What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Redirected Host

91 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
erniemarinukjr .

Lets try the following

Please download hoster from the link below.

http://members.aol.com/toadbee/hoster.zip

Unzip Hoster.zip
Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.




Download DllCompare.
http://www.bleepingcomputer.com/files/dllcompare.php

Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

Then run the findit program and post a new log

Also "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
Post #17
* DLLCompare Log version(1.0.0.125) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found :)" ________________________________________________ ——————–End log——————— Sorry I was unable to get anything to work… (unsure of where to start [Windows\windowsSystem32] <– I typed that in the field then clicked RUN Locate.com Also tried… [WindowsSystem32] <– that didn't work either. I didn't run a Fixit log since I was unable to get the last task completed… Need detailed directions to complete this last task. Nothing was present when I ran Hoster.zip Thanks -> Right now I'm having problems viewing anything here with AOL, I had to start Internet Explorer to be able to view this site. Error page when linking to this site with AOL = <– box shows up web page not available etc… With directions on Detecting Network etc… Sorry :(
Post #18
Yes I downloaded V2X, and it found NOTHING… Sorry I forgot to include that info, and yes the findit.log I last posted was after I ran the V2X program…
Post #19
It looks like your DLL Compare found nothing.

Hoster doesn't scan your system, it just resets your hosts files.

Download the Killbox program from here, you may have to scroll through the entries, it is towards the bottom of this site. Download it to your desktop, but don't run it yet, as soon as you have it downloaded, post back and we will start the process of deleteing some bad entries.

http://www.malwareremoval.com/downloads.html

With your next post, post a new Findit log and a new HJT log please.
Post #20
:thumbup: Download the Killbox program from here, DONE! Download it to your desktop, OK! but don't run it yet, as soon as you have it downloaded, post back and we will start the process of deleteing some bad entries. I had a problem with Ad-Aware, I've downloaded it again just in case. Thanks. Ernie
Post #21 last edited
Ernie,

Here is a turtorial on using Killbox.
http://forum.malwareremoval.com/viewtopic.php?t=320

You want to use the option REPLACE ON REBOOT I suggest you read it and get a little familiar with how it works. Unfortunatlly, we have over a 100 files that have to be entered into Killbox, and they have to be entered one at a time. You can't shut off your compurter or reboot until all the files are entered or they will all just come back. So yor need to pick a time when you have an hour or so and will not be disturbed so you can concentrate on what your doing. After you open Killbox, choose the REPLACE ON REBOOT OPTION, then at the top window for FILES TO ADD scroll to C:\WINDOWS\SYSTEM\ make sure that there is a forward slash after SYSTEM\. Then you need to copy and paste the files in one at a time like this

EXAMPLE C:\WINDOWS\SYSTEM\pcpwprop.dll <—This file is pasted in from the list

Then put a checkmark in the DUMMY FILE OPTION and click on the RED X. Do not reboot until all the files are entered.

What I would suggest doing is to copy and paste all the files in Notepad, then you CUT and PASTE as you go to keep up with what has been enterend and also because you need to disconnect from the internet and close all windows except Killbox and Notepad.

Take your time, make sure you don't miss any files and after the last file has been entered, click on the reboot option.

When your done, run Findit and HJT and post new logs please.




Files to delete

pcpwprop.dll
jlsd400.dll
wd32dll.dll
one32.dll
mlscmc32.dll

fptls432.dll
drskcopy.dll
cwfview.dll
ccm.dll
mpxtrk.dll

mfvcp50.dll
wr5inf16.dll
llprxy.dll
aomui.dll
lngmgr.dll
dgusic.dll
jceg1x32.dll
oy30.dll
moi.dll
dzcxatm.dll
iyvideo.dll
stlsrv32.dll
dho350.dll
mlvidctl.dll
mwvidctl.dll
oyecnv32.dll

czetcfg.dll
oxesvr.dll
dnnlobby.dll
dbskcopy.dll
taolhelp.dll
ozgfs400.dll
vs5stkit.dll
oqbc32.dll
svlwapi.dll
mgtcp.dll
dyvmgr32.dll
crdial32.dll
tpinin~1.dll
iosetup.dll
skrobj.dll
mhxbse35.dll
vh40016.dll
dxdim.dll
dmnmpntw.dll
cdgwiz.dll
rqcltc1.dll
vuhelper.dll
hsfsui08.dll
mardo20.dll
wqvdmod.dll
wmock32.dll
gpouppol.dll
mfrating.dll
nktos.dll
moc70.dll
mpstery.dll
anmwprox.dll
vfrsion.dll
tb2032.dll
wrsdmod.dll
cum.dll Fri
wistream.dll
djcxatm.dll
idsetup.dll
igrop.dll
innpstub.dll
sekit416.dll
ujdm32.dll
nrtos.dll
ixloader.dll
uxer32.dll
jlpl400.dll
edysh7.dll
rvcmqsvr.dll
wylp32t.dll
mpxml3.dll
kwmmctrl.dll
nyswan32.dll
danmpntw.dll
tvolhelp.dll
rdched.dll
dvcxatm.dll
mivcp50.dll
cnreak.dll
mqvbvm60.dll
msg200~1.dll
hnfdos08.dll
sptupx.dll
xwilexr.dll
dotmla~1.dll
mjxtrk.dll
sicdll.dll
cyyptext.dll
mhc30.dll
mlpi32x.dll
cnmctl32.dll
mrg_hook.dll
mujeto~1.dll
qiauto.dll
iuet16.dll
meieftp.dll
decvr.dll
qrgr.dll
pdpndi.dll
svace.dll
nitos.dll
iafrared.dll
wptsecur.dll
igetwh32.dll
rmclts5.dll
driman32.dll
cgmmdlg.dll
lmprxy.dll
jxpl400.dll
nwwmsdrm.dll
lgp.dll
ibsetup.dll
mtdocs.dll
dcnlobby.dll
hifrdb08.dll
igloader.dll
Post #22
B)

I completed the killbox list & re-booted, here's the findit.log & hijackthis.log…

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

SVDOCLC DLL 227,104 03-18-05 4:22a SVDOCLC.DLL
HTFPML08 DLL 227,104 03-18-05 4:22a HTFPML08.DLL
PCPWPROP DLL 227,104 03-09-05 1:24a PCPWPROP.DLL
FPTLS432 DLL 227,104 03-09-05 1:24a FPTLS432.DLL
DRSKCOPY DLL 227,104 03-09-05 1:24a DRSKCOPY.DLL
MPXTRK DLL 227,104 03-09-05 1:24a mpxtrk.dll
MFVCP50 DLL 227,104 03-09-05 1:24a MFVCP50.DLL
WR5INF16 DLL 227,104 03-09-05 1:24a WR5INF16.DLL
AOMUI DLL 227,104 03-09-05 1:24a AOMUI.DLL
LNGMGR DLL 227,104 03-09-05 1:24a lngmgr.dll
DGUSIC DLL 227,104 03-09-05 1:24a DGUSIC.DLL
JCEG1X32 DLL 227,104 03-09-05 1:24a JCEG1X32.DLL
AZYCFILT DLL 227,104 03-09-05 1:24a AZYCFILT.DLL
FKSRCH DLL 227,104 03-09-05 1:24a FKSRCH.DLL
OY30 DLL 227,104 03-09-05 1:24a OY30.DLL
AYFSIPC DLL 227,104 03-09-05 1:24a ayfsipc.dll
JADW400 DLL 227,104 03-09-05 1:24a JADW400.DLL
MOAWT DLL 227,104 03-09-05 1:24a MOAWT.DLL
MSXPERF DLL 227,104 03-09-05 1:24a msxperf.dll
DZCXATM DLL 227,104 03-09-05 1:24a dzcxatm.dll
ISETWH32 DLL 227,104 03-09-05 1:24a Isetwh32.dll
DBDIM DLL 227,104 03-09-05 1:24a DBDIM.DLL
DDNADDR DLL 227,104 03-09-05 1:24a DDNADDR.DLL
SPROBJ DLL 227,104 03-09-05 1:24a SPROBJ.DLL
IMSETUP DLL 227,104 03-09-05 1:24a IMSETUP.DLL
DBSKCOPY DLL 227,104 03-09-05 1:24a DBSKCOPY.DLL
TAOLHELP DLL 227,104 03-09-05 1:24a TAOLHELP.DLL
TPININ~1 DLL 227,104 03-09-05 1:24a tpinInstTSX113ez.dll
WPTSECUR DLL 227,104 03-09-05 1:24a WPTSECUR.DLL
IGETWH32 DLL 227,104 03-09-05 1:24a Igetwh32.dll
RMCLTS5 DLL 227,104 03-09-05 1:24a RmCLTS5.DLL
DRIMAN32 DLL 227,104 03-09-05 1:24a DRIMAN32.DLL
CGMMDLG DLL 227,104 03-09-05 1:24a CGMMDLG.DLL
LMPRXY DLL 227,104 03-09-05 1:24a LMPRXY.DLL
JXPL400 DLL 227,104 03-09-05 1:24a JXPL400.DLL
NWWMSDRM DLL 227,104 03-09-05 1:24a NWWMSDRM.DLL
LGP DLL 227,104 03-09-05 1:24a lgp.dll
IBSETUP DLL 227,104 03-09-05 1:24a IbSETUP.DLL
MTDOCS DLL 227,104 03-09-05 1:24a MTDOCS.DLL
DCNLOBBY DLL 227,104 03-09-05 1:24a DCNLOBBY.DLL
HIFRDB08 DLL 227,104 03-09-05 1:24a HIFRDB08.DLL
IGLOADER DLL 227,104 03-09-05 1:24a IGLOADER.DLL
MLSCMC32 DLL 222,568 03-05-05 12:27p MLSCMC32.DLL
CWFVIEW DLL 222,568 03-05-05 12:27p CWFVIEW.DLL
IYVIDEO DLL 222,568 03-05-05 12:27p IYVIDEO.DLL
STLSRV32 DLL 222,568 03-05-05 12:27p STLSRV32.DLL
NITOS DLL 222,568 03-05-05 12:27p NiTOS.DLL
IAFRARED DLL 222,568 03-05-05 12:27p IaFRARED.DLL
CCM DLL 222,568 01-21-05 7:07p CCM.DLL
MOI DLL 222,568 01-21-05 7:07p MOI.DLL
DHO350 DLL 222,568 01-21-05 7:07p DHO350.DLL
MLVIDCTL DLL 222,568 01-21-05 7:07p MLVIDCTL.DLL
MWVIDCTL DLL 222,568 01-21-05 7:07p MWVIDCTL.DLL
OYECNV32 DLL 222,568 01-21-05 7:07p OYECNV32.DLL
CZETCFG DLL 222,568 01-21-05 7:07p CZETCFG.DLL
OXESVR DLL 222,568 01-21-05 7:07p OXESVR.DLL
DNNLOBBY DLL 222,568 01-21-05 7:07p DNNLOBBY.DLL
OZGFS400 DLL 222,568 01-21-05 7:07p OZGFS400.DLL
VS5STKIT DLL 222,568 01-21-05 7:07p VS5STKIT.DLL
OQBC32 DLL 222,568 01-21-05 7:07p OQBC32.DLL
SVLWAPI DLL 222,568 01-21-05 7:07p SVLWAPI.DLL
MGTCP DLL 222,568 01-21-05 7:07p MgTCP.DLL
DYVMGR32 DLL 222,568 01-21-05 7:07p DYVMGR32.DLL
CRDIAL32 DLL 222,568 01-21-05 7:07p CRDIAL32.DLL
IOSETUP DLL 222,568 01-21-05 7:07p IOSETUP.DLL
SKROBJ DLL 222,568 01-21-05 7:07p SKROBJ.DLL
MHXBSE35 DLL 222,568 01-21-05 7:07p mhxbse35.dll
VH40016 DLL 222,568 01-21-05 7:07p VH40016.DLL
DXDIM DLL 222,568 01-21-05 7:07p DXDIM.DLL
DMNMPNTW DLL 222,568 01-21-05 7:07p DMNMPNTW.DLL
CDGWIZ DLL 222,568 01-21-05 7:07p CdGWIZ.DLL
RQCLTC1 DLL 222,568 01-21-05 7:07p RqCLTC1.DLL
VUHELPER DLL 222,568 01-21-05 7:07p VUHELPER.DLL
HSFSUI08 DLL 222,568 01-21-05 7:07p HSFSUI08.DLL
MARDO20 DLL 222,568 01-21-05 7:07p mardo20.dll
WQVDMOD DLL 222,568 01-21-05 7:07p WQVDMOD.DLL
WMOCK32 DLL 222,568 01-21-05 7:07p WMOCK32.DLL
GPOUPPOL DLL 222,568 01-21-05 7:07p GPOUPPOL.DLL
MFRATING DLL 222,568 01-21-05 7:07p MFRATING.DLL
NKTOS DLL 222,568 01-21-05 7:07p NkTOS.DLL
MOC70 DLL 222,568 01-21-05 7:07p moc70.dll
MPSTERY DLL 222,568 01-21-05 7:07p Mpstery.dll
ANMWPROX DLL 222,568 01-21-05 7:07p anmwprox.dll
VFRSION DLL 222,568 01-21-05 7:07p VFRSION.DLL
TB2032 DLL 222,568 01-21-05 7:07p TB2032.DLL
WRSDMOD DLL 222,568 01-21-05 7:07p WRSDMOD.DLL
CUM DLL 222,568 01-21-05 7:07p CUM.DLL
WISTREAM DLL 222,568 01-21-05 7:07p WISTREAM.DLL
DJCXATM DLL 222,568 01-21-05 7:07p djcxatm.dll
IDSETUP DLL 222,568 01-21-05 7:07p IDSETUP.DLL
IGROP DLL 222,568 01-21-05 7:07p IGROP.DLL
INNPSTUB DLL 222,568 01-21-05 7:07p INNPSTUB.DLL
SEKIT416 DLL 222,568 01-21-05 7:07p SEKIT416.DLL
UJDM32 DLL 222,568 01-21-05 7:07p UJDM32.DLL
NRTOS DLL 222,568 01-21-05 7:07p NrTOS.DLL
IXLOADER DLL 222,568 01-21-05 7:07p IXLOADER.DLL
UXER32 DLL 222,568 01-21-05 7:07p UXER32.DLL
JLPL400 DLL 222,568 01-21-05 7:07p JLPL400.DLL
EDYSH7 DLL 222,568 01-21-05 7:07p EDYSH7.DLL
RVCMQSVR DLL 222,568 01-21-05 7:07p RVCMQSVR.DLL
WYLP32T DLL 222,568 01-21-05 7:07p WYLP32T.DLL
MPXML3 DLL 222,568 01-21-05 7:07p MPXML3.DLL
KWMMCTRL DLL 222,568 01-21-05 7:07p KwMMCTRL.DLL
NYSWAN32 DLL 222,568 01-21-05 7:07p NySWAN32.DLL
DANMPNTW DLL 222,568 01-21-05 7:07p DANMPNTW.DLL
TVOLHELP DLL 222,568 01-21-05 7:07p TVOLHELP.DLL
RDCHED DLL 222,568 01-21-05 7:07p RdCHED.DLL
DVCXATM DLL 222,568 01-21-05 7:07p dvcxatm.dll
MIVCP50 DLL 222,568 01-21-05 7:07p MIVCP50.DLL
CNREAK DLL 222,568 01-21-05 7:07p cnreak.dll
MQVBVM60 DLL 222,568 01-21-05 7:07p mqvbvm60.dll
MSG200~1 DLL 222,568 01-21-05 7:07p msg200.cpy.dll
HNFDOS08 DLL 222,568 01-21-05 7:07p HNFDOS08.DLL
SPTUPX DLL 222,568 01-21-05 7:07p SPTUPX.DLL
XWILEXR DLL 222,568 01-21-05 7:07p XWILEXR.DLL
DOTMLA~1 DLL 222,568 01-21-05 7:07p DOTMLAccess.dll
MJXTRK DLL 222,568 01-21-05 7:07p mjxtrk.dll
SICDLL DLL 222,568 01-21-05 7:07p SICDLL.DLL
CYYPTEXT DLL 222,568 01-21-05 7:07p CYYPTEXT.DLL
MHC30 DLL 222,568 01-21-05 7:07p MHC30.DLL
MLPI32X DLL 222,568 01-21-05 7:07p mLpi32x.dll
CNMCTL32 DLL 222,568 01-21-05 7:07p CNMCTL32.DLL
MRG_HOOK DLL 222,568 01-21-05 7:07p MRG_HOOK.DLL
MUJETO~1 DLL 222,568 01-21-05 7:07p mujetoledb40.dll
QIAUTO DLL 222,568 01-21-05 7:07p QIAUTO.DLL
IUET16 DLL 222,568 01-21-05 7:07p IUET16.DLL
MEIEFTP DLL 222,568 01-21-05 7:07p MEIEFTP.DLL
DECVR DLL 222,568 01-21-05 7:07p DECVR.DLL
QRGR DLL 222,568 01-21-05 7:07p QRGR.DLL
PDPNDI DLL 222,568 01-21-05 7:07p PdPNDI.DLL
SVACE DLL 222,568 01-21-05 7:07p Svace.dll
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
132 file(s) 29,346,920 bytes
0 dir(s) 5,454.78 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

RATINGS POL 8,192 03-17-05 1:53a RATINGS.POL
FOLDER HTT 13,122 12-28-04 5:38a folder.htt
DESKTOP INI 266 12-28-04 5:38a desktop.ini
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
HPF67H08 GID 8,628 05-11-04 3:36a hpf67h08.GID
HPF67T08 GID 8,628 05-11-04 3:28a hpf67t08.GID
HPF68H17 GID 8,628 04-29-04 4:39a HPF68h17.GID
HPF68R17 GID 8,628 04-29-04 2:59a HPF68r17.GID
HPF67T18 GID 8,628 08-16-03 7:42p HPF67t18.GID
9 file(s) 64,720 bytes
0 dir(s) 5,454.77 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{BA5F8E7F-49D1-5D57-F440-2637609D2135}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
pcpwprop.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
mlscmc32.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
folder.htt Tue Dec 28 2004 5:38:48a …H. 13,122 12.81 K
fptls432.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
drskcopy.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
cwfview.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
ccm.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mpxtrk.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
desktop.ini Tue Dec 28 2004 5:38:48a …H. 266 0.26 K
mfvcp50.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
wr5inf16.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
aomui.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
lngmgr.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
dgusic.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
jceg1x32.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
azycfilt.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
fksrch.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
oy30.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ayfsipc.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
jadw400.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
moawt.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
moi.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
msxperf.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
dzcxatm.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
isetwh32.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
svdoclc.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
dbdim.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ddnaddr.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
sprobj.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
imsetup.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
htfpml08.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
iyvideo.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
stlsrv32.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
dho350.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mlvidctl.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mwvidctl.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
oyecnv32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
ratings.pol Thu Mar 17 2005 1:53:44a …HR 8,192 8.00 K
czetcfg.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
oxesvr.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dnnlobby.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dbskcopy.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
taolhelp.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ozgfs400.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
vs5stkit.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
oqbc32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
svlwapi.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mgtcp.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dyvmgr32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
crdial32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
tpinin~1.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
iosetup.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
skrobj.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mhxbse35.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
vh40016.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dxdim.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dmnmpntw.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
cdgwiz.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
rqcltc1.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
vuhelper.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
hsfsui08.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mardo20.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
wqvdmod.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
wmock32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
gpouppol.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mfrating.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
nktos.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
moc70.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mpstery.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
anmwprox.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
vfrsion.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
tb2032.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
wrsdmod.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
cum.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
wistream.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
djcxatm.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
idsetup.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
igrop.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
innpstub.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
sekit416.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
ujdm32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
nrtos.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
ixloader.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
uxer32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
jlpl400.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
edysh7.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
rvcmqsvr.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
wylp32t.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mpxml3.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
kwmmctrl.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
nyswan32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
danmpntw.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
tvolhelp.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
rdched.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dvcxatm.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mivcp50.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
cnreak.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mqvbvm60.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
msg200~1.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
hnfdos08.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
sptupx.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
xwilexr.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
dotmla~1.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mjxtrk.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
sicdll.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
cyyptext.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mhc30.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mlpi32x.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
cnmctl32.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mrg_hook.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
mujeto~1.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
qiauto.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
iuet16.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
meieftp.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
decvr.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
qrgr.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
pdpndi.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
svace.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K
nitos.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
iafrared.dll Sat Mar 5 2005 12:27:26p ..S.R 222,568 217.35 K
wptsecur.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
igetwh32.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
rmclts5.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
driman32.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
cgmmdlg.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
lmprxy.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
jxpl400.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
nwwmsdrm.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
lgp.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ibsetup.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
mtdocs.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
dcnlobby.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
hifrdb08.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
igloader.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K

134 items found: 134 files, 0 directories.
Total of file sizes: 29,368,500 bytes 28.01 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\noanhe.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net,

————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\JLSD400.DLL: UMonitor
C:\WINDOWS\SYSTEM\WD32DLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\ONE32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLSCMC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CWFVIEW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CCM.DLL: UMonitor
C:\WINDOWS\SYSTEM\CKUSALGO.DLL: UMonitor
C:\WINDOWS\SYSTEM\MOI.DLL: UMonitor
C:\WINDOWS\SYSTEM\IYVIDEO.DLL: UMonitor
C:\WINDOWS\SYSTEM\STLSRV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DHO350.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MWVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\OYECNV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CZETCFG.DLL: UMonitor
C:\WINDOWS\SYSTEM\OXESVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DNNLOBBY.DLL: UMonitor
C:\WINDOWS\SYSTEM\OZGFS400.DLL: UMonitor
C:\WINDOWS\SYSTEM\VS5STKIT.DLL: UMonitor
C:\WINDOWS\SYSTEM\OQBC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\SVLWAPI.DLL: UMonitor
C:\WINDOWS\SYSTEM\MgTCP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DYVMGR32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CRDIAL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\IOSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\SKROBJ.DLL: UMonitor
C:\WINDOWS\SYSTEM\mhxbse35.dll: UMonitor
C:\WINDOWS\SYSTEM\VH40016.DLL: UMonitor
C:\WINDOWS\SYSTEM\DXDIM.DLL: UMonitor
C:\WINDOWS\SYSTEM\DMNMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CdGWIZ.DLL: UMonitor
C:\WINDOWS\SYSTEM\RqCLTC1.DLL: UMonitor
C:\WINDOWS\SYSTEM\VUHELPER.DLL: UMonitor
C:\WINDOWS\SYSTEM\HSFSUI08.DLL: UMonitor
C:\WINDOWS\SYSTEM\mardo20.dll: UMonitor
C:\WINDOWS\SYSTEM\WQVDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\WMOCK32.DLL: UMonitor
C:\WINDOWS\SYSTEM\GPOUPPOL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MFRATING.DLL: UMonitor
C:\WINDOWS\SYSTEM\NkTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\moc70.dll: UMonitor
C:\WINDOWS\SYSTEM\Mpstery.dll: UMonitor
C:\WINDOWS\SYSTEM\anmwprox.dll: UMonitor
C:\WINDOWS\SYSTEM\VFRSION.DLL: UMonitor
C:\WINDOWS\SYSTEM\TB2032.DLL: UMonitor
C:\WINDOWS\SYSTEM\WRSDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\CUM.DLL: UMonitor
C:\WINDOWS\SYSTEM\WISTREAM.DLL: UMonitor
C:\WINDOWS\SYSTEM\djcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\IDSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\IGROP.DLL: UMonitor
C:\WINDOWS\SYSTEM\INNPSTUB.DLL: UMonitor
C:\WINDOWS\SYSTEM\SEKIT416.DLL: UMonitor
C:\WINDOWS\SYSTEM\UJDM32.DLL: UMonitor
C:\WINDOWS\SYSTEM\NrTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IXLOADER.DLL: UMonitor
C:\WINDOWS\SYSTEM\UXER32.DLL: UMonitor
C:\WINDOWS\SYSTEM\JLPL400.DLL: UMonitor
C:\WINDOWS\SYSTEM\EDYSH7.DLL: UMonitor
C:\WINDOWS\SYSTEM\RVCMQSVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\WYLP32T.DLL: UMonitor
C:\WINDOWS\SYSTEM\MPXML3.DLL: UMonitor
C:\WINDOWS\SYSTEM\KwMMCTRL.DLL: UMonitor
C:\WINDOWS\SYSTEM\NySWAN32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DANMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\TVOLHELP.DLL: UMonitor
C:\WINDOWS\SYSTEM\RdCHED.DLL: UMonitor
C:\WINDOWS\SYSTEM\dvcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\MIVCP50.DLL: UMonitor
C:\WINDOWS\SYSTEM\cnreak.dll: UMonitor
C:\WINDOWS\SYSTEM\mqvbvm60.dll: UMonitor
C:\WINDOWS\SYSTEM\msg200.cpy.dll: UMonitor
C:\WINDOWS\SYSTEM\HNFDOS08.DLL: UMonitor
C:\WINDOWS\SYSTEM\SPTUPX.DLL: UMonitor
C:\WINDOWS\SYSTEM\XWILEXR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DOTMLAccess.dll: UMonitor
C:\WINDOWS\SYSTEM\mjxtrk.dll: UMonitor
C:\WINDOWS\SYSTEM\SICDLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\CYYPTEXT.DLL: UMonitor
C:\WINDOWS\SYSTEM\MHC30.DLL: UMonitor
C:\WINDOWS\SYSTEM\mLpi32x.dll: UMonitor
C:\WINDOWS\SYSTEM\CNMCTL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MRG_HOOK.DLL: UMonitor
C:\WINDOWS\SYSTEM\mujetoledb40.dll: UMonitor
C:\WINDOWS\SYSTEM\QIAUTO.DLL: UMonitor
C:\WINDOWS\SYSTEM\IUET16.DLL: UMonitor
C:\WINDOWS\SYSTEM\MEIEFTP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DECVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\QRGR.DLL: UMonitor
C:\WINDOWS\SYSTEM\PdPNDI.DLL: UMonitor
C:\WINDOWS\SYSTEM\Svace.dll: UMonitor
C:\WINDOWS\SYSTEM\NiTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IaFRARED.DLL: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"WinPatrol"="C:\\PROGRAM FILES\\BILLP STUDIOS\\WINPATROL\\winpatrol.exe"



Logfile of HijackThis v1.99.1
Scan saved at 12:22:13 PM, on 3/19/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.learn2type.com/Rel092/setup.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.6.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup…p1/imloader.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net



I tried typing this in at the killbox top window to save time…
C:\WINDOWSSYSTEM\pcpwprop.dll\jlsd400.dll\wd32.dll\ etc… (it takes all the files) I did that first then re-booted.
I also completed the task one at a time from the kill box top line
C:\WINDOWSSYSTEM\pcpwprop.dll (X) <–enter etc…

If I have to do that again, I'd like to know if the top string
C:\WINDOWSSYSTEM\file.dll\file.dll\file.dll <– works, thats a lot faster. I type 90 WPM. And that list makes a kickass typing test ;)


Thanks
EM.
Post #23

I tried typing this in at the killbox top window to save time…
C:\WINDOWSSYSTEM\pcpwprop.dll\jlsd400.dll\wd32.dll\ etc… (it takes all the files) I did that first then re-booted.
I also completed the task one at a time from the kill box top line
C:\WINDOWSSYSTEM\pcpwprop.dll (X) <–enter etc…


Ernie,

Unfortunatty you have to add them one at a time. After each one, you have to put a checkmark in the Dummy File box and then click on the Red X
When it asks you to reboot, say no and then add the next file. After there all entered, then you can reboot. The last try didn't work, the files are still there.
Post #24
:)
OK! I was able to run killbox, and this time used the "Dummy check box everytime." Here's the findit.log and hijackthis.log files.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

SVDOCLC DLL 227,104 03-18-05 4:22a SVDOCLC.DLL
LFPRXY DLL 227,104 03-18-05 4:22a LFPRXY.DLL
MCCO30 DLL 227,104 03-18-05 4:22a MCCO30.DLL
VKRSION DLL 227,104 03-18-05 4:22a VKRSION.DLL
MAOEACCT DLL 227,104 03-18-05 4:22a MAOEACCT.DLL
DEWSOCK DLL 227,104 03-18-05 4:22a DEWSOCK.DLL
RMPILIB DLL 227,104 03-18-05 4:22a RMPILIB.DLL
VIRSION DLL 227,104 03-18-05 4:22a VIRSION.DLL
AZYCFILT DLL 227,104 03-09-05 1:24a AZYCFILT.DLL
FKSRCH DLL 227,104 03-09-05 1:24a FKSRCH.DLL
AYFSIPC DLL 227,104 03-09-05 1:24a ayfsipc.dll
JADW400 DLL 227,104 03-09-05 1:24a JADW400.DLL
MOAWT DLL 227,104 03-09-05 1:24a MOAWT.DLL
MSXPERF DLL 227,104 03-09-05 1:24a msxperf.dll
ISETWH32 DLL 227,104 03-09-05 1:24a Isetwh32.dll
DBDIM DLL 227,104 03-09-05 1:24a DBDIM.DLL
DDNADDR DLL 227,104 03-09-05 1:24a DDNADDR.DLL
SPROBJ DLL 227,104 03-09-05 1:24a SPROBJ.DLL
IMSETUP DLL 227,104 03-09-05 1:24a IMSETUP.DLL
CUM DLL 222,568 01-21-05 7:07p CUM.DLL
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
21 file(s) 4,537,544 bytes
0 dir(s) 5,984.94 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

RATINGS POL 8,192 03-17-05 1:53a RATINGS.POL
FOLDER HTT 13,122 12-28-04 5:38a folder.htt
DESKTOP INI 266 12-28-04 5:38a desktop.ini
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
HPF67H08 GID 8,628 05-11-04 3:36a hpf67h08.GID
HPF67T08 GID 8,628 05-11-04 3:28a hpf67t08.GID
HPF68H17 GID 8,628 04-29-04 4:39a HPF68h17.GID
HPF68R17 GID 8,628 04-29-04 2:59a HPF68r17.GID
HPF67T18 GID 8,628 08-16-03 7:42p HPF67t18.GID
9 file(s) 64,720 bytes
0 dir(s) 5,984.94 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{BA5F8E7F-49D1-5D57-F440-2637609D2135}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
folder.htt Tue Dec 28 2004 5:38:48a …H. 13,122 12.81 K
desktop.ini Tue Dec 28 2004 5:38:48a …H. 266 0.26 K
azycfilt.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
fksrch.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ayfsipc.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
jadw400.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
moawt.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
msxperf.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
isetwh32.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
svdoclc.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
dbdim.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
ddnaddr.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
sprobj.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
imsetup.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
lfprxy.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
mcco30.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
vkrsion.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
maoeacct.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
dewsock.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
rmpilib.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
virsion.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
ratings.pol Thu Mar 17 2005 1:53:44a …HR 8,192 8.00 K
cum.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K

23 items found: 23 files, 0 directories.
Total of file sizes: 4,559,124 bytes 4.35 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\noanhe.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net,

————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\JLSD400.DLL: UMonitor
C:\WINDOWS\SYSTEM\WD32DLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\ONE32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLSCMC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CWFVIEW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CCM.DLL: UMonitor
C:\WINDOWS\SYSTEM\CKUSALGO.DLL: UMonitor
C:\WINDOWS\SYSTEM\MOI.DLL: UMonitor
C:\WINDOWS\SYSTEM\IYVIDEO.DLL: UMonitor
C:\WINDOWS\SYSTEM\STLSRV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DHO350.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MWVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\OYECNV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CZETCFG.DLL: UMonitor
C:\WINDOWS\SYSTEM\OXESVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DNNLOBBY.DLL: UMonitor
C:\WINDOWS\SYSTEM\OZGFS400.DLL: UMonitor
C:\WINDOWS\SYSTEM\VS5STKIT.DLL: UMonitor
C:\WINDOWS\SYSTEM\OQBC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\SVLWAPI.DLL: UMonitor
C:\WINDOWS\SYSTEM\MgTCP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DYVMGR32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CRDIAL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\IOSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\SKROBJ.DLL: UMonitor
C:\WINDOWS\SYSTEM\mhxbse35.dll: UMonitor
C:\WINDOWS\SYSTEM\VH40016.DLL: UMonitor
C:\WINDOWS\SYSTEM\DXDIM.DLL: UMonitor
C:\WINDOWS\SYSTEM\DMNMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CdGWIZ.DLL: UMonitor
C:\WINDOWS\SYSTEM\RqCLTC1.DLL: UMonitor
C:\WINDOWS\SYSTEM\VUHELPER.DLL: UMonitor
C:\WINDOWS\SYSTEM\HSFSUI08.DLL: UMonitor
C:\WINDOWS\SYSTEM\mardo20.dll: UMonitor
C:\WINDOWS\SYSTEM\WQVDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\WMOCK32.DLL: UMonitor
C:\WINDOWS\SYSTEM\GPOUPPOL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MFRATING.DLL: UMonitor
C:\WINDOWS\SYSTEM\NkTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\moc70.dll: UMonitor
C:\WINDOWS\SYSTEM\Mpstery.dll: UMonitor
C:\WINDOWS\SYSTEM\anmwprox.dll: UMonitor
C:\WINDOWS\SYSTEM\VFRSION.DLL: UMonitor
C:\WINDOWS\SYSTEM\TB2032.DLL: UMonitor
C:\WINDOWS\SYSTEM\WRSDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\CUM.DLL: UMonitor
C:\WINDOWS\SYSTEM\WISTREAM.DLL: UMonitor
C:\WINDOWS\SYSTEM\djcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\IDSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\IGROP.DLL: UMonitor
C:\WINDOWS\SYSTEM\INNPSTUB.DLL: UMonitor
C:\WINDOWS\SYSTEM\SEKIT416.DLL: UMonitor
C:\WINDOWS\SYSTEM\UJDM32.DLL: UMonitor
C:\WINDOWS\SYSTEM\NrTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IXLOADER.DLL: UMonitor
C:\WINDOWS\SYSTEM\UXER32.DLL: UMonitor
C:\WINDOWS\SYSTEM\JLPL400.DLL: UMonitor
C:\WINDOWS\SYSTEM\EDYSH7.DLL: UMonitor
C:\WINDOWS\SYSTEM\RVCMQSVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\WYLP32T.DLL: UMonitor
C:\WINDOWS\SYSTEM\MPXML3.DLL: UMonitor
C:\WINDOWS\SYSTEM\KwMMCTRL.DLL: UMonitor
C:\WINDOWS\SYSTEM\NySWAN32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DANMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\TVOLHELP.DLL: UMonitor
C:\WINDOWS\SYSTEM\RdCHED.DLL: UMonitor
C:\WINDOWS\SYSTEM\dvcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\MIVCP50.DLL: UMonitor
C:\WINDOWS\SYSTEM\cnreak.dll: UMonitor
C:\WINDOWS\SYSTEM\mqvbvm60.dll: UMonitor
C:\WINDOWS\SYSTEM\msg200.cpy.dll: UMonitor
C:\WINDOWS\SYSTEM\HNFDOS08.DLL: UMonitor
C:\WINDOWS\SYSTEM\SPTUPX.DLL: UMonitor
C:\WINDOWS\SYSTEM\XWILEXR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DOTMLAccess.dll: UMonitor
C:\WINDOWS\SYSTEM\mjxtrk.dll: UMonitor
C:\WINDOWS\SYSTEM\SICDLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\CYYPTEXT.DLL: UMonitor
C:\WINDOWS\SYSTEM\MHC30.DLL: UMonitor
C:\WINDOWS\SYSTEM\mLpi32x.dll: UMonitor
C:\WINDOWS\SYSTEM\CNMCTL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MRG_HOOK.DLL: UMonitor
C:\WINDOWS\SYSTEM\mujetoledb40.dll: UMonitor
C:\WINDOWS\SYSTEM\QIAUTO.DLL: UMonitor
C:\WINDOWS\SYSTEM\IUET16.DLL: UMonitor
C:\WINDOWS\SYSTEM\MEIEFTP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DECVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\QRGR.DLL: UMonitor
C:\WINDOWS\SYSTEM\PdPNDI.DLL: UMonitor
C:\WINDOWS\SYSTEM\Svace.dll: UMonitor
C:\WINDOWS\SYSTEM\NiTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IaFRARED.DLL: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"WinPatrol"="C:\\PROGRAM FILES\\BILLP STUDIOS\\WINPATROL\\winpatrol.exe"


Logfile of HijackThis v1.99.1
Scan saved at 12:44:51 AM, on 3/22/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.learn2type.com/Rel092/setup.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.6.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup…p1/imloader.cab


I'm only using AOL 7.0 until this problem is fixed, each time I log on using AOL 9.0 SE, the WINPATROL pops up, with an added start up from AOL that keeps hanging up the system. I click NO, and run msconfig to find that in the win.ini file AOL is shaded, and I clear the check mark and only run systray and winpatrol from the start up menu. I also checked out the site about the memory this is a Packard Bell 55, and can be maxed to 128 Ram. Once were 100% I'll upgrade to max out the memory. The Winpatrol program is doing a hell of a job.

EM
Post #25
Ernie, We are almost there, I need you to run Killbox again and do the same thing with these 20 files. It is important that after you enter the last file and reboot, to keep your computer on, don't turn it off or these files have babies , and get right back to me with a new find it log and a new HJT log. Here are the files, do it the sameway C\WINDOWS\SYSTEM\ azycfilt.dll fksrch.dll ayfsipc.dll jadw400.dll moawt.dll msxperf.dll isetwh32.dll svdoclc.dll dbdim.dll ddnaddr.dll sprobj.dll imsetup.dll lfprxy.dll mcco30.dll vkrsion.dll maoeacct.dll dewsock.dll rmpilib.dll virsion.dll cum.dll Fri
Post #26
:wavey:

OK, almost done right? Cool. I ran Killbox, and was able to complete the task. Using the dummy files on the last list of .dll files. Here's the findit.log and hijackthis.log files you asked for.

I'm still having the pop up (Work offline) window click stay offline or connect when I log on to a site using AOL, also graffic's inside of email are not viewable. [x] followed by code lines, are what I see. Is that a setting problem with Internet Explorer?

Anyway, I'll be sending a donation ASAP… Thanks a million.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

SVDOCLC DLL 227,104 03-18-05 4:22a SVDOCLC.DLL
LFPRXY DLL 227,104 03-18-05 4:22a LFPRXY.DLL
MECO30 DLL 227,104 03-18-05 4:22a MECO30.DLL
DEWSOCK DLL 227,104 03-18-05 4:22a DEWSOCK.DLL
SNTUPKIT DLL 227,104 03-18-05 4:22a SNTUPKIT.DLL
WHASPI32 DLL 227,104 03-18-05 4:22a WHASPI32.DLL
MOAWT DLL 227,104 03-09-05 1:24a MOAWT.DLL
CUM DLL 222,568 01-21-05 7:07p CUM.DLL
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
9 file(s) 1,812,296 bytes
0 dir(s) 6,005.07 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 1631-1603
Directory of C:\WINDOWS\SYSTEM

FOLDER HTT 13,122 03-22-05 1:16p folder.htt
DESKTOP INI 266 03-22-05 1:16p desktop.ini
RATINGS POL 8,192 03-17-05 1:53a RATINGS.POL
DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL
HPF67H08 GID 8,628 05-11-04 3:36a hpf67h08.GID
HPF67T08 GID 8,628 05-11-04 3:28a hpf67t08.GID
HPF68H17 GID 8,628 04-29-04 4:39a HPF68h17.GID
HPF68R17 GID 8,628 04-29-04 2:59a HPF68r17.GID
HPF67T18 GID 8,628 08-16-03 7:42p HPF67t18.GID
9 file(s) 64,720 bytes
0 dir(s) 6,005.06 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{BA5F8E7F-49D1-5D57-F440-2637609D2135}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
folder.htt Tue Mar 22 2005 1:16:12p …H. 13,122 12.81 K
desktop.ini Tue Mar 22 2005 1:16:12p …H. 266 0.26 K
moawt.dll Wed Mar 9 2005 1:24:38a ..S.R 227,104 221.78 K
svdoclc.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
lfprxy.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
meco30.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
dewsock.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
sntupkit.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
whaspi32.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K
ratings.pol Thu Mar 17 2005 1:53:44a …HR 8,192 8.00 K
cum.dll Fri Jan 21 2005 7:07:42p ..S.R 222,568 217.35 K

11 items found: 11 files, 0 directories.
Total of file sizes: 1,833,876 bytes 1.75 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\noanhe.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net,

————– Strings.exe Aspack Results ————-


—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-
C:\WINDOWS\SYSTEM\JLSD400.DLL: UMonitor
C:\WINDOWS\SYSTEM\WD32DLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\ONE32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLSCMC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CWFVIEW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CCM.DLL: UMonitor
C:\WINDOWS\SYSTEM\CKUSALGO.DLL: UMonitor
C:\WINDOWS\SYSTEM\MOI.DLL: UMonitor
C:\WINDOWS\SYSTEM\IYVIDEO.DLL: UMonitor
C:\WINDOWS\SYSTEM\STLSRV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DHO350.DLL: UMonitor
C:\WINDOWS\SYSTEM\MLVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MWVIDCTL.DLL: UMonitor
C:\WINDOWS\SYSTEM\OYECNV32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CZETCFG.DLL: UMonitor
C:\WINDOWS\SYSTEM\OXESVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DNNLOBBY.DLL: UMonitor
C:\WINDOWS\SYSTEM\OZGFS400.DLL: UMonitor
C:\WINDOWS\SYSTEM\VS5STKIT.DLL: UMonitor
C:\WINDOWS\SYSTEM\OQBC32.DLL: UMonitor
C:\WINDOWS\SYSTEM\SVLWAPI.DLL: UMonitor
C:\WINDOWS\SYSTEM\MgTCP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DYVMGR32.DLL: UMonitor
C:\WINDOWS\SYSTEM\CRDIAL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\IOSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\SKROBJ.DLL: UMonitor
C:\WINDOWS\SYSTEM\mhxbse35.dll: UMonitor
C:\WINDOWS\SYSTEM\VH40016.DLL: UMonitor
C:\WINDOWS\SYSTEM\DXDIM.DLL: UMonitor
C:\WINDOWS\SYSTEM\DMNMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\CdGWIZ.DLL: UMonitor
C:\WINDOWS\SYSTEM\RqCLTC1.DLL: UMonitor
C:\WINDOWS\SYSTEM\VUHELPER.DLL: UMonitor
C:\WINDOWS\SYSTEM\HSFSUI08.DLL: UMonitor
C:\WINDOWS\SYSTEM\mardo20.dll: UMonitor
C:\WINDOWS\SYSTEM\WQVDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\WMOCK32.DLL: UMonitor
C:\WINDOWS\SYSTEM\GPOUPPOL.DLL: UMonitor
C:\WINDOWS\SYSTEM\MFRATING.DLL: UMonitor
C:\WINDOWS\SYSTEM\NkTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\moc70.dll: UMonitor
C:\WINDOWS\SYSTEM\Mpstery.dll: UMonitor
C:\WINDOWS\SYSTEM\anmwprox.dll: UMonitor
C:\WINDOWS\SYSTEM\VFRSION.DLL: UMonitor
C:\WINDOWS\SYSTEM\TB2032.DLL: UMonitor
C:\WINDOWS\SYSTEM\WRSDMOD.DLL: UMonitor
C:\WINDOWS\SYSTEM\CUM.DLL: UMonitor
C:\WINDOWS\SYSTEM\WISTREAM.DLL: UMonitor
C:\WINDOWS\SYSTEM\djcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\IDSETUP.DLL: UMonitor
C:\WINDOWS\SYSTEM\IGROP.DLL: UMonitor
C:\WINDOWS\SYSTEM\INNPSTUB.DLL: UMonitor
C:\WINDOWS\SYSTEM\SEKIT416.DLL: UMonitor
C:\WINDOWS\SYSTEM\UJDM32.DLL: UMonitor
C:\WINDOWS\SYSTEM\NrTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IXLOADER.DLL: UMonitor
C:\WINDOWS\SYSTEM\UXER32.DLL: UMonitor
C:\WINDOWS\SYSTEM\JLPL400.DLL: UMonitor
C:\WINDOWS\SYSTEM\EDYSH7.DLL: UMonitor
C:\WINDOWS\SYSTEM\RVCMQSVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\WYLP32T.DLL: UMonitor
C:\WINDOWS\SYSTEM\MPXML3.DLL: UMonitor
C:\WINDOWS\SYSTEM\KwMMCTRL.DLL: UMonitor
C:\WINDOWS\SYSTEM\NySWAN32.DLL: UMonitor
C:\WINDOWS\SYSTEM\DANMPNTW.DLL: UMonitor
C:\WINDOWS\SYSTEM\TVOLHELP.DLL: UMonitor
C:\WINDOWS\SYSTEM\RdCHED.DLL: UMonitor
C:\WINDOWS\SYSTEM\dvcxatm.dll: UMonitor
C:\WINDOWS\SYSTEM\MIVCP50.DLL: UMonitor
C:\WINDOWS\SYSTEM\cnreak.dll: UMonitor
C:\WINDOWS\SYSTEM\mqvbvm60.dll: UMonitor
C:\WINDOWS\SYSTEM\msg200.cpy.dll: UMonitor
C:\WINDOWS\SYSTEM\HNFDOS08.DLL: UMonitor
C:\WINDOWS\SYSTEM\SPTUPX.DLL: UMonitor
C:\WINDOWS\SYSTEM\XWILEXR.DLL: UMonitor
C:\WINDOWS\SYSTEM\DOTMLAccess.dll: UMonitor
C:\WINDOWS\SYSTEM\mjxtrk.dll: UMonitor
C:\WINDOWS\SYSTEM\SICDLL.DLL: UMonitor
C:\WINDOWS\SYSTEM\CYYPTEXT.DLL: UMonitor
C:\WINDOWS\SYSTEM\MHC30.DLL: UMonitor
C:\WINDOWS\SYSTEM\mLpi32x.dll: UMonitor
C:\WINDOWS\SYSTEM\CNMCTL32.DLL: UMonitor
C:\WINDOWS\SYSTEM\MRG_HOOK.DLL: UMonitor
C:\WINDOWS\SYSTEM\mujetoledb40.dll: UMonitor
C:\WINDOWS\SYSTEM\QIAUTO.DLL: UMonitor
C:\WINDOWS\SYSTEM\IUET16.DLL: UMonitor
C:\WINDOWS\SYSTEM\MEIEFTP.DLL: UMonitor
C:\WINDOWS\SYSTEM\DECVR.DLL: UMonitor
C:\WINDOWS\SYSTEM\QRGR.DLL: UMonitor
C:\WINDOWS\SYSTEM\PdPNDI.DLL: UMonitor
C:\WINDOWS\SYSTEM\Svace.dll: UMonitor
C:\WINDOWS\SYSTEM\NiTOS.DLL: UMonitor
C:\WINDOWS\SYSTEM\IaFRARED.DLL: UMonitor

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe"
"WinPatrol"="C:\\PROGRAM FILES\\BILLP STUDIOS\\WINPATROL\\winpatrol.exe"


Logfile of HijackThis v1.99.1
Scan saved at 3:04:06 AM, on 3/23/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\PROGRAM FILES\FREE DOWNLOADS ACCELERATOR\FDABAR99.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} (InstallShield Setup Player 2K2) - http://www.learn2type.com/Rel092/setup.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…etup1.0.0.6.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup…p1/imloader.cab


;)
Post #27
Ernie, Just about 7more files to go with Killbox, after the last file and you reboot, keep your computer running. C:\WINDOWS\SYSTEM\ moawt.dll svdoclc.dll lfprxy.dll meco30.dll dewsock.dll sntupkit.dll whaspi32.dll cum.dll Then post a new findit log only at this time, then we can address your other issue
Post #28
:rant2: Well you know what happend… The system froze I had to hard boot. I completed the task the second time. I'll list the findit.log, but I don't expect it to be over just yet right? :-) Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 1631-1603 Directory of C:\WINDOWS\SYSTEM MUR2CENU DLL 227,104 03-18-05 4:22a MUR2CENU.DLL SVDOCLC DLL 227,104 03-18-05 4:22a SVDOCLC.DLL DABENG DLL 227,104 03-18-05 4:22a DABENG.DLL GJTFILE DLL 227,104 03-18-05 4:22a GjtFile.dll DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL 5 file(s) 908,416 bytes 0 dir(s) 6,037.68 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 1631-1603 Directory of C:\WINDOWS\SYSTEM FOLDER HTT 13,122 03-22-05 1:16p folder.htt DESKTOP INI 266 03-22-05 1:16p desktop.ini RATINGS POL 8,192 03-17-05 1:53a RATINGS.POL DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL HPF67H08 GID 8,628 05-11-04 3:36a hpf67h08.GID HPF67T08 GID 8,628 05-11-04 3:28a hpf67t08.GID HPF68H17 GID 8,628 04-29-04 4:39a HPF68h17.GID HPF68R17 GID 8,628 04-29-04 2:59a HPF68r17.GID HPF67T18 GID 8,628 08-16-03 7:42p HPF67t18.GID 9 file(s) 64,720 bytes 0 dir(s) 6,037.67 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{BA5F8E7F-49D1-5D57-F440-2637609D2135}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ folder.htt Tue Mar 22 2005 1:16:12p …H. 13,122 12.81 K mur2cenu.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K desktop.ini Tue Mar 22 2005 1:16:12p …H. 266 0.26 K svdoclc.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K dabeng.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K gjtfile.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K ratings.pol Thu Mar 17 2005 1:53:44a …HR 8,192 8.00 K 7 items found: 7 files, 0 directories. Total of file sizes: 929,996 bytes 908.20 K ———— Strings.exe Qoologic Results ———— C:\WINDOWS\noanhe.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net, ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\JLSD400.DLL: UMonitor C:\WINDOWS\SYSTEM\WD32DLL.DLL: UMonitor C:\WINDOWS\SYSTEM\ONE32.DLL: UMonitor C:\WINDOWS\SYSTEM\MLSCMC32.DLL: UMonitor C:\WINDOWS\SYSTEM\CWFVIEW.DLL: UMonitor C:\WINDOWS\SYSTEM\CCM.DLL: UMonitor C:\WINDOWS\SYSTEM\CKUSALGO.DLL: UMonitor C:\WINDOWS\SYSTEM\MOI.DLL: UMonitor C:\WINDOWS\SYSTEM\IYVIDEO.DLL: UMonitor C:\WINDOWS\SYSTEM\STLSRV32.DLL: UMonitor C:\WINDOWS\SYSTEM\DHO350.DLL: UMonitor C:\WINDOWS\SYSTEM\MLVIDCTL.DLL: UMonitor C:\WINDOWS\SYSTEM\MWVIDCTL.DLL: UMonitor C:\WINDOWS\SYSTEM\OYECNV32.DLL: UMonitor C:\WINDOWS\SYSTEM\CZETCFG.DLL: UMonitor C:\WINDOWS\SYSTEM\OXESVR.DLL: UMonitor C:\WINDOWS\SYSTEM\DNNLOBBY.DLL: UMonitor C:\WINDOWS\SYSTEM\OZGFS400.DLL: UMonitor C:\WINDOWS\SYSTEM\VS5STKIT.DLL: UMonitor C:\WINDOWS\SYSTEM\OQBC32.DLL: UMonitor C:\WINDOWS\SYSTEM\SVLWAPI.DLL: UMonitor C:\WINDOWS\SYSTEM\MgTCP.DLL: UMonitor C:\WINDOWS\SYSTEM\DYVMGR32.DLL: UMonitor C:\WINDOWS\SYSTEM\CRDIAL32.DLL: UMonitor C:\WINDOWS\SYSTEM\IOSETUP.DLL: UMonitor C:\WINDOWS\SYSTEM\SKROBJ.DLL: UMonitor C:\WINDOWS\SYSTEM\mhxbse35.dll: UMonitor C:\WINDOWS\SYSTEM\VH40016.DLL: UMonitor C:\WINDOWS\SYSTEM\DXDIM.DLL: UMonitor C:\WINDOWS\SYSTEM\DMNMPNTW.DLL: UMonitor C:\WINDOWS\SYSTEM\CdGWIZ.DLL: UMonitor C:\WINDOWS\SYSTEM\RqCLTC1.DLL: UMonitor C:\WINDOWS\SYSTEM\VUHELPER.DLL: UMonitor C:\WINDOWS\SYSTEM\HSFSUI08.DLL: UMonitor C:\WINDOWS\SYSTEM\mardo20.dll: UMonitor C:\WINDOWS\SYSTEM\WQVDMOD.DLL: UMonitor C:\WINDOWS\SYSTEM\WMOCK32.DLL: UMonitor C:\WINDOWS\SYSTEM\GPOUPPOL.DLL: UMonitor C:\WINDOWS\SYSTEM\MFRATING.DLL: UMonitor C:\WINDOWS\SYSTEM\NkTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\moc70.dll: UMonitor C:\WINDOWS\SYSTEM\Mpstery.dll: UMonitor C:\WINDOWS\SYSTEM\anmwprox.dll: UMonitor C:\WINDOWS\SYSTEM\VFRSION.DLL: UMonitor C:\WINDOWS\SYSTEM\TB2032.DLL: UMonitor C:\WINDOWS\SYSTEM\WRSDMOD.DLL: UMonitor C:\WINDOWS\SYSTEM\CUM.DLL: UMonitor C:\WINDOWS\SYSTEM\WISTREAM.DLL: UMonitor C:\WINDOWS\SYSTEM\djcxatm.dll: UMonitor C:\WINDOWS\SYSTEM\IDSETUP.DLL: UMonitor C:\WINDOWS\SYSTEM\IGROP.DLL: UMonitor C:\WINDOWS\SYSTEM\INNPSTUB.DLL: UMonitor C:\WINDOWS\SYSTEM\SEKIT416.DLL: UMonitor C:\WINDOWS\SYSTEM\UJDM32.DLL: UMonitor C:\WINDOWS\SYSTEM\NrTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\IXLOADER.DLL: UMonitor C:\WINDOWS\SYSTEM\UXER32.DLL: UMonitor C:\WINDOWS\SYSTEM\JLPL400.DLL: UMonitor C:\WINDOWS\SYSTEM\EDYSH7.DLL: UMonitor C:\WINDOWS\SYSTEM\RVCMQSVR.DLL: UMonitor C:\WINDOWS\SYSTEM\WYLP32T.DLL: UMonitor C:\WINDOWS\SYSTEM\MPXML3.DLL: UMonitor C:\WINDOWS\SYSTEM\KwMMCTRL.DLL: UMonitor C:\WINDOWS\SYSTEM\NySWAN32.DLL: UMonitor C:\WINDOWS\SYSTEM\DANMPNTW.DLL: UMonitor C:\WINDOWS\SYSTEM\TVOLHELP.DLL: UMonitor C:\WINDOWS\SYSTEM\RdCHED.DLL: UMonitor C:\WINDOWS\SYSTEM\dvcxatm.dll: UMonitor C:\WINDOWS\SYSTEM\MIVCP50.DLL: UMonitor C:\WINDOWS\SYSTEM\cnreak.dll: UMonitor C:\WINDOWS\SYSTEM\mqvbvm60.dll: UMonitor C:\WINDOWS\SYSTEM\msg200.cpy.dll: UMonitor C:\WINDOWS\SYSTEM\HNFDOS08.DLL: UMonitor C:\WINDOWS\SYSTEM\SPTUPX.DLL: UMonitor C:\WINDOWS\SYSTEM\XWILEXR.DLL: UMonitor C:\WINDOWS\SYSTEM\DOTMLAccess.dll: UMonitor C:\WINDOWS\SYSTEM\mjxtrk.dll: UMonitor C:\WINDOWS\SYSTEM\SICDLL.DLL: UMonitor C:\WINDOWS\SYSTEM\CYYPTEXT.DLL: UMonitor C:\WINDOWS\SYSTEM\MHC30.DLL: UMonitor C:\WINDOWS\SYSTEM\mLpi32x.dll: UMonitor C:\WINDOWS\SYSTEM\CNMCTL32.DLL: UMonitor C:\WINDOWS\SYSTEM\MRG_HOOK.DLL: UMonitor C:\WINDOWS\SYSTEM\mujetoledb40.dll: UMonitor C:\WINDOWS\SYSTEM\QIAUTO.DLL: UMonitor C:\WINDOWS\SYSTEM\IUET16.DLL: UMonitor C:\WINDOWS\SYSTEM\MEIEFTP.DLL: UMonitor C:\WINDOWS\SYSTEM\DECVR.DLL: UMonitor C:\WINDOWS\SYSTEM\QRGR.DLL: UMonitor C:\WINDOWS\SYSTEM\PdPNDI.DLL: UMonitor C:\WINDOWS\SYSTEM\Svace.dll: UMonitor C:\WINDOWS\SYSTEM\NiTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\IaFRARED.DLL: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemTray"="SysTray.Exe" "WinPatrol"="C:\\PROGRAM FILES\\BILLP STUDIOS\\WINPATROL\\winpatrol.exe" "AOLWebutil"="\"C:\\PROGRAM FILES\\AMERICA ONLINE 7.0\\download\\webutil.exe\""  :rant: Computers [Charile Brown scream ARRRRGGGGHHHH] EM
Post #29
Ernie, You need to run Killbox and add these 4, mur2cenu.dll svdoclc.dll dabeng.dll gjtfile.dll If you can, don't turn the computer off after the reboot from Killbox, post right back with a new findit log.
Post #30
:thumbup: I was able to run killbox and reboot with out the system locking up. Here's the findit.log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 1631-1603 Directory of C:\WINDOWS\SYSTEM SVDOCLC DLL 227,104 03-18-05 4:22a SVDOCLC.DLL LFKRN10N DLL 227,104 03-18-05 4:22a lfkrn10N.dll DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL 3 file(s) 454,208 bytes 0 dir(s) 6,023.04 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 1631-1603 Directory of C:\WINDOWS\SYSTEM FOLDER HTT 13,122 03-22-05 1:16p folder.htt DESKTOP INI 266 03-22-05 1:16p desktop.ini RATINGS POL 8,192 03-17-05 1:53a RATINGS.POL DPNDI DLL 0 11-14-04 5:22a DpNDI.DLL HPF67H08 GID 8,628 05-11-04 3:36a hpf67h08.GID HPF67T08 GID 8,628 05-11-04 3:28a hpf67t08.GID HPF68H17 GID 8,628 04-29-04 4:39a HPF68h17.GID HPF68R17 GID 8,628 04-29-04 2:59a HPF68r17.GID HPF67T18 GID 8,628 08-16-03 7:42p HPF67t18.GID 9 file(s) 64,720 bytes 0 dir(s) 6,023.03 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{BA5F8E7F-49D1-5D57-F440-2637609D2135}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ folder.htt Tue Mar 22 2005 1:16:12p …H. 13,122 12.81 K desktop.ini Tue Mar 22 2005 1:16:12p …H. 266 0.26 K svdoclc.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K lfkrn10n.dll Fri Mar 18 2005 4:22:54a ..S.R 227,104 221.78 K ratings.pol Thu Mar 17 2005 1:53:44a …HR 8,192 8.00 K 5 items found: 5 files, 0 directories. Total of file sizes: 475,788 bytes 464.64 K ———— Strings.exe Qoologic Results ———— C:\WINDOWS\noanhe.dll: excl_urls=adsv2.delfinproject.com,popup.msn.com,i.emarketresearchgroup.com,u.clkoptimizer.com,ezula.com,ads2.revenue.net,banners.pennyweb.com,counters.honesty.com,ads.bidclix.com,oz.valueclick.com,radio.launch.yahoo.com,zone.msn.com,sr.adwave.com,xlime.offeroptimizer.com,clickit.go2net.com,us.update.companion.yahoo.com,kill-pop-ups.com,qksrv.net,clickspring.net,cdn-aimtoday.aol.com,search200.com,servedby.adscpm.com,xanga.com,count.exitexchange.com,jnictech.cjt1.net,xadsq.offeroptimizer.com,paypopup.com,popuptraffic.com,cdn-cf.aol.com,allaboutsearching.com,hotmail.msn.com,adfarm.mediaplex.com,by.optimost.com,amch.questionmarket.com,akapp.whenu.com,newupdates.lzio.com,cfg.mywebsearch.com,searcheffect.com,ads.delfinproject.com,master.mx-targeting.com,hotmail.com,ctl.twain-tech.com,mail.yahoo.com,m2.doubleclick.net,insider.msg.yahoo.com,focusin.ads.targetnet.com,e.rn11.com,jmnad1.com,topicks.com,ad.doubleclick.net,m3.doubleclick.net,as.casalemedia.com,pgq.yahoo.com,webpdp.gator.com,stopzilla.com,ayb.lop.com,xadso.offeroptimizer.com,download.smileycentral.com,mm.delfinproject.com,view.atdmt.com,delfinproject.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,as.adwave.com,popuppers.com,look2me.com,wisapidata.weatherbug.com,ads.addynamix.com,ar.atwola.com,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,weatherbug.com,jicmedia.cjt1.net,games.yahoo.com,adsrv.qoologic.com,servedby.advertising.com,ww2.weatherbug.com,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,mmm.media-motor.net,hop.clickbank.net,media76.fastclick.net,websearch.com,isapi60.weatherbug.com,web.tickle.com,messenger.zango.com,wwp.icq.com,smileycentral.com,adserv1.gruvmedia.com,cdn.icq.com,s.clkoptimizer.com,tv.180solutions.com,pops.browseraid.com,download.abetterinternet.com,adserv.internetfuel.com,messenger.msn.com,sr.websearch.com,top-banners.com,advert.runescape.com,join1.winhundred.com,odysseusmarketing.com,v4.windowsupdate.microsoft.com,adverts.lzio.com,windowsupdate.microsoft.com,filter.belkin.com,comcast.net,sc.musicmatch.com,license.hotbar.com,trk.pcsecurityshield.com,web.icq.com,whenusearch.com,jbigpops.cjt1.net,isg05.casalemedia.com,yahoo.com,aol.com,anrdoezrs.net,microsoft.com,target.com,aim-charts.pf.aol.com,download.websearch.com,actualdeals.com,images.trafficmp.com,mydailyhoroscope.net,couponage.com,c5.zedo.com,ekmas.com,ads.mydailyhoroscope.net,creativeby.viewpoint.com,affiliates.4lowrates.com,hits.clickandtrack.net,jcontent.bns1.net,clickserve.cc-dt.com,popups.ad-logics.com,adlog2.lzio.com,host239.ipowerweb.com,bv.channel.aol.com,img2.mailpostdirect.com,dw.dailywinner.net,toprebates.com,trk.bestmagsdirect.com,ads.clickagents.com,a.websponsors.com,sandboxer.com,media.fastclick.net,click2.containsitall.com,ads234.com,http300.edge.ru4.com,adlog.com.com,rs.websearch.com,ads.com.com,server.iad.liveperson.net, ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\JLSD400.DLL: UMonitor C:\WINDOWS\SYSTEM\WD32DLL.DLL: UMonitor C:\WINDOWS\SYSTEM\ONE32.DLL: UMonitor C:\WINDOWS\SYSTEM\MLSCMC32.DLL: UMonitor C:\WINDOWS\SYSTEM\CWFVIEW.DLL: UMonitor C:\WINDOWS\SYSTEM\CCM.DLL: UMonitor C:\WINDOWS\SYSTEM\CKUSALGO.DLL: UMonitor C:\WINDOWS\SYSTEM\MOI.DLL: UMonitor C:\WINDOWS\SYSTEM\IYVIDEO.DLL: UMonitor C:\WINDOWS\SYSTEM\STLSRV32.DLL: UMonitor C:\WINDOWS\SYSTEM\DHO350.DLL: UMonitor C:\WINDOWS\SYSTEM\MLVIDCTL.DLL: UMonitor C:\WINDOWS\SYSTEM\MWVIDCTL.DLL: UMonitor C:\WINDOWS\SYSTEM\OYECNV32.DLL: UMonitor C:\WINDOWS\SYSTEM\CZETCFG.DLL: UMonitor C:\WINDOWS\SYSTEM\OXESVR.DLL: UMonitor C:\WINDOWS\SYSTEM\DNNLOBBY.DLL: UMonitor C:\WINDOWS\SYSTEM\OZGFS400.DLL: UMonitor C:\WINDOWS\SYSTEM\VS5STKIT.DLL: UMonitor C:\WINDOWS\SYSTEM\OQBC32.DLL: UMonitor C:\WINDOWS\SYSTEM\SVLWAPI.DLL: UMonitor C:\WINDOWS\SYSTEM\MgTCP.DLL: UMonitor C:\WINDOWS\SYSTEM\DYVMGR32.DLL: UMonitor C:\WINDOWS\SYSTEM\CRDIAL32.DLL: UMonitor C:\WINDOWS\SYSTEM\IOSETUP.DLL: UMonitor C:\WINDOWS\SYSTEM\SKROBJ.DLL: UMonitor C:\WINDOWS\SYSTEM\mhxbse35.dll: UMonitor C:\WINDOWS\SYSTEM\VH40016.DLL: UMonitor C:\WINDOWS\SYSTEM\DXDIM.DLL: UMonitor C:\WINDOWS\SYSTEM\DMNMPNTW.DLL: UMonitor C:\WINDOWS\SYSTEM\CdGWIZ.DLL: UMonitor C:\WINDOWS\SYSTEM\RqCLTC1.DLL: UMonitor C:\WINDOWS\SYSTEM\VUHELPER.DLL: UMonitor C:\WINDOWS\SYSTEM\HSFSUI08.DLL: UMonitor C:\WINDOWS\SYSTEM\mardo20.dll: UMonitor C:\WINDOWS\SYSTEM\WQVDMOD.DLL: UMonitor C:\WINDOWS\SYSTEM\WMOCK32.DLL: UMonitor C:\WINDOWS\SYSTEM\GPOUPPOL.DLL: UMonitor C:\WINDOWS\SYSTEM\MFRATING.DLL: UMonitor C:\WINDOWS\SYSTEM\NkTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\moc70.dll: UMonitor C:\WINDOWS\SYSTEM\Mpstery.dll: UMonitor C:\WINDOWS\SYSTEM\anmwprox.dll: UMonitor C:\WINDOWS\SYSTEM\VFRSION.DLL: UMonitor C:\WINDOWS\SYSTEM\TB2032.DLL: UMonitor C:\WINDOWS\SYSTEM\WRSDMOD.DLL: UMonitor C:\WINDOWS\SYSTEM\CUM.DLL: UMonitor C:\WINDOWS\SYSTEM\WISTREAM.DLL: UMonitor C:\WINDOWS\SYSTEM\djcxatm.dll: UMonitor C:\WINDOWS\SYSTEM\IDSETUP.DLL: UMonitor C:\WINDOWS\SYSTEM\IGROP.DLL: UMonitor C:\WINDOWS\SYSTEM\INNPSTUB.DLL: UMonitor C:\WINDOWS\SYSTEM\SEKIT416.DLL: UMonitor C:\WINDOWS\SYSTEM\UJDM32.DLL: UMonitor C:\WINDOWS\SYSTEM\NrTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\IXLOADER.DLL: UMonitor C:\WINDOWS\SYSTEM\UXER32.DLL: UMonitor C:\WINDOWS\SYSTEM\JLPL400.DLL: UMonitor C:\WINDOWS\SYSTEM\EDYSH7.DLL: UMonitor C:\WINDOWS\SYSTEM\RVCMQSVR.DLL: UMonitor C:\WINDOWS\SYSTEM\WYLP32T.DLL: UMonitor C:\WINDOWS\SYSTEM\MPXML3.DLL: UMonitor C:\WINDOWS\SYSTEM\KwMMCTRL.DLL: UMonitor C:\WINDOWS\SYSTEM\NySWAN32.DLL: UMonitor C:\WINDOWS\SYSTEM\DANMPNTW.DLL: UMonitor C:\WINDOWS\SYSTEM\TVOLHELP.DLL: UMonitor C:\WINDOWS\SYSTEM\RdCHED.DLL: UMonitor C:\WINDOWS\SYSTEM\dvcxatm.dll: UMonitor C:\WINDOWS\SYSTEM\MIVCP50.DLL: UMonitor C:\WINDOWS\SYSTEM\cnreak.dll: UMonitor C:\WINDOWS\SYSTEM\mqvbvm60.dll: UMonitor C:\WINDOWS\SYSTEM\msg200.cpy.dll: UMonitor C:\WINDOWS\SYSTEM\HNFDOS08.DLL: UMonitor C:\WINDOWS\SYSTEM\SPTUPX.DLL: UMonitor C:\WINDOWS\SYSTEM\XWILEXR.DLL: UMonitor C:\WINDOWS\SYSTEM\DOTMLAccess.dll: UMonitor C:\WINDOWS\SYSTEM\mjxtrk.dll: UMonitor C:\WINDOWS\SYSTEM\SICDLL.DLL: UMonitor C:\WINDOWS\SYSTEM\CYYPTEXT.DLL: UMonitor C:\WINDOWS\SYSTEM\MHC30.DLL: UMonitor C:\WINDOWS\SYSTEM\mLpi32x.dll: UMonitor C:\WINDOWS\SYSTEM\CNMCTL32.DLL: UMonitor C:\WINDOWS\SYSTEM\MRG_HOOK.DLL: UMonitor C:\WINDOWS\SYSTEM\mujetoledb40.dll: UMonitor C:\WINDOWS\SYSTEM\QIAUTO.DLL: UMonitor C:\WINDOWS\SYSTEM\IUET16.DLL: UMonitor C:\WINDOWS\SYSTEM\MEIEFTP.DLL: UMonitor C:\WINDOWS\SYSTEM\DECVR.DLL: UMonitor C:\WINDOWS\SYSTEM\QRGR.DLL: UMonitor C:\WINDOWS\SYSTEM\PdPNDI.DLL: UMonitor C:\WINDOWS\SYSTEM\Svace.dll: UMonitor C:\WINDOWS\SYSTEM\NiTOS.DLL: UMonitor C:\WINDOWS\SYSTEM\IaFRARED.DLL: UMonitor REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemTray"="SysTray.Exe" "WinPatrol"="C:\\PROGRAM FILES\\BILLP STUDIOS\\WINPATROL\\winpatrol.exe"  The system is acting up again after that prior failed re-boot, it's now very slow. Thanks for all the help. EM

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI