What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Help

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi
First of all, I try to follow rules as best I can, and I notice you have #2 that says "Flames will not be tolerated" … I hope I'm not breaking this, can someone tell me what a flame is? other than what comes from a fire… and I agree that would be bad for the puter…lol

I have run both Ad-aware, and SpyBot and then rebooted my computer. Then I proceded to run Hijack This and this is my report. I would appreciate all the help I can get with this.

Logfile of HijackThis v1.99.1
Scan saved at 12:24:02 PM, on 11/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
\\SBC_5\SYS\PUBLIC\CLNTRUST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\PORT CONTROLLER\MFPSCDL.EXE
C:\WINDOWS\TEMP\SVCMM32.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\WINDOWS\SYSTEM\AICDVO.EXE
C:\WINDOWS\TEMP\180AX.EXE
C:\WINDOWS\SYSTEM\HZGI.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\ZE9M.EXE
C:\WINDOWS\SYSTEM\AP9H4QMO.EXE
C:\WINDOWS\SYSTEM\NSVSVC\NSVSVC.EXE
C:\WINDOWS\SYSTEM\PICSVR\PICSVR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\FACETCORP\FACETWIN\FWAGENT.EXE
C:\PROGRAM FILES\STAROFFICE7\PROGRAM\SOFFICE.EXE
C:\WINDOWS\CALC.EXE
C:\WINDOWS\SYSTEM\HZGI.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saundersbook.ca/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.saundersbook.ca/"); (C:\Program Files\Netscape\Users\spearson\prefs.js)
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Port Controller] C:\Program Files\Panasonic\Panasonic-DMS\Port Controller\Mgcsload.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [USB controller] "C:\WINDOWS\TEMP\SVCMM32.EXE" /startup
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [FARMMEXT] C:\WINDOWS\FARMMEXT.exe
O4 - HKLM\..\Run: [aicdvo] c:\windows\system\aicdvo.exe
O4 - HKLM\..\Run: [180ax] c:\windows\temp\180ax.exe
O4 - HKLM\..\Run: [Hzgi.exe] C:\WINDOWS\SYSTEM\HZGI.EXE
O4 - HKLM\..\Run: [ahwpqhqf] C:\WINDOWS\ahwpqhqf.exe
O4 - HKLM\..\Run: [Ze9m] C:\WINDOWS\SYSTEM\ZE9M.EXE
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\SYSTEM\nsvsvc\nsvsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\SYSTEM\PICSVR\PICSVR.EXE
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
O4 - HKLM\..\RunServices: [MFP Data Manage] C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\Nprotect.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Startup: FacetWin Agent.lnk = C:\Program Files\FacetCorp\FacetWin\fwagent.exe
O4 - Startup: StarOffice 7.lnk = C:\Program Files\StarOffice7\program\quickstart.exe
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

Thank you in advance,
DMCAngel
Post #2
Flaming is when you add nasty comment to someone else thread.

Follow the steps in the link below. It is important to follow all of the steps in the thread. You will not be able to run the Microsoft Beta Scanner as it does not support Win 98 so skip that.

http://computercops.biz/postt106277.html


Reboot and post a new HiJackThis log by clicking on "add reply" at the bottom right.
Post #3
Hi, Thank you for your help, I am working on the bad computer with your instructions now, it is taking a little time, so I just wanted to let you know I was working on it… will post again when I get the next report for you…. Thank you sooooooo much!!! DMCAngel :wavey:
Post #4
Hi sig
Well had a few problems, but here is the latest hjt log. I also saved the Kaspersky log but it is too large to fit in notepad, so I thought it might be too large to fit in here too. Just to let you know.. It found 207 Viruses, and only deleted 206. It did not quarantine or disinfect any so I think I still have some cleaning up to do.
I am also getting a Wo window… Saying that it has preformed an illegal operation. I don't know what "Wo" is.

By the way, Thanks for the info on flaming, I don't understand why anyone would want to waste their time doing that, but I guess "to each their own".

Logfile of HijackThis v1.99.1
Scan saved at 3:52:54 PM, on 13/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\PORT CONTROLLER\MFPSCDL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\WEB OFFER\WO.EXE
C:\PROGRAM FILES\FACETCORP\FACETWIN\FWAGENT.EXE
C:\PROGRAM FILES\STAROFFICE7\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saundersbook.ca/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.saundersbook.ca/"); (C:\Program Files\Netscape\Users\spearson\prefs.js)
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Port Controller] C:\Program Files\Panasonic\Panasonic-DMS\Port Controller\Mgcsload.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Hzgi.exe] C:\WINDOWS\SYSTEM\HZGI.EXE
O4 - HKLM\..\Run: [Ze9m] C:\WINDOWS\SYSTEM\ZE9M.EXE
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [MFP Data Manage] C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Startup: FacetWin Agent.lnk = C:\Program Files\FacetCorp\FacetWin\fwagent.exe
O4 - Startup: StarOffice 7.lnk = C:\Program Files\StarOffice7\program\quickstart.exe
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll


Thank you for your help with this.
DMCAngel

ps… just noticed in the report above…. bet you are going to tell me to get rid of wo.exe… but I will wait for your reply, as you know best.
Post #5
Scan with hijackthis and put a check beside these lines and choose FIX O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing) O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [Hzgi.exe] C:\WINDOWS\SYSTEM\HZGI.EXE O4 - HKLM\..\Run: [Ze9m] C:\WINDOWS\SYSTEM\ZE9M.EXE O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBOUNCER\VirtualBouncer.exe O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll Then reboot and post a new log please.
Post #6
Hi again,
Just got back to my computer, and did what you asked.

I still have some disturbing desktop icons, "Virus Hunter Security", "Spyware Avenger", "Cheap Holiday Travel","Golden Palace Online Casino","Online Dating","Remove Spyware","Free Online Music". All of which I did not intentionally download. I know how to take the shortcut off the desktop, but is there still hidden files located for these?

Here is my latest log
Logfile of HijackThis v1.99.1
Scan saved at 8:50:08 AM, on 14/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
\\SBC_5\SYS\PUBLIC\CLNTRUST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\PORT CONTROLLER\MFPSCDL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\FACETCORP\FACETWIN\FWAGENT.EXE
C:\PROGRAM FILES\STAROFFICE7\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saundersbook.ca/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.saundersbook.ca/"); (C:\Program Files\Netscape\Users\spearson\prefs.js)
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Port Controller] C:\Program Files\Panasonic\Panasonic-DMS\Port Controller\Mgcsload.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [MFP Data Manage] C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"
O4 - Startup: FacetWin Agent.lnk = C:\Program Files\FacetCorp\FacetWin\fwagent.exe
O4 - Startup: StarOffice 7.lnk = C:\Program Files\StarOffice7\program\quickstart.exe


Thank you for all your help!!

DMCAngel
Post #7
Please download MicroWorld scanner for the link below. Make sure that you choose all files and directories. I warn that the scan will tak a long time and will not fix anything. Once the scan is completed in the LOWER box hilight all the files there then copy (ctrl +c) and paste it into the thread please.

Here >>>> http://www.mwti.net/antivirus/mwav.asp
Post #8
Hello, Here is the information it give me in the lower window. I couldn't get back to this forum when I was done so I had to save the information in notepad and restart the machine. File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "eZula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "Adintelligence.AproposToolbar Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "exactutil Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "dvx Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "vendor Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "se Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "dlmax Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "pynix Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "addestroyer Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Thank you so much for your time! DMCAngel
Post #9
Please download and run Spybot Search & Destroy and AdAware. Then follow the instructions in the links below to run.

Spybot Tutorial

AdAware Tutorial



Please do an online scan,

Panda >>> http://www.pandasoftware.com/activescan/co…n_principal.htm

Make sure that you choose "fix" or "clean".

Reboot and post a new HiJackThis log by clicking on "add reply" at the bottom right.
Post #10
Hi, I'm finally back….
Ok had a few problems this time. I had Spybot and Adaware loaded and had run in before coming onto the forum but with your request, I actually removed both of them and then installed from your directions and ran them. They both found stuff and I had them delete the problems. I then went to the Panda Online scan.

You said
Make sure that you choose "fix" or "clean".

Well, when it finished scanning, it only give me the option to create a report. Did not see where I could fix or clean. It did find 60. Here is the report.

Incident Status Location

Adware:Adware/eZula No disinfected C:\WINDOWS\SYSTEM\ezPopStub.exe
Adware:Adware/SaveNow No disinfected Windows Registry
Adware:Adware/CWS No disinfected C:\WINDOWS\Desktop\Virus Hunter Security.lnk
Adware:Adware/Apropos No disinfected C:\Program Files\cxtpls
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\All Users\Application Data\AdDestroyer
Adware:Adware/DelFinMedia No disinfected Windows Registry
Adware:Adware/IPInsight No disinfected C:\WINDOWS\farmmext.ini
Adware:Adware/ISearch No disinfected C:\WINDOWS\deskbar.ini
Adware:Adware/Twain-Tech No disinfected C:\windows\TEMP\THI*.tmp
Adware:Adware/WildTangent No disinfected C:\WINDOWS\wt
Adware:Adware/WUpd No disinfected C:\WINDOWS\SYSTEM\q17i9a4j.ini
Adware:Adware/BroadcastPC No disinfected Windows Registry
Adware:Adware/Transponder No disinfected C:\WINDOWS\inf\dlmax.inf
Spyware:Spyware/BetterInet No disinfected C:\RECYCLED\NPROTECT\00003138.INF
Adware:Adware/IPInsight No disinfected C:\RECYCLED\NPROTECT\00003403.INF
Adware:Adware/Apropos No disinfected C:\RECYCLED\NPROTECT\00003918.EXE
Adware:Adware/Apropos No disinfected C:\RECYCLED\NPROTECT\00003916.DLL
Adware:Adware/Apropos No disinfected C:\RECYCLED\NPROTECT\00003919.DLL
Adware:Adware/FIsearch No disinfected C:\RECYCLED\DC0\msdbhk.dll
Adware:Adware/ISearch No disinfected C:\RECYCLED\DC0\ffisearch.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI6EF7.TMP\farmmext.cab[farmmext.inf]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI6EF7.TMP\farmmext.cab[farmmext.ini]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI6EF7.TMP\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI6EF7.TMP\farmmext.ini
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI2AE7.TMP\farmmext.cab[farmmext.inf]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI2AE7.TMP\farmmext.cab[farmmext.ini]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI38FC.TMP\dlmax.cab[dlmax.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI38FC.TMP\dlmax.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI3535.TMP\dlmax.cab[dlmax.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI3535.TMP\dlmax.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THICB4.TMP\dlmax.cab[dlmax.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THICB4.TMP\dlmax.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI5AB1.TMP\dlmax.cab[dlmax.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI5AB1.TMP\dlmax.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI4042.TMP\dlmax.cab[dlmax.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\THI4042.TMP\dlmax.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4C47.TMP\farmmext.cab[farmmext.inf]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI4C47.TMP\farmmext.cab[farmmext.ini]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI954.TMP\farmmext.cab[farmmext.inf]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI954.TMP\farmmext.cab[farmmext.ini]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI954.TMP\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\THI954.TMP\farmmext.ini
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI71E1.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI71E1.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI21B5.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI21B5.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI447A.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI447A.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI52C0.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI52C0.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI544F.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI544F.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI4924.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI4924.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI375.TMP\ceres.cab[ceres.inf]
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\THI375.TMP\ceres.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\INF\CERES.INF
Adware:Adware/Transponder No disinfected C:\WINDOWS\INF\DLMAX.INF
Adware:Adware/Apropos No disinfected C:\WINDOWS\Local Settings\Temporary Internet Files\Content.IE5\M5W3E1Y5\AproposClientInstaller[1].exe
Adware:Adware/ISearch No disinfected C:\WINDOWS\delprot.ini
<_<

So, Did I do something wrong? Should I have had an option to Fix or Clean?
:wall:
Here also is the latest HijackThis report.

Logfile of HijackThis v1.99.1
Scan saved at 2:08:48 PM, on 15/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\RTVSCN95.EXE
\\SBC_5\SYS\PUBLIC\CLNTRUST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\PORT CONTROLLER\MFPSCDL.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\FACETCORP\FACETWIN\FWAGENT.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\STAROFFICE7\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saundersbook.ca/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.saundersbook.ca/"); (C:\Program Files\Netscape\Users\spearson\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Port Controller] C:\Program Files\Panasonic\Panasonic-DMS\Port Controller\Mgcsload.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\Nprotect.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\RunServices: [MFP Data Manage] C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\SYMANT~1\SYMANT~1\rtvscn95.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: FacetWin Agent.lnk = C:\Program Files\FacetCorp\FacetWin\fwagent.exe
O4 - Startup: StarOffice 7.lnk = C:\Program Files\StarOffice7\program\quickstart.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

Thank you again for your time and patience…. I really appreciate your help.

DMCAngel

:wall:
Post #12
Hello Again,
I re-ran Kaspersky in safe mode just like I did the first time by following the instructions in the document you had me look at. One of the issues is…
It says:

*Press Ctrl + Alt + Del and bring up task manager, go to processes tab and right click on explorer.exe and then select stop process.

because I am running win98 I don't have tabs when I do a Ctrl+Alt+Delete. But I found Explorer and told it to End Task, Then I rank KAV and when done I still had explorer.exe runing… and I had no way of restarting it anyway.

However, Kaspersky did not find anything this time around.

I still have 3 Icons on my desktop that I am suspect of. Virus Hunter Security, Golden Palace Online Casino, and Spyware Avenger.

I assumed you would like another HJT report so I have included it.
Logfile of HijackThis v1.99.1
Scan saved at 10:47:38 AM, on 18/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
C:\PROGRAM FILES\SYMANTEC_CLIENT_SECURITY\SYMANTEC ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\PORT CONTROLLER\MFPSCDL.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\FACETCORP\FACETWIN\FWAGENT.EXE
C:\PROGRAM FILES\STAROFFICE7\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\DOWNLOADS\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saundersbook.ca/
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.saundersbook.ca/"); (C:\Program Files\Netscape\Users\spearson\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Port Controller] C:\Program Files\Panasonic\Panasonic-DMS\Port Controller\Mgcsload.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\Nprotect.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\RunServices: [MFP Data Manage] C:\PROGRAM FILES\PANASONIC\PANASONIC-DMS\MFP UTILITIES\MFPDTMNG.EXE
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\SYMANT~1\SYMANT~1\defwatch.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: FacetWin Agent.lnk = C:\Program Files\FacetCorp\FacetWin\fwagent.exe
O4 - Startup: StarOffice 7.lnk = C:\Program Files\StarOffice7\program\quickstart.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

Am I getting anywhere? or am I just going in circles?

Thank you again.

DMCAngel
Post #14
Hi Siggyx, No I hadn't tried it yet, because, as I had said above I wanted to follow your directions. I have helped enough people to know that the most frustrating thing is when they do stuff without you knowing, so once I started getting your help, I tried to follow you as close as I could. Now I have deleted them off the desktop and everything seems to be ok. Thank you SO much for all your help. In the process of trying to get your help, I ended up with 2 posts on the site, I tried to go back and delete the other one but couldn't so I replied to it and said that it was taken care of. Is there any way of deleting it? Thank you again for your help! DMCAngel:-) :lol: :lol: much happier now! :D :D
Post #15
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI