What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Hi DeeEss! Sorry about the late reply to this being reopened. You mentioned you are getting help at another forum. I need you to make a decision. I will be more than happy to help you, but you need to get help from one forum at a time only. This way you are not taking up the time of multiple helpers when only one may be needed. This also will prevent me from being confused as to why your logs go through changes I have not instructed. This can cause helpers to end up working against each other as we don't know what the other is doing. As I said, I have no problems with helping you again. You just need to decide where you are going to get that help from. Here, or the other forum. Let me know. Thanks! :)
Post #33
OK… so you got some reg entries we need to take care of?

Scan again with MWAV(might want to redownload it as the reference files for have been updated yesterday). Post the log when done along with a new HijackThis log please.

Thanks!
Post #34
Not only do I have registry problems, MWAV found another varmint. :o I don't know why Spybot or Ad-Aware didn't find them. Anyway, here are the MWAV and HijackThis logs:

Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\msgrchkr.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\pxwma.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\windows\system\cdral.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\windows\system\iosubsys\Cdralvsd.vxd". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\windows\system\iosubsys\Cdr4vsd.vxd". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\Aiff.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\DefConvertor.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\msa.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\Vqf.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\wav.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\Lib\NeroCBUI.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeFileSrc.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeRender.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\Lib\apreg.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeAudio.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeAMR.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\Aac.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\aacenc32.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NDParser.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\NeQTDec.ax". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\DSFilter\aacplus.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\Lib\AdvrCntr.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\Lib\NeroIPP.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\ogg.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\NeroCoverDesigner_fra.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-jpn.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\NeroBackItUp_Fra.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_deu.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_fra.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart_jpn.chm". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\Nero BackItUp\BackItUp-Jpn.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\mp3PP.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\mp3PRO.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Ahead\AudioPlugins\lame_enc.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\msgrchkr.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6C373D24-7575-4507-972C-1814914570C9}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f1f2ece6-0289-4992-a536-f82dfc6f6d6e}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1c613f47-70c5-4551-a264-f7254139854c}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{7b9717b1-2d9b-4d14-b2da-d4bf5a28c6af}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f495ebbe-a068-41fb-89b6-c605d20a2df3}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9871f8af-152a-4651-834c-cdc5fe61c14c}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{ec39bf14-ca12-46cd-8ea2-b48d5a44350a}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{e6028af3-ee0a-4e49-a043-c44437680ad8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0b1511cd-37ee-4f0a-9647-cb2785b68a29}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{a861a366-0c7a-484b-9116-f366bf0fa23f}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{940f79d9-2062-41b7-a22f-9e99ffdd1b85}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{712a2867-02b2-402b-8f8d-74437494dcfb}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0edcdb7d-cd9e-44e6-9e9a-adbaa85540e8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{e5b2709a-0e6b-45d3-83c8-ef90c2ed5340}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{612fbd09-aad2-4f1c-ba97-f56658b1161b}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9e42f1b8-de23-4af5-a79a-0976e9ec5781}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{bc91ed21-e702-44e5-aa88-9f2f70e986c6}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\NEROCBUI.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D6BE4241-EF01-4C6C-9BBE-E9827B97F430}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEFILESRC.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F127DAF7-8D36-4E5F-8685-FC762B88E3A4}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NERENDER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{768CB288-8E28-4EA3-8887-297666E3A3D8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NERENDER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{39226F44-9732-4E51-8726-26F7298CC8A8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NERENDER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{84FDAC26-FB13-48BF-8ED0-B3E3EA78C758}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NERENDER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3D276BF5-0093-4084-B1B1-A3871DF19E1D}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\APREG.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A97E5305-400F-421D-978F-0DA9DD3876E5}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\APREG.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B6DDA744-57C3-4646-9C9F-24E2BACC8506}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\APREG.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{138130AF-A79B-45D5-B4AA-87697457BA87}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEAUDIO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8FF1A53C-B045-473A-89ED-FD90D0B84C8F}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEAUDIO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{CDBC46EF-1247-44C4-8F12-367D889F2EC8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEAUDIO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C0BA9CF8-96E0-4C34-B5DE-E92C3FC05ED6}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEVIDEO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DCD6EADC-EE69-47DD-B934-95573296039C}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEVIDEO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4BEFA071-8258-4884-A67B-26AF915214CB}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEVIDEO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{DF5E5E34-AE22-483D-94C3-9DD02FFF231E}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEVIDEO.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E206E4DE-A7EE-4A62-B3E9-4FBC8FE84C73}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NDPARSER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{5CB78A55-01B8-431E-96DE-6227D2E0C312}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NDPARSER.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{470157A6-BFEA-4DF8-A8A7-12CE5EF33AE7}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEQTDEC.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6E9B8139-8DC2-4554-8D80-9ECDB085938F}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEQTDEC.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D6D8A64E-F9F7-4685-9757-7338077234D8}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEQTDEC.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{44629984-2B6D-4F31-956B-9C91CB0775AF}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\DSFILTER\NEQTDEC.AX". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4EC0690F-EA6F-4573-845F-782AD19F35DB}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{E0E98A24-9C44-4F7C-B739-BA05D2965400}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F661DC11-4D60-4A50-ABA9-602FC4B54FEE}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{4966A6E3-D77A-42D5-9BC0-EED2215430D7}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C46FF1FF-78EF-4939-8B00-46273B7B8EE1}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{2DE3F90D-ACA9-4AC8-9033-DE2F360C4F7A}" refers to invalid object "C:\PROGRAM FILES\COMMON FILES\AHEAD\LIB\ADVRCNTR.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C3C6A060-C344-11D0-A20B-0800361A1803}" refers to invalid object "C:\PROGRAM FILES\HTML HELP WORKSHOP\CNVTOC.DLL". Action Taken: No Action Taken.
Entry "HKCR\Overview.Document" refers to invalid object "{DA23B9C9-6893-11D0-8534-00C04FD7AD0C}". Action Taken: No Action Taken.
Entry "HKCR\TSHOOT.TSHOOTCtrl.1" refers to invalid object "{4B106874-DD36-11D0-8B44-00A024DD9EFF}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CddbDisc.1" refers to invalid object "{fba38bcf-e23d-4979-811e-1326bbadb8c8}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CddbDisc" refers to invalid object "{fba38bcf-e23d-4979-811e-1326bbadb8c8}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CDDBWinampControl.1" refers to invalid object "{44b09a5f-5dee-4539-8001-d4b2d45c2876}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CDDBWinampControl" refers to invalid object "{44b09a5f-5dee-4539-8001-d4b2d45c2876}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CddbFullName.1" refers to invalid object "{d4387178-98ca-4929-b8e3-a11cd2f333a6}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.FullName" refers to invalid object "{d4387178-98ca-4929-b8e3-a11cd2f333a6}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CddbTrackManager.1" refers to invalid object "{43918f8f-f3be-4760-b4bb-6c89d9d91487}". Action Taken: No Action Taken.
Entry "HKCR\CDDBControlWinamp.CddbTrackManager" refers to invalid object "{43918f8f-f3be-4760-b4bb-6c89d9d91487}". Action Taken: No Action Taken.
Entry "HKCR\Mpgmux.LMpgMux.1" refers to invalid object "{7808A677-4F0E-4431-9E86-D5A68C76341E}". Action Taken: No Action Taken.
Entry "HKCR\Mpgmux.LMpgMux" refers to invalid object "{7808A677-4F0E-4431-9E86-D5A68C76341E}". Action Taken: No Action Taken.
Entry "HKCR\MpgAparse.LMpgAparser.1" refers to invalid object "{648C0939-1F4F-4D10-8B8C-A54C65A00560}". Action Taken: No Action Taken.
Entry "HKCR\MpgAparse.LMpgAparser" refers to invalid object "{648C0939-1F4F-4D10-8B8C-A54C65A00560}". Action Taken: No Action Taken.
Entry "HKCR\MpgVparse.LMpgVparser.1" refers to invalid object "{E0D84E7C-1997-4F77-97C4-74D79FCF6B50}". Action Taken: No Action Taken.
Entry "HKCR\MpgVparse.LMpgVparser" refers to invalid object "{E0D84E7C-1997-4F77-97C4-74D79FCF6B50}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.LXContentCenter.1" refers to invalid object "{E69C308A-0582-4BFF-B3DA-697BB2BB5CDA}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.LXContentCenter" refers to invalid object "{E69C308A-0582-4BFF-B3DA-697BB2BB5CDA}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDiscCompiler.1" refers to invalid object "{BB37EFA1-7BA6-437D-99AA-16E023451DE2}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDiscCompiler" refers to invalid object "{BB37EFA1-7BA6-437D-99AA-16E023451DE2}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXVCDDiscCompiler.1" refers to invalid object "{94515F8C-8451-4067-9816-4166B3418F0B}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXVCDDiscCompiler" refers to invalid object "{94515F8C-8451-4067-9816-4166B3418F0B}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXSVCDDiscCompiler.1" refers to invalid object "{D19355DC-9045-4B3A-B321-1710330B5AB8}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXSVCDDiscCompiler" refers to invalid object "{D19355DC-9045-4B3A-B321-1710330B5AB8}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDVDCmdParser.1" refers to invalid object "{1E5CC1BF-9B43-47BA-AFA9-BB38A9068722}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDVDCmdParser" refers to invalid object "{1E5CC1BF-9B43-47BA-AFA9-BB38A9068722}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscDVDDiscCompiler.1" refers to invalid object "{DF5F4E46-D041-416C-B77E-6F8E662E2734}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscDVDDiscCompiler" refers to invalid object "{DF5F4E46-D041-416C-B77E-6F8E662E2734}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDVDVRDiscReader.1" refers to invalid object "{039CD332-FB27-4F71-93D2-DB6610BB84D3}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDVDVRDiscReader" refers to invalid object "{039CD332-FB27-4F71-93D2-DB6610BB84D3}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscCaptureDVDDiscCompiler.1" refers to invalid object "{49527153-FCFD-42FC-A7B8-07B6CADB4D2D}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscCaptureDVDDiscCompiler" refers to invalid object "{49527153-FCFD-42FC-A7B8-07B6CADB4D2D}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXSimpleDataWriter.1" refers to invalid object "{09076121-9B82-463F-AB64-571692399646}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXSimpleDataWriter" refers to invalid object "{09076121-9B82-463F-AB64-571692399646}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDiscScriptWriter.1" refers to invalid object "{AADE03FE-7BB6-4312-981D-E9F6DAAA3D75}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXDiscScriptWriter" refers to invalid object "{AADE03FE-7BB6-4312-981D-E9F6DAAA3D75}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscFileBasedCaptureDVDDiscCompiler.1" refers to invalid object "{D7BCD582-12D9-41DE-A0DD-1140A140D8C3}". Action Taken: No Action Taken.
Entry "HKCR\XDiscLayer.ULXOnDiscFileBasedCaptureDVDDiscCompiler" refers to invalid object "{D7BCD582-12D9-41DE-A0DD-1140A140D8C3}". Action Taken: No Action Taken.
Entry "HKCR\XLogUtil.ULXLogCObj.1" refers to invalid object "{9885A107-6FB9-4D28-8864-8DB73413B7E9}". Action Taken: No Action Taken.
Entry "HKCR\XLogUtil.ULXLogCObj" refers to invalid object "{9885A107-6FB9-4D28-8864-8DB73413B7E9}". Action Taken: No Action Taken.
Entry "HKCR\LdrtBurn.DirectBurnSource.1" refers to invalid object "{AC8BF71E-E41F-4FE7-B58C-E4AC3555C0BF}". Action Taken: No Action Taken.
Entry "HKCR\LdrtBurn.DirectBurnSource" refers to invalid object "{AC8BF71E-E41F-4FE7-B58C-E4AC3555C0BF}". Action Taken: No Action Taken.
Entry "HKCR\LdrtDisc.DiscSource.1" refers to invalid object "{B4346D2E-E989-49B1-B3AB-4506028194C6}". Action Taken: No Action Taken.
Entry "HKCR\LdrtDisc.DiscSource" refers to invalid object "{B4346D2E-E989-49B1-B3AB-4506028194C6}". Action Taken: No Action Taken.
Entry "HKCR\LdvdRec.LdvdRecorder.1" refers to invalid object "{DC377543-0DAB-4737-87DF-A7BB78769370}". Action Taken: No Action Taken.
Entry "HKCR\LdvdRec.LdvdRecorder" refers to invalid object "{DC377543-0DAB-4737-87DF-A7BB78769370}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LdvdVideo.1" refers to invalid object "{7630D6A2-4512-4ca2-915D-F457BC782564}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LdvdVideo" refers to invalid object "{7630D6A2-4512-4ca2-915D-F457BC782564}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LvcdVideo.1" refers to invalid object "{99AC5564-0CF3-4c5b-A594-651AC625DE15}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LvcdVideo" refers to invalid object "{99AC5564-0CF3-4c5b-A594-651AC625DE15}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LsvdVideo.1" refers to invalid object "{70DC80A9-D4F8-4383-A0D7-93179AA8305E}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LsvdVideo" refers to invalid object "{70DC80A9-D4F8-4383-A0D7-93179AA8305E}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LmpgInfo.1" refers to invalid object "{C2316705-49F3-46a6-B178-FD617FA235D8}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng2.LmpgInfo" refers to invalid object "{C2316705-49F3-46a6-B178-FD617FA235D8}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng.LdcdDataCd.1" refers to invalid object "{4573D9BF-F1AE-4516-B9B3-F9B1B9A9BDDC}". Action Taken: No Action Taken.
Entry "HKCR\LdvdEng.LdcdDataCd" refers to invalid object "{4573D9BF-F1AE-4516-B9B3-F9B1B9A9BDDC}". Action Taken: No Action Taken.
Entry "HKCR\ULCDRDrv.LCDRDrv.1" refers to invalid object "{4281B857-D41F-4165-B9E6-BE3DD5B24109}". Action Taken: No Action Taken.
Entry "HKCR\ULCDRDrv.LCDRDrv" refers to invalid object "{4281B857-D41F-4165-B9E6-BE3DD5B24109}". Action Taken: No Action Taken.
Entry "HKCR\NTICdDrv.NCdrDrv.2" refers to invalid object "{61CAAD5D-29B6-4207-A3AA-E9AFEDA8510C}". Action Taken: No Action Taken.
Entry "HKCR\NTICdDrv.NCdrDrv" refers to invalid object "{61CAAD5D-29B6-4207-A3AA-E9AFEDA8510C}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileRead" refers to invalid object "{119E34C1-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileRead.1" refers to invalid object "{119E34C1-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileWrite" refers to invalid object "{119E34C2-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileWrite.1" refers to invalid object "{119E34C2-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileInfo" refers to invalid object "{119E34C3-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\UFileIO.CFileInfo.1" refers to invalid object "{119E34C3-8108-11D5-91D7-00004CD94BFF}". Action Taken: No Action Taken.
Entry "HKCR\LdsStmDrv.LdsStmRead.1" refers to invalid object "{BF53F2AF-4E62-4986-BA1B-ECC1816BFDB7}". Action Taken: No Action Taken.
Entry "HKCR\LdsStmDrv.LdsStmRead" refers to invalid object "{BF53F2AF-4E62-4986-BA1B-ECC1816BFDB7}". Action Taken: No Action Taken.
Entry "HKCR\VSEditorFactory.VsEditorFactory.1" refers to invalid object "{CB3FCF01-03DF-11D1-81D2-00A0C91BBEE3}". Action Taken: No Action Taken.
Entry "HKCR\SDISERVR50.SDIEVENT" refers to invalid object "{294CFD20-E0C9-11D9-A966-00085417EBE3}". Action Taken: No Action Taken.

Logfile of HijackThis v1.99.1
Scan saved at 6:57:52 PM, on 6/22/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\HJT\HIJACKTHIS.EXE

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_6_2_0.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_6_2_0.DLL
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .mpg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .MID: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin4.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #35
Download the registry Search Tool from here. Extract(unzip) the file. Double click RegSrch.vbs. In the text field, type in altnet, click OK. It may take a while to finish its scan. When it is done, it will offer you to look at a file. Accept and post the contents.

Do the same with isearch please.
Post #37
'KotaGuy, I think I did something wrong. Since you didn't mention if it should be in a folder of it's own, I put it on the desktop(bad idea?).
I then followed your instructions about downloading and running Regsrch.vbs–it found 2 instances of altnet. Clicked OK to view the file but wordpad hungup so I stopped it. Now I can't find the file. Would the extension be .txt, .doc, or .vbs? I'm sorry for being such a pain in the a**. :oops:
Post #38 last edited
Okay, here's what happened: I re-downloaded Regsrch, ran it from the unzipped folder. It found 2 instances of altnet again. While waiting for Wordpad to open, a dialog box opened stating: "The COMCTL32.DLL file cannot start. Check the file to determine the problem." I clicked OK. I don't know how to check for the problem, so I did a search and found the file(s) in the SYSTEM and SYSBACKUP folders. I then noticed that the shortcut to Ad-Aware was missing so, I ran another search and found the files. I'm about ready to give up. :( I'm going to get some sleep. Hope to see you later today(it's now 4:00am my time).

Edit: I forgot to mention Regsrch found 9 instances of isearch.
Post #40
Hi 'KotaGuy,
Sorry for taking so long to reply. I finally found the Win98 CD.
Followed the steps at the site when at step #5 this showed up:
"Error: Extract.EXE must be in the current directory!".
I found it in the command directory, but I'm not sure if I should copy it to the system folder. What do you think I should do?
Thanks for being so patient with me. :)
Post #42
At step #9, I typed "Y" at the prompt, then this showed up:
"ERROR: Cannot open file E:\win98\(null)". :wall:
I don't know what to do next, so I'll wait for your reply.


Dee
Post #43
Bah… looks like you're going to have to do this manually then…

Download and install Registrar Lite. Run it. Click the Search Menu item. In the "Text to Search for" box, type in altnet. In the "Search In" box, make sure Registry is selected from the drop down menu. Click the magnifying glass icon in the lower left corner to commence the search. Delete anything that is found by hiliting it and pressing the red "X".

Do the same for isearch.

Exit RegLite when done and reboot Windows.

Let me know how that goes.
Post #44
Things are lookin' up I think. (1)I ran RegLite and MWAV in normal mode and got rid of AltNet and isearch-at least that's what I thought until I scanned with MWAV again. The is from the full log that was opened in Wordpad:
Fri Jun 24 12:31:21 2005 => Offending value found in HKLM\Software\microsoft\downloadmanager !!!
Fri Jun 24 12:31:28 2005 => Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Fri Jun 24 12:31:56 2005 => System found infected with iSearch Spyware/Adware (patch.exe)! Action taken: No Action Taken.
Fri Jun 24 12:31:56 2005 => Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken.

(2) I re-booted into safe mode and deleted patch.exe(was suprised to see it was from TrendMicro–part of the ActiveUpdate). I then ran RegLite again–searched for altnet, got rid of it or so I thought. Well, to make a long story short, altnet is still lurking about, but isearch is gone.
What's next? :)
Post #45
Got a search tool for you to use. RegFinder by Rand. I'm going to attach it to this post. Download it, extract it. Run the script and search for altnet. Post back the results. Thanks!

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI