What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help With Hijackthis Log

24 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm getting all kinds of pop-ups and have run ad-aware and spyboy s&d to no avail.

Attached is my first HJT log.

Thanks for your help.

Logfile of HijackThis v1.97.7
Scan saved at 7:39:52 PM, on 3/24/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASSK.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\PROGRAM FILES\TOOLBAR\PIB.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\PROGRAM FILES\TOOLBAR\TBPS.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Media Pass] C:\PROGRAM FILES\MEDIA PASS\MediaPassK.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\TOOLBAR\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKCU\..\Run: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\RunServices: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\RunOnce: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Ebates (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8326.2298032407
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
Post #3
Attached is a new scan log from the latest HijackThis and a log from Find L-2m.

Logfile of HijackThis v1.99.1
Scan saved at 2:10:21 PM, on 3/25/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\TOOLBAR\TBPS.EXE
C:\PROGRAM FILES\TOOLBAR\PIB.EXE
C:\PROGRAM FILES\TOOLBAR\RADIO.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASSK.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASS.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [Media Pass] C:\PROGRAM FILES\MEDIA PASS\MediaPassK.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\TOOLBAR\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServicesOnce: [TBPS] C:\PROGRA~1\TOOLBAR\TBPS.exe /boot
O4 - HKLM\..\RunServicesOnce: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE /boot
O4 - HKCU\..\Run: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\RunServices: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\RunOnce: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL


L-2m log file

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»»» Files found in System »»»»»»»»»»»»»»»»»»»»»»»

* IsProcessorFeaX C:\WINDOWS\system\RAASETUP.DLL
* IsProcessorFeaX C:\WINDOWS\system\RHCLTC3.DLL
* IsProcessorFeaX C:\WINDOWS\system\LOCMP70N.DLL
* IsProcessorFeaX C:\WINDOWS\system\DMOUND.DLL
* IsProcessorFeaX C:\WINDOWS\system\DYUSIC.DLL
* IsProcessorFeaX C:\WINDOWS\system\MOR2C.DLL
* IsProcessorFeaX C:\WINDOWS\system\DEWSOCKX.DLL
* IsProcessorFeaX C:\WINDOWS\system\DVTIME.DLL
* IsProcessorFeaX C:\WINDOWS\system\TKD32.DLL
* IsProcessorFeaX C:\WINDOWS\system\MBLTUS40.DLL
* IsProcessorFeaX C:\WINDOWS\system\HBSETUP.DLL
* IsProcessorFeaX C:\WINDOWS\system\PIPNDI.DLL
* IsProcessorFeaX C:\WINDOWS\system\TFOLHELP.DLL
* IsProcessorFeaX C:\WINDOWS\system\OFGFS400.DLL
* IsProcessorFeaX C:\WINDOWS\system\DT7VB.DLL
* IsProcessorFeaX C:\WINDOWS\system\QBENCLIB.DLL
* IsProcessorFeaX C:\WINDOWS\system\CJS1722.DLL
* IsProcessorFeaX C:\WINDOWS\system\ATVAPI32.DLL
* IsProcessorFeaX C:\WINDOWS\system\DDNPUT.DLL
* IsProcessorFeaX C:\WINDOWS\system\HJZSTSIN.DLL
* IsProcessorFeaX C:\WINDOWS\system\DWMSSHRN.DLL
* IsProcessorFeaX C:\WINDOWS\system\DNSPEX.DLL
* IsProcessorFeaX C:\WINDOWS\system\WYPDXM.DLL
* IsProcessorFeaX C:\WINDOWS\system\HTINV.DLL
* IsProcessorFeaX C:\WINDOWS\system\EBENU.DLL
* IsProcessorFeaX C:\WINDOWS\system\EDSHARED.DLL
* IsProcessorFeaX C:\WINDOWS\system\DND9.DLL
* IsProcessorFeaX C:\WINDOWS\system\SCTUPWBV.DLL
* IsProcessorFeaX C:\WINDOWS\system\OYTWA400.DLL
* IsProcessorFeaX C:\WINDOWS\system\DJDMO.DLL
* IsProcessorFeaX C:\WINDOWS\system\MDBSYNC.DLL
* IsProcessorFeaX C:\WINDOWS\system\MYPI.DLL
* IsProcessorFeaX C:\WINDOWS\system\HAINK.DLL
* IsProcessorFeaX C:\WINDOWS\system\ILV16.DLL
* IsProcessorFeaX C:\WINDOWS\system\EMHSIG.DLL
* IsProcessorFeaX C:\WINDOWS\system\RNCLTC3.DLL
* IsProcessorFeaX C:\WINDOWS\system\HRAGENT.DLL
* IsProcessorFeaX C:\WINDOWS\system\BBOWSELC.DLL
* IsProcessorFeaX C:\WINDOWS\system\MUSCP.DLL
* IsProcessorFeaX C:\WINDOWS\system\IRSS.DLL
* IsProcessorFeaX C:\WINDOWS\system\SPNS.DLL
* IsProcessorFeaX C:\WINDOWS\system\DN290USD.DLL


* Nictechnetworks+ C:\WINDOWS\system\RAASETUP.DLL
* Nictechnetworks+ C:\WINDOWS\system\RHCLTC3.DLL
* Nictechnetworks+ C:\WINDOWS\system\LOCMP70N.DLL
* Nictechnetworks+ C:\WINDOWS\system\DMOUND.DLL
* Nictechnetworks+ C:\WINDOWS\system\DYUSIC.DLL
* Nictechnetworks+ C:\WINDOWS\system\MOR2C.DLL
* Nictechnetworks+ C:\WINDOWS\system\DEWSOCKX.DLL
* Nictechnetworks+ C:\WINDOWS\system\DVTIME.DLL
* Nictechnetworks+ C:\WINDOWS\system\TKD32.DLL
* Nictechnetworks+ C:\WINDOWS\system\MBLTUS40.DLL
* Nictechnetworks+ C:\WINDOWS\system\HBSETUP.DLL
* Nictechnetworks+ C:\WINDOWS\system\PIPNDI.DLL
* Nictechnetworks+ C:\WINDOWS\system\TFOLHELP.DLL
* Nictechnetworks+ C:\WINDOWS\system\OFGFS400.DLL
* Nictechnetworks+ C:\WINDOWS\system\DT7VB.DLL
* Nictechnetworks+ C:\WINDOWS\system\QBENCLIB.DLL
* Nictechnetworks+ C:\WINDOWS\system\CJS1722.DLL
* Nictechnetworks+ C:\WINDOWS\system\ATVAPI32.DLL
* Nictechnetworks+ C:\WINDOWS\system\DDNPUT.DLL
* Nictechnetworks+ C:\WINDOWS\system\HJZSTSIN.DLL
* Nictechnetworks+ C:\WINDOWS\system\DWMSSHRN.DLL
* Nictechnetworks+ C:\WINDOWS\system\DNSPEX.DLL
* Nictechnetworks+ C:\WINDOWS\system\WYPDXM.DLL
* Nictechnetworks+ C:\WINDOWS\system\HTINV.DLL
* Nictechnetworks+ C:\WINDOWS\system\EBENU.DLL
* Nictechnetworks+ C:\WINDOWS\system\EDSHARED.DLL
* Nictechnetworks+ C:\WINDOWS\system\DND9.DLL
* Nictechnetworks+ C:\WINDOWS\system\SCTUPWBV.DLL
* Nictechnetworks+ C:\WINDOWS\system\OYTWA400.DLL
* Nictechnetworks+ C:\WINDOWS\system\DJDMO.DLL
* Nictechnetworks+ C:\WINDOWS\system\MDBSYNC.DLL
* Nictechnetworks+ C:\WINDOWS\system\MYPI.DLL
* Nictechnetworks+ C:\WINDOWS\system\HAINK.DLL
* Nictechnetworks+ C:\WINDOWS\system\ILV16.DLL
* Nictechnetworks+ C:\WINDOWS\system\EMHSIG.DLL
* Nictechnetworks+ C:\WINDOWS\system\RNCLTC3.DLL
* Nictechnetworks+ C:\WINDOWS\system\HRAGENT.DLL
* Nictechnetworks+ C:\WINDOWS\system\BBOWSELC.DLL
* Nictechnetworks+ C:\WINDOWS\system\MUSCP.DLL
* Nictechnetworks+ C:\WINDOWS\system\IRSS.DLL
* Nictechnetworks+ C:\WINDOWS\system\SPNS.DLL
* Nictechnetworks+ C:\WINDOWS\system\DN290USD.DLL
Post #4
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Post #6
Please download the killbox from here.
http://www.downloads.subratam.org/KillBox.zip

Unzip the program, and Double-Click the program. Select 'Delete on Reboot'.

Now copy and paste the following line into the 'Full Pate to Delete File' Box

C:\WINDOWS\system\RAASETUP.DLL

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button.

A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; once you reach the last file select YES on the second dialog box.


C:\WINDOWS\system\RHCLTC3.DLL
C:\WINDOWS\system\LOCMP70N.DLL
C:\WINDOWS\system\DMOUND.DLL
C:\WINDOWS\system\DYUSIC.DLL
C:\WINDOWS\system\MOR2C.DLL
C:\WINDOWS\system\DEWSOCKX.DLL
C:\WINDOWS\system\DVTIME.DLL
C:\WINDOWS\system\TKD32.DLL
C:\WINDOWS\system\MBLTUS40.DLL
C:\WINDOWS\system\HBSETUP.DLL
C:\WINDOWS\system\PIPNDI.DLL
C:\WINDOWS\system\TFOLHELP.DLL
C:\WINDOWS\system\OFGFS400.DLL
C:\WINDOWS\system\DT7VB.DLL
C:\WINDOWS\system\QBENCLIB.DLL
C:\WINDOWS\system\CJS1722.DLL
C:\WINDOWS\system\ATVAPI32.DLL
C:\WINDOWS\system\DDNPUT.DLL
C:\WINDOWS\system\HJZSTSIN.DLL
C:\WINDOWS\system\DWMSSHRN.DLL
C:\WINDOWS\system\DNSPEX.DLL
C:\WINDOWS\system\WYPDXM.DLL
C:\WINDOWS\system\HTINV.DLL
C:\WINDOWS\system\EBENU.DLL
C:\WINDOWS\system\EDSHARED.DLL
C:\WINDOWS\system\DND9.DLL
C:\WINDOWS\system\SCTUPWBV.DLL
C:\WINDOWS\system\OYTWA400.DLL
C:\WINDOWS\system\DJDMO.DLL
C:\WINDOWS\system\MDBSYNC.DLL
C:\WINDOWS\system\MYPI.DLL
C:\WINDOWS\system\HAINK.DLL
C:\WINDOWS\system\ILV16.DLL
C:\WINDOWS\system\EMHSIG.DLL
C:\WINDOWS\system\RNCLTC3.DLL
C:\WINDOWS\system\HRAGENT.DLL
C:\WINDOWS\system\BBOWSELC.DLL
C:\WINDOWS\system\MUSCP.DLL
C:\WINDOWS\system\IRSS.DLL
C:\WINDOWS\system\SPNS.DLL
C:\WINDOWS\system\DN290USD.DLL Reboot Here!

If your computer does not reboot please manually reboot.

Download http://lineofire.geekstogo.com/FindIt%209x-ME.zip
Unzip it and double click on FindIt9xME.bat
Let it run (this will take a while)
Post the log it produces afterwards.
Post #7
Per my last post. I didn't have the l2mfix folder and didn't run the l2mfix.bat Is this okay and should i just proceed with instructions from your last post and run killbox.exe which looks like it deletes all the files found using l2m from a previous post. Thanks BountyBob
Post #8
Please forget about the l2m, I thought there was a removal tool in the folder. Download the killbox and perform the steps in my last post. Once complete please post a fresh Hijackthis log and a fresh Findit log.
Post #9
Attached is a new Hijackthis log and a findit log.

Logfile of HijackThis v1.99.1
Scan saved at 11:55:11 AM, on 3/27/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\TOOLBAR\TBPS.EXE
C:\PROGRAM FILES\TOOLBAR\PIB.EXE
C:\PROGRAM FILES\TOOLBAR\RADIO.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASSK.EXE
C:\PROGRAM FILES\MEDIA PASS\MEDIAPASS.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\PROGRAM FILES\WEB OFFER\WO.EXE
C:\WINDOWS\SYSTEM\AIRCITY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50220
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL/sa
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\Run: [Media Pass] C:\PROGRAM FILES\MEDIA PASS\MediaPassK.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\TOOLBAR\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O4 - HKLM\..\RunServices: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE
O4 - HKLM\..\RunServicesOnce: [TBPS] C:\PROGRA~1\TOOLBAR\TBPS.exe /boot
O4 - HKLM\..\RunServicesOnce: [WinTools] C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSA.EXE /boot
O4 - HKCU\..\Run: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\RunServices: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O4 - HKCU\..\RunServices: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\RunOnce: [AIRCITY] C:\WINDOWS\SYSTEM\AIRCITY.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\TOOLBAR\TOOLBAR.DLL


Findit Results

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

TBPS INI 1,134 03-27-05 11:28a TBPS.ini
TCPBVEFS DLL 475 03-16-05 7:31p tcpbvefs.dll
RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL
MBLTUS40 DLL 227,104 03-15-05 8:19p mbltus40.dll
OWBCCP32 DLL 227,104 03-15-05 8:19p owbccp32.dll
TFP3216S DLL 227,104 03-15-05 8:19p TFP3216S.DLL
OBCOM400 DLL 227,104 03-15-05 8:19p OBCOM400.DLL
CCSEQCHK DLL 227,104 03-15-05 8:19p CCSEQCHK.DLL
HRZSTSIN DLL 227,104 03-15-05 8:19p HRZSTSIN.DLL
MCPBDE40 DLL 227,104 03-15-05 8:19p mcpbde40.dll
IBS DLL 227,104 03-15-05 8:19p IBS.DLL
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
13 file(s) 2,227,947 bytes
0 dir(s) 29,862.94 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

TCPBVEFS DLL 475 03-16-05 7:31p tcpbvefs.dll
QOOX DLL 106 03-16-05 7:30p qoox.dll
WSXSVC 03-15-05 8:43p wsxsvc
VMSS 03-15-05 8:43p vmss
SYSMONNT EXE 110,592 03-04-05 4:11p sysmonnt.exe
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
FOLDER HTT 13,122 04-18-04 8:17p folder.htt
DESKTOP INI 266 04-18-04 8:17p desktop.ini
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
7 file(s) 306,963 bytes
2 dir(s) 29,862.91 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
mbltus40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
tcpbvefs.exe Tue Jan 11 2005 10:06:06p ..SH. 176,258 172.13 K
qoox.dll Wed Mar 16 2005 7:30:36p A..H. 106 0.10 K
tcpbvefs.dll Wed Mar 16 2005 7:31:06p ..SH. 475 0.46 K
sysmonnt.exe Fri Mar 4 2005 4:11:26p A..H. 110,592 108.00 K
tbps.ini Sun Mar 27 2005 11:28:56a ..S.R 1,134 1.11 K
owbccp32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
tfp3216s.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
obcom400.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
ccseqchk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
hrzstsin.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
mcpbde40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
ibs.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K

14 items found: 14 files, 0 directories.
Total of file sizes: 2,332,501 bytes 2.22 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb

————– Strings.exe Aspack Results ————-

C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00
C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\SYSTEM\dvp.vxd: .aspack

—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"PaperPort"="c:\\paprport\\pportldr.exe"
"Dcfssvc"="C:\\WINDOWS\\System32\\Drivers\\dcfssvc.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\ADELPH~1\\SMARTB~1\\MotiveSB.exe"
"seticlient"="C:\\Program Files\\SETI@home\\[removed] -min"
"mdac_runonce"="C:\\WINDOWS\\SYSTEM\\runonce.exe"
"Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"
"GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon"
"KodakCCS"="C:\\WINDOWS\\System32\\Drivers\\KodakCCS.exe"
"Media Pass"="C:\\PROGRAM FILES\\MEDIA PASS\\MediaPassK.exe"
"TBPS"="C:\\PROGRA~1\\TOOLBAR\\TBPS.exe"
"WinTools"="C:\\PROGRA~1\\COMMON~1\\WINTOOLS\\WTOOLSA.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"



Post #10
First go to your Add/Remove Programs Panel and Uninstall the following.
InternetOffers
Media Access
WebSearch Toolbar
WinTools
Media Pass



double-click the killbox

Select the Delete on reboot option.

Now copy and paste the following line into the 'Full Path to Delete File' Box
C:\WINDOWS\SYSTEM

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button.

A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; A second dialog box will ask you if you want to REBOOT now. Press the YES button.
C:\WINDOWS\SYSTEM\RHCLTC3.DLL
C:\WINDOWS\SYSTEM\mbltus40.dll
C:\WINDOWS\SYSTEM\owbccp32.dll
C:\WINDOWS\SYSTEM\TFP3216S.DLL
C:\WINDOWS\SYSTEM\OBCOM400.DLL
C:\WINDOWS\SYSTEM\CCSEQCHK.DLL
C:\WINDOWS\SYSTEM\HRZSTSIN.DLL
C:\WINDOWS\SYSTEM\mcpbde40.dll
C:\WINDOWS\SYSTEM\IBS.DLL
C:\WINDOWS\SYSTEM\sysmonnt.exe
C:\WINDOWS\SYSTEM\qoox.dll
C:\WINDOWS\SYSTEM\tcpbvefs.dll
C:\WINDOWS\SYSTEM\hrzstsin.dll Reboot Here

If your computer doesn't reboot please manually reboot your computer.

Once complete please post a fresh hijackthis and findit log.
Post #11
Hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 5:25:15 PM, on 3/28/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\WINUPDT.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdt.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409



Findit log

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL
CCSEQCHK DLL 227,104 03-15-05 8:19p CCSEQCHK.DLL
MCPBDE40 DLL 227,104 03-15-05 8:19p mcpbde40.dll
WAASPI32 DLL 227,104 03-15-05 8:19p WAASPI32.DLL
SSLWID DLL 227,104 03-15-05 8:19p sslwid.dll
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
7 file(s) 1,317,922 bytes
0 dir(s) 29,334.44 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

WSXSVC 03-15-05 8:43p wsxsvc
VMSS 03-15-05 8:43p vmss
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
FOLDER HTT 13,122 04-18-04 8:17p folder.htt
DESKTOP INI 266 04-18-04 8:17p desktop.ini
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
4 file(s) 195,790 bytes
2 dir(s) 29,334.41 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
tcpbvefs.exe Tue Jan 11 2005 10:06:06p ..SH. 176,258 172.13 K
ccseqchk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
mcpbde40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
waaspi32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
sslwid.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K

6 items found: 6 files, 0 directories.
Total of file sizes: 1,311,778 bytes 1.25 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb

————– Strings.exe Aspack Results ————-

C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00
C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\SYSTEM\dvp.vxd: .aspack

—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"PaperPort"="c:\\paprport\\pportldr.exe"
"Dcfssvc"="C:\\WINDOWS\\System32\\Drivers\\dcfssvc.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\ADELPH~1\\SMARTB~1\\MotiveSB.exe"
"seticlient"="C:\\Program Files\\SETI@home\\[removed] -min"
"mdac_runonce"="C:\\WINDOWS\\SYSTEM\\runonce.exe"
"Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"
"GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon"
"KodakCCS"="C:\\WINDOWS\\System32\\Drivers\\KodakCCS.exe"
"winupdtl"="C:\\WINDOWS\\SYSTEM\\winupdt.exe"
"{12EE7A5E-0674-42f9-A76B-000000004D00}"="rundll32.exe stlb2.dll,DllRunMain"
"A70F6A1D-0195-42a2-934C-D8AC0F7C08EB"="rundll32.exe E6F1873B.DLL,D9EBC318C"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"98D0CE0C16B1"="rundll32.exe D0CE0C16B1,D0CE0C16B1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"



Post #12
I did not reboot before the last post.

Here are the logs after rebooting

Logfile of HijackThis v1.99.1
Scan saved at 5:56:42 PM, on 3/28/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\WINUPDT.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409



Findit

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL
QSON32 DLL 227,104 03-15-05 8:19p QSON32.DLL
CCSEQCHK DLL 227,104 03-15-05 8:19p CCSEQCHK.DLL
MCPBDE40 DLL 227,104 03-15-05 8:19p mcpbde40.dll
WAASPI32 DLL 227,104 03-15-05 8:19p WAASPI32.DLL
SSLWID DLL 227,104 03-15-05 8:19p sslwid.dll
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
8 file(s) 1,545,026 bytes
0 dir(s) 29,333.25 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

WSXSVC 03-15-05 8:43p wsxsvc
VMSS 03-15-05 8:43p vmss
TCPBVEFS EXE 176,258 01-11-05 10:06p tcpBVeFs.exe
FOLDER HTT 13,122 04-18-04 8:17p folder.htt
DESKTOP INI 266 04-18-04 8:17p desktop.ini
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
4 file(s) 195,790 bytes
2 dir(s) 29,333.22 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
qson32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
tcpbvefs.exe Tue Jan 11 2005 10:06:06p ..SH. 176,258 172.13 K
ccseqchk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
mcpbde40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
waaspi32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
sslwid.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K

7 items found: 7 files, 0 directories.
Total of file sizes: 1,538,882 bytes 1.46 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb

————– Strings.exe Aspack Results ————-

C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00
C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\SYSTEM\dvp.vxd: .aspack

—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"PaperPort"="c:\\paprport\\pportldr.exe"
"Dcfssvc"="C:\\WINDOWS\\System32\\Drivers\\dcfssvc.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\ADELPH~1\\SMARTB~1\\MotiveSB.exe"
"seticlient"="C:\\Program Files\\SETI@home\\[removed] -min"
"mdac_runonce"="C:\\WINDOWS\\SYSTEM\\runonce.exe"
"Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"
"GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon"
"KodakCCS"="C:\\WINDOWS\\System32\\Drivers\\KodakCCS.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
Post #13 last edited
Please download the following Cleanup!, CWshredder, Ad-aware, & Spy-Bot.
  • Updating Ad-aware:
    Double-Click the Desktop Icon > Click 'Check For Updates Now' > Click 'Connect'
  • Updating Spybot:
    Double-Click the Desktop Icon > Click Update > Drop-Down Box UniDo(Europe) > Select Pure-Elite(USA) or EON (AU) > Click 'Search for Updates' > Click 'Download Updates'
Don't do anything with these programs yet.

Close all running programs, run Hijackthis and place a check next to the following.

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\SYSTEM\STLB2.DLL
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\PROGRAM FILES\EBATES_MOEMONEYMAKER\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.anywebcam.com/awc/html/voice/voice.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/20908050756517…ip/RdxIE601.cab

close ALL your internet browsers and click fix in Hijackthis.

Now run the killbox.

Select the Delete on reboot option.

Now copy and paste the following line into the 'Full Path to Delete File' Box

C:\WINDOWS\SYSTEM\RHCLTC3.DLL

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button.

A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; A second dialog box will ask you if you want to REBOOT now. Press the YES button.

C:\WINDOWS\SYSTEM\QSON32.DLL
C:\WINDOWS\SYSTEM\CCSEQCHK.DLL
C:\WINDOWS\SYSTEM\mcpbde40.dll
C:\WINDOWS\SYSTEM\WAASPI32.DLL
C:\WINDOWS\SYSTEM\sslwid.dll
C:\WINDOWS\SYSTEM\runonce.exe
C:\WINDOWS\SYSTEM\tcpBVeFs.exe Reboot Here

If you computer does not reboot please reboot manually.

Now that you're back in normal mode, don't reconnect to the net just yet. However, please run the programs you downloaded.
  • First please run the Cleanup! program, it's best to have all internet browsers to closed.Close Cleanup!
  • Double-Click CWShredder and click 'Fix'
  • Close CWShredder
  • Open Ad-aware and make the following changes to the settings in Ad-aware.
  • Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Scanning Engine:
    check: "Unload recognized processes during scanning."
  • Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Cleaning Engine:
    Check: "Let Windows remove files in use at next reboot."
Press 'Proceed'

Click 'Start'
  • Select option 'Use Custom scanning options'
  • Click 'Activate in-depth scan'
  • Click 'Select drives\folders to scan' Select the active partition which is usually C:
Click 'Customize'
  • Make sure the following are all are Checked:
  • 'Scan Within Archives'
  • 'Scan Active Processes'
  • 'Scan Registry'
  • 'Deep Scan Registry'
  • 'Scan My IE Favorites For Banned URL'S
  • 'Scan My Hosts File'
Click 'Proceed'
  • Now click "Next" to let Ad-aware scan your drives.
  • Once Ad-aware has completed its scan click 'Next' > Now Click 'Scan Summary' > Click All the Boxes with a Green Check Mark
  • Now Click 'Next' and Finally Click 'OK'
Close Out Ad-Aware

Open Spybot.
  • Click 'Search & Destroy'
  • Click 'Check for problems' (the program will now search your HDD)
  • Make sure all findings are checked and click 'Fix Selected Problems'
Close SpyBot and Reboot!
Post #14
I'm still getting some pop-ups.

Not as many or as often but they are still happening.

When I do the routines you advise, should I always be dissconnected from the internet? From previous post instructions I was not always dissconnected.

Here is a new hHijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 6:45:30 AM, on 3/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2COMM.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2PRE.EXE
C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2TRAY.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PAPRPORT\PPORTLDR.EXE
C:\PROGRAM FILES\ADELPHIA ESUPPORT ASSISTANT\SMARTBRIDGE\MOTIVESB.EXE
C:\PROGRAM FILES\SETI@HOME\[removed]
C:\PROGRAM FILES\ZERO KNOWLEDGE\FREEDOM\FREEDOM.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\COMMAND SOFTWARE\DVPAPI9X.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PaperPort] c:\paprport\pportldr.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [seticlient] C:\Program Files\SETI@home\[removed] -min
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -logon
O4 - HKLM\..\Run: [KodakCCS] C:\WINDOWS\System32\Drivers\KodakCCS.exe
O4 - HKLM\..\RunServices: [GoToMyPC] C:\PROGRAM FILES\EXPERTCITY\GOTOMYPC\G2SVC.EXE -service
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {6D3CED33-9C0A-44BA-AAB9-252EE67A436C} (IEObj Class) - http://fs.adelphia.freedom.net/software/dmx.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/…ropper1_4us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409



New Findit log

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

——- System Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL
MFXMLR DLL 227,104 03-15-05 8:19p MFXMLR.DLL
UQDMXFRM DLL 227,104 03-15-05 8:19p UQDMXFRM.DLL
RMANP DLL 227,104 03-15-05 8:19p RMANP.DLL
TKPELIB DLL 227,104 03-15-05 8:19p TKPELIB.DLL
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
6 file(s) 1,141,664 bytes
0 dir(s) 29,470.59 MB free

——- Hidden Files in System Directory ——-


Volume in drive C has no label
Volume Serial Number is 0357-16E8
Directory of C:\WINDOWS\SYSTEM

WSXSVC 03-15-05 8:43p wsxsvc
VMSS 03-15-05 8:43p vmss
FOLDER HTT 13,122 04-18-04 8:17p folder.htt
DESKTOP INI 266 04-18-04 8:17p desktop.ini
ACCESS CTL 6,144 03-12-03 3:30p access.ctl
3 file(s) 19,532 bytes
2 dir(s) 29,470.56 MB free

—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"=""


—————— Locate.com Results ——————

C:\WINDOWS\SYSTEM\
rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
mfxmlr.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
uqdmxfrm.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
rmanp.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K
tkpelib.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1,135,520 bytes 1.08 M

———— Strings.exe Qoologic Results ————

C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb

————– Strings.exe Aspack Results ————-

C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00
C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\SYSTEM\dvp.vxd: .aspack

—————– HKLM Run Key ——————

————– Strings.exe Umonitor Results ————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"PaperPort"="c:\\paprport\\pportldr.exe"
"Dcfssvc"="C:\\WINDOWS\\System32\\Drivers\\dcfssvc.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\ADELPH~1\\SMARTB~1\\MotiveSB.exe"
"seticlient"="C:\\Program Files\\SETI@home\\[removed] -min"
"Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"
"GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon"
"KodakCCS"="C:\\WINDOWS\\System32\\Drivers\\KodakCCS.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"



Post #15
Yes lets try that, it might help us.

First Copy and paste the information in the quote box to notepad. Save it to your desktop as type "all files" and name it fixme.reg.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{6B614660-B8FA-4FDE-B9ED-49164B33B7E7}"=-


Disconnect from the internet.

Now run Ad-aware and Spybot

Close down all your running programs, run Hijackthis and place a check next to the following.

O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch

close all your internet browsers and click fix in Hijackthis.


Run the killbox and make sure the 'Delete On Reboot' option is selected.

Now copy and paste the following line into the 'Full Path to Delete File' Box
C:\WINDOWS\SYSTEM\rhcltc3.dll

A first dialog box will ask if you want to delete the file on reboot, press the YES button. A second dialog box will ask you if you want to REBOOT now. Press the NO button.


Perform the same procedure on the following files until you reach the last one; A second dialog box will ask you if you want to REBOOT now. Press the YES button.

C:\WINDOWS\SYSTEM\mfxmlr.dll
C:\WINDOWS\SYSTEM\uqdmxfrm.dll
C:\WINDOWS\SYSTEM\rmanp.dll
C:\WINDOWS\SYSTEM\tkpelib.dll
C:\WINDOWS\SYSTEM\unadbeh.exe Reboot Here

If your computer doesn't reboot please reboot manually.

Once complete please post a fresh findit log only.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI