Hijack Log - Systb.dll, Okxahj And Others Won't De

bump. thanks for looking.

Hello deenab , Welcome to the forum.

This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

LDTate - Thanks for the help. I'll work on this today.

OK.

I ran another Panda scan today. This is after the adaware scan. Here is the report. Incident Status Location Adware:Adware/Transponder No disinfected C:\WINDOWS\PYNIX.DLL Adware:Adware/IPInsight No disinfected C:\WINDOWS\FARMMEXT.EXE Adware:Adware/nCase No disinfected C:\WINDOWS\SYSTEM\FLEOK Adware:Adware/SideSearch No disinfected C:\WINDOWS\Application Data\Lycos Adware:Adware/IPInsight No disinfected C:\WINDOWS\FARMMEXT.exe Adware:Adware/Twain-Tech No disinfected C:\windows\TEMP\THI*.tmp Spyware:Spyware/Virtumonde No disinfected C:\WINDOWS\dpusys.ini Adware:Adware/Transponder No disinfected C:\WINDOWS\PYNIX.DLL Possible Virus. No disinfected C:\PIPEPLUS\EUDORA\EUDORA.EXE Virus:W32/Badtrans.B Disinfected C:\PIPEPLUS\EUDORA\Trash.mbx[~000370.@x@][~000000.@x@][YOU_are_FAT!.MP3.scr] Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI3320.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI727C.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4CE9.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4CE9.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI14C3.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI14C3.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI2424.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI2424.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4432.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4432.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI51FD.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI51FD.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4F1E.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4F1E.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI32FB.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI32FB.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4746.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4746.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI65DE.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI65DE.TMP\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI5759.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI5759.TMP\farmmext.exe Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI486.TMP\pynix.cab[Pynix.inf] Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI486.TMP\pynix.cab[Pynix.dll] Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI486.TMP\pynix.cab[spike.exe] Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI486.TMP\Pynix.inf Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI486.TMP\Pynix.dll Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\DrTemp\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\DrTemp\farmmext.exe Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI14DC.TMP\farmmext.inf Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI14DC.TMP\farmmext.exe Adware:Adware/Transponder No disinfected C:\WINDOWS\INF\PYNIX.INF Adware:Adware/IPInsight No disinfected C:\WINDOWS\FARMMEXT.EXE Adware:Adware/Transponder No disinfected C:\WINDOWS\PYNIX.DLL Spyware:Spyware/New.net No disinfected C:\Program Files\FileSubmit\HELLO KITTY - Fairy Kitty Active Wallpaper\nnez_388.exe

I suggest you do this:

Run HijackThis again and put a check by these.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - Default URLSearchHook is missing

F1 - win.ini: run=c:\windows\options\systools\cyxid98.exe

O2 - BHO: (no name) - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL

O4 - HKLM\..\Run: [okxahj] c:\windows\system\okxahj.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe

O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart in Safe Mode:
Restart your computer.

Press the F8 key until the startup menu appears.

Choose the Safe Mode option then press Enter.


Search for and delete these files if listed:
c:\windows\options\systools\cyxid98.exe
C:\WINDOWS\PYNIX.DLL
c:\windows\system\okxahj.exe
C:\WINDOWS\FARMMEXT.exe




To configure Windows to show all files

Do the following:
In Windows, on the Windows desktop, double-click the My Computer icon.

On the Tools menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.

Uncheck Hide protected operating system files. Then, under the "Hidden files" folder, click Show hidden files and folders.
If you see a warning message, click Yes.
Click Apply.
Click OK.




Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

I suggest you do this:

Run HijackThis again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL

O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


Search for and delete these files if listed:
C:\WINDOWS\wupdt.exe




Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

I suggest you do this:

Run Hijack This again and put a check by these.

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

Close ALL windows and browsers except HijackThis and click "Fix checked"




Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Good Job

Log looks good

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

MANY THANKS for all your help. I just made a donation to the site via PayPal. Keep up the great work! deenab