What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer = Unwell....!

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi everyone,

Just bought my mates computer, and it seems to be a little unwell. IE keeps crashing, and it appears it is ridden with spyware!!!

You help is much appreciated.

Thanks,

Hux :(

Logfile of HijackThis v1.99.1
Scan saved at 12:49:13, on 25/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\APIBK32.EXE
C:\WINDOWS\JAVAXV32.EXE
C:\WINDOWS\SYSTEM\NTXY.EXE
C:\WINDOWS\SYSTEM\JAVAIF32.EXE
C:\WINDOWS\JAVAGD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\JAVAHY32.EXE
C:\WINDOWS\WINNW32.EXE
C:\WINDOWS\SYSTEM\D3YK.EXE
C:\WINDOWS\SYSTEM\IEXS.EXE
C:\WINDOWS\MFCSL.EXE
C:\WINDOWS\APIRA.EXE
C:\WINDOWS\SYSTEM\WINAS32.EXE
C:\WINDOWS\NTQK32.EXE
C:\WINDOWS\NETJK.EXE
C:\WINDOWS\APPEH.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\NTUA32.EXE
C:\WINDOWS\SYSTEM\MFCMT32.EXE
C:\WINDOWS\SYSTEM\NTJR.EXE
C:\WINDOWS\APIMO32.EXE
C:\WINDOWS\SYSTEM\NETCU32.EXE
C:\WINDOWS\APPFQ.EXE
C:\WINDOWS\SYSTEM\SYSVU32.EXE
C:\WINDOWS\SYSTEM\APPFP.EXE
C:\WINDOWS\SYSTEM\IPAX.EXE
C:\WINDOWS\SYSTEM\JAVANZ32.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADUSERMON.EXE
C:\PROGRAM FILES\IOMEGA\DRIVEICONS\IMGICON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TEMP\C201.TMP.EXE
C:\WINDOWS\APIKV32.EXE
C:\WINDOWS\JAVAXV32.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\APIBK32.EXE
C:\WINDOWS\SYSTEM\NTPW32.EXE
C:\WINDOWS\SYSTEM\NTPW32.EXE
C:\WINDOWS\NETFD32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\NTPW32.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\iwgol.dll/sp.html#51014
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {C09EE5E7-D49F-277C-B382-2AE86D6E874B} - C:\WINDOWS\APPDQ32.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [C201.TMP] C:\WINDOWS\TEMP\C201.TMP.exe 0 10001
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKLM\..\Run: [APIKV32.EXE] C:\WINDOWS\APIKV32.EXE
O4 - HKLM\..\Run: [r64h36l] LZEDN32.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [C201.TMP.EXE] C:\WINDOWS\TEMP\C201.TMP.EXE 0 10001
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\WINDOWS\SYSTEM\CnxDslTb.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [SBMX] C:\WINDOWS\SYSTEM\sbmx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ADService] C:\Program Files\Iomega\AutoDisk\ADService.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [APIOR32.EXE] C:\WINDOWS\APIOR32.EXE
O4 - HKLM\..\RunServices: [D3YK.EXE] C:\WINDOWS\SYSTEM\D3YK.EXE
O4 - HKLM\..\RunServices: [WINNW32.EXE] C:\WINDOWS\WINNW32.EXE
O4 - HKLM\..\RunServices: [APIBK32.EXE] C:\WINDOWS\SYSTEM\APIBK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAXV32.EXE] C:\WINDOWS\JAVAXV32.EXE /s
O4 - HKLM\..\RunServices: [NTXY.EXE] C:\WINDOWS\SYSTEM\NTXY.EXE /s
O4 - HKLM\..\RunServices: [JAVAIF32.EXE] C:\WINDOWS\SYSTEM\JAVAIF32.EXE /s
O4 - HKLM\..\RunServices: [JAVAGD.EXE] C:\WINDOWS\JAVAGD.EXE /s
O4 - HKLM\..\RunServices: [JAVAHY32.EXE] C:\WINDOWS\SYSTEM\JAVAHY32.EXE /s
O4 - HKLM\..\RunServices: [IEXS.EXE] C:\WINDOWS\SYSTEM\IEXS.EXE /s
O4 - HKLM\..\RunServices: [MFCSL.EXE] C:\WINDOWS\MFCSL.EXE /s
O4 - HKLM\..\RunServices: [APIRA.EXE] C:\WINDOWS\APIRA.EXE /s
O4 - HKLM\..\RunServices: [WINAS32.EXE] C:\WINDOWS\SYSTEM\WINAS32.EXE /s
O4 - HKLM\..\RunServices: [NTQK32.EXE] C:\WINDOWS\NTQK32.EXE /s
O4 - HKLM\..\RunServices: [NETJK.EXE] C:\WINDOWS\NETJK.EXE /s
O4 - HKLM\..\RunServices: [APPEH.EXE] C:\WINDOWS\APPEH.EXE /s
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [NTUA32.EXE] C:\WINDOWS\SYSTEM\NTUA32.EXE /s
O4 - HKLM\..\RunServices: [MFCMT32.EXE] C:\WINDOWS\SYSTEM\MFCMT32.EXE /s
O4 - HKLM\..\RunServices: [NTJR.EXE] C:\WINDOWS\SYSTEM\NTJR.EXE /s
O4 - HKLM\..\RunServices: [APIMO32.EXE] C:\WINDOWS\APIMO32.EXE /s
O4 - HKLM\..\RunServices: [NETCU32.EXE] C:\WINDOWS\SYSTEM\NETCU32.EXE /s
O4 - HKLM\..\RunServices: [APPFQ.EXE] C:\WINDOWS\APPFQ.EXE /s
O4 - HKLM\..\RunServices: [SYSVU32.EXE] C:\WINDOWS\SYSTEM\SYSVU32.EXE /s
O4 - HKLM\..\RunServices: [APPFP.EXE] C:\WINDOWS\SYSTEM\APPFP.EXE /s
O4 - HKLM\..\RunServices: [IPAX.EXE] C:\WINDOWS\SYSTEM\IPAX.EXE /s
O4 - HKLM\..\RunServices: [JAVANZ32.EXE] C:\WINDOWS\SYSTEM\JAVANZ32.EXE /s
O4 - HKLM\..\RunServices: [MSGO32.EXE] C:\WINDOWS\SYSTEM\MSGO32.EXE /s
O4 - HKLM\..\RunServices: [NTPW32.EXE] C:\WINDOWS\SYSTEM\NTPW32.EXE /s
O4 - HKLM\..\RunServices: [NETFD32.EXE] C:\WINDOWS\NETFD32.EXE /s
O4 - HKLM\..\RunServices: [ICH Synth] eusexe.exe
O4 - HKCU\..\Run: [axvnRWJmR] JOBXPAND.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: AVerTV Timer.lnk = C:\AVerTV USB\Schtra.exe
O8 - Extra context menu item: Read By Natural Voice Reader - C:\Program Files\Natural Voice Reader Standard\read.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program Files\Natural Voice Reader Standard\read.html
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) - http://01.sharedsource.org/html/UDConn.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/097610866859e6837622/…ip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azesearch.com/install/azesearch.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
Post #2
Welcome to the forum.

and it appears it is ridden with spyware!!!


That's an understatement!


1. Please download and unzip
AboutBuster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.

2. Download CW-Shredder at the link below:
http://cwshredder.net/bin/CWShredder.exe

3. HowToShowHiddenFiles - <—enable this

4. Make sure you know how to boot into - SafeMode


5. Run AboutBuster . This will scan your computer for the bad files and delete them. It will ask to scan the system again, let it. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

6. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

7. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin


8. Reboot into normal mode.


9. Download and run this online virus scan:
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you check "AutoClean"

10. Download this file to your desktop:
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'



11. Reboot and post a fresh HJT log back here by using the add reply button below, and lets see how we did, MrC
Post #3

That's an understatement!

:o

Hi MrCharlie,

Thank you very much for your immediate response and of course the warm welcome.

However, I did encounter a couple of problems whilst running through your suggestions:

1) I was unable to save the log file having completed the AboutBuster. For some reason it wasn't highlighted and the only option available was to exit the programme.

2) I was unable to run the TrendMicro online scan as the "Microsoft Error Message" kept on popping up asking if I wanted to send an error report to Microsoft!

I have however, added a new HJT log below. Look forward to your response. Please do let me know if the only way of resolving this issue is to throw the computer out of the window. :D

Thanks, Hux


Logfile of HijackThis v1.99.1
Scan saved at 11:57:50, on 26/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\APIBK32.EXE
C:\WINDOWS\JAVAXV32.EXE
C:\WINDOWS\SYSTEM\NTXY.EXE
C:\WINDOWS\SYSTEM\JAVAIF32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\JAVAGD.EXE
C:\WINDOWS\SYSTEM\JAVAHY32.EXE
C:\WINDOWS\SYSTEM\D3YK.EXE
C:\WINDOWS\SYSTEM\IEXS.EXE
C:\WINDOWS\MFCSL.EXE
C:\WINDOWS\APIRA.EXE
C:\WINDOWS\SYSTEM\WINAS32.EXE
C:\WINDOWS\NTQK32.EXE
C:\WINDOWS\NETJK.EXE
C:\WINDOWS\APPEH.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\NTUA32.EXE
C:\WINDOWS\SYSTEM\MFCMT32.EXE
C:\WINDOWS\SYSTEM\NTJR.EXE
C:\WINDOWS\APIMO32.EXE
C:\WINDOWS\SYSTEM\NETCU32.EXE
C:\WINDOWS\APPFQ.EXE
C:\WINDOWS\SYSTEM\SYSVU32.EXE
C:\WINDOWS\SYSTEM\APPFP.EXE
C:\WINDOWS\SYSTEM\IPAX.EXE
C:\WINDOWS\SYSTEM\JAVANZ32.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\WINDOWS\SYSTEM\NTPW32.EXE
C:\WINDOWS\NETFD32.EXE
C:\WINDOWS\SYSTEM\EUSEXE.EXE
C:\WINDOWS\SYSTEM\JAVAKP32.EXE
C:\WINDOWS\ATLQU.EXE
C:\WINDOWS\SYSTEM\IEGD.EXE
C:\WINDOWS\D3CN32.EXE
C:\WINDOWS\SYSTEM\CRHA.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\JAVAYC32.EXE
C:\WINDOWS\SYSTEM\JAVASQ32.EXE
C:\WINDOWS\SYSTEM\ADDSK32.EXE
C:\WINDOWS\SYSTEM\MFCIU32.EXE
C:\WINDOWS\SDKCC.EXE
C:\WINDOWS\SYSTEM\SYSSP.EXE
C:\WINDOWS\SYSTEM\SDKVH.EXE
C:\WINDOWS\SDKOP.EXE
C:\WINDOWS\SDKPV32.EXE
C:\WINDOWS\SYSTEM\MSHM32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADUSERMON.EXE
C:\PROGRAM FILES\IOMEGA\DRIVEICONS\IMGICON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TEMP\C201.TMP.EXE
C:\WINDOWS\SYSTEM\CNXDSLTB.EXE
C:\WINDOWS\SYSTEM\IGFXTRAY.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\WINDOWS\SYSTEM\SBMX.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\WINDOWS\SYSTEM\WINRM.EXE
C:\AVERTV USB\SCHTRA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\MSHM32.EXE
C:\WINDOWS\JAVAXV32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {DFEFC2E4-F483-9FA6-4309-4E2EDB1D0426} - C:\WINDOWS\IEFN.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [C201.TMP] C:\WINDOWS\TEMP\C201.TMP.exe 0 10001
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKLM\..\Run: [r64h36l] LZEDN32.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\WINDOWS\SYSTEM\CnxDslTb.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [SBMX] C:\WINDOWS\SYSTEM\sbmx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [C201.TMP.EXE] C:\WINDOWS\TEMP\C201.TMP.EXE 0 10001
O4 - HKLM\..\Run: [WINRM.EXE] C:\WINDOWS\SYSTEM\WINRM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ADService] C:\Program Files\Iomega\AutoDisk\ADService.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [APIOR32.EXE] C:\WINDOWS\APIOR32.EXE
O4 - HKLM\..\RunServices: [D3YK.EXE] C:\WINDOWS\SYSTEM\D3YK.EXE
O4 - HKLM\..\RunServices: [WINNW32.EXE] C:\WINDOWS\WINNW32.EXE
O4 - HKLM\..\RunServices: [APIBK32.EXE] C:\WINDOWS\SYSTEM\APIBK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAXV32.EXE] C:\WINDOWS\JAVAXV32.EXE /s
O4 - HKLM\..\RunServices: [NTXY.EXE] C:\WINDOWS\SYSTEM\NTXY.EXE /s
O4 - HKLM\..\RunServices: [JAVAIF32.EXE] C:\WINDOWS\SYSTEM\JAVAIF32.EXE /s
O4 - HKLM\..\RunServices: [JAVAGD.EXE] C:\WINDOWS\JAVAGD.EXE /s
O4 - HKLM\..\RunServices: [JAVAHY32.EXE] C:\WINDOWS\SYSTEM\JAVAHY32.EXE /s
O4 - HKLM\..\RunServices: [IEXS.EXE] C:\WINDOWS\SYSTEM\IEXS.EXE /s
O4 - HKLM\..\RunServices: [MFCSL.EXE] C:\WINDOWS\MFCSL.EXE /s
O4 - HKLM\..\RunServices: [APIRA.EXE] C:\WINDOWS\APIRA.EXE /s
O4 - HKLM\..\RunServices: [WINAS32.EXE] C:\WINDOWS\SYSTEM\WINAS32.EXE /s
O4 - HKLM\..\RunServices: [NTQK32.EXE] C:\WINDOWS\NTQK32.EXE /s
O4 - HKLM\..\RunServices: [NETJK.EXE] C:\WINDOWS\NETJK.EXE /s
O4 - HKLM\..\RunServices: [APPEH.EXE] C:\WINDOWS\APPEH.EXE /s
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [NTUA32.EXE] C:\WINDOWS\SYSTEM\NTUA32.EXE /s
O4 - HKLM\..\RunServices: [MFCMT32.EXE] C:\WINDOWS\SYSTEM\MFCMT32.EXE /s
O4 - HKLM\..\RunServices: [NTJR.EXE] C:\WINDOWS\SYSTEM\NTJR.EXE /s
O4 - HKLM\..\RunServices: [APIMO32.EXE] C:\WINDOWS\APIMO32.EXE /s
O4 - HKLM\..\RunServices: [NETCU32.EXE] C:\WINDOWS\SYSTEM\NETCU32.EXE /s
O4 - HKLM\..\RunServices: [APPFQ.EXE] C:\WINDOWS\APPFQ.EXE /s
O4 - HKLM\..\RunServices: [SYSVU32.EXE] C:\WINDOWS\SYSTEM\SYSVU32.EXE /s
O4 - HKLM\..\RunServices: [APPFP.EXE] C:\WINDOWS\SYSTEM\APPFP.EXE /s
O4 - HKLM\..\RunServices: [IPAX.EXE] C:\WINDOWS\SYSTEM\IPAX.EXE /s
O4 - HKLM\..\RunServices: [JAVANZ32.EXE] C:\WINDOWS\SYSTEM\JAVANZ32.EXE /s
O4 - HKLM\..\RunServices: [MSGO32.EXE] C:\WINDOWS\SYSTEM\MSGO32.EXE /s
O4 - HKLM\..\RunServices: [NTPW32.EXE] C:\WINDOWS\SYSTEM\NTPW32.EXE /s
O4 - HKLM\..\RunServices: [NETFD32.EXE] C:\WINDOWS\NETFD32.EXE /s
O4 - HKLM\..\RunServices: [ICH Synth] eusexe.exe
O4 - HKLM\..\RunServices: [JAVAKP32.EXE] C:\WINDOWS\SYSTEM\JAVAKP32.EXE /s
O4 - HKLM\..\RunServices: [ATLQU.EXE] C:\WINDOWS\ATLQU.EXE /s
O4 - HKLM\..\RunServices: [IEGD.EXE] C:\WINDOWS\SYSTEM\IEGD.EXE /s
O4 - HKLM\..\RunServices: [D3CN32.EXE] C:\WINDOWS\D3CN32.EXE /s
O4 - HKLM\..\RunServices: [CRHA.EXE] C:\WINDOWS\SYSTEM\CRHA.EXE /s
O4 - HKLM\..\RunServices: [JAVAYC32.EXE] C:\WINDOWS\SYSTEM\JAVAYC32.EXE /s
O4 - HKLM\..\RunServices: [JAVASQ32.EXE] C:\WINDOWS\SYSTEM\JAVASQ32.EXE /s
O4 - HKLM\..\RunServices: [ADDSK32.EXE] C:\WINDOWS\SYSTEM\ADDSK32.EXE /s
O4 - HKLM\..\RunServices: [MFCIU32.EXE] C:\WINDOWS\SYSTEM\MFCIU32.EXE /s
O4 - HKLM\..\RunServices: [SDKCC.EXE] C:\WINDOWS\SDKCC.EXE /s
O4 - HKLM\..\RunServices: [SYSSP.EXE] C:\WINDOWS\SYSTEM\SYSSP.EXE /s
O4 - HKLM\..\RunServices: [SDKVH.EXE] C:\WINDOWS\SYSTEM\SDKVH.EXE /s
O4 - HKLM\..\RunServices: [SDKOP.EXE] C:\WINDOWS\SDKOP.EXE /s
O4 - HKLM\..\RunServices: [SDKPV32.EXE] C:\WINDOWS\SDKPV32.EXE /s
O4 - HKLM\..\RunServices: [MSHM32.EXE] C:\WINDOWS\SYSTEM\MSHM32.EXE /s
O4 - HKCU\..\Run: [axvnRWJmR] JOBXPAND.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: AVerTV Timer.lnk = C:\AVerTV USB\Schtra.exe
O8 - Extra context menu item: Read By Natural Voice Reader - C:\Program Files\Natural Voice Reader Standard\read.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program Files\Natural Voice Reader Standard\read.html
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) - http://01.sharedsource.org/html/UDConn.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/097610866859e6837622/…ip/RdxIE601.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azesearch.com/install/azesearch.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #4 last edited
Please move HJT into its own permanent folder so backups can be made, suggest:
C:\WINDOWS\DESKTOP\MyHJT\HIJACKTHIS.EXE

Download and unzip the KillBox to a folder - we'll use it later.

HowToShowHiddenFiles - <—enable this

Make sure you know how to boot into - SafeMode

Reboot into safe mode.

Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if found:

APIBK32.EXE
JAVAXV32.EXE
NTXY.EXE
JAVAIF32.EXE
JAVAGD.EXE
JAVAHY32.EXE
D3YK.EXE
IEXS.EXE
MFCSL.EXE
APIRA.EXE
WINAS32.EXE
NTQK32.EXE
NETJK.EXE
APPEH.EXE
NTUA32.EXE
MFCMT32.EXE
NTJR.EXE
APIMO32.EXE
NETCU32.EXE
APPFQ.EXE
SYSVU32.EXE
APPFP.EXE
IPAX.EXE
JAVANZ32.EXE
MSGO32.EXE
NTPW32.EXE
NETFD32.EXE
EUSEXE.EXE
JAVAKP32.EXE
ATLQU.EXE
IEGD.EXE
D3CN32.EXE
CRHA.EXE
JAVAYC32.EXE
JAVASQ32.EXE
ADDSK32.EXE
MFCIU32.EXE
SDKCC.EXE
SYSSP.EXE
SDKVH.EXE
SDKOP.EXE
SDKPV32.EXE
MSHM32.EXE
C201.TMP.EXE
CNXDSLTB.EXE
SBMX.EXE
WINRM.EXE
JAVAXV32.EXE

Exit the Task Manager when finished

Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\lhtjn.dll/sp.html#37049
O2 - BHO: Class - {DFEFC2E4-F483-9FA6-4309-4E2EDB1D0426} - C:\WINDOWS\IEFN.DLL
O4 - HKLM\..\Run: [C201.TMP] C:\WINDOWS\TEMP\C201.TMP.exe 0 10001
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\SYSTEM\tibs3.exe
O4 - HKLM\..\Run: [r64h36l] LZEDN32.EXE
O4 - HKLM\..\Run: [C201.TMP.EXE] C:\WINDOWS\TEMP\C201.TMP.EXE 0 10001
O4 - HKLM\..\Run: [WINRM.EXE] C:\WINDOWS\SYSTEM\WINRM.EXE
O4 - HKLM\..\RunServices: [APIOR32.EXE] C:\WINDOWS\APIOR32.EXE
O4 - HKLM\..\RunServices: [D3YK.EXE] C:\WINDOWS\SYSTEM\D3YK.EXE
O4 - HKLM\..\RunServices: [WINNW32.EXE] C:\WINDOWS\WINNW32.EXE
O4 - HKLM\..\RunServices: [APIBK32.EXE] C:\WINDOWS\SYSTEM\APIBK32.EXE /s
O4 - HKLM\..\RunServices: [JAVAXV32.EXE] C:\WINDOWS\JAVAXV32.EXE /s
O4 - HKLM\..\RunServices: [NTXY.EXE] C:\WINDOWS\SYSTEM\NTXY.EXE /s
O4 - HKLM\..\RunServices: [JAVAIF32.EXE] C:\WINDOWS\SYSTEM\JAVAIF32.EXE /s
O4 - HKLM\..\RunServices: [JAVAGD.EXE] C:\WINDOWS\JAVAGD.EXE /s
O4 - HKLM\..\RunServices: [JAVAHY32.EXE] C:\WINDOWS\SYSTEM\JAVAHY32.EXE /s
O4 - HKLM\..\RunServices: [IEXS.EXE] C:\WINDOWS\SYSTEM\IEXS.EXE /s
O4 - HKLM\..\RunServices: [MFCSL.EXE] C:\WINDOWS\MFCSL.EXE /s
O4 - HKLM\..\RunServices: [APIRA.EXE] C:\WINDOWS\APIRA.EXE /s
O4 - HKLM\..\RunServices: [WINAS32.EXE] C:\WINDOWS\SYSTEM\WINAS32.EXE /s
O4 - HKLM\..\RunServices: [NTQK32.EXE] C:\WINDOWS\NTQK32.EXE /s
O4 - HKLM\..\RunServices: [NETJK.EXE] C:\WINDOWS\NETJK.EXE /s
O4 - HKLM\..\RunServices: [APPEH.EXE] C:\WINDOWS\APPEH.EXE /s
O4 - HKLM\..\RunServices: [NTUA32.EXE] C:\WINDOWS\SYSTEM\NTUA32.EXE /s
O4 - HKLM\..\RunServices: [MFCMT32.EXE] C:\WINDOWS\SYSTEM\MFCMT32.EXE /s
O4 - HKLM\..\RunServices: [NTJR.EXE] C:\WINDOWS\SYSTEM\NTJR.EXE /s
O4 - HKLM\..\RunServices: [APIMO32.EXE] C:\WINDOWS\APIMO32.EXE /s
O4 - HKLM\..\RunServices: [NETCU32.EXE] C:\WINDOWS\SYSTEM\NETCU32.EXE /s
O4 - HKLM\..\RunServices: [APPFQ.EXE] C:\WINDOWS\APPFQ.EXE /s
O4 - HKLM\..\RunServices: [SYSVU32.EXE] C:\WINDOWS\SYSTEM\SYSVU32.EXE /s
O4 - HKLM\..\RunServices: [APPFP.EXE] C:\WINDOWS\SYSTEM\APPFP.EXE /s
O4 - HKLM\..\RunServices: [IPAX.EXE] C:\WINDOWS\SYSTEM\IPAX.EXE /s
O4 - HKLM\..\RunServices: [JAVANZ32.EXE] C:\WINDOWS\SYSTEM\JAVANZ32.EXE /s
O4 - HKLM\..\RunServices: [MSGO32.EXE] C:\WINDOWS\SYSTEM\MSGO32.EXE /s
O4 - HKLM\..\RunServices: [NTPW32.EXE] C:\WINDOWS\SYSTEM\NTPW32.EXE /s
O4 - HKLM\..\RunServices: [NETFD32.EXE] C:\WINDOWS\NETFD32.EXE /s
O4 - HKLM\..\RunServices: [JAVAKP32.EXE] C:\WINDOWS\SYSTEM\JAVAKP32.EXE /s
O4 - HKLM\..\RunServices: [ATLQU.EXE] C:\WINDOWS\ATLQU.EXE /s
O4 - HKLM\..\RunServices: [IEGD.EXE] C:\WINDOWS\SYSTEM\IEGD.EXE /s
O4 - HKLM\..\RunServices: [D3CN32.EXE] C:\WINDOWS\D3CN32.EXE /s
O4 - HKLM\..\RunServices: [CRHA.EXE] C:\WINDOWS\SYSTEM\CRHA.EXE /s
O4 - HKLM\..\RunServices: [JAVAYC32.EXE] C:\WINDOWS\SYSTEM\JAVAYC32.EXE /s
O4 - HKLM\..\RunServices: [JAVASQ32.EXE] C:\WINDOWS\SYSTEM\JAVASQ32.EXE /s
O4 - HKLM\..\RunServices: [ADDSK32.EXE] C:\WINDOWS\SYSTEM\ADDSK32.EXE /s
O4 - HKLM\..\RunServices: [MFCIU32.EXE] C:\WINDOWS\SYSTEM\MFCIU32.EXE /s
O4 - HKLM\..\RunServices: [SDKCC.EXE] C:\WINDOWS\SDKCC.EXE /s
O4 - HKLM\..\RunServices: [SYSSP.EXE] C:\WINDOWS\SYSTEM\SYSSP.EXE /s
O4 - HKLM\..\RunServices: [SDKVH.EXE] C:\WINDOWS\SYSTEM\SDKVH.EXE /s
O4 - HKLM\..\RunServices: [SDKOP.EXE] C:\WINDOWS\SDKOP.EXE /s
O4 - HKLM\..\RunServices: [SDKPV32.EXE] C:\WINDOWS\SDKPV32.EXE /s
O4 - HKLM\..\RunServices: [MSHM32.EXE] C:\WINDOWS\SYSTEM\MSHM32.EXE /s
O4 - HKCU\..\Run: [axvnRWJmR] JOBXPAND.EXE
O16 - DPF: {2F0D1DA3-F3E4-4C67-BB5C-5AFD70C1A4A5} (UDConnect Class) - http://01.sharedsource.org/html/UDConn.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/097610866859e6837622/…ip/RdxIE601.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} (CParamWr Class) - http://toolbar.azesearch.com/install/azesearch.cab

Click on Fix Checked and exit HijackThis.

Now open up the KillBox and copy and paste each one of these in and hit delete, if the file exists, it will appear in blue under the window, if not move on to the next file.
(or you can manually delete the files)

C:\WINDOWS\system\lhtjn.dll
C:\WINDOWS\SYSTEM\APIBK32.EXE
C:\WINDOWS\SYSTEM\NTXY.EXE
C:\WINDOWS\SYSTEM\JAVAIF32.EXE
C:\WINDOWS\SYSTEM\JAVAHY32.EXE
C:\WINDOWS\SYSTEM\D3YK.EXE
C:\WINDOWS\SYSTEM\IEXS.EXE
C:\WINDOWS\SYSTEM\WINAS32.EXE
C:\WINDOWS\SYSTEM\NTUA32.EXE
C:\WINDOWS\SYSTEM\MFCMT32.EXE
C:\WINDOWS\SYSTEM\NTJR.EXE
C:\WINDOWS\SYSTEM\NETCU32.EXE
C:\WINDOWS\SYSTEM\SYSVU32.EXE
C:\WINDOWS\SYSTEM\APPFP.EXE
C:\WINDOWS\SYSTEM\IPAX.EXE
C:\WINDOWS\SYSTEM\JAVANZ32.EXE
C:\WINDOWS\SYSTEM\MSGO32.EXE
C:\WINDOWS\SYSTEM\NTPW32.EXE
C:\WINDOWS\SYSTEM\EUSEXE.EXE
C:\WINDOWS\SYSTEM\JAVAKP32.EXE
C:\WINDOWS\SYSTEM\IEGD.EXE
C:\WINDOWS\SYSTEM\CRHA.EXE
C:\WINDOWS\SYSTEM\JAVAYC32.EXE
C:\WINDOWS\SYSTEM\JAVASQ32.EXE
C:\WINDOWS\SYSTEM\ADDSK32.EXE
C:\WINDOWS\SYSTEM\MFCIU32.EXE
C:\WINDOWS\SYSTEM\SYSSP.EXE
C:\WINDOWS\SYSTEM\SDKVH.EXE
C:\WINDOWS\SYSTEM\MSHM32.EXE
C:\WINDOWS\TEMP\C201.TMP.EXE
C:\WINDOWS\SYSTEM\CNXDSLTB.EXE
C:\WINDOWS\SYSTEM\SBMX.EXE
C:\WINDOWS\SYSTEM\WINRM.EXE
C:\WINDOWS\SYSTEM\tibs3.exe
C:\WINDOWS\JAVAXV32.EXE
C:\WINDOWS\MFCSL.EXE
C:\WINDOWS\APIRA.EXE
C:\WINDOWS\NTQK32.EXE
C:\WINDOWS\NETJK.EXE
C:\WINDOWS\APPEH.EXE
C:\WINDOWS\ATLQU.EXE
C:\WINDOWS\JAVAGD.EXE
C:\WINDOWS\D3CN32.EXE
C:\WINDOWS\SDKCC.EXE
C:\WINDOWS\WINNW32.EXE
C:\WINDOWS\APIMO32.EXE
C:\WINDOWS\APPFQ.EXE
C:\WINDOWS\NETFD32.EXE
C:\WINDOWS\SDKOP.EXE
C:\WINDOWS\SDKPV32.EXE
C:\WINDOWS\APIOR32.EXE
C:\WINDOWS\IEFN.DLL
LZEDN32.EXE <—-these two you will have to search for
JOBXPAND.EXE

Now run AboutBuster again

Now run CW-Shredder again

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Reboot into normal mode and see if you can run the virus scan:

http://housecall.trendmicro.com/housecall/start_corp.asp

Reboot and post a fresh HJT log, MrC
Post #5
Hey MrC,

Following your latest instructions, I hope I have deleted everything!

Do you recomend I do anything else? Am I totally spyware free? :ph34r:

Thanks,

Hux


Logfile of HijackThis v1.99.1
Scan saved at 19:55:31, on 26/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\IOMEGA\AUTODISK\ADUSERMON.EXE
C:\PROGRAM FILES\IOMEGA\DRIVEICONS\IMGICON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\IGFXTRAY.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\AVERTV USB\SCHTRA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACK\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\WINDOWS\SYSTEM\CnxDslTb.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\SYSTEM\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [SBMX] C:\WINDOWS\SYSTEM\sbmx.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ADService] C:\Program Files\Iomega\AutoDisk\ADService.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: AVerTV Timer.lnk = C:\AVerTV USB\Schtra.exe
O8 - Extra context menu item: Read By Natural Voice Reader - C:\Program Files\Natural Voice Reader Standard\read.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program Files\Natural Voice Reader Standard\read.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #6
Well Done!! Pour yourself a drink!

I figured we would be here for days fixing this one.

I'll leave you with……..

Some preventive maintenance:

Must have or do.

Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point:
(ME and XP users only)

XP system restore

ME system restore


Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked. Check for updates weekly.

SpywareBlaster

SpywareGuard


IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
IE-SPYAD

SpyBot has some protection benefits - use them.

Need a free anti virus?
AVG*free
(check for updates - daily)

How about a firewall? The front door to your computer.
ZoneAlarm*free

http://www.diamondcs.com.au/index.php?page=regprot


———————————————————————

Free spyware removal programs:
SpyBot
AD-Aware
CW-Shredder

Free Online Trojan Scan

A SQUARED FREE TROJAN SCANNER

Trojan Hunter
TrojanHunter - free trial

Please consider using FireFox instead of Internet Explorer

Replace Java with SunJava

Pop-up stoppers:
GoogleToolBar
Pop-upStopperFree

Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

Good luck and thanks for using the forum - MrC
Post #7
As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Thanks, MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI