Need Help With Hijackthis Log

I executed your last post and I'm still getting them. Wasn't sure what to do with the QUOTE copied to notepad on desktop. When i wasn't connected to the internet the 01 -Hosts entries did not show up in Hijackthis but did after connecting. Deleted them but they always come back in a new Hijackthis scan. Here is a new Findit log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL RY3228_8 DLL 227,104 03-15-05 8:19p rY3228_8.dll EYENU DLL 227,104 03-15-05 8:19p eyenu.dll PKWEROLD DLL 227,104 03-15-05 8:19p PKWEROLD.DLL LLFIL70N DLL 227,104 03-15-05 8:19p LLFIL70N.DLL MNG4DMOD DLL 227,104 03-15-05 8:19p mng4dmod.dll MDXBDE40 DLL 227,104 03-15-05 8:19p mdxbde40.dll CBS1722 DLL 227,104 03-15-05 8:19p cbs1722.dll DEMSADSN DLL 227,104 03-15-05 8:19p DEMSADSN.DLL RWCLTS3 DLL 227,104 03-15-05 8:19p RWCLTS3.DLL MIXBSE35 DLL 227,104 03-15-05 8:19p mixbse35.dll WGBCHECK DLL 227,104 03-15-05 8:19p WGBCHECK.DLL MQANG DLL 227,104 03-15-05 8:19p MQANG.DLL SJORAGE DLL 227,104 03-15-05 8:19p SJORAGE.DLL OGESVR DLL 227,104 03-15-05 8:19p OGESVR.DLL LTCMP70N DLL 227,104 03-15-05 8:19p LTCMP70N.DLL OBE2CONV DLL 227,104 03-15-05 8:19p OBE2CONV.DLL HUSETUP DLL 227,104 03-15-05 8:19p husetup.dll OWBCBCP DLL 227,104 03-15-05 8:19p owbcbcp.dll SUBAPI DLL 227,104 03-15-05 8:19p subapi.dll ILWPHBK DLL 227,104 03-15-05 8:19p ilwphbk.dll WR2THK DLL 227,104 03-15-05 8:19p WR2THK.DLL IBGCMN DLL 227,104 03-15-05 8:19p IBGCMN.DLL IDETCPLC DLL 227,104 03-15-05 8:19p IDETCPLC.DLL PBGFILT DLL 227,104 03-15-05 8:19p pbgfilt.dll MTC30 DLL 227,104 03-15-05 8:19p MTC30.DLL OJUI400 DLL 227,104 03-15-05 8:19p OJUI400.DLL RGINOS~1 DLL 227,104 03-15-05 8:19p RginoShExt.dll OYE2CONV DLL 227,104 03-15-05 8:19p OYE2CONV.DLL MHPDOX35 DLL 227,104 03-15-05 8:19p mhpdox35.dll HXINV DLL 227,104 03-15-05 8:19p hxinv.dll IDM32 DLL 227,104 03-15-05 8:19p IDM32.DLL SDREAMCI DLL 227,104 03-15-05 8:19p SDREAMCI.DLL PIP7 DLL 227,104 03-15-05 8:19p pip7.dll MVXML2 DLL 227,104 03-15-05 8:19p mvxml2.dll AHFSIPC DLL 227,104 03-15-05 8:19p ahfsipc.dll IVM32 DLL 227,104 03-15-05 8:19p IVM32.DLL LKEXPAND DLL 227,104 03-15-05 8:19p LKEXPAND.DLL ACCESS CTL 6,144 03-12-03 3:30p access.ctl 39 file(s) 8,636,096 bytes 0 dir(s) 29,447.72 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM WSXSVC 03-15-05 8:43p wsxsvc VMSS 03-15-05 8:43p vmss FOLDER HTT 13,122 04-18-04 8:17p folder.htt DESKTOP INI 266 04-18-04 8:17p desktop.ini ACCESS CTL 6,144 03-12-03 3:30p access.ctl 3 file(s) 19,532 bytes 2 dir(s) 29,447.69 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ry3228_8.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K eyenu.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pkwerold.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K llfil70n.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mng4dmod.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mdxbde40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K cbs1722.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K demsadsn.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K rwclts3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mixbse35.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wgbcheck.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mqang.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K sjorage.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ogesvr.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ltcmp70n.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K obe2conv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K husetup.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K owbcbcp.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K subapi.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ilwphbk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wr2thk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ibgcmn.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K idetcplc.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pbgfilt.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mtc30.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ojui400.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K rginos~1.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K oye2conv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mhpdox35.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K hxinv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K idm32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K sdreamci.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pip7.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mvxml2.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ahfsipc.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ivm32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K lkexpand.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K 38 items found: 38 files, 0 directories. Total of file sizes: 8,629,952 bytes 8.23 M ———— Strings.exe Qoologic Results ———— C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb ————– Strings.exe Aspack Results ————- C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\SYSTEM\dvp.vxd: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "SystemTray"="SysTray.Exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 

First make sure your copies of Ad-aware, Spy-Bot and CWShredder are updated first.


Next, Run the killbox and make sure the 'Delete On Reboot' option is selected.

Now copy and paste the following line into the 'Full Path to Delete File' Box
C:\WINDOWS\unadbeh.exe


A first dialog box will ask if you want to delete the file on reboot, press the YES button. A second dialog box will ask you if you want to REBOOT now. Press the YES button.

Now don't reconnect to the net, however run Ad-aware, Spy-Bot, and CWShredder in that order.

Once complete please post only a findit! log.

Latest Findit log 3-31-2005 Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL RY3228_8 DLL 227,104 03-15-05 8:19p rY3228_8.dll EYENU DLL 227,104 03-15-05 8:19p eyenu.dll PKWEROLD DLL 227,104 03-15-05 8:19p PKWEROLD.DLL LLFIL70N DLL 227,104 03-15-05 8:19p LLFIL70N.DLL MNG4DMOD DLL 227,104 03-15-05 8:19p mng4dmod.dll MDXBDE40 DLL 227,104 03-15-05 8:19p mdxbde40.dll CBS1722 DLL 227,104 03-15-05 8:19p cbs1722.dll DEMSADSN DLL 227,104 03-15-05 8:19p DEMSADSN.DLL RWCLTS3 DLL 227,104 03-15-05 8:19p RWCLTS3.DLL MIXBSE35 DLL 227,104 03-15-05 8:19p mixbse35.dll WGBCHECK DLL 227,104 03-15-05 8:19p WGBCHECK.DLL MQANG DLL 227,104 03-15-05 8:19p MQANG.DLL SJORAGE DLL 227,104 03-15-05 8:19p SJORAGE.DLL OGESVR DLL 227,104 03-15-05 8:19p OGESVR.DLL LTCMP70N DLL 227,104 03-15-05 8:19p LTCMP70N.DLL OBE2CONV DLL 227,104 03-15-05 8:19p OBE2CONV.DLL HUSETUP DLL 227,104 03-15-05 8:19p husetup.dll OWBCBCP DLL 227,104 03-15-05 8:19p owbcbcp.dll SUBAPI DLL 227,104 03-15-05 8:19p subapi.dll ILWPHBK DLL 227,104 03-15-05 8:19p ilwphbk.dll WR2THK DLL 227,104 03-15-05 8:19p WR2THK.DLL IBGCMN DLL 227,104 03-15-05 8:19p IBGCMN.DLL IDETCPLC DLL 227,104 03-15-05 8:19p IDETCPLC.DLL PBGFILT DLL 227,104 03-15-05 8:19p pbgfilt.dll MTC30 DLL 227,104 03-15-05 8:19p MTC30.DLL OJUI400 DLL 227,104 03-15-05 8:19p OJUI400.DLL RGINOS~1 DLL 227,104 03-15-05 8:19p RginoShExt.dll OYE2CONV DLL 227,104 03-15-05 8:19p OYE2CONV.DLL MHPDOX35 DLL 227,104 03-15-05 8:19p mhpdox35.dll HXINV DLL 227,104 03-15-05 8:19p hxinv.dll IDM32 DLL 227,104 03-15-05 8:19p IDM32.DLL SDREAMCI DLL 227,104 03-15-05 8:19p SDREAMCI.DLL PIP7 DLL 227,104 03-15-05 8:19p pip7.dll MVXML2 DLL 227,104 03-15-05 8:19p mvxml2.dll AHFSIPC DLL 227,104 03-15-05 8:19p ahfsipc.dll IVM32 DLL 227,104 03-15-05 8:19p IVM32.DLL LKEXPAND DLL 227,104 03-15-05 8:19p LKEXPAND.DLL HPINV DLL 227,104 03-15-05 8:19p hpinv.dll MPTCP DLL 227,104 03-15-05 8:19p MPTCP.DLL WRPSHELL DLL 227,104 03-15-05 8:19p wrpshell.dll ACCESS CTL 6,144 03-12-03 3:30p access.ctl 42 file(s) 9,317,408 bytes 0 dir(s) 29,317.91 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM WSXSVC 03-15-05 8:43p wsxsvc VMSS 03-15-05 8:43p vmss FOLDER HTT 13,122 04-18-04 8:17p folder.htt DESKTOP INI 266 04-18-04 8:17p desktop.ini ACCESS CTL 6,144 03-12-03 3:30p access.ctl 3 file(s) 19,532 bytes 2 dir(s) 29,317.88 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ry3228_8.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K eyenu.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pkwerold.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K llfil70n.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mng4dmod.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mdxbde40.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K cbs1722.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K demsadsn.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K rwclts3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mixbse35.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wgbcheck.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mqang.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K sjorage.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ogesvr.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ltcmp70n.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K obe2conv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K husetup.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K owbcbcp.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K subapi.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ilwphbk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wr2thk.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ibgcmn.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K idetcplc.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pbgfilt.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mtc30.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ojui400.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K rginos~1.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K oye2conv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mhpdox35.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K hxinv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K idm32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K sdreamci.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K pip7.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mvxml2.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ahfsipc.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ivm32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K lkexpand.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K hpinv.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mptcp.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wrpshell.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K 41 items found: 41 files, 0 directories. Total of file sizes: 9,311,264 bytes 8.88 M ———— Strings.exe Qoologic Results ———— C:\WINDOWS\unadbeh.exe: e:\Projects\Qoologic\PopupClient\FancyUninstall\Release\FancyUninstall.pdb ————– Strings.exe Aspack Results ————- C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\SYSTEM\dvp.vxd: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "SystemTray"="SysTray.Exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 

First make sure you can view all hidden files and folders, use this link for help.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Please copy my notes into Notepad and save to your desktop, you need to be offline and have ALL your Internet browsers closed

Please log off the internet and close all your internet browsers and run the cleanup! program I had you download a few posts ago.
http://www.spywareaid.com/index.php?file=s…=1&softtype=exe



Next, click Start > go to Run > type explorer hit enter > Click 'My Computer' > Click Local Disk (C: ) > Click 'Windows' > Now find this file and delete it > C:\WINDOWS\unadbeh.exe

After deleting the find in the WINDOWS folder > Scroll Down and locate the 'System' folder and Click > Now find that is close to this file and delete it > C:\WINDOWS\System\rginos…..dll

You should only have one file that shares the same 5 letters as the file above. The full file name is not listed in your logs, so we'll manually need to delete the file.



Double-click the Killbox

Select the 'Delete on reboot option'.

Now copy and paste the following line into the 'Full Path to Delete File' Box
C:\WINDOWS\SYSTEM\rhcltc3.dll

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button. A second dialog box will ask you if you want to REBOOT now. Press the NO button.


Perform the same procedure on the following files until you reach the last one; when the second dialog appears click YES
C:\WINDOWS\SYSTEM\ry3228_8.dll
C:\WINDOWS\SYSTEM\eyenu.dll
C:\WINDOWS\SYSTEM\pkwerold.dll
C:\WINDOWS\SYSTEM\llfil70n.dll
C:\WINDOWS\SYSTEM\mng4dmod.dll
C:\WINDOWS\SYSTEM\mdxbde40.dll
C:\WINDOWS\SYSTEM\cbs1722.dll
C:\WINDOWS\SYSTEM\demsadsn.dll
C:\WINDOWS\SYSTEM\rwclts3.dll
C:\WINDOWS\SYSTEM\mixbse35.dll
C:\WINDOWS\SYSTEM\wgbcheck.dll
C:\WINDOWS\SYSTEM\mqang.dll
C:\WINDOWS\SYSTEM\sjorage.dll
C:\WINDOWS\SYSTEM\ogesvr.dll
C:\WINDOWS\SYSTEM\ltcmp70n.dll
C:\WINDOWS\SYSTEM\obe2conv.dll
C:\WINDOWS\SYSTEM\husetup.dll
C:\WINDOWS\SYSTEM\owbcbcp.dll
C:\WINDOWS\SYSTEM\subapi.dll
C:\WINDOWS\SYSTEM\ilwphbk.dll
C:\WINDOWS\SYSTEM\wr2thk.dll
C:\WINDOWS\SYSTEM\ibgcmn.dll
C:\WINDOWS\SYSTEM\idetcplc.dll
C:\WINDOWS\SYSTEM\pbgfilt.dll
C:\WINDOWS\SYSTEM\mtc30.dll
C:\WINDOWS\SYSTEM\ojui400.dll
C:\WINDOWS\SYSTEM\oye2conv.dll
C:\WINDOWS\SYSTEM\mhpdox35.dll
C:\WINDOWS\SYSTEM\hxinv.dll
C:\WINDOWS\SYSTEM\idm32.dll
C:\WINDOWS\SYSTEM\sdreamci.dll
C:\WINDOWS\SYSTEM\pip7.dll
C:\WINDOWS\SYSTEM\mvxml2.dll
C:\WINDOWS\SYSTEM\ivm32.dll
C:\WINDOWS\SYSTEM\ahfsipc.dll
C:\WINDOWS\SYSTEM\lkexpand.dll
C:\WINDOWS\SYSTEM\hpinv.dll
C:\WINDOWS\SYSTEM\mptcp.dll
C:\WINDOWS\SYSTEM\wrpshell.dll REBOOT HERE!


If your computer doesn't reboot please reboot manually.

Once you're back in normal mode please post a fresh findit! log.

There still popping up. Here is the latest Findit log. Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM RHCLTC3 DLL 227,104 03-15-05 8:19p RHCLTC3.DLL ASKRNL32 DLL 227,104 03-15-05 8:19p ASKRNL32.DLL UDDMXFRM DLL 227,104 03-15-05 8:19p UDDMXFRM.DLL MAR DLL 227,104 03-15-05 8:19p MAR.DLL CSFG95 DLL 227,104 03-15-05 8:19p CSFG95.DLL WKBVW DLL 227,104 03-15-05 8:19p WKBVW.DLL MSG4DMOD DLL 227,104 03-15-05 8:19p msg4dmod.dll UKP10 DLL 227,104 03-15-05 8:19p ukp10.dll DHWSOCKX DLL 227,104 03-15-05 8:19p DHWSOCKX.DLL MCOEACCT DLL 227,104 03-15-05 8:19p mcoeacct.dll IFSETUP DLL 227,104 03-15-05 8:19p IFSETUP.DLL JZEG1X32 DLL 227,104 03-15-05 8:19p JZEG1X32.DLL MNT2FW95 DLL 227,104 03-15-05 8:19p MNT2FW95.DLL UAP10 DLL 227,104 03-15-05 8:19p uap10.dll ACCESS CTL 6,144 03-12-03 3:30p access.ctl 15 file(s) 3,185,600 bytes 0 dir(s) 29,799.00 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM WSXSVC 03-15-05 8:43p wsxsvc VMSS 03-15-05 8:43p vmss FOLDER HTT 13,122 04-18-04 8:17p folder.htt DESKTOP INI 266 04-18-04 8:17p desktop.ini ACCESS CTL 6,144 03-12-03 3:30p access.ctl 3 file(s) 19,532 bytes 2 dir(s) 29,798.97 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ rhcltc3.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K askrnl32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K uddmxfrm.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mar.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K csfg95.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K wkbvw.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K msg4dmod.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ukp10.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K dhwsockx.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mcoeacct.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K ifsetup.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K jzeg1x32.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mnt2fw95.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K uap10.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K 14 items found: 14 files, 0 directories. Total of file sizes: 3,179,456 bytes 3.03 M ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\SYSTEM\dvp.vxd: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "SystemTray"="SysTray.Exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon" "USB controller"="\"C:\\WINDOWS\\TEMP\\ICD1.TMP\\SVCMM32.EXE\" /startup" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 

Phew, it got better. Same procedure as before, just one difference.

Run Hijackthis and place a check next to the following.
C:\\WINDOWS\\TEMP\\ICD1.TMP\\SVCMM32.EXE\" /startup



Please copy my notes into Notepad and save to your desktop, you need to be offline and have ALL your Internet browsers closed.

Close all your internet browsers and log off the internet.

First, run Cleanup!

Double-click the Killbox

Select the 'Delete on reboot option'.

Now copy and paste the following line into the 'Full Path to Delete File' Box
C:\WINDOWS\SYSTEM\rhcltc3.dll

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button. A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; when the second dialog appears click YES
C:\WINDOWS\SYSTEM\mnt2fw95.dll
C:\WINDOWS\SYSTEM\askrnl32.dll
C:\WINDOWS\SYSTEM\uddmxfrm.dll
C:\WINDOWS\SYSTEM\mar.dll
C:\WINDOWS\SYSTEM\csfg95.dll
C:\WINDOWS\SYSTEM\wkbvw.dll
C:\WINDOWS\SYSTEM\msg4dmod.dll
C:\WINDOWS\SYSTEM\ukp10.dll
C:\WINDOWS\SYSTEM\dhwsockx.dll
C:\WINDOWS\SYSTEM\mcoeacct.dll
C:\WINDOWS\SYSTEM\ifsetup.dll
C:\WINDOWS\SYSTEM\jzeg1x32.dll
C:\WINDOWS\SYSTEM\uap10.dll REBOOT HERE!

If your computer doesn't reboot, please reboot manually.

Here is a Findit log Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM MCHTML DLL 227,104 03-15-05 8:19p MCHTML.DLL MZHTMLER DLL 227,104 03-15-05 8:19p MZHTMLER.DLL GSLDNE~1 DLL 227,104 03-15-05 8:19p gsldnew2b.dll MALW DLL 227,104 03-15-05 8:19p malw.dll ACCESS CTL 6,144 03-12-03 3:30p access.ctl 5 file(s) 914,560 bytes 0 dir(s) 29,811.94 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM WSXSVC 03-15-05 8:43p wsxsvc VMSS 03-15-05 8:43p vmss FOLDER HTT 13,122 04-18-04 8:17p folder.htt DESKTOP INI 266 04-18-04 8:17p desktop.ini ACCESS CTL 6,144 03-12-03 3:30p access.ctl 3 file(s) 19,532 bytes 2 dir(s) 29,811.91 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ mchtml.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mzhtmler.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K gsldne~1.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K malw.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K 4 items found: 4 files, 0 directories. Total of file sizes: 908,416 bytes 887.13 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\SYSTEM\dvp.vxd: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "SystemTray"="SysTray.Exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" 

Still improving that's a good sign, however those are all new so we are missing something.

There's a removal tool, but it's track record is shotty at best. It doesn't always work, but it's worth a try.

Please save this removal utility to your desktop.
http://securityresponse.symantec.com/avcenter/FxSpL2Me.exe

You Must Be in Safe Mode for This Utility to Work

To boot into safe mode, reboot, during the reboot press f8 and select safe mode.

Once in safe mode Run the utility 2 times.

Go ahead and boot into safe mode and run the utility twice now.

Please post a fresh Findit log once complete.

Pop-ups seem to have stopped at least for now. Thanks for all your help to say the least. I ran FxSpL2Me in the safe mode but it always had a fatal error at some point and I don't think it ever finished completley. Ad-Aware finally didn't find any hosts file entries and the last run only found a few tracking cookies. Should I run it on a regular basis and keep the custom settings you had me set in an earlier post? Is there any software I should run to prevent this from happening agian? Or are there other things I should do on a regular basis to keep system clean? All I use now is Freedom software from Adelphia cable. It has a firewall and checks for viruses only. I use the internet alot and this problem started after searching on Frank Sinatra and going to a few sites for info. (No music download sites) I see this message on your posts and wonder if you could tell me how to disable these items and what capibility I will loose with them disabled. You Want Security? Disable javascript and ActiveX!! Could you recommend how to configure a 98se system and what software to install to give the best protection aginst this type of problem. Thanks for all your help. Here is a final log from Findit: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM MCHTML DLL 227,104 03-15-05 8:19p MCHTML.DLL MZHTMLER DLL 227,104 03-15-05 8:19p MZHTMLER.DLL GSLDNE~1 DLL 227,104 03-15-05 8:19p gsldnew2b.dll MALW DLL 227,104 03-15-05 8:19p malw.dll ACCESS CTL 6,144 03-12-03 3:30p access.ctl 5 file(s) 914,560 bytes 0 dir(s) 29,923.19 MB free ——- Hidden Files in System Directory ——- Volume in drive C has no label Volume Serial Number is 0357-16E8 Directory of C:\WINDOWS\SYSTEM WSXSVC 03-15-05 8:43p wsxsvc VMSS 03-15-05 8:43p vmss FOLDER HTT 13,122 04-18-04 8:17p folder.htt DESKTOP INI 266 04-18-04 8:17p desktop.ini ACCESS CTL 6,144 03-12-03 3:30p access.ctl 3 file(s) 19,532 bytes 2 dir(s) 29,923.16 MB free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C87D2DA6-3AE3-E833-CE42-B323BA42C6DC}"="" —————— Locate.com Results —————— C:\WINDOWS\SYSTEM\ mchtml.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K mzhtmler.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K gsldne~1.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K malw.dll Tue Mar 15 2005 8:19:18p ..S.R 227,104 221.78 K 4 items found: 4 files, 0 directories. Total of file sizes: 908,416 bytes 887.13 K ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- C:\WINDOWS\vsapi32.dll: ASPack 1.08.04 C:\WINDOWS\vsapi32.dll: ASPack 1.08.03 C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b C:\WINDOWS\vsapi32.dll: ASPack 1.08.01 C:\WINDOWS\vsapi32.dll: ASPack 1.08 C:\WINDOWS\vsapi32.dll: ASPack 1.07b C:\WINDOWS\vsapi32.dll: ASPack 1.61 C:\WINDOWS\vsapi32.dll: ASPack 1.05b C:\WINDOWS\vsapi32.dll: ASPack 1.03 C:\WINDOWS\vsapi32.dll: ASPack 1.02 C:\WINDOWS\vsapi32.dll: ASPack 1.01 C:\WINDOWS\vsapi32.dll: ASPack 1.00 C:\WINDOWS\vsapi32.dll: ASPACK EXE C:\WINDOWS\vsapi32.dll: ASPACK2 EXE C:\WINDOWS\SYSTEM\dvp.vxd: .aspack —————– HKLM Run Key —————— ————– Strings.exe Umonitor Results ————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun" "TaskMonitor"="C:\\WINDOWS\\taskmon.exe" "SystemTray"="SysTray.Exe" "LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" "GoToMyPC"="C:\\PROGRAM FILES\\EXPERTCITY\\GOTOMYPC\\G2SVC.EXE -logon" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1"

Yea that utility, is strange sometimes it works, and then it doesn't.



Just a few more files to remove. And we're done but first make sure you can view all hidden files and folders, use this link for help.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Click Start > go to Run > type explorer and hit enter > Click the C:\ > Click 'Windows' > Scroll Down and Click 'System'

Look for the following and delete.

Files:
C:\WINDOWS\SYSTEM\MCHTML.DLL
C:\WINDOWS\SYSTEM\MZHTMLER.DLL
C:\WINDOWS\SYSTEM\gsldnew2b.dll
C:\WINDOWS\SYSTEM\malw.dll

Folders:
C:\WINDOWS\SYSTEM\WSXSVC
C:\WINDOWS\SYSTEM\VMSS


Yes it's a wise idea to keep Ad-aware Spy-bot and Cleanup!. All three programs are helpful in removing malware. In addition, I would download a good firewall, I recommend ZoneAlarm, it's free and one of the best. Secondly, I would recommend downloading a good Anti-Virus. I use NOD32 however, Kaspersky is another great Anti-Virus. Both programs cost money, but are invaulable in keeping your computer clean.

Disabling Javascript and ActiveX is easy, however you must change a few items in IE in order to safely browse the web. I will detail these steps later, first if you could please post a fresh Hijackthis and findit log I would appreciate it. Just as a precaution to make sure everything looks good.

That's a clean log.

To prevent the hijackers from taking over your system, increase the level of security on your system. Don't allow the hijackers to take you over!! Review these articles to increase the level of security.

http://www.computercops.biz/postt7736.html
http://www.markusjansson.net/eienbid.html

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.