What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Has My Hijackthis Been Hijacked?

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Help! I downloaded HijackThis 1.99, ran it, and went to save the log file. I got a message from McAfee telling me that a file in the HijackThis folder (couldn't tell what file) was infected with EXPLOIT=MhtRedir.gen. I was also told that I couldn't access the logfile in Notebook. I checked the folder, and the log file was nowhere to be found. What gives? –Tom vonHatten
Post #2
Since I'm bumping this, I've tried to run CWShredder with no luck. I've run the latest AdAware, and it came up with over 450 items to delete. When I try to quarantine and delete the files with AdAware, it hangs up in the quarantine stage and won't finish. About 20 of the items AdAware found are in smething called EEIEIS.exe, which can't be removed, because it is "in use by Windows". I wonder if that isn't hanging up AdAware. Anyway, I still can't print out a HJT log, because I get the virus message I mentioned earlier, followed by no file to copy from. This is getting really old really fast! –Tom vonHatten
Post #3
Holy I have the exact problem you do except I have nortons. My post is on the next page called "cant save logfile" Please someone help us! For me when i disabled the auto protect i was able to save my logfile and post it, but as soon as it turned on again, Nortons deleted the logfile…
Post #4
Hello Tom and welcome to TomCoyote. :wavey:

Before posting a log, please run these scans in Safe Mode and see if they will finish fixing the problem item.

How to reboot the computer into Safe Mode

* Restart the computer.
* As the computer restarts, press and hold down the F8 key until the Windows ME startup menu appears.
* Choose Safe mode from the startup menu, and then press Enter. Windows starts in Safe mode.



Please download and install Ad-Aware SE and Spybot S&D according to the following instructions. If you already have these programs, please make sure they are the latest version (Ad-Aware SE Personal 1.05, Spybot Search and Destroy 1.3), than run scans as described below.

Scanning With Spybot S&D;:

1. Downloaded and Install Spybot S&D; accepting the Default Settings.

2. In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.

3. Close ALL windows except Spybot S&D.

4. Click the button to ‘Search for Updates’ then download and install the Updates.

5. Next click the button ‘Check for Problems’

6. When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window.

7. Make certain there is a check mark beside all of the RED entries ONLY.

8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.

9.REBOOT to complete the scan and clear memory.

10. Do not enable Tea Timer until the log is clean as it will prevent the fix from working.


Scanning With Ad-Aware SE:

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan.

2.Close ALL windows except Ad-Aware SE.

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window.

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days


2) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file


3) Click on the ‘Advanced’ button on the left and select in green:

Under Shell Integration:
*Move deleted files to recycle bin

Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information

Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT


4) Click the ‘Tweak’ button and select in green:

Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only


Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot


Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list in logfile


5. Click on ‘Proceed’ to save the settings.

6. Click ‘Start’

*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.

7. Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.

8. If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window.

9. Save the log file when it asks and then click ‘finish’.

10. REBOOT to complete the removal of what Ad-Aware SE found.



To post the log you will have to do what tgcrosle suggested and disable McAfee. Scan with HijackThis, save the log, copy/paste it into this thread, then enable McAfee.
Post #5
I finally went and shut off Virus Scan, and tried HJT again…and got a log file to finally print. I haven't turned the Virus Scan back on yet, so here's what's on the file:

Logfile of HijackThis v1.99.1
Scan saved at 9:47:43 PM, on 3/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\TABLET.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\WVWWVQ.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\DELL\SOLUTION CENTER\SERVICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LTMSG.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON98.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
C:\WINDOWS\SYSTEM\ZNNGVJ.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\NAVISEARCH\BIN\NLS.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\PACKAGER.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\SAVIOR\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R3 - URLSearchHook: (no name) - {B21B6847-4A17-C1E5-A278-02504198DFDF} - ms-its.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Name - {D75EFD7F-C8E9-4E45-996C-38CBF1574213} - C:\WINDOWS\SYSTEM\MSLVM.DLL (file missing)
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\SYSTEM\IECUSTOM32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [AutoUpdater] c:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE
O4 - HKLM\..\Run: [pmr] C:\Program Files\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [OrbitUpdate] C:\Program Files\Orbit\update.exe
O4 - HKLM\..\Run: [95inf32w] C:\WINDOWS\SYSTEM\95inf32w.exe
O4 - HKLM\..\Run: [OrbitView] C:\Program Files\Orbit\view.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [xitdhcifgdbv] C:\WINDOWS\SYSTEM\znngvj.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wvwwvq.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [wormexe] prgsys0984.exe
O4 - HKLM\..\Run: [driver64] clamav.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tablet] C:\WINDOWS\SYSTEM\Tablet.exe
O4 - HKLM\..\RunServices: [APIBZ32.EXE] C:\WINDOWS\SYSTEM\APIBZ32.EXE
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ATLIEHELPER] Brong32.exe
O4 - HKCU\..\Run: [defect08] Shaitan1678.exe
O4 - HKCU\..\Run: [corrida] newbreed.exe
O4 - Startup: POWERR~1.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: hkhhkf.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra 'Tools' menuitem: IMI - {A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…8a29296baabe1d6
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=BRANDY
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://install.spywarelabs.com/landing/253…rapperouter.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03863ca7510940…ip/RdxIE601.cab
O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} - http://www.sitetracking.info/cttdl.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37

–Tom vonHatten
Post #6
You have quite a few nasty items in the log. Please do the scans I recommended above in Safe Mode to make the log more manageable.


Also run at least two of the following online virus scans making sure to reboot in between each one. Allow them to fix anything they find.
You need to use Internet Explorer or Netscape browsers.
Bitdefender
Pandasoftware
Trend Micro << Click Auto Clean
Symantec Security Check << click scan for viruses
RAV Online Virus Scanner << Enter your e-mail address and click on To continue without subscribing
McAfee

Write down anything that can not be fixed. Include the file name and the path to the file.


I'll have you fix a few items to allow a new log without interference from McAfee.
Open HijackThis,run a scan and check the following:

O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)

O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…8a29296baabe1d6
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://install.spywarelabs.com/landing/253…rapperouter.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03863ca7510940…ip/RdxIE601.cab
O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} - http://www.sitetracking.info/cttdl.cab

With all other programs and browsers closed, click fix checked.


Scan with HijackThis and post the new log as a reply to this thread. Include anything that can not be fixed by the online scans.
Post #7
I ran Spybot S&D in safe mode–no problem.

Ran Ad-Aware SE–it found 432 objects, and when I went to quarantine/delete them, it hung up in the quarantine phase of the operation. I left it there for over an hour without noting any change, so I saved a copy of the log to another file and killed it. I can post that log if you wish. I don't know why it's hanging up.

I ran another HJT scan after this. Here's that log:

Logfile of HijackThis v1.99.1
Scan saved at 6:24:03 PM, on 3/18/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\NAVISEARCH\BIN\NLS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\DESKTOP\SAVIOR\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - {B21B6847-4A17-C1E5-A278-02504198DFDF} - ms-its.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Name - {D75EFD7F-C8E9-4E45-996C-38CBF1574213} - C:\WINDOWS\SYSTEM\MSLVM.DLL (file missing)
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\SYSTEM\IECUSTOM32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [pmr] C:\Program Files\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [95inf32w] C:\WINDOWS\SYSTEM\95inf32w.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [xitdhcifgdbv] C:\WINDOWS\SYSTEM\znngvj.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wvwwvq.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [wormexe] prgsys0984.exe
O4 - HKLM\..\Run: [driver64] clamav.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tablet] C:\WINDOWS\SYSTEM\Tablet.exe
O4 - HKLM\..\RunServices: [APIBZ32.EXE] C:\WINDOWS\SYSTEM\APIBZ32.EXE
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autocheck
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ATLIEHELPER] Brong32.exe
O4 - HKCU\..\Run: [defect08] Shaitan1678.exe
O4 - HKCU\..\Run: [corrida] newbreed.exe
O4 - Startup: POWERR~1.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: hkhhkf.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…8a29296baabe1d6
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=BRANDY
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://install.spywarelabs.com/landing/253…rapperouter.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03863ca7510940…ip/RdxIE601.cab
O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} - http://www.sitetracking.info/cttdl.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37
Post #8
Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - {B21B6847-4A17-C1E5-A278-02504198DFDF} - ms-its.dll (file missing)

O2 - BHO: Name - {D75EFD7F-C8E9-4E45-996C-38CBF1574213} - C:\WINDOWS\SYSTEM\MSLVM.DLL (file missing)
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\SYSTEM\MSBE.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\SYSTEM\NVMS.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\SYSTEM\MSCB.DLL

O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\SYSTEM\IECUSTOM32.DLL

O4 - HKLM\..\Run: [pmr] C:\Program Files\Common Files\Presentia\pmr.exe
O4 - HKLM\..\Run: [95inf32w] C:\WINDOWS\SYSTEM\95inf32w.exe
O4 - HKLM\..\Run: [xitdhcifgdbv] C:\WINDOWS\SYSTEM\znngvj.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [wormexe] prgsys0984.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe
O4 - HKLM\..\RunServices: [APIBZ32.EXE] C:\WINDOWS\SYSTEM\APIBZ32.EXE
O4 - HKCU\..\Run: [ATLIEHELPER] Brong32.exe
O4 - HKCU\..\Run: [defect08] Shaitan1678.exe
O4 - HKCU\..\Run: [corrida] newbreed.exe
O4 - Startup: hkhhkf.exe

O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)

O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/templates/s/x.chm::/ad.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…8a29296baabe1d6
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=BRANDY
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44297DA} - http://install.spywarelabs.com/landing/253…rapperouter.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03863ca7510940…ip/RdxIE601.cab
O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} - http://www.sitetracking.info/cttdl.cab

O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37

With all other programs and browsers closed, click fix checked.


Step 2
Go to Add/Remove Programs and remove the following items (if found):

PowerStrip
EbatesMoeMoneyMaker


Step 3
Please set your computer to show all files.

* Double-click the My Computer icon on the Windows desktop.
* Select the Tools menu and click Folder Options. Select the View Tab.
* Uncheck the "Hide protected operating system files (recommended)" option.
* Under the Hidden files and folders heading select "Show hidden files and folders".
* On the View tab, uncheck the "Hide file extensions for known file types" option.
* Click Yes to confirm. Click OK.

You will need to reverse this process when all steps are done.


Step 4
Please delete the following files/folders:

C:\WINDOWS\SYSTEM\IECUSTOM32.DLL << File only
C:\WINDOWS\SYSTEM\95inf32w.exe << File only
C:\WINDOWS\SYSTEM\znngvj.exe << File only
C:\WINDOWS\FARMMEXT.exe << File only
C:\WINDOWS\SYSTEM\APIBZ32.EXE << File only


C:\Program Files\NaviSearch << Whole Folder
C:\Program Files\Ebates_MoeMoneyMaker << Whole Folder
C:\Program Files\Common Files\Presentia << Whole Folder



You'll need to search for these files with Explorer to delete. They may be in C:\WINDOWS\system32\ or C:\WINDOWS\
(Start > Search > All files and folders > More advanced options place a check in the first three boxes)

hkhhkf.exe
newbreed.exe
Shaitan1678.exe
Brong32.exe
prgsys0984.exe

If you have any problem deleting these files, reboot into Safe Mode and try again.
* Restart the computer.
* As the computer restarts, press and hold down the F8 key until the Windows 98/ME startup menu appears.
* Choose Safe mode from the startup menu, and then press Enter. Windows starts in Safe mode.


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #9
I was slightly out of sync with your posts, so I hope this gets it all straightened out…

First, I ran several of the online antivirus checks you recommended. The results were as follows:

–I ran Auto Clean at Trend Micro.

–From Symantec Security Check:

c:\_RESTORE\TEMP\A0009567.CPY is infected with Bloodhound.Exploit.6
c:\WINDOWS\Desktop\Savior\hijackthis\backups\backup-20050318-213023-820 is infected with Bloodhound.Exploit.6
c:\WINDOWS\TEMP\i30E0.TMP is infected with Downloader.Trojan
c:\WINDOWS\SYSTEM\mxbkup.exe is infected with Trojan.Flush.B

–From RAV Online Virus Scanner:

c:\ClrSchP071.exe - Backdoor:Win32/Ruledor.B -> Infected
c:\WINDOWS\Updreg.exe - TrojanDownloader:Win32/Agent.Z -> Infected
c:\WINDOWS\p_981116.exe - TrojanDownloader:Win32/Agent.Z -> Infected
c:\WINDOWS\clccli.dll - TrojanDownloader:Win32/Qoologic.E -> Infected
c:\WINDOWS\svohost.exe.$$$ - TrojanDownloader:Win32/Agent.Z -> Infected
c:\WINDOWS\bdl24126.exe - Trojan:Win32/Revop.C -> Infected
c:\WINDOWS\fzidg.dll - TrojanDownloader:Win32/WinShow.AK -> Infected
c:\WINDOWS\xwp.exe - TrojanDownloader:Win32/Agent.Z -> Infected
c:\WINDOWS\xwp.exe.bak - TrojanDownloader:Win32/Agent.Z -> Infected
c:\WINDOWS\UnstSA2.exe - TrojanDropper:Win32/Delf.Z -> Infected
c:\WINDOWS\winingt.ini - TrojanDownloader:Win32/Agent.J -> Infected
c:\WINDOWS\ssk.exe - TrojanDropper:Win32/Small.NF -> Infected
c:\WINDOWS\pwppwg.dat - TrojanDropper:Win32/Qoologic.C -> Infected
c:\WINDOWS\eieeis.dll - TrojanDownloader:Win32/Qoologic.D -> Infected
c:\WINDOWS\hlhhlx.exe - TrojanDownloader:Win32/Qoologic.F -> Infected
c:\WINDOWS\SYSTEM\POLALL1M.EXE->(CExe) - TrojanDownloader:Win32/Agent.AE -> Infected
c:\WINDOWS\SYSTEM\sysobj.exe - HackTool:Win32/Hidd.G -> Infected
c:\WINDOWS\SYSTEM\connmie.exe - Trojan:Win32/AdSearch.A -> Suspicious
c:\WINDOWS\SYSTEM\iecustme32.exe - TrojanDropper:Win32/StartPage.CC -> Infected
c:\WINDOWS\SYSTEM\AQZH0G6.EXE - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\istinstall_mpb1126.exe - TrojanDownloader:Win32/IstBar.BU -> Suspicious
c:\WINDOWS\SYSTEM\Ufq1.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\appsys.exe - TrojanDownloader:Win32/Delf.AU -> Infected
c:\WINDOWS\SYSTEM\AyeYd.exe - Backdoor:Win32/VB.QQ -> Infected
c:\WINDOWS\SYSTEM\Smf1iKZ.exe - Backdoor:Win32/VB.QQ -> Infected
c:\WINDOWS\SYSTEM\Dgw3.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\Pnzzd.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\Yhgy6.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\Tgr89m24.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\RkxWV.exe - Backdoor:Win32/VB.NB -> Infected
c:\WINDOWS\SYSTEM\iecustme.exe - TrojanDropper:Win32/StartPage.CC -> Infected
c:\WINDOWS\SYSTEM\iecustom32.dll - Trojan:Win32/StartPage.PU -> Infected
c:\WINDOWS\SYSTEM32\notepad.com - TrojanDownloader:Win32/Small.AAJ -> Infected
c:\WINDOWS\Start Menu\Programs\StartUp\hkhhkf.exe - TrojanDropper:Win32/Qoologic.C -> Infected
c:\WINDOWS\TEMP\cln9261.TMP->(UPXW) - TrojanDownloader:Win32/Dyfuca.J -> Infected
c:\WINDOWS\TEMP\i30E0.TMP - TrojanDownloader:Win32/Small.ID -> Infected
c:\WINDOWS\TEMP\THI5EED.TMP\twaintec.cab->twaintec.dll - TrojanSpy:Win32/BiSpy.C -> Infected
c:\WINDOWS\TEMP\THI40D7.TMP\twaintec.cab->polall1m.exe->(CExe) - TrojanDownloader:Win32/Agent.AE -> Infected
c:\WINDOWS\TEMP\THI40D7.TMP\polall1m.exe->(CExe) - TrojanDownloader:Win32/Agent.AE -> Infected
c:\WINDOWS\TEMP\THI6B6F.TMP\farmmext.cab->farmmext.exe - TrojanDownloader:Win32/Stubby.C -> Infected
c:\WINDOWS\TEMP\THI6B6F.TMP\farmmext.exe - TrojanDownloader:Win32/Stubby.C -> Infected
c:\WINDOWS\TEMP\THI40D1.TMP\btgrab.cab->polall1b.exe->(UPXW) - Trojan:Win32/Agent.BS -> Infected
c:\WINDOWS\TEMP\THI40D1.TMP\polall1b.exe->(UPXW) - Trojan:Win32/Agent.BS -> Infected
c:\WINDOWS\TEMP\THI612E.TMP\farmmext.cab->farmmext.exe - TrojanDownloader:Win32/Stubby.C -> Infected
c:\WINDOWS\TEMP\THI612E.TMP\farmmext.exe - TrojanDownloader:Win32/Stubby.C -> Infected
c:\WINDOWS\Temporary Internet Files\ISTactivex.dll - TrojanDownloader:Win32/IstBar.AG -> Infected
c:\WINDOWS\Temporary Internet Files\CONTENT.IE5\ELJKL8B2\nem214[1] - TrojanDownloader:Win32/Dyfuca.O -> Infected
c:\WINDOWS\Temporary Internet Files\CONTENT.IE5\OBZB6KP5\install[1] - TrojanDownloader:Win32/Dyf -> Infected
c:\WINDOWS\Desktop\Savior\hijackthis\backups\backup-20050318-213023-820 - Exploit:HTML/MhtRedir.gen* -> Infected
c:\_RESTORE\TEMP\A0009567.CPY - Exploit:HTML/MhtRedir.gen* -> Infected
c:\_RESTORE\TEMP\A0009655.CPY - TrojanDropper:Win32/Qoologic.C -> Infected
c:\TEMP\msbb.exe - Tool:Win32/180Solutions.5_11 -> Infected
c:\TEMP\Installer2.exe - TrojanDropper:Win32/Delf -> Infected
c:\TEMP\optimize.exe - TrojanDownloader:Win32/Dyfuca.CY -> Infected
c:\TEMP\FLEOK\msbb.exe - Tool:Win32/180Solutions.5_11 -> Infected

I then followed the instructions in your later post. Not all the files mentioned were there by this time, but those that were I got removed–had to go into Safe Mode to get zzngvj.exe removed.

Here's the latest HJT scan:

Logfile of HijackThis v1.99.1
Scan saved at 12:14:52 AM, on 3/19/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\DESKTOP\SAVIOR\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\DLMAX.DLL
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [driver64] clamav.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wvwwvq.exe
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [znngvj] c:\windows\system\znngvj.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tablet] C:\WINDOWS\SYSTEM\Tablet.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: POWERR~1.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: Ebates - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37
Post #11
Ran Find It as you suggested. Here's the file: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 07D1-081B Directory of C:\WINDOWS\SYSTEM AQZH0G6 EXE 435,818 02-17-04 6:38a AQZH0G6.EXE RKXWV EXE 442,382 02-10-04 4:11a RkxWV.exe TGR89M24 EXE 442,382 02-09-04 4:00a Tgr89m24.exe DGW3 EXE 442,382 02-08-04 1:45a Dgw3.exe YHGY6 EXE 442,382 02-07-04 12:34a Yhgy6.exe PNZZD EXE 442,382 02-06-04 1:08a Pnzzd.exe UFQ1 EXE 442,382 02-03-04 12:22p Ufq1.exe AYEYD EXE 225,294 01-27-04 8:11a AyeYd.exe SMF1IKZ EXE 225,294 01-27-04 8:11a Smf1iKZ.exe 9 file(s) 3,540,698 bytes 0 dir(s) 22,545.16 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 07D1-081B Directory of C:\WINDOWS\SYSTEM FOLDER HTT 23,155 03-14-05 6:22p FOLDER.HTT DESKTOP INI 271 03-14-05 6:22p DESKTOP.INI VX0 NLS 8,192 03-03-05 9:59p VX0.NLS VX3 NLS 8,192 03-03-05 9:59p VX3.NLS VX3X NLS 8,192 03-03-05 9:59p VX3X.NLS VX2 NLS 8,192 03-03-05 9:59p VX2.NLS VX2X NLS 8,192 03-03-05 9:59p VX2X.NLS VX1 NLS 8,192 03-03-05 9:59p VX1.NLS VX1X NLS 8,192 03-03-05 9:59p VX1X.NLS AQZH0G6 EXE 435,818 02-17-04 6:38a AQZH0G6.EXE RKXWV EXE 442,382 02-10-04 4:11a RkxWV.exe TGR89M24 EXE 442,382 02-09-04 4:00a Tgr89m24.exe DGW3 EXE 442,382 02-08-04 1:45a Dgw3.exe YHGY6 EXE 442,382 02-07-04 12:34a Yhgy6.exe PNZZD EXE 442,382 02-06-04 1:08a Pnzzd.exe UFQ1 EXE 442,382 02-03-04 12:22p Ufq1.exe AYEYD EXE 225,294 01-27-04 8:11a AyeYd.exe SMF1IKZ EXE 225,294 01-27-04 8:11a Smf1iKZ.exe FIZ1 87 01-26-04 10:49p fiz1 KYF DAT 1,861,320 01-26-04 9:57p kyf.dat TCAUDIAG GID 8,628 09-07-02 2:52p TCAUDIAG.GID 21 file(s) 5,491,503 bytes 0 dir(s) 22,545.13 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ vx1.nls Thu Mar 3 2005 9:59:16p …HR 8,192 8.00 K folder.htt Mon Mar 14 2005 6:22:16p …H. 23,155 22.61 K desktop.ini Mon Mar 14 2005 6:22:16p …H. 271 0.26 K vx1x.nls Thu Mar 3 2005 9:59:16p …HR 8,192 8.00 K vx2.nls Thu Mar 3 2005 9:59:20p …HR 8,192 8.00 K vx2x.nls Thu Mar 3 2005 9:59:20p …HR 8,192 8.00 K vx3.nls Thu Mar 3 2005 9:59:22p …HR 8,192 8.00 K vx0.nls Thu Mar 3 2005 9:59:26p …HR 8,192 8.00 K vx3x.nls Thu Mar 3 2005 9:59:22p …HR 8,192 8.00 K 9 items found: 9 files, 0 directories. Total of file sizes: 80,770 bytes 78.88 K ———— Strings.exe Qoologic Results ———— C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.G C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.C C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.B C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.A C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.G C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.C C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.B C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.A C:\WINDOWS\clccli.dll: updates.qoologic.com C:\WINDOWS\hnhhnk.dll: excl_urls=photobucket.com,c1.zedo.com,media.deskwizz.com,stats.eblocs.com,passportimages.com,banners.searchingbooth.com,ads234.com,click2.containsitall.com,media.fastclick.net,sandboxer.com,a.websponsors.com,ads.clickagents.com,trk.bestmagsdirect.com,toprebates.com,ad.doubleclick.net,as.casalemedia.com,m3.doubleclick.net,dw.dailywinner.net,img2.mailpostdirect.com,bv.channel.aol.com,adlog2.lzio.com,host239.ipowerweb.com,popups.ad-logics.com,clickserve.cc-dt.com,hits.clickandtrack.net,ads.mydailyhoroscope.net,c5.zedo.com,affiliates.4lowrates.com,couponage.com,ekmas.com,creativeby.viewpoint.com,mydailyhoroscope.net,images.trafficmp.com,actualdeals.com,download.websearch.com,aim-charts.pf.aol.com,aol.com,target.com,yahoo.com,microsoft.com,anrdoezrs.net,isg05.casalemedia.com,jbigpops.cjt1.net,whenusearch.com,trk.pcsecurityshield.com,license.hotbar.com,web.icq.com,sc.musicmatch.com,comcast.net,filter.belkin.com,clickit.go2net.com,adverts.lzio.com,windowsupdate.microsoft.com,v4.windowsupdate.microsoft.com,odysseusmarketing.com,join1.winhundred.com,advert.runescape.com,top-banners.com,sr.websearch.com,messenger.msn.com,download.abetterinternet.com,adserv.internetfuel.com,pops.browseraid.com,banners.pennyweb.com,tv.180solutions.com,s.clkoptimizer.com,adserv1.gruvmedia.com,cdn.icq.com,messenger.zango.com,smileycentral.com,wwp.icq.com,web.tickle.com,isapi60.weatherbug.com,websearch.com,hop.clickbank.net,media76.fastclick.net,mmm.media-motor.net,rightmedia.net,bannerserver.gator.com,www4.yesadvertising.com,ww2.weatherbug.com,servedby.advertising.com,adsrv.qoologic.com,games.yahoo.com,weatherbug.com,jicmedia.cjt1.net,ad.trafficmp.com,updates.qoologic.com,ads1.revenue.net,ar.atwola.com,ads.addynamix.com,wisapidata.weatherbug.com,popuppers.com,as.adwave.com,look2me.com,jbns2.cydoor.com,bannerfarm.ace.advertising.com,delfinproject.com,view.atdmt.com,mm.delfinproject.com,download.smileycentral.com,xadso.offeroptimizer.com,webpdp.gator.com,ayb.lop.com,stopzilla.com,pgq.yahoo.com,jmnad1.com,topicks.com,e.rn11.com,focusin.ads.targetnet.com,insider.msg.yahoo.com,m2.doubleclick.net,mail.yahoo.com,jcontent.bns1.net,ctl.twain-tech.com,master.mx-targeting.com,hotmail.com,searcheffect.com,ads.delfinproject.com,cfg.mywebsearch.com,akapp.whenu.com,newupdates.lzio.com,allaboutsearching.com,amch.questionmarket.com,adfarm.mediaplex.com,hotmail.msn.com,by.optimost.com,cdn-cf.aol.com,paypopup.com,popuptraffic.com,xadsq.offeroptimizer.com,jnictech.cjt1.net,xanga.com,count.exitexchange.com,servedby.adscpm.com,search200.com,cdn-aimtoday.aol.com,kill-pop-ups.com,us.update.companion.yahoo.com,qksrv.net,clickspring.net,xlime.offeroptimizer.com,sr.adwave.com,zone.msn.com,radio.launch.yahoo.com,ads.bidclix.com,counters.honesty.com,oz.valueclick.com,i.emarketresearchgroup.com,ads2.revenue.net,popup.msn.com,adsv2.delfinproject.com,u.clkoptimizer.com,ezula.com,server.iad.liveperson.net,loadingwebsite.com,pan-advert.com,t.trafficmp.com,clicktrk.com,aaabesthomepage.com,ads.exitexchange.com,us.a1.yimg.com,trafficmp.com,yimg.com,a.as-us.falkag.net,a1.yimg.com,z1.adserver.com,falkag.net,as-us.falkag.net,loginnet.passport.com,ads.inet1.com,pagead2.googlesyndication.com,login.passport.net,v8.alwaysupdatednews.com,adv.eblocs.com,alwaysupdatednews.com,fxfeeds.mozilla.org,cdn.aim.com,ar.atwola.com,c4.maxserving.com,maxserving.com,mediaplex.com,altfarm.mediaplex.com,topmoxie.com,global.msads.net,msads.net,banner.goldenpalace.com,goldenpalace.com,us.i1.yimg.com,cdn.comcast.net,us.yimg.com,us.js1.yimg.com,js1.yimg.com,switch.atdmt.com,atdmt.com,update32.searchmiracle.com,onemoresearch.net, C:\WINDOWS\eieeis.dll: updates.qoologic.com C:\WINDOWS\hlhhlx.exe: updates.qoologic.com ————– Strings.exe Aspack Results ————- C:\WINDOWS\abi.exe: .aspack C:\WINDOWS\pwppwg.dat: .aspack C:\WINDOWS\qool.exe: .aspack C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\wvwwvq.exe: .aspack C:\WINDOWS\SYSTEM\iecustme32.exe: aspack C:\WINDOWS\SYSTEM\appsys.exe: .aspack C:\WINDOWS\SYSTEM\iecustme.exe: aspack C:\WINDOWS\Start Menu\Programs\StartUp\hkhhkf.exe: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s" "SystemTray"="SysTray.Exe" "TCASUTIEXE"="TCAUDIAG -off" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "DellSC"="C:\\Program Files\\Dell\\Solution Center\\service.exe" "Speed racer"="C:\\Program Files\\Creative\\PlayCenter\\CTSRReg.exe" "LTWinModem1"="ltmsg.exe 9" "MULTIMEDIA KEYBOARD"="C:\\Program Files\\Netropa\\Multimedia Keyboard\\MMKeybd.exe" "projselector"="\"C:\\Program Files\\Common Files\\Roxio Shared\\Project Selector\\projselector.exe\" -r" "RoxioEngineUtility"="\"C:\\Program Files\\Common Files\\Roxio Shared\\System\\EngUtil.exe\"" "RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\DragToDisc\\DrgToDsc.exe\"" "RoxioAudioCentral"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\AudioCentral\\RxMon.exe\"" "Sunkist"="C:\\Program Files\\Multimedia Card Reader\\shwicon98.exe" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvMcTray.dll,NvTaskbarInit" "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "driver64"="clamav.exe" "Win Server Updt"="C:\\WINDOWS\\wupdt.exe" "Narrator"="C:\\WINDOWS\\wvwwvq.exe" "znngvj"="c:\\windows\\system\\znngvj.exe" "FARMMEXT"="C:\\WINDOWS\\FARMMEXT.exe" "EbatesMoeMoneyMaker0"="\"C:\\PROGRAM FILES\\EBATES_MOEMONEYMAKER\\EbatesMoeMoneyMaker0.exe\"" "devldr16.exe"="C:\\WINDOWS\\SYSTEM\\devldr16.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 
Post #12
  • Please download the Killbox.
  • Unzip it to the desktop but do NOT run it yet.
  • Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.
  • Once in Safe Mode, please run Killbox.
  • Click "Replace on Reboot" and check the "Use Dummy" box.
  • Paste the following into the top "Full Path of File to Delete" box.
    • C:\WINDOWS\clccli.dll
  • Click the red-and-white "Delete File".
  • Click "Yes" at the Replace on Reboot prompt.
  • Click "No" at the Pending Operations prompt.
  • Repeat steps 5-9 above for these files:
    • C:\WINDOWS\hnhhnk.dll
    • C:\WINDOWS\eieeis.dll
    • C:\WINDOWS\hlhhlx.exe
    • C:\WINDOWS\pwppwg.dat
    • C:\WINDOWS\qool.exe
    • C:\WINDOWS\wvwwvq.exe
    • C:\WINDOWS\SYSTEM\iecustme32.exe
    • C:\WINDOWS\SYSTEM\appsys.exe
    • C:\WINDOWS\SYSTEM\iecustme.exe
  • Click "Replace on Reboot" and check the "Use Dummy" box.
  • Paste the following file into the top "Full Path of File to Delete" box.
    • C:\WINDOWS\Start Menu\Programs\StartUp\hkhhkf.exe
  • Click the red-and-white "Delete File" button.
  • Click "Yes" at the Replace on Reboot prompt.
  • Click "Yes" at the Pending Operations prompt to restart your computer. You do not need to reboot into Safe Mode this time.
  • When your computer reboots, please run FindIt.bat again and post the new log here.
Post #13
Ran the Killbox in Safe Mode. Didn't get the "Pending Operations" prompt, but everything else seemd to run correctly, so I kept putting in sucessive files, and I got indications that replacements were being made during the restart. Got a message during boot up that "C:\WINDOWS\Start Menu\Programs\StartUp\HKHHKF.EXE is not a valid Win32 application". My IE browser window is no longer wordwrapping test strings in the forum postings, so I have to scroll from side-to-side to read them. Ran FindIt.bat again. Here's the file: ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 07D1-081B Directory of C:\WINDOWS\SYSTEM AQZH0G6 EXE 435,818 02-17-04 6:38a AQZH0G6.EXE RKXWV EXE 442,382 02-10-04 4:11a RkxWV.exe TGR89M24 EXE 442,382 02-09-04 4:00a Tgr89m24.exe DGW3 EXE 442,382 02-08-04 1:45a Dgw3.exe YHGY6 EXE 442,382 02-07-04 12:34a Yhgy6.exe PNZZD EXE 442,382 02-06-04 1:08a Pnzzd.exe UFQ1 EXE 442,382 02-03-04 12:22p Ufq1.exe AYEYD EXE 225,294 01-27-04 8:11a AyeYd.exe SMF1IKZ EXE 225,294 01-27-04 8:11a Smf1iKZ.exe 9 file(s) 3,540,698 bytes 0 dir(s) 22,586.50 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 07D1-081B Directory of C:\WINDOWS\SYSTEM FOLDER HTT 23,155 03-14-05 6:22p FOLDER.HTT DESKTOP INI 271 03-14-05 6:22p DESKTOP.INI VX0 NLS 8,192 03-03-05 9:59p VX0.NLS VX3 NLS 8,192 03-03-05 9:59p VX3.NLS VX3X NLS 8,192 03-03-05 9:59p VX3X.NLS VX2 NLS 8,192 03-03-05 9:59p VX2.NLS VX2X NLS 8,192 03-03-05 9:59p VX2X.NLS VX1 NLS 8,192 03-03-05 9:59p VX1.NLS VX1X NLS 8,192 03-03-05 9:59p VX1X.NLS AQZH0G6 EXE 435,818 02-17-04 6:38a AQZH0G6.EXE RKXWV EXE 442,382 02-10-04 4:11a RkxWV.exe TGR89M24 EXE 442,382 02-09-04 4:00a Tgr89m24.exe DGW3 EXE 442,382 02-08-04 1:45a Dgw3.exe YHGY6 EXE 442,382 02-07-04 12:34a Yhgy6.exe PNZZD EXE 442,382 02-06-04 1:08a Pnzzd.exe UFQ1 EXE 442,382 02-03-04 12:22p Ufq1.exe AYEYD EXE 225,294 01-27-04 8:11a AyeYd.exe SMF1IKZ EXE 225,294 01-27-04 8:11a Smf1iKZ.exe FIZ1 87 01-26-04 10:49p fiz1 KYF DAT 1,861,320 01-26-04 9:57p kyf.dat TCAUDIAG GID 8,628 09-07-02 2:52p TCAUDIAG.GID 21 file(s) 5,491,503 bytes 0 dir(s) 22,586.47 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ vx1.nls Thu Mar 3 2005 9:59:16p …HR 8,192 8.00 K folder.htt Mon Mar 14 2005 6:22:16p …H. 23,155 22.61 K desktop.ini Mon Mar 14 2005 6:22:16p …H. 271 0.26 K vx1x.nls Thu Mar 3 2005 9:59:16p …HR 8,192 8.00 K vx2.nls Thu Mar 3 2005 9:59:20p …HR 8,192 8.00 K vx2x.nls Thu Mar 3 2005 9:59:20p …HR 8,192 8.00 K vx3.nls Thu Mar 3 2005 9:59:22p …HR 8,192 8.00 K vx0.nls Thu Mar 3 2005 9:59:26p …HR 8,192 8.00 K vx3x.nls Thu Mar 3 2005 9:59:22p …HR 8,192 8.00 K 9 items found: 9 files, 0 directories. Total of file sizes: 80,770 bytes 78.88 K ———— Strings.exe Qoologic Results ———— C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.G C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.C C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.B C:\WINDOWS\VPTNFILE.504: TROJ_QOOLOGIC.A C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.G C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.C C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.B C:\WINDOWS\LPT$VPN.504: TROJ_QOOLOGIC.A ————– Strings.exe Aspack Results ————- C:\WINDOWS\abi.exe: .aspack C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- C:\WINDOWS\SYSTEM\ipebase12.dll: ??0ECalMonitor@@QAE@PAUMONITOR_CAL@@@Z REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PCHealth"="C:\\WINDOWS\\PCHealth\\Support\\PCHSchd.exe -s" "SystemTray"="SysTray.Exe" "TCASUTIEXE"="TCAUDIAG -off" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "DellSC"="C:\\Program Files\\Dell\\Solution Center\\service.exe" "Speed racer"="C:\\Program Files\\Creative\\PlayCenter\\CTSRReg.exe" "LTWinModem1"="ltmsg.exe 9" "MULTIMEDIA KEYBOARD"="C:\\Program Files\\Netropa\\Multimedia Keyboard\\MMKeybd.exe" "projselector"="\"C:\\Program Files\\Common Files\\Roxio Shared\\Project Selector\\projselector.exe\" -r" "RoxioEngineUtility"="\"C:\\Program Files\\Common Files\\Roxio Shared\\System\\EngUtil.exe\"" "RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\DragToDisc\\DrgToDsc.exe\"" "RoxioAudioCentral"="\"C:\\Program Files\\Roxio\\Easy CD Creator 6\\AudioCentral\\RxMon.exe\"" "Sunkist"="C:\\Program Files\\Multimedia Card Reader\\shwicon98.exe" "QuickTime Task"="\"C:\\WINDOWS\\SYSTEM\\QTTASK.EXE\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\SYSTEM\\NvMcTray.dll,NvTaskbarInit" "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "driver64"="clamav.exe" "Win Server Updt"="C:\\WINDOWS\\wupdt.exe" "Narrator"="C:\\WINDOWS\\wvwwvq.exe" "znngvj"="c:\\windows\\system\\znngvj.exe" "FARMMEXT"="C:\\WINDOWS\\FARMMEXT.exe" "devldr16.exe"="C:\\WINDOWS\\SYSTEM\\devldr16.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 
Post #14
Open Killbox, go to the File menu, and choose "Delete all Dummy Files". Reboot into Safe Mode and scan with Adaware SE. See if it will allow you to fix everything now. Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Post #15
Sorry for the slow response. I was in CA on business the past several days. My daughters use this PC, so I don't know if they've brought in anything accidentally.

Did as you instructed. Here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 9:14:35 PM, on 3/22/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\TABLET.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\DELL\SOLUTION CENTER\SERVICE.EXE
C:\WINDOWS\SYSTEM\LTMSG.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\PROGRAM FILES\MULTIMEDIA CARD READER\SHWICON98.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\ZNNGVJ.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\DESKTOP\SAVIOR\HIJACKTHIS\HIJACKTHIS.EXE

R3 - Default URLSearchHook is missing
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\DLMAX.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [DellSC] C:\Program Files\Dell\Solution Center\service.exe
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [projselector] "C:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [Sunkist] C:\Program Files\Multimedia Card Reader\shwicon98.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [driver64] clamav.exe
O4 - HKLM\..\Run: [znngvj] c:\windows\system\znngvj.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [Tablet] C:\WINDOWS\SYSTEM\Tablet.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: POWERR~1.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: HKHHKF.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.dellnet.com (file missing) (HKCU)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted IP range: 206.161.125.149
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/default/R…bGameLoader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: WebWorks Help 2.0 - file://C:\Program Files\procreate Painter Classic\Help\wwhelp2.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedCon…bin/AvSniff.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.84,195.225.176.37

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI