protected operating system files."
* Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 3
Please delete the following folders:

C:\WIN98\APPLICATION DATA\SCRFORD
C:\WIN98\Application Data\Peakantisecondenc
C:\WIN98\APPLICATION DATA\CDROMM~1 << Whole folder with name starting with CDROMM

If you have any problem deleting these files, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 4
Please reinstall MessengerPlus 3 with sponsers then reboot the computer. http://www.msgplus.net/download.php


Step 5
1. Go to Add/Remove programs. Double click on "Messenger Plus!" (or click on Remove)

2. The "Messenger Plus! - Setup" is now displayed. Click on the Uninstall button. Note: options displayed on the first screen are not related to the sponsor program.

3. The sponsor screen is now displayed (if you don't see it, search for it in your Task Bar). To prove that someone is currently reading the screen, you have to type the code that is displayed. Once you enter the code, press Uninstall.

4. If you entered the code properly, the program will ask you to confirm that you want to uninstall. You must answer "Yes" to this question, else, you won't have another chance of uninstalling.

5. To complete the uninstallation, follow the instructions that are displayed (the first one is to close all your Internet Explorer windows, that's very important). When everything is complete, restart your computer and, hopefully voila one nasty infection is gone.


Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications and how the computer is behaving.
Post #11
Hi Alan!

I've followed all your instructions, with one or two hiccups that I'd like to consult:

- I couldn't delete HKCU\software\Internet……..www.vslhidggmnaxk.net……
nor any file which said CDROMM as they weren't there (well, at least, I couldn't find them

- During my search I found loads of Temporary Internet files beginning fff…… fff99e4f for example, can I eliminate all these?

- Can I also delete RUNDLL. EXE? is this connected with wild tangent? or could it belong to something else

- I reinstalled messenger plus, but don't know if I've deleted it again correctly as I had to copy a series of numbers to prove I was human (!!) and each time I did, it said I had got it wrong :( I can assure you I hadn?t!

- why was your last post edited????


You said to reverse the process set out in step one. This I haven't done, partly because I didn't know exactly when and secondly cos I didn't actually change anything as it was already like that (probably from your last set of instructions).

So after all that, I did another HiJack this, and here are the results:

Logfile of HijackThis v1.99.1
Scan saved at 16:29:01, on 14/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.luwbbomleuvcmwl.com/BIDyR8Z8dbT…sVgTAyWNIfc.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WIN98\command.com /C "C:\WIN98\TEMP\MsgPlusUninst.bat"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab

Thanks Alan again, and again
Why am I such a numbskull???

Di
Post #12

- I couldn't delete HKCU\software\Internet……..www.vslhidggmnaxk.net……
nor any file which said CDROMM as they weren't there (well, at least, I couldn't find them

Note that the first line will change names but can be spotted by the random characters that it uses. The CDROMM is a folder that needs removed.

- During my search I found loads of Temporary Internet files beginning fff…… fff99e4f for example, can I eliminate all these?

All files in the Temporary Internet Files are safe to remove. I added this step to the fix.

- Can I also delete RUNDLL.EXE? is this connected with wild tangent? or could it belong to something else

Do not remove that file. It is a valid system file. You can read about it here.

- I reinstalled messenger plus, but don't know if I've deleted it again correctly as I had to copy a series of numbers to prove I was human (!!) and each time I did, it said I had got it wrong sad.gif I can assure you I hadn?t!

The malware makers try to make their stuff as hard to remove as possible. :rant2:

- why was your last post edited????

Not sure as it's been several days. I usually preview my posts to make sure that everything is correct before posting. I must have missed something in the coding (bold, color, etc.) this time so it was edited to fix.

Please let me know if you have more than one user account on your computer. They may be cross polluting each other causing this pest to come back.


Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.luwbbomleuvcmwl.com/BIDyR8Z8dbT…sVgTAyWNIfc.htm << Note this line may change but will always be random characters.

O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WIN98\command.com /C "C:\WIN98\TEMP\MsgPlusUninst.bat"
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

* Double-click the My Computer icon on the Windows desktop.
* Click Folder Options. Select the View Tab.
* In the Advanced Settings box, under the "Hidden files" folder, click "Show all files".
* On the View tab, uncheck the "Hide file extensions for known file types" option.
* Click Yes to confirm. Click OK.


Step 3
Please delete the following files/folders:

C:\Archivos de programa\Messenger Plus! 3 << This Folder may not exist
C:\WIN98\APPLICATION DATA\CDROMM~1 << Whole Folder with name beginning with CDROMM


Step 4
Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\Every username\Local Settings\Temp\
Also delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications and how the computer is behaving.
Post #13
Hi Alan

Help! Please! My daughter's been at it again, and I'm back to square one :( .

I've been trying all morning to get things back as they were, using your earlier instructions, but I can't delete Scrford folder as it says Windows is using it, and the Peakantisecondenc folder says I'm deleting something that belongs to the system.
So rather than mess things up even more, I've done another HijackThis scan, hoping you will put me straught for the nth time.
Here goes:

Logfile of HijackThis v1.99.1
Scan saved at 12:45:22, on 25/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\DDHELP.EXE
C:\WIN98\ESCRITORIO\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pelelbvbebnwyoqhqm.com/BIDyR8Z8…VgTAyWNIfc.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\64 skip.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab


Thanks Alan, really, THANKS. :)
Di
Post #14
Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pelelbvbebnwyoqhqm.com/BIDyR8Z8…VgTAyWNIfc.html << Note this line may change but will always be random characters.

O2 - BHO: (no name) - {1904BEF7-5F60-A584-8CA7-A27E993CACB2} - C:\WIN98\APPLICATION DATA\SCRFORD\JUGSGREY.EXE
O4 - HKLM\..\Run: [secondencsavesetup] C:\WIN98\Application Data\Peakantisecondenc\64 skip.exe
O4 - HKCU\..\Run: [Bat Curb] C:\WIN98\APPLIC~1\CDROMM~1\bolt for cake.exe

With all other programs and browsers closed, click fix checked.


Step 2
Please set your computer to show all files.

* Double-click the My Computer icon on the Windows desktop.
* Click Folder Options. Select the View Tab.
* In the Advanced Settings box, under the "Hidden files" folder, click "Show all files".
* On the View tab, uncheck the "Hide file extensions for known file types" option.
* Click Yes to confirm. Click OK.


Step 3
Reboot the computer into Safe Mode

* Restart the computer.
* As the computer restarts, press and hold down the F8 key until the Windows 98/ME startup menu appears.
* Choose Safe mode from the startup menu, and then press Enter. Windows starts in Safe mode.


Step 4
Please delete the following folders:

C:\WIN98\APPLICATION DATA\SCRFORD
C:\WIN98\Application Data\Peakantisecondenc
C:\WIN98\APPLICATION DATA\CDROMM~1 << Whole Folder with name beginning with CDROMM


Step 5
Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\Every username\Local Settings\Temp\
Also delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.


Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Please post a log from every user account on the computer so I can see if they are reinfecting each other.
Post #15
Hi Alan

I'm here again with all my problems and doubts,having followed your instructions as far as I can and ready to post new log. But can I ask you a few questions first please?

1. I can't reboot in safe mode :( I press F8 and keep it pressed but no. Tried several times. Could it be cos I've got Grisoft installed to scan?

2. When I run Spybot it always finds DSO Exploit and try as I may I cannot remove it. it says its in the folder Hkey_Users\default\software\Microsft\Windows which I also tried to remove (can I? should I? or is it basic to the system??) and failed to do so.

3. In Add/Remove Programmes I can see "Wild Tangent Web Driver" Shoulld I remove this or is it now spyware?

4. Whenever I try to do things on my pc, like simply opening other programmes the colours change and flash. Why might this be?

5. Finally here is the latest log. When I start up I don't go into any special user account, though I can see "close session 1" about the start button. Could this be another user account? Otherwise there is only one on here - we all use the same one.

Logfile of HijackThis v1.99.1
Scan saved at 12:29:15, on 28/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WIN98\SYSTEM\KERNEL32.DLL
C:\WIN98\SYSTEM\MSGSRV32.EXE
C:\WIN98\SYSTEM\MPREXE.EXE
C:\WIN98\SYSTEM\mmtask.tsk
C:\WIN98\SYSTEM\MSTASK.EXE
C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE
C:\ARCHIVOS DE PROGRAMA\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WIN98\EXPLORER.EXE
C:\WIN98\SYSTEM\HIDSERV.EXE
C:\WIN98\TASKMON.EXE
C:\WIN98\SYSTEM\SYSTRAY.EXE
C:\WIN98\LOADQM.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\ITOUCH.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WIN98\SYSTEM\LVCOMS.EXE
C:\WIN98\SYSTEM\STIMON.EXE
C:\ARCHIVOS DE PROGRAMA\HP\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\ARCHIVOS DE PROGRAMA\ACD SYSTEMS\DEVDETECT\DEVDETECT.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGCC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGEMC.EXE
C:\ARCHIVOS DE PROGRAMA\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\ARCHIVOS DE PROGRAMA\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\ARCHIVOS DE PROGRAMA\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE
C:\ARCHIVOS DE PROGRAMA\WLAN\GCONFIG\GCONFIG.EXE
C:\WIN98\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\LOGITECH\ITOUCH\KBDTRAY.EXE
C:\WIN98\SYSTEM\SPOOL32.EXE
C:\WIN98\SYSTEM\DDHELP.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\ACCESORIOS\WORDPAD.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.262.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.es/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WIN98\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_16_0.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WIN98\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WIN98\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Archivos de programa\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\ARCHIV~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Alogserv] C:\Archivos de programa\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WIN98\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [LVComs] C:\WIN98\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WIN98\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [KAZAA] C:\WIN98\ESCRITORIO\SARA\KAZAA.EXE /SYSTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\WIN98\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Camera Detector] C:\ARCHIV~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARCHIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Archivos de programa\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WIN98\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [DkService] C:\Archivos de programa\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\RunServices: [Yahoo! Pager] C:\ARCHIV~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - Startup: HP Digital Imaging Monitor.lnk = C:\Archivos de programa\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Startup: GConfig.lnk = C:\Archivos de programa\WLAN\GConfig\GConfig.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\ARCHIVOS DE PROGRAMA\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…ter/install.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/clients/y/bt1_x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab27571.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst_current.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://213.96.242.94/activex/AxisCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/clients/y/tt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab

Thanks once again

Di

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI