Please help with horrible CSW!

Hi Wng, No problem about delay. Those viruses can bombard at times… Here is an updated log: Logfile of HijackThis v1.99.1 Scan saved at 8:58:52 AM, on 8/1/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE C:\WINDOWS\WINGG.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\ATLYS32.EXE C:\WINDOWS\MFCSL.EXE C:\WINDOWS\SYSTEM\NTMZ.EXE C:\WINDOWS\D3DS32.EXE C:\WINDOWS\SYSTEM\WINEJ.EXE C:\WINDOWS\SYSTEM\CRIW.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\WINDOWS\APIOT.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\WINDOWS\MFCSL.EXE C:\WINDOWS\SYSTEM\WINEJ.EXE C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\WINGG.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\SYSTEM\ADDXF32.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\WINGG.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\WINGG.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\SYSTEM\NETWE32.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\MSSP.EXE C:\WINDOWS\APIZI32.EXE C:\WINDOWS\APIZI32.EXE C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE C:\HIJACKTHIS.EXE C:\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\caoqz.dll/sp.html#37049 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Class - {6A75E72D-A81A-7057-DD5F-9CDBB2A67935} - C:\WINDOWS\ATLTV.DLL O2 - BHO: Class - {5BA426C5-FB02-68E6-5AAF-4FD3DFFBFCED} - C:\WINDOWS\SYSTEM\JAVAIK.DLL O2 - BHO: Class - {A436A13A-A3DC-EDEA-BFB3-FF46DF2066F9} - C:\WINDOWS\SYSTEM\MFCGM.DLL O2 - BHO: Class - {A52CD02D-C487-B30D-DB70-31A4C19A741A} - C:\WINDOWS\WINNT32.DLL O2 - BHO: Class - {3E72FA3D-4625-F19B-9AC4-DCBCF55B6163} - C:\WINDOWS\D3UN32.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [APIOT.EXE] C:\WINDOWS\APIOT.EXE O4 - HKLM\..\Run: [JAVAJE.EXE] C:\WINDOWS\JAVAJE.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [APPAN32.EXE] C:\WINDOWS\SYSTEM\APPAN32.EXE /s O4 - HKLM\..\RunServices: [MSJU.EXE] C:\WINDOWS\SYSTEM\MSJU.EXE /s O4 - HKLM\..\RunServices: [CRAL.EXE] C:\WINDOWS\CRAL.EXE /s O4 - HKLM\..\RunServices: [MFCPJ32.EXE] C:\WINDOWS\SYSTEM\MFCPJ32.EXE /s O4 - HKLM\..\RunServices: [CROZ.EXE] C:\WINDOWS\CROZ.EXE /s O4 - HKLM\..\RunServices: [JAVAWT32.EXE] C:\WINDOWS\SYSTEM\JAVAWT32.EXE /s O4 - HKLM\..\RunServices: [D3XF.EXE] C:\WINDOWS\D3XF.EXE /s O4 - HKLM\..\RunServices: [IEPA32.EXE] C:\WINDOWS\IEPA32.EXE /s O4 - HKLM\..\RunServices: [APIZE32.EXE] C:\WINDOWS\SYSTEM\APIZE32.EXE /s O4 - HKLM\..\RunServices: [ADDPA32.EXE] C:\WINDOWS\SYSTEM\ADDPA32.EXE /s O4 - HKLM\..\RunServices: [IEYA.EXE] C:\WINDOWS\SYSTEM\IEYA.EXE /s O4 - HKLM\..\RunServices: [IEFU32.EXE] C:\WINDOWS\IEFU32.EXE /s O4 - HKLM\..\RunServices: [APIKK.EXE] C:\WINDOWS\APIKK.EXE /s O4 - HKLM\..\RunServices: [MFCLE.EXE] C:\WINDOWS\MFCLE.EXE /s O4 - HKLM\..\RunServices: [MSXY32.EXE] C:\WINDOWS\SYSTEM\MSXY32.EXE /s O4 - HKLM\..\RunServices: [MSUQ.EXE] C:\WINDOWS\MSUQ.EXE /s O4 - HKLM\..\RunServices: [D3QK32.EXE] C:\WINDOWS\D3QK32.EXE /s O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [WINQA32.EXE] C:\WINDOWS\SYSTEM\WINQA32.EXE /s O4 - HKLM\..\RunServices: [SDKJE32.EXE] C:\WINDOWS\SYSTEM\SDKJE32.EXE /s O4 - HKLM\..\RunServices: [MSSJ32.EXE] C:\WINDOWS\SYSTEM\MSSJ32.EXE /s O4 - HKLM\..\RunServices: [SYSRF32.EXE] C:\WINDOWS\SYSRF32.EXE /s O4 - HKLM\..\RunServices: [NETIJ32.EXE] C:\WINDOWS\NETIJ32.EXE /s O4 - HKLM\..\RunServices: [APPZG.EXE] C:\WINDOWS\APPZG.EXE /s O4 - HKLM\..\RunServices: [APICJ32.EXE] C:\WINDOWS\SYSTEM\APICJ32.EXE /s O4 - HKLM\..\RunServices: [ADDXY32.EXE] C:\WINDOWS\SYSTEM\ADDXY32.EXE /s O4 - HKLM\..\RunServices: [IPRQ32.EXE] C:\WINDOWS\IPRQ32.EXE /s O4 - HKLM\..\RunServices: [MSIR32.EXE] C:\WINDOWS\SYSTEM\MSIR32.EXE /s O4 - HKLM\..\RunServices: [JAVAYO.EXE] C:\WINDOWS\JAVAYO.EXE /s O4 - HKLM\..\RunServices: [APPBW.EXE] C:\WINDOWS\SYSTEM\APPBW.EXE /s O4 - HKLM\..\RunServices: [JAVABP.EXE] C:\WINDOWS\JAVABP.EXE /s O4 - HKLM\..\RunServices: [SDKIB32.EXE] C:\WINDOWS\SDKIB32.EXE /s O4 - HKLM\..\RunServices: [NETOD.EXE] C:\WINDOWS\NETOD.EXE /s O4 - HKLM\..\RunServices: [ATLTT.EXE] C:\WINDOWS\SYSTEM\ATLTT.EXE /s O4 - HKLM\..\RunServices: [APPEN.EXE] C:\WINDOWS\SYSTEM\APPEN.EXE /s O4 - HKLM\..\RunServices: [ADDKO32.EXE] C:\WINDOWS\ADDKO32.EXE /s O4 - HKLM\..\RunServices: [SYSUP32.EXE] C:\WINDOWS\SYSTEM\SYSUP32.EXE /s O4 - HKLM\..\RunServices: [MFCRT.EXE] C:\WINDOWS\SYSTEM\MFCRT.EXE /s O4 - HKLM\..\RunServices: [MSND32.EXE] C:\WINDOWS\MSND32.EXE /s O4 - HKLM\..\RunServices: [SDKEA32.EXE] C:\WINDOWS\SYSTEM\SDKEA32.EXE /s O4 - HKLM\..\RunServices: [ADDIW.EXE] C:\WINDOWS\ADDIW.EXE /s O4 - HKLM\..\RunServices: [SYSOO32.EXE] C:\WINDOWS\SYSTEM\SYSOO32.EXE /s O4 - HKLM\..\RunServices: [SYSEE.EXE] C:\WINDOWS\SYSTEM\SYSEE.EXE /s O4 - HKLM\..\RunServices: [NTZQ32.EXE] C:\WINDOWS\NTZQ32.EXE /s O4 - HKLM\..\RunServices: [APIHN.EXE] C:\WINDOWS\SYSTEM\APIHN.EXE /s O4 - HKLM\..\RunServices: [D3KR.EXE] C:\WINDOWS\D3KR.EXE /s O4 - HKLM\..\RunServices: [JAVAKQ.EXE] C:\WINDOWS\SYSTEM\JAVAKQ.EXE /s O4 - HKLM\..\RunServices: [CRFL32.EXE] C:\WINDOWS\CRFL32.EXE /s O4 - HKLM\..\RunServices: [APISH32.EXE] C:\WINDOWS\SYSTEM\APISH32.EXE /s O4 - HKLM\..\RunServices: [MSNS.EXE] C:\WINDOWS\MSNS.EXE /s O4 - HKLM\..\RunServices: [JAVANL.EXE] C:\WINDOWS\SYSTEM\JAVANL.EXE /s O4 - HKLM\..\RunServices: [SYSBU32.EXE] C:\WINDOWS\SYSBU32.EXE /s O4 - HKLM\..\RunServices: [JAVAIM.EXE] C:\WINDOWS\SYSTEM\JAVAIM.EXE /s O4 - HKLM\..\RunServices: [SDKJF.EXE] C:\WINDOWS\SYSTEM\SDKJF.EXE /s O4 - HKLM\..\RunServices: [NTJP32.EXE] C:\WINDOWS\NTJP32.EXE /s O4 - HKLM\..\RunServices: [APPAP32.EXE] C:\WINDOWS\SYSTEM\APPAP32.EXE /s O4 - HKLM\..\RunServices: [D3MQ32.EXE] C:\WINDOWS\SYSTEM\D3MQ32.EXE /s O4 - HKLM\..\RunServices: [NETSY32.EXE] C:\WINDOWS\NETSY32.EXE /s O4 - HKLM\..\RunServices: [WINFM32.EXE] C:\WINDOWS\WINFM32.EXE /s O4 - HKLM\..\RunServices: [WINJU.EXE] C:\WINDOWS\SYSTEM\WINJU.EXE /s O4 - HKLM\..\RunServices: [APPRF.EXE] C:\WINDOWS\SYSTEM\APPRF.EXE /s O4 - HKLM\..\RunServices: [MSXW32.EXE] C:\WINDOWS\MSXW32.EXE /s O4 - HKLM\..\RunServices: [IPLZ32.EXE] C:\WINDOWS\SYSTEM\IPLZ32.EXE /s O4 - HKLM\..\RunServices: [MFCXO.EXE] C:\WINDOWS\SYSTEM\MFCXO.EXE /s O4 - HKLM\..\RunServices: [APPPN.EXE] C:\WINDOWS\SYSTEM\APPPN.EXE /s O4 - HKLM\..\RunServices: [IPLX.EXE] C:\WINDOWS\SYSTEM\IPLX.EXE /s O4 - HKLM\..\RunServices: [APIAV.EXE] C:\WINDOWS\APIAV.EXE /s O4 - HKLM\..\RunServices: [SYSSU32.EXE] C:\WINDOWS\SYSSU32.EXE /s O4 - HKLM\..\RunServices: [SDKEL.EXE] C:\WINDOWS\SDKEL.EXE /s O4 - HKLM\..\RunServices: [APIQO32.EXE] C:\WINDOWS\SYSTEM\APIQO32.EXE /s O4 - HKLM\..\RunServices: [NTCM32.EXE] C:\WINDOWS\SYSTEM\NTCM32.EXE /s O4 - HKLM\..\RunServices: [SDKQP.EXE] C:\WINDOWS\SYSTEM\SDKQP.EXE /s O4 - HKLM\..\RunServices: [MSVM.EXE] C:\WINDOWS\SYSTEM\MSVM.EXE /s O4 - HKLM\..\RunServices: [IPPD32.EXE] C:\WINDOWS\SYSTEM\IPPD32.EXE /s O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [WINGG.EXE] C:\WINDOWS\WINGG.EXE /s O4 - HKLM\..\RunServices: [APIZI32.EXE] C:\WINDOWS\APIZI32.EXE /s O4 - HKLM\..\RunServices: [ATLYS32.EXE] C:\WINDOWS\ATLYS32.EXE /s O4 - HKLM\..\RunServices: [MFCSL.EXE] C:\WINDOWS\MFCSL.EXE /s O4 - HKLM\..\RunServices: [NTMZ.EXE] C:\WINDOWS\SYSTEM\NTMZ.EXE /s O4 - HKLM\..\RunServices: [D3DS32.EXE] C:\WINDOWS\D3DS32.EXE /s O4 - HKLM\..\RunServices: [WINEJ.EXE] C:\WINDOWS\SYSTEM\WINEJ.EXE /s O4 - HKLM\..\RunServices: [CRIW.EXE] C:\WINDOWS\SYSTEM\CRIW.EXE /s O4 - HKLM\..\RunServices: [NETWE32.EXE] C:\WINDOWS\SYSTEM\NETWE32.EXE /s O4 - HKLM\..\RunServices: [ADDXF32.EXE] C:\WINDOWS\SYSTEM\ADDXF32.EXE /s O4 - HKLM\..\RunServices: [MSSP.EXE] C:\WINDOWS\MSSP.EXE /s O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 Still having horrible problems with the thing! Appreciate your time and help… kmount

Hi kmount.

Win asked me to take over for him.

You have a nasty infection that will need some special treatment.


The Fix -

(the reason Wordpad was chosen is that Notepad is often deleted by this variant)

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening them will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Close Outlook Express and Internet Explorer for the duration of this fix

Please continue with the next steps and if you run into any problems with the current one, just keep going through the list step by step. Just be sure to let us know what the problem was when you finally reply.



Step#1:Make Sure Hidden Files Are Visible

• Please make sure you can view all Hidden Files by choosing the instructions for your Windows OS.

Step#2:Download and Update CWShredder

• Download CWShredder.Do Not Use It Yet
• Save CWShredder.exe to a convenient location.
• make sure it is up to date.

Step#3:Download DllCompare

• Download DLLCompare.Do Not Use It Yet

Step#4:Download Killbox

• Download the Killbox.Do Not Use It Yet
• Unzip the contents of KillBox.zip to a convenient location.

Step#5:Download About Buster

• Please download About:Buster from here: Do Not Use It Yet
• About Buster.
• extract it to c:\aboutbuster.
• update. to latest definitions

Please disconnect from the Internet and unplug your modem for the duration of this fix



Step#6:Reboot To Safe Mode

Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE



Step#7: Use CWShredder

• Open CWShredder.exe.
• Click "Fix ->" and click "OK" at the prompt.
• CWShredder will scan and clean your system of CWS files.
• Click "Next->" and then "Exit".
• REBOOT back into Safe Mode by tapping F8 while booting up.l

Step#8:Use DllCompare

• Open DllCompare.exe to run the program.
• Click "Run Locate.com" and it will scan your system for files.
• Once the scan has finished click "Compare" to compare your files to valid Windows files.
  Files in the upper window have now been verified to "exist", Files in the lower window were not able to be accessed. Very few files should be listed in the lower window when the Compare scan is complete.
• Once it has finished comparing click " Make a Log of what was found".
• Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files)
• Click "Yes" at the ‘View Log file’ prompt to view the log.
• Copy and paste the entire log into your next reply after completing all steps.(saved as log.txt in the DllCompare folder)
• Click "Exit".

Step#9:Delete Running Processes

• In Safe Mode delete the Running Processes that have been Identified as being part of the infection. If unable to delete them, see below to use Killbox.
  C:\WINDOWS\WINGG.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\ATLYS32.EXE
  C:\WINDOWS\MFCSL.EXE
  C:\WINDOWS\SYSTEM\NTMZ.EXE
  C:\WINDOWS\D3DS32.EXE
  C:\WINDOWS\SYSTEM\WINEJ.EXE
  C:\WINDOWS\SYSTEM\CRIW.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\APIOT.EXE
  C:\WINDOWS\MFCSL.EXE
  C:\WINDOWS\SYSTEM\WINEJ.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\WINGG.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\SYSTEM\ADDXF32.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\WINGG.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\WINGG.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APIZI32.EXE

Step#10:Delete Infected Files

Please boot into Safe Mode and delete the following files:
C:\WINDOWS\ADDIW.EXE
C:\WINDOWS\ADDKO32.EXE
C:\WINDOWS\APIAV.EXE
C:\WINDOWS\APIKK.EXE
C:\WINDOWS\APIOT.EXE
C:\WINDOWS\APIZI32.EXE
C:\WINDOWS\APPZG.EXE
C:\WINDOWS\ATLTV.DLL
C:\WINDOWS\ATLYS32.EXE
C:\WINDOWS\caoqz.dll
C:\WINDOWS\CRAL.EXE
C:\WINDOWS\CRFL32.EXE
C:\WINDOWS\CROZ.EXE
C:\WINDOWS\D3DS32.EXE
C:\WINDOWS\D3DS32.EXE
C:\WINDOWS\D3KR.EXE
C:\WINDOWS\D3QK32.EXE
C:\WINDOWS\D3UN32.DLL
C:\WINDOWS\D3XF.EXE
C:\WINDOWS\IEFU32.EXE
C:\WINDOWS\IEPA32.EXE
C:\WINDOWS\IPRQ32.EXE
C:\WINDOWS\JAVABP.EXE
C:\WINDOWS\JAVAJE.EXE
C:\WINDOWS\JAVAYO.EXE
C:\WINDOWS\MFCLE.EXE
C:\WINDOWS\MFCSL.EXE
C:\WINDOWS\MSND32.EXE
C:\WINDOWS\MSNS.EXE
C:\WINDOWS\MSSP.EXE
C:\WINDOWS\MSUQ.EXE
C:\WINDOWS\MSXW32.EXE
C:\WINDOWS\NETIJ32.EXE
C:\WINDOWS\NETOD.EXE
C:\WINDOWS\NETSY32.EXE
C:\WINDOWS\NTJP32.EXE
C:\WINDOWS\NTZQ32.EXE
C:\WINDOWS\SDKEL.EXE
C:\WINDOWS\SDKIB32.EXE
C:\WINDOWS\SYSBU32.EXE
C:\WINDOWS\SYSRF32.EXE
C:\WINDOWS\SYSSU32.EXE
C:\WINDOWS\WINFM32.EXE
C:\WINDOWS\WINGG.EXE
C:\WINDOWS\WINNT32.DLL
C:\WINDOWS\SYSTEM\ADDPA32.EXE
C:\WINDOWS\SYSTEM\ADDXF32.EXE
C:\WINDOWS\SYSTEM\ADDXY32.EXE
C:\WINDOWS\SYSTEM\APICJ32.EXE
C:\WINDOWS\SYSTEM\APIHN.EXE
C:\WINDOWS\SYSTEM\APIQO32.EXE
C:\WINDOWS\SYSTEM\APISH32.EXE
C:\WINDOWS\SYSTEM\APIZE32.EXE
C:\WINDOWS\SYSTEM\APPAN32.EXE
C:\WINDOWS\SYSTEM\APPAP32.EXE
C:\WINDOWS\SYSTEM\APPBW.EXE
C:\WINDOWS\SYSTEM\APPEN.EXE
C:\WINDOWS\SYSTEM\APPPN.EXE
C:\WINDOWS\SYSTEM\APPRF.EXE
C:\WINDOWS\SYSTEM\ATLTT.EXE
C:\WINDOWS\SYSTEM\CRIW.EXE
C:\WINDOWS\SYSTEM\D3MQ32.EXE
C:\WINDOWS\SYSTEM\IEYA.EXE
C:\WINDOWS\SYSTEM\IPLX.EXE
C:\WINDOWS\SYSTEM\IPLZ32.EXE
C:\WINDOWS\SYSTEM\IPPD32.EXE
C:\WINDOWS\SYSTEM\JAVAIK.DLL
C:\WINDOWS\SYSTEM\JAVAIM.EXE
C:\WINDOWS\SYSTEM\JAVAKQ.EXE
C:\WINDOWS\SYSTEM\JAVANL.EXE
C:\WINDOWS\SYSTEM\JAVAWT32.EXE
C:\WINDOWS\SYSTEM\MFCGM.DLL
C:\WINDOWS\SYSTEM\MFCPJ32.EXE
C:\WINDOWS\SYSTEM\MFCRT.EXE
C:\WINDOWS\SYSTEM\MFCXO.EXE
C:\WINDOWS\SYSTEM\MSIR32.EXE
C:\WINDOWS\SYSTEM\MSJU.EXE
C:\WINDOWS\SYSTEM\MSSJ32.EXE
C:\WINDOWS\SYSTEM\MSVM.EXE
C:\WINDOWS\SYSTEM\MSXY32.EXE
C:\WINDOWS\SYSTEM\NETWE32.EXE
C:\WINDOWS\SYSTEM\NTCM32.EXE
C:\WINDOWS\SYSTEM\NTMZ.EXE
C:\WINDOWS\SYSTEM\SDKEA32.EXE
C:\WINDOWS\SYSTEM\SDKJE32.EXE
C:\WINDOWS\SYSTEM\SDKJF.EXE
C:\WINDOWS\SYSTEM\SDKQP.EXE
C:\WINDOWS\SYSTEM\SYSEE.EXE
C:\WINDOWS\SYSTEM\SYSOO32.EXE
C:\WINDOWS\SYSTEM\SYSUP32.EXE
C:\WINDOWS\SYSTEM\WINEJ.EXE
C:\WINDOWS\SYSTEM\WINJU.EXE
C:\WINDOWS\SYSTEM\WINQA32.EXE


Step#11:Use Killbox(may not be necessary)

• If unable to delete files above in safe mode please use KillBox that you downloaded earlier:
• Open KillBox
• Highlight the list of names to delete then CTRL-C to copy and then Paste all files into the box "Full Path of File to Delete" . C:\WINDOWS\ADDIW.EXE
  C:\WINDOWS\ADDKO32.EXE
  C:\WINDOWS\APIAV.EXE
  C:\WINDOWS\APIKK.EXE
  C:\WINDOWS\APIOT.EXE
  C:\WINDOWS\APIZI32.EXE
  C:\WINDOWS\APPZG.EXE
  C:\WINDOWS\ATLTV.DLL
  C:\WINDOWS\ATLYS32.EXE
  C:\WINDOWS\caoqz.dll
  C:\WINDOWS\CRAL.EXE
  C:\WINDOWS\CRFL32.EXE
  C:\WINDOWS\CROZ.EXE
  C:\WINDOWS\D3DS32.EXE
  C:\WINDOWS\D3DS32.EXE
  C:\WINDOWS\D3KR.EXE
  C:\WINDOWS\D3QK32.EXE
  C:\WINDOWS\D3UN32.DLL
  C:\WINDOWS\D3XF.EXE
  C:\WINDOWS\IEFU32.EXE
  C:\WINDOWS\IEPA32.EXE
  C:\WINDOWS\IPRQ32.EXE
  C:\WINDOWS\JAVABP.EXE
  C:\WINDOWS\JAVAJE.EXE
  C:\WINDOWS\JAVAYO.EXE
  C:\WINDOWS\MFCLE.EXE
  C:\WINDOWS\MFCSL.EXE
  C:\WINDOWS\MSND32.EXE
  C:\WINDOWS\MSNS.EXE
  C:\WINDOWS\MSSP.EXE
  C:\WINDOWS\MSUQ.EXE
  C:\WINDOWS\MSXW32.EXE
  C:\WINDOWS\NETIJ32.EXE
  C:\WINDOWS\NETOD.EXE
  C:\WINDOWS\NETSY32.EXE
  C:\WINDOWS\NTJP32.EXE
  C:\WINDOWS\NTZQ32.EXE
  C:\WINDOWS\SDKEL.EXE
  C:\WINDOWS\SDKIB32.EXE
  C:\WINDOWS\SYSBU32.EXE
  C:\WINDOWS\SYSRF32.EXE
  C:\WINDOWS\SYSSU32.EXE
  C:\WINDOWS\WINFM32.EXE
  C:\WINDOWS\WINGG.EXE
  C:\WINDOWS\WINNT32.DLL
  C:\WINDOWS\SYSTEM\ADDPA32.EXE
  C:\WINDOWS\SYSTEM\ADDXF32.EXE
  C:\WINDOWS\SYSTEM\ADDXY32.EXE
  C:\WINDOWS\SYSTEM\APICJ32.EXE
  C:\WINDOWS\SYSTEM\APIHN.EXE
  C:\WINDOWS\SYSTEM\APIQO32.EXE
  C:\WINDOWS\SYSTEM\APISH32.EXE
  C:\WINDOWS\SYSTEM\APIZE32.EXE
  C:\WINDOWS\SYSTEM\APPAN32.EXE
  C:\WINDOWS\SYSTEM\APPAP32.EXE
  C:\WINDOWS\SYSTEM\APPBW.EXE
  C:\WINDOWS\SYSTEM\APPEN.EXE
  C:\WINDOWS\SYSTEM\APPPN.EXE
  C:\WINDOWS\SYSTEM\APPRF.EXE
  C:\WINDOWS\SYSTEM\ATLTT.EXE
  C:\WINDOWS\SYSTEM\CRIW.EXE
  C:\WINDOWS\SYSTEM\D3MQ32.EXE
  C:\WINDOWS\SYSTEM\IEYA.EXE
  C:\WINDOWS\SYSTEM\IPLX.EXE
  C:\WINDOWS\SYSTEM\IPLZ32.EXE
  C:\WINDOWS\SYSTEM\IPPD32.EXE
  C:\WINDOWS\SYSTEM\JAVAIK.DLL
  C:\WINDOWS\SYSTEM\JAVAIM.EXE
  C:\WINDOWS\SYSTEM\JAVAKQ.EXE
  C:\WINDOWS\SYSTEM\JAVANL.EXE
  C:\WINDOWS\SYSTEM\JAVAWT32.EXE
  C:\WINDOWS\SYSTEM\MFCGM.DLL
  C:\WINDOWS\SYSTEM\MFCPJ32.EXE
  C:\WINDOWS\SYSTEM\MFCRT.EXE
  C:\WINDOWS\SYSTEM\MFCXO.EXE
  C:\WINDOWS\SYSTEM\MSIR32.EXE
  C:\WINDOWS\SYSTEM\MSJU.EXE
  C:\WINDOWS\SYSTEM\MSSJ32.EXE
  C:\WINDOWS\SYSTEM\MSVM.EXE
  C:\WINDOWS\SYSTEM\MSXY32.EXE
  C:\WINDOWS\SYSTEM\NETWE32.EXE
  C:\WINDOWS\SYSTEM\NTCM32.EXE
  C:\WINDOWS\SYSTEM\NTMZ.EXE
  C:\WINDOWS\SYSTEM\SDKEA32.EXE
  C:\WINDOWS\SYSTEM\SDKJE32.EXE
  C:\WINDOWS\SYSTEM\SDKJF.EXE
  C:\WINDOWS\SYSTEM\SDKQP.EXE
  C:\WINDOWS\SYSTEM\SYSEE.EXE
  C:\WINDOWS\SYSTEM\SYSOO32.EXE
  C:\WINDOWS\SYSTEM\SYSUP32.EXE
  C:\WINDOWS\SYSTEM\WINEJ.EXE
  C:\WINDOWS\SYSTEM\WINJU.EXE
  C:\WINDOWS\SYSTEM\WINQA32.EXE
• Choose Delete on Reboot.
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Delete on Reboot prompt.
• If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Step#12:Use HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\caoqz.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {6A75E72D-A81A-7057-DD5F-9CDBB2A67935} - C:\WINDOWS\ATLTV.DLL
O2 - BHO: Class - {5BA426C5-FB02-68E6-5AAF-4FD3DFFBFCED} - C:\WINDOWS\SYSTEM\JAVAIK.DLL
O2 - BHO: Class - {A436A13A-A3DC-EDEA-BFB3-FF46DF2066F9} - C:\WINDOWS\SYSTEM\MFCGM.DLL
O2 - BHO: Class - {A52CD02D-C487-B30D-DB70-31A4C19A741A} - C:\WINDOWS\WINNT32.DLL
O2 - BHO: Class - {3E72FA3D-4625-F19B-9AC4-DCBCF55B6163} - C:\WINDOWS\D3UN32.DLL
O4 - HKLM\..\Run: [APIOT.EXE] C:\WINDOWS\APIOT.EXE
O4 - HKLM\..\Run: [JAVAJE.EXE] C:\WINDOWS\JAVAJE.EXE
O4 - HKLM\..\RunServices: [APPAN32.EXE] C:\WINDOWS\SYSTEM\APPAN32.EXE /s
O4 - HKLM\..\RunServices: [MSJU.EXE] C:\WINDOWS\SYSTEM\MSJU.EXE /s
O4 - HKLM\..\RunServices: [CRAL.EXE] C:\WINDOWS\CRAL.EXE /s
O4 - HKLM\..\RunServices: [MFCPJ32.EXE] C:\WINDOWS\SYSTEM\MFCPJ32.EXE /s
O4 - HKLM\..\RunServices: [CROZ.EXE] C:\WINDOWS\CROZ.EXE /s
O4 - HKLM\..\RunServices: [JAVAWT32.EXE] C:\WINDOWS\SYSTEM\JAVAWT32.EXE /s
O4 - HKLM\..\RunServices: [D3XF.EXE] C:\WINDOWS\D3XF.EXE /s
O4 - HKLM\..\RunServices: [IEPA32.EXE] C:\WINDOWS\IEPA32.EXE /s
O4 - HKLM\..\RunServices: [APIZE32.EXE] C:\WINDOWS\SYSTEM\APIZE32.EXE /s
O4 - HKLM\..\RunServices: [ADDPA32.EXE] C:\WINDOWS\SYSTEM\ADDPA32.EXE /s
O4 - HKLM\..\RunServices: [IEYA.EXE] C:\WINDOWS\SYSTEM\IEYA.EXE /s
O4 - HKLM\..\RunServices: [IEFU32.EXE] C:\WINDOWS\IEFU32.EXE /s
O4 - HKLM\..\RunServices: [APIKK.EXE] C:\WINDOWS\APIKK.EXE /s
O4 - HKLM\..\RunServices: [MFCLE.EXE] C:\WINDOWS\MFCLE.EXE /s
O4 - HKLM\..\RunServices: [MSXY32.EXE] C:\WINDOWS\SYSTEM\MSXY32.EXE /s
O4 - HKLM\..\RunServices: [MSUQ.EXE] C:\WINDOWS\MSUQ.EXE /s
O4 - HKLM\..\RunServices: [D3QK32.EXE] C:\WINDOWS\D3QK32.EXE /s
O4 - HKLM\..\RunServices: [WINQA32.EXE] C:\WINDOWS\SYSTEM\WINQA32.EXE /s
O4 - HKLM\..\RunServices: [SDKJE32.EXE] C:\WINDOWS\SYSTEM\SDKJE32.EXE /s
O4 - HKLM\..\RunServices: [MSSJ32.EXE] C:\WINDOWS\SYSTEM\MSSJ32.EXE /s
O4 - HKLM\..\RunServices: [SYSRF32.EXE] C:\WINDOWS\SYSRF32.EXE /s
O4 - HKLM\..\RunServices: [NETIJ32.EXE] C:\WINDOWS\NETIJ32.EXE /s
O4 - HKLM\..\RunServices: [APPZG.EXE] C:\WINDOWS\APPZG.EXE /s
O4 - HKLM\..\RunServices: [APICJ32.EXE] C:\WINDOWS\SYSTEM\APICJ32.EXE /s
O4 - HKLM\..\RunServices: [ADDXY32.EXE] C:\WINDOWS\SYSTEM\ADDXY32.EXE /s
O4 - HKLM\..\RunServices: [IPRQ32.EXE] C:\WINDOWS\IPRQ32.EXE /s
O4 - HKLM\..\RunServices: [MSIR32.EXE] C:\WINDOWS\SYSTEM\MSIR32.EXE /s
O4 - HKLM\..\RunServices: [JAVAYO.EXE] C:\WINDOWS\JAVAYO.EXE /s
O4 - HKLM\..\RunServices: [APPBW.EXE] C:\WINDOWS\SYSTEM\APPBW.EXE /s
O4 - HKLM\..\RunServices: [JAVABP.EXE] C:\WINDOWS\JAVABP.EXE /s
O4 - HKLM\..\RunServices: [SDKIB32.EXE] C:\WINDOWS\SDKIB32.EXE /s
O4 - HKLM\..\RunServices: [NETOD.EXE] C:\WINDOWS\NETOD.EXE /s
O4 - HKLM\..\RunServices: [ATLTT.EXE] C:\WINDOWS\SYSTEM\ATLTT.EXE /s
O4 - HKLM\..\RunServices: [APPEN.EXE] C:\WINDOWS\SYSTEM\APPEN.EXE /s
O4 - HKLM\..\RunServices: [ADDKO32.EXE] C:\WINDOWS\ADDKO32.EXE /s
O4 - HKLM\..\RunServices: [SYSUP32.EXE] C:\WINDOWS\SYSTEM\SYSUP32.EXE /s
O4 - HKLM\..\RunServices: [MFCRT.EXE] C:\WINDOWS\SYSTEM\MFCRT.EXE /s
O4 - HKLM\..\RunServices: [MSND32.EXE] C:\WINDOWS\MSND32.EXE /s
O4 - HKLM\..\RunServices: [SDKEA32.EXE] C:\WINDOWS\SYSTEM\SDKEA32.EXE /s
O4 - HKLM\..\RunServices: [ADDIW.EXE] C:\WINDOWS\ADDIW.EXE /s
O4 - HKLM\..\RunServices: [SYSOO32.EXE] C:\WINDOWS\SYSTEM\SYSOO32.EXE /s
O4 - HKLM\..\RunServices: [SYSEE.EXE] C:\WINDOWS\SYSTEM\SYSEE.EXE /s
O4 - HKLM\..\RunServices: [NTZQ32.EXE] C:\WINDOWS\NTZQ32.EXE /s
O4 - HKLM\..\RunServices: [APIHN.EXE] C:\WINDOWS\SYSTEM\APIHN.EXE /s
O4 - HKLM\..\RunServices: [D3KR.EXE] C:\WINDOWS\D3KR.EXE /s
O4 - HKLM\..\RunServices: [JAVAKQ.EXE] C:\WINDOWS\SYSTEM\JAVAKQ.EXE /s
O4 - HKLM\..\RunServices: [CRFL32.EXE] C:\WINDOWS\CRFL32.EXE /s
O4 - HKLM\..\RunServices: [APISH32.EXE] C:\WINDOWS\SYSTEM\APISH32.EXE /s
O4 - HKLM\..\RunServices: [MSNS.EXE] C:\WINDOWS\MSNS.EXE /s
O4 - HKLM\..\RunServices: [JAVANL.EXE] C:\WINDOWS\SYSTEM\JAVANL.EXE /s
O4 - HKLM\..\RunServices: [SYSBU32.EXE] C:\WINDOWS\SYSBU32.EXE /s
O4 - HKLM\..\RunServices: [JAVAIM.EXE] C:\WINDOWS\SYSTEM\JAVAIM.EXE /s
O4 - HKLM\..\RunServices: [SDKJF.EXE] C:\WINDOWS\SYSTEM\SDKJF.EXE /s
O4 - HKLM\..\RunServices: [NTJP32.EXE] C:\WINDOWS\NTJP32.EXE /s
O4 - HKLM\..\RunServices: [APPAP32.EXE] C:\WINDOWS\SYSTEM\APPAP32.EXE /s
O4 - HKLM\..\RunServices: [D3MQ32.EXE] C:\WINDOWS\SYSTEM\D3MQ32.EXE /s
O4 - HKLM\..\RunServices: [NETSY32.EXE] C:\WINDOWS\NETSY32.EXE /s
O4 - HKLM\..\RunServices: [WINFM32.EXE] C:\WINDOWS\WINFM32.EXE /s
O4 - HKLM\..\RunServices: [WINJU.EXE] C:\WINDOWS\SYSTEM\WINJU.EXE /s
O4 - HKLM\..\RunServices: [APPRF.EXE] C:\WINDOWS\SYSTEM\APPRF.EXE /s
O4 - HKLM\..\RunServices: [MSXW32.EXE] C:\WINDOWS\MSXW32.EXE /s
O4 - HKLM\..\RunServices: [IPLZ32.EXE] C:\WINDOWS\SYSTEM\IPLZ32.EXE /s
O4 - HKLM\..\RunServices: [MFCXO.EXE] C:\WINDOWS\SYSTEM\MFCXO.EXE /s
O4 - HKLM\..\RunServices: [APPPN.EXE] C:\WINDOWS\SYSTEM\APPPN.EXE /s
O4 - HKLM\..\RunServices: [IPLX.EXE] C:\WINDOWS\SYSTEM\IPLX.EXE /s
O4 - HKLM\..\RunServices: [APIAV.EXE] C:\WINDOWS\APIAV.EXE /s
O4 - HKLM\..\RunServices: [SYSSU32.EXE] C:\WINDOWS\SYSSU32.EXE /s
O4 - HKLM\..\RunServices: [SDKEL.EXE] C:\WINDOWS\SDKEL.EXE /s
O4 - HKLM\..\RunServices: [APIQO32.EXE] C:\WINDOWS\SYSTEM\APIQO32.EXE /s
O4 - HKLM\..\RunServices: [NTCM32.EXE] C:\WINDOWS\SYSTEM\NTCM32.EXE /s
O4 - HKLM\..\RunServices: [SDKQP.EXE] C:\WINDOWS\SYSTEM\SDKQP.EXE /s
O4 - HKLM\..\RunServices: [MSVM.EXE] C:\WINDOWS\SYSTEM\MSVM.EXE /s
O4 - HKLM\..\RunServices: [IPPD32.EXE] C:\WINDOWS\SYSTEM\IPPD32.EXE /s
O4 - HKLM\..\RunServices: [WINGG.EXE] C:\WINDOWS\WINGG.EXE /s
O4 - HKLM\..\RunServices: [APIZI32.EXE] C:\WINDOWS\APIZI32.EXE /s
O4 - HKLM\..\RunServices: [ATLYS32.EXE] C:\WINDOWS\ATLYS32.EXE /s
O4 - HKLM\..\RunServices: [MFCSL.EXE] C:\WINDOWS\MFCSL.EXE /s
O4 - HKLM\..\RunServices: [NTMZ.EXE] C:\WINDOWS\SYSTEM\NTMZ.EXE /s
O4 - HKLM\..\RunServices: [D3DS32.EXE] C:\WINDOWS\D3DS32.EXE /s
O4 - HKLM\..\RunServices: [WINEJ.EXE] C:\WINDOWS\SYSTEM\WINEJ.EXE /s
O4 - HKLM\..\RunServices: [CRIW.EXE] C:\WINDOWS\SYSTEM\CRIW.EXE /s
O4 - HKLM\..\RunServices: [NETWE32.EXE] C:\WINDOWS\SYSTEM\NETWE32.EXE /s
O4 - HKLM\..\RunServices: [ADDXF32.EXE] C:\WINDOWS\SYSTEM\ADDXF32.EXE /s
O4 - HKLM\..\RunServices: [MSSP.EXE] C:\WINDOWS\MSSP.EXE /s




Step#13:Use About Buster


This is the step where we will use About:Buster that you had downloaded previously.

• Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe
• When the tool is open press the OK button,
• then the Start button, then the OK button, and then finally the Yes button.
• It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.
• Post the log file in your next reply

Step#14:Use Registry File

• Copy the contents of the Quote Box below to Notepad.
• Name the file as fix.reg
• Change the Save as Type to All Files
• and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

• Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

Reboot your computer back to normal mode



Reconnect To The Internet




Step#15:Use HijackThis and Post To Thread In Forum

1. Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

2. Post your logs from About Buster, DllCompare and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

Good Luck!



E

Here goes Elrond…. Whew! That was really difficult for a novice My husband helped on a few areas that didn't make sense to me. Nothing found on DIICompare…. * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 20,647 items found: 20,647 files, 0 directories. Total of file sizes: 150,694,993 bytes 143.71 M ——————–End log——————— Logfile of HijackThis v1.99.1 Scan saved at 12:32:26 PM, on 8/4/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Hijackthis log: Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE C:\WINDOWS\SYSTEM\APINK.EXE C:\WINDOWS\SYSTEM\D3AJ.EXE C:\WINDOWS\IEBN32.EXE C:\WINDOWS\SYSTEM\CRYO32.EXE C:\WINDOWS\SYSPJ32.EXE C:\WINDOWS\APIJE.EXE C:\WINDOWS\NETDW.EXE C:\WINDOWS\SYSTEM\NETAU32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\SDKJS32.EXE C:\WINDOWS\SYSTEM\SYSQV.EXE C:\WINDOWS\JAVAJM32.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\SYSTEM\JAVALW32.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\IEBN32.EXE C:\WINDOWS\IEBN32.EXE C:\WINDOWS\SYSTEM\APINK.EXE C:\WINDOWS\IPZC.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\WINDOWS\NOTEPAD.EXE C:\WINDOWS\SYSTEM\SYSQV.EXE C:\WINDOWS\NTEB32.EXE C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\WINDOWS\JAVAJM32.EXE C:\WINDOWS\JAVAJM32.EXE C:\WINDOWS\IECW32.EXE C:\WINDOWS\SYSTEM\SYSQV.EXE C:\WINDOWS\SYSTEM\IERV.EXE C:\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Class - {6F2100DD-ACA4-626F-1F56-2064BFA300C4} - C:\WINDOWS\NETAD32.DLL O2 - BHO: Class - {C89869FF-ABB3-6FA3-5EA2-398242CF48F1} - C:\WINDOWS\SYSTEM\MFCBD.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [JAVALW32.EXE] C:\WINDOWS\SYSTEM\JAVALW32.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" O4 - HKLM\..\RunServices: [APINK.EXE] C:\WINDOWS\SYSTEM\APINK.EXE /s O4 - HKLM\..\RunServices: [D3AJ.EXE] C:\WINDOWS\SYSTEM\D3AJ.EXE /s O4 - HKLM\..\RunServices: [IEBN32.EXE] C:\WINDOWS\IEBN32.EXE /s O4 - HKLM\..\RunServices: [CRYO32.EXE] C:\WINDOWS\SYSTEM\CRYO32.EXE /s O4 - HKLM\..\RunServices: [SYSPJ32.EXE] C:\WINDOWS\SYSPJ32.EXE /s O4 - HKLM\..\RunServices: [APIJE.EXE] C:\WINDOWS\APIJE.EXE /s O4 - HKLM\..\RunServices: [NETDW.EXE] C:\WINDOWS\NETDW.EXE /s O4 - HKLM\..\RunServices: [NETAU32.EXE] C:\WINDOWS\SYSTEM\NETAU32.EXE /s O4 - HKLM\..\RunServices: [SDKJS32.EXE] C:\WINDOWS\SYSTEM\SDKJS32.EXE /s O4 - HKLM\..\RunServices: [SYSQV.EXE] C:\WINDOWS\SYSTEM\SYSQV.EXE /s O4 - HKLM\..\RunServices: [JAVAJM32.EXE] C:\WINDOWS\JAVAJM32.EXE /s O4 - HKLM\..\RunServices: [IPZC.EXE] C:\WINDOWS\IPZC.EXE /s O4 - HKLM\..\RunServices: [NTEB32.EXE] C:\WINDOWS\NTEB32.EXE /s O4 - HKLM\..\RunServices: [IECW32.EXE] C:\WINDOWS\IECW32.EXE /s O4 - HKLM\..\RunServices: [IERV.EXE] C:\WINDOWS\SYSTEM\IERV.EXE /s O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 Aboutbuster LOG: AboutBuster 5.0 reference file 28 Scan started on [8/4/2005] at [12:17:50 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— No Files Found! ———————————————— Scan was ABORTED at 12:19:34 AM AboutBuster 5.0 reference file 28 Scan started on [8/4/2005] at [12:20:49 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tnboxk.dat Removed File! : C:\Windows\mkdse.dat Removed File! : C:\Windows\mwchtb.dat Removed File! : C:\Windows\gakjm.dat Removed File! : C:\Windows\dwdvn.dat Removed File! : C:\Windows\eaxuju.dat Removed File! : C:\Windows\xcfxb.dat Removed File! : C:\Windows\hhppf.dat Removed File! : C:\Windows\beysg.dat Removed File! : C:\Windows\jrwyaj.dat Removed File! : C:\Windows\kemunj.dat Removed File! : C:\Windows\vfdpe.dat Removed File! : C:\Windows\doqym.dat Removed File! : C:\Windows\dbtfxb.dat Removed File! : C:\Windows\abjiek.dat Removed File! : C:\Windows\aletp.dat Removed File! : C:\Windows\tzetip.dat Removed File! : C:\Windows\iwofs.dat Removed File! : C:\Windows\xexzch.dat Removed File! : C:\Windows\oiscbx.dat Removed File! : C:\Windows\hugwp.dat Removed File! : C:\Windows\nilsu.dll Removed File! : C:\Windows\lveafh.dat Removed File! : C:\Windows\gonhfn.dat Removed File! : C:\Windows\kzdqr.dll Removed File! : C:\Windows\gghje.dll Removed File! : C:\Windows\odkeg.dll Removed File! : C:\Windows\fvcozi.dat Removed File! : C:\Windows\qcrvd.dll Removed File! : C:\Windows\yzljo.dll Removed File! : C:\Windows\slncq.dll Removed File! : C:\Windows\muygi.dll Removed File! : C:\Windows\vqccr.dat Removed File! : C:\Windows\qxnhvv.dat Removed File! : C:\Windows\sfekiu.dat Removed File! : C:\Windows\dhhvfh.dat Removed File! : C:\Windows\hczss.dll Removed File! : C:\Windows\emney.dll Removed File! : C:\Windows\myvmj.dll Removed File! : C:\Windows\rgeca.dll Removed File! : C:\Windows\njols.dll Removed File! : C:\Windows\vmkyve.dat Removed File! : C:\Windows\nncdxp.dat Removed File! : C:\Windows\klbcip.dat Removed File! : C:\Windows\awqdc.dll Removed File! : C:\Windows\rvvlvx.dat Removed File! : C:\Windows\cwiae.dll Removed File! : C:\Windows\ailhd.dll Removed File! : C:\Windows\lumeie.dat Removed File! : C:\Windows\esybti.dat Removed File! : C:\Windows\tbyiu.dat Removed File! : C:\Windows\wecar.dat Removed File! : C:\Windows\xslhw.dll Removed File! : C:\Windows\vnbve.dll Removed File! : C:\Windows\vayjq.dll Removed File! : C:\Windows\aaqac.dll Removed File! : C:\Windows\nhmzp.dll Removed File! : C:\Windows\tvejp.dll Removed File! : C:\Windows\qidrfj.dat Removed File! : C:\Windows\ofoxtu.dat Removed File! : C:\Windows\rnzis.dll Removed File! : C:\Windows\ratqz.dll Removed File! : C:\Windows\fgeoc.dll Removed File! : C:\Windows\qyfdx.dll Removed File! : C:\Windows\suopg.dll Removed File! : C:\Windows\qovhbp.dat Removed File! : C:\Windows\lckbe.dll Removed File! : C:\Windows\owbbc.dll Removed File! : C:\Windows\ltjdc.dat Removed File! : C:\Windows\aetwso.dat Removed File! : C:\Windows\hrsra.dll Removed File! : C:\Windows\odcml.dll Removed File! : C:\Windows\mamdk.dll Removed File! : C:\Windows\hkcll.dll Removed File! : C:\Windows\osxpy.dll Removed File! : C:\Windows\dffpe.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:08:51 AM Other questions or notes: Does it matter that I am using this laptop inbetween our attempts to fix? I noticed that when I click on start, run…there is a continuous hourglass as though something is running all the time?? Appreciate the help! kmount

Hi kmount.

You and your husband did great. I spent close to three hours sorting out all the junk and preparing the instructions. I can imaging how much time it must have taken you to run them.

This is some infection. It has not given up yet but hopefully we have it on the run.

We will have to go through nearly the whole mess once more. If we have really bad luck we will have to do it more than once more. As I said it is nasty and complicated. At least we have reduced the infected files that need to be removed from I believe 93 to just under 20. At least a step in the right direction.

By the way, try not to use the computer on the net until we have gotten rid of this pest. It downloads itself from the net.
Until we are through getting rid of this infection I will not even guess what is going on with your computer.

I am posting the whole fix but you do not need to run steps 1 through 5 again. Start by disconnecting from the net.

The Fix -

(the reason Wordpad was chosen is that Notepad is often deleted by this variant)

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening them will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Close Outlook Express and Internet Explorer for the duration of this fix

Please continue with the next steps and if you run into any problems with the current one, just keep going through the list step by step. Just be sure to let us know what the problem was when you finally reply.



Step#1:Make Sure Hidden Files Are Visible

• Please make sure you can view all Hidden Files by choosing the instructions for your Windows OS.

Step#2:Download and Update CWShredder

• Download CWShredder.Do Not Use It Yet
• Save CWShredder.exe to a convenient location.
• make sure it is up to date.

Step#3:Download DllCompare

• Download DLLCompare.Do Not Use It Yet

Step#4:Download Killbox

• Download the Killbox.Do Not Use It Yet
• Unzip the contents of KillBox.zip to a convenient location.

Step#5:Download About Buster

• Please download About:Buster from here: Do Not Use It Yet
• About Buster.
• extract it to c:\aboutbuster.
• update. to latest definitions

Please disconnect from the Internet and unplug your modem for the duration of this fix



Step#6:Reboot To Safe Mode

Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE



Step#7: Use CWShredder

• Open CWShredder.exe.
• Click "Fix ->" and click "OK" at the prompt.
• CWShredder will scan and clean your system of CWS files.
• Click "Next->" and then "Exit".
• REBOOT back into Safe Mode by tapping F8 while booting up.l

Step#8:Use DllCompare

• Open DllCompare.exe to run the program.
• Click "Run Locate.com" and it will scan your system for files.
• Once the scan has finished click "Compare" to compare your files to valid Windows files.
  Files in the upper window have now been verified to "exist", Files in the lower window were not able to be accessed. Very few files should be listed in the lower window when the Compare scan is complete.
• Once it has finished comparing click " Make a Log of what was found".
• Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files)
• Click "Yes" at the ‘View Log file’ prompt to view the log.
• Copy and paste the entire log into your next reply after completing all steps.(saved as log.txt in the DllCompare folder)
• Click "Exit".

Step#9:Delete Running Processes

• In Safe Mode delete the Running Processes that have been Identified as being part of the infection. If unable to delete them, see below to use Killbox.
  C:\WINDOWS\SYSTEM\APINK.EXE
  C:\WINDOWS\SYSTEM\D3AJ.EXE
  C:\WINDOWS\IEBN32.EXE
  C:\WINDOWS\SYSTEM\CRYO32.EXE
  C:\WINDOWS\SYSPJ32.EXE
  C:\WINDOWS\APIJE.EXE
  C:\WINDOWS\NETDW.EXE
  C:\WINDOWS\SYSTEM\NETAU32.EXE
  C:\WINDOWS\SYSTEM\SDKJS32.EXE
  C:\WINDOWS\SYSTEM\SYSQV.EXE
  C:\WINDOWS\JAVAJM32.EXE
  C:\WINDOWS\SYSTEM\JAVALW32.EXE
  C:\WINDOWS\IEBN32.EXE
  C:\WINDOWS\IEBN32.EXE
  C:\WINDOWS\SYSTEM\APINK.EXE
  C:\WINDOWS\IPZC.EXE
  C:\WINDOWS\SYSTEM\SYSQV.EXE
  C:\WINDOWS\NTEB32.EXE
  C:\WINDOWS\JAVAJM32.EXE
  C:\WINDOWS\JAVAJM32.EXE
  C:\WINDOWS\IECW32.EXE
  C:\WINDOWS\SYSTEM\SYSQV.EXE
  C:\WINDOWS\SYSTEM\IERV.EXE

Step#10:Delete Infected Files
Please boot into Safe Mode and delete the following files:
C:\WINDOWS\APIJE.EXE
C:\WINDOWS\IEBN32.EXE
C:\WINDOWS\IECW32.EXE
C:\WINDOWS\IPZC.EXE
C:\WINDOWS\JAVAJM32.EXE
C:\WINDOWS\NETAD32.DLL
C:\WINDOWS\NETDW.EXE
C:\WINDOWS\NTEB32.EXE
C:\WINDOWS\SYSPJ32.EXE
C:\WINDOWS\SYSTEM\APINK.EXE
C:\WINDOWS\SYSTEM\CRYO32.EXE
C:\WINDOWS\SYSTEM\D3AJ.EXE
C:\WINDOWS\SYSTEM\IERV.EXE
C:\WINDOWS\SYSTEM\JAVALW32.EXE
C:\WINDOWS\SYSTEM\MFCBD.DLL
C:\WINDOWS\SYSTEM\NETAU32.EXE
C:\WINDOWS\SYSTEM\SDKJS32.EXE
C:\WINDOWS\SYSTEM\SYSQV.EXE
C:\WINDOWS\system\uyvqn.dll

Step#11:Use Killbox(may not be necessary)

• If unable to delete files above in safe mode please use KillBox that you downloaded earlier:
• Open KillBox
• Highlight the list of names to delete then CTRL-C to copy and then Paste all files into the box "Full Path of File to Delete" . C:\WINDOWS\APIJE.EXE
  C:\WINDOWS\IEBN32.EXE
  C:\WINDOWS\IECW32.EXE
  C:\WINDOWS\IPZC.EXE
  C:\WINDOWS\JAVAJM32.EXE
  C:\WINDOWS\NETAD32.DLL
  C:\WINDOWS\NETDW.EXE
  C:\WINDOWS\NTEB32.EXE
  C:\WINDOWS\SYSPJ32.EXE
  C:\WINDOWS\SYSTEM\APINK.EXE
  C:\WINDOWS\SYSTEM\CRYO32.EXE
  C:\WINDOWS\SYSTEM\D3AJ.EXE
  C:\WINDOWS\SYSTEM\IERV.EXE
  C:\WINDOWS\SYSTEM\JAVALW32.EXE
  C:\WINDOWS\SYSTEM\MFCBD.DLL
  C:\WINDOWS\SYSTEM\NETAU32.EXE
  C:\WINDOWS\SYSTEM\SDKJS32.EXE
  C:\WINDOWS\SYSTEM\SYSQV.EXE
  C:\WINDOWS\system\uyvqn.dll
  
• Choose Delete on Reboot.
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Delete on Reboot prompt.
• If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Step#12:Use HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\uyvqn.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {6F2100DD-ACA4-626F-1F56-2064BFA300C4} - C:\WINDOWS\NETAD32.DLL
O2 - BHO: Class - {C89869FF-ABB3-6FA3-5EA2-398242CF48F1} - C:\WINDOWS\SYSTEM\MFCBD.DLL
O4 - HKLM\..\Run: [JAVALW32.EXE] C:\WINDOWS\SYSTEM\JAVALW32.EXE
O4 - HKLM\..\RunServices: [APINK.EXE] C:\WINDOWS\SYSTEM\APINK.EXE /s
O4 - HKLM\..\RunServices: [D3AJ.EXE] C:\WINDOWS\SYSTEM\D3AJ.EXE /s
O4 - HKLM\..\RunServices: [IEBN32.EXE] C:\WINDOWS\IEBN32.EXE /s
O4 - HKLM\..\RunServices: [CRYO32.EXE] C:\WINDOWS\SYSTEM\CRYO32.EXE /s
O4 - HKLM\..\RunServices: [SYSPJ32.EXE] C:\WINDOWS\SYSPJ32.EXE /s
O4 - HKLM\..\RunServices: [APIJE.EXE] C:\WINDOWS\APIJE.EXE /s
O4 - HKLM\..\RunServices: [NETDW.EXE] C:\WINDOWS\NETDW.EXE /s
O4 - HKLM\..\RunServices: [NETAU32.EXE] C:\WINDOWS\SYSTEM\NETAU32.EXE /s
O4 - HKLM\..\RunServices: [SDKJS32.EXE] C:\WINDOWS\SYSTEM\SDKJS32.EXE /s
O4 - HKLM\..\RunServices: [SYSQV.EXE] C:\WINDOWS\SYSTEM\SYSQV.EXE /s
O4 - HKLM\..\RunServices: [JAVAJM32.EXE] C:\WINDOWS\JAVAJM32.EXE /s
O4 - HKLM\..\RunServices: [IPZC.EXE] C:\WINDOWS\IPZC.EXE /s
O4 - HKLM\..\RunServices: [NTEB32.EXE] C:\WINDOWS\NTEB32.EXE /s
O4 - HKLM\..\RunServices: [IECW32.EXE] C:\WINDOWS\IECW32.EXE /s
O4 - HKLM\..\RunServices: [IERV.EXE] C:\WINDOWS\SYSTEM\IERV.EXE /s




Step#13:Use About Buster


This is the step where we will use About:Buster that you had downloaded previously.

• Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe
• When the tool is open press the OK button,
• then the Start button, then the OK button, and then finally the Yes button.
• It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.
• Post the log file in your next reply

Step#14:Use Registry File

• Copy the contents of the Quote Box below to Notepad.
• Name the file as fix.reg
• Change the Save as Type to All Files
• and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

• Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

Reboot your computer back to normal mode



Reconnect To The Internet




Step#15:Use HijackThis and Post To Thread In Forum

1. Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

2. Post your logs from About Buster, DllCompare and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

Good Luck!



E

Not as difficult this time….I'm even learning a little about DOS… Here are the logs: * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 20,763 items found: 20,763 files, 0 directories. Total of file sizes: 150,413,579 bytes 143.45 M ——————–End log——————— AboutBuster 5.0 reference file 28 Scan started on [8/4/2005] at [12:20:49 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tnboxk.dat Removed File! : C:\Windows\mkdse.dat Removed File! : C:\Windows\mwchtb.dat Removed File! : C:\Windows\gakjm.dat Removed File! : C:\Windows\dwdvn.dat Removed File! : C:\Windows\eaxuju.dat Removed File! : C:\Windows\xcfxb.dat Removed File! : C:\Windows\hhppf.dat Removed File! : C:\Windows\beysg.dat Removed File! : C:\Windows\jrwyaj.dat Removed File! : C:\Windows\kemunj.dat Removed File! : C:\Windows\vfdpe.dat Removed File! : C:\Windows\doqym.dat Removed File! : C:\Windows\dbtfxb.dat Removed File! : C:\Windows\abjiek.dat Removed File! : C:\Windows\aletp.dat Removed File! : C:\Windows\tzetip.dat Removed File! : C:\Windows\iwofs.dat Removed File! : C:\Windows\xexzch.dat Removed File! : C:\Windows\oiscbx.dat Removed File! : C:\Windows\hugwp.dat Removed File! : C:\Windows\nilsu.dll Removed File! : C:\Windows\lveafh.dat Removed File! : C:\Windows\gonhfn.dat Removed File! : C:\Windows\kzdqr.dll Removed File! : C:\Windows\gghje.dll Removed File! : C:\Windows\odkeg.dll Removed File! : C:\Windows\fvcozi.dat Removed File! : C:\Windows\qcrvd.dll Removed File! : C:\Windows\yzljo.dll Removed File! : C:\Windows\slncq.dll Removed File! : C:\Windows\muygi.dll Removed File! : C:\Windows\vqccr.dat Removed File! : C:\Windows\qxnhvv.dat Removed File! : C:\Windows\sfekiu.dat Removed File! : C:\Windows\dhhvfh.dat Removed File! : C:\Windows\hczss.dll Removed File! : C:\Windows\emney.dll Removed File! : C:\Windows\myvmj.dll Removed File! : C:\Windows\rgeca.dll Removed File! : C:\Windows\njols.dll Removed File! : C:\Windows\vmkyve.dat Removed File! : C:\Windows\nncdxp.dat Removed File! : C:\Windows\klbcip.dat Removed File! : C:\Windows\awqdc.dll Removed File! : C:\Windows\rvvlvx.dat Removed File! : C:\Windows\cwiae.dll Removed File! : C:\Windows\ailhd.dll Removed File! : C:\Windows\lumeie.dat Removed File! : C:\Windows\esybti.dat Removed File! : C:\Windows\tbyiu.dat Removed File! : C:\Windows\wecar.dat Removed File! : C:\Windows\xslhw.dll Removed File! : C:\Windows\vnbve.dll Removed File! : C:\Windows\vayjq.dll Removed File! : C:\Windows\aaqac.dll Removed File! : C:\Windows\nhmzp.dll Removed File! : C:\Windows\tvejp.dll Removed File! : C:\Windows\qidrfj.dat Removed File! : C:\Windows\ofoxtu.dat Removed File! : C:\Windows\rnzis.dll Removed File! : C:\Windows\ratqz.dll Removed File! : C:\Windows\fgeoc.dll Removed File! : C:\Windows\qyfdx.dll Removed File! : C:\Windows\suopg.dll Removed File! : C:\Windows\qovhbp.dat Removed File! : C:\Windows\lckbe.dll Removed File! : C:\Windows\owbbc.dll Removed File! : C:\Windows\ltjdc.dat Removed File! : C:\Windows\aetwso.dat Removed File! : C:\Windows\hrsra.dll Removed File! : C:\Windows\odcml.dll Removed File! : C:\Windows\mamdk.dll Removed File! : C:\Windows\hkcll.dll Removed File! : C:\Windows\osxpy.dll Removed File! : C:\Windows\dffpe.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:08:51 AM AboutBuster 5.0 reference file 28 Scan started on [8/5/2005] at [12:40:25 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tashv.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat Removed File! : C:\Windows\pttrp.dll Removed File! : C:\Windows\dtkuz.dll Removed File! : C:\Windows\qoqsq.dll Removed File! : C:\Windows\akqmi.dll ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:11:46 AM Logfile of HijackThis v1.99.1 Scan saved at 1:33:20 AM, on 8/5/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\SYSTEM\WINBP.EXE C:\WINDOWS\ADDQN32.EXE C:\WINDOWS\SYSTEM\APPCR.EXE C:\WINDOWS\WINXP32.EXE C:\WINDOWS\SYSTEM\WINFK32.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\WINDOWS\SYSTEM\IPJA32.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\WINDOWS\SYSTEM\APPCR.EXE C:\WINDOWS\ADDQN32.EXE C:\HIJACKTHIS.EXE R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: Class - {E436CD32-AE4D-738A-E06E-D227AC75B577} - C:\WINDOWS\APIIR32.DLL O2 - BHO: Class - {D8F0E5CF-F02C-5845-C984-FB04E2D9B2A7} - C:\WINDOWS\SYSTEM\APPLV.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [IPJA32.EXE] C:\WINDOWS\SYSTEM\IPJA32.EXE O4 - HKLM\..\Run: [MSCJ.EXE] C:\WINDOWS\MSCJ.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [WINBP.EXE] C:\WINDOWS\SYSTEM\WINBP.EXE /s O4 - HKLM\..\RunServices: [ADDQN32.EXE] C:\WINDOWS\ADDQN32.EXE /s O4 - HKLM\..\RunServices: [APPCR.EXE] C:\WINDOWS\SYSTEM\APPCR.EXE /s O4 - HKLM\..\RunServices: [WINXP32.EXE] C:\WINDOWS\WINXP32.EXE /s O4 - HKLM\..\RunServices: [WINFK32.EXE] C:\WINDOWS\SYSTEM\WINFK32.EXE /s O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 I'll await the next step of attack……thanks for your time investment! kmount

Hi kmount.

We will have to go through the routine once more but each time the infection is loosing ground. However once you are rid of the infection there are still steps to be done in order to clean up after it.
However first things first. Let's see if the last pieces will let themselfs be fixed this time.


The Fix -

(the reason Wordpad was chosen is that Notepad is often deleted by this variant)

Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening them will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.

Close Outlook Express and Internet Explorer for the duration of this fix

Please continue with the next steps and if you run into any problems with the current one, just keep going through the list step by step. Just be sure to let us know what the problem was when you finally reply.



Please disconnect from the Internet and unplug your modem for the duration of this fix



Step#6:Reboot To Safe Mode

Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE



Step#7: Use CWShredder

• Open CWShredder.exe.
• Click "Fix ->" and click "OK" at the prompt.
• CWShredder will scan and clean your system of CWS files.
• Click "Next->" and then "Exit".
• REBOOT back into Safe Mode by tapping F8 while booting up.l

Step#8:Use DllCompare

• Open DllCompare.exe to run the program.
• Click "Run Locate.com" and it will scan your system for files.
• Once the scan has finished click "Compare" to compare your files to valid Windows files.
  Files in the upper window have now been verified to "exist", Files in the lower window were not able to be accessed. Very few files should be listed in the lower window when the Compare scan is complete.
• Once it has finished comparing click " Make a Log of what was found".
• Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files)
• Click "Yes" at the ‘View Log file’ prompt to view the log.
• Copy and paste the entire log into your next reply after completing all steps.(saved as log.txt in the DllCompare folder)
• Click "Exit".

Step#9:Delete Running Processes

• In Safe Mode delete the Running Processes that have been Identified as being part of the infection. If unable to delete them, see below to use Killbox.
  C:\WINDOWS\SYSTEM\WINBP.EXE
  C:\WINDOWS\ADDQN32.EXE
  C:\WINDOWS\SYSTEM\APPCR.EXE
  C:\WINDOWS\WINXP32.EXE
  C:\WINDOWS\SYSTEM\WINFK32.EXE
  C:\WINDOWS\SYSTEM\IPJA32.EXE
  C:\WINDOWS\SYSTEM\APPCR.EXE
  C:\WINDOWS\ADDQN32.EXE

Step#10:Delete Infected Files
Please boot into Safe Mode and delete the following files:
C:\WINDOWS\ADDQN32.EXE
C:\WINDOWS\APIIR32.DLL
C:\WINDOWS\MSCJ.EXE
C:\WINDOWS\WINXP32.EXE
C:\WINDOWS\SYSTEM\APPCR.EXE
C:\WINDOWS\SYSTEM\APPLV.DLL
C:\WINDOWS\SYSTEM\IPJA32.EXE
C:\WINDOWS\SYSTEM\WINBP.EXE
C:\WINDOWS\SYSTEM\WINFK32.EXE

Step#11:Use Killbox(may not be necessary)

• If unable to delete files above in safe mode please use KillBox that you downloaded earlier:
• Open KillBox
• Highlight the list of names to delete then CTRL-C to copy and then Paste all files into the box "Full Path of File to Delete" . C:\WINDOWS\ADDQN32.EXE
  C:\WINDOWS\APIIR32.DLL
  C:\WINDOWS\MSCJ.EXE
  C:\WINDOWS\WINXP32.EXE
  C:\WINDOWS\SYSTEM\APPCR.EXE
  C:\WINDOWS\SYSTEM\APPLV.DLL
  C:\WINDOWS\SYSTEM\IPJA32.EXE
  C:\WINDOWS\SYSTEM\WINBP.EXE
  C:\WINDOWS\SYSTEM\WINFK32.EXE

[*]Choose Delete on Reboot.

[*]Click the "Delete File" button which looks like a stop sign.

[*]Click "Yes" at the Delete on Reboot prompt.

[*]If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.




Step#12:Use HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E436CD32-AE4D-738A-E06E-D227AC75B577} - C:\WINDOWS\APIIR32.DLL
O2 - BHO: Class - {D8F0E5CF-F02C-5845-C984-FB04E2D9B2A7} - C:\WINDOWS\SYSTEM\APPLV.DLL
O4 - HKLM\..\Run: [IPJA32.EXE] C:\WINDOWS\SYSTEM\IPJA32.EXE
O4 - HKLM\..\Run: [MSCJ.EXE] C:\WINDOWS\MSCJ.EXE
O4 - HKLM\..\RunServices: [WINBP.EXE] C:\WINDOWS\SYSTEM\WINBP.EXE /s
O4 - HKLM\..\RunServices: [ADDQN32.EXE] C:\WINDOWS\ADDQN32.EXE /s
O4 - HKLM\..\RunServices: [APPCR.EXE] C:\WINDOWS\SYSTEM\APPCR.EXE /s
O4 - HKLM\..\RunServices: [WINXP32.EXE] C:\WINDOWS\WINXP32.EXE /s
O4 - HKLM\..\RunServices: [WINFK32.EXE] C:\WINDOWS\SYSTEM\WINFK32.EXE




Step#13:Use About Buster


This is the step where we will use About:Buster that you had downloaded previously.

• Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe
• When the tool is open press the OK button,
• then the Start button, then the OK button, and then finally the Yes button.
• It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.
• Post the log file in your next reply

Step#14:Use Registry File

• Copy the contents of the Quote Box below to Notepad.
• Name the file as fix.reg
• Change the Save as Type to All Files
• and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

• Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

Reboot your computer back to normal mode



Reconnect To The Internet




Step#15:Use HijackThis and Post To Thread In Forum

1. Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.

2. Post your logs from About Buster, DllCompare and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

Hope for the best that this is the last round of this part of the cleanup.


E

Hey El, Here are the logs! Logfile of HijackThis v1.99.1 Scan saved at 4:33:44 PM, on 8/5/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\APIUT.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [APIUT.EXE] C:\WINDOWS\APIUT.EXE /s O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 20,762 items found: 20,762 files, 0 directories. Total of file sizes: 150,346,542 bytes 143.38 M ——————–End log——————— AboutBuster 5.0 reference file 28 Scan started on [8/5/2005] at [12:40:25 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tashv.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat Removed File! : C:\Windows\pttrp.dll Removed File! : C:\Windows\dtkuz.dll Removed File! : C:\Windows\qoqsq.dll Removed File! : C:\Windows\akqmi.dll ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:11:46 AM AboutBuster 5.0 reference file 28 Scan started on [8/5/2005] at [3:40:03 PM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— No Files Found! ———————————————— Scan was COMPLETED SUCCESSFULLY at 4:09:19 PM Looks like we are getting closer! kmount

Hey E…. Here's the log: Logfile of HijackThis v1.99.1 Scan saved at 11:07:13 PM, on 8/5/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\APIUT.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKLM\..\RunServices: [APIUT.EXE] C:\WINDOWS\APIUT.EXE /s O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 All seven files listed were present (step #1)… TREND MICRO found over 100 CWS files…. Just let me know what's next…. I will be back SUNDAY late afternoon….. Thanks! kmount

(Thanks Wng, I didn't notice your post until afterwards, but after a momemt of being puzzled, I figured that must be what E meant….) Hey E……Here are the posts…..I am not using this laptop except in safe mode while fixing this problem….I am using our upstairs computer instead…. Who knows what kind of horrible viruses it has though…. * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 20,710 items found: 20,710 files, 0 directories. Total of file sizes: 146,929,835 bytes 140.12 M ——————–End log——————— AboutBuster 5.0 reference file 28 Scan started on [8/4/2005] at [12:17:50 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— No Files Found! ———————————————— Scan was ABORTED at 12:19:34 AM AboutBuster 5.0 reference file 28 Scan started on [8/4/2005] at [12:20:49 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tnboxk.dat Removed File! : C:\Windows\mkdse.dat Removed File! : C:\Windows\mwchtb.dat Removed File! : C:\Windows\gakjm.dat Removed File! : C:\Windows\dwdvn.dat Removed File! : C:\Windows\eaxuju.dat Removed File! : C:\Windows\xcfxb.dat Removed File! : C:\Windows\hhppf.dat Removed File! : C:\Windows\beysg.dat Removed File! : C:\Windows\jrwyaj.dat Removed File! : C:\Windows\kemunj.dat Removed File! : C:\Windows\vfdpe.dat Removed File! : C:\Windows\doqym.dat Removed File! : C:\Windows\dbtfxb.dat Removed File! : C:\Windows\abjiek.dat Removed File! : C:\Windows\aletp.dat Removed File! : C:\Windows\tzetip.dat Removed File! : C:\Windows\iwofs.dat Removed File! : C:\Windows\xexzch.dat Removed File! : C:\Windows\oiscbx.dat Removed File! : C:\Windows\hugwp.dat Removed File! : C:\Windows\nilsu.dll Removed File! : C:\Windows\lveafh.dat Removed File! : C:\Windows\gonhfn.dat Removed File! : C:\Windows\kzdqr.dll Removed File! : C:\Windows\gghje.dll Removed File! : C:\Windows\odkeg.dll Removed File! : C:\Windows\fvcozi.dat Removed File! : C:\Windows\qcrvd.dll Removed File! : C:\Windows\yzljo.dll Removed File! : C:\Windows\slncq.dll Removed File! : C:\Windows\muygi.dll Removed File! : C:\Windows\vqccr.dat Removed File! : C:\Windows\qxnhvv.dat Removed File! : C:\Windows\sfekiu.dat Removed File! : C:\Windows\dhhvfh.dat Removed File! : C:\Windows\hczss.dll Removed File! : C:\Windows\emney.dll Removed File! : C:\Windows\myvmj.dll Removed File! : C:\Windows\rgeca.dll Removed File! : C:\Windows\njols.dll Removed File! : C:\Windows\vmkyve.dat Removed File! : C:\Windows\nncdxp.dat Removed File! : C:\Windows\klbcip.dat Removed File! : C:\Windows\awqdc.dll Removed File! : C:\Windows\rvvlvx.dat Removed File! : C:\Windows\cwiae.dll Removed File! : C:\Windows\ailhd.dll Removed File! : C:\Windows\lumeie.dat Removed File! : C:\Windows\esybti.dat Removed File! : C:\Windows\tbyiu.dat Removed File! : C:\Windows\wecar.dat Removed File! : C:\Windows\xslhw.dll Removed File! : C:\Windows\vnbve.dll Removed File! : C:\Windows\vayjq.dll Removed File! : C:\Windows\aaqac.dll Removed File! : C:\Windows\nhmzp.dll Removed File! : C:\Windows\tvejp.dll Removed File! : C:\Windows\qidrfj.dat Removed File! : C:\Windows\ofoxtu.dat Removed File! : C:\Windows\rnzis.dll Removed File! : C:\Windows\ratqz.dll Removed File! : C:\Windows\fgeoc.dll Removed File! : C:\Windows\qyfdx.dll Removed File! : C:\Windows\suopg.dll Removed File! : C:\Windows\qovhbp.dat Removed File! : C:\Windows\lckbe.dll Removed File! : C:\Windows\owbbc.dll Removed File! : C:\Windows\ltjdc.dat Removed File! : C:\Windows\aetwso.dat Removed File! : C:\Windows\hrsra.dll Removed File! : C:\Windows\odcml.dll Removed File! : C:\Windows\mamdk.dll Removed File! : C:\Windows\hkcll.dll Removed File! : C:\Windows\osxpy.dll Removed File! : C:\Windows\dffpe.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:08:51 AM AboutBuster 5.0 reference file 28 Scan started on [8/5/2005] at [12:40:25 AM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— Removed File! : C:\Windows\tashv.dll Removed File! : C:\Windows\pnsrza.dat Removed File! : C:\Windows\hflxbk.dat Removed File! : C:\Windows\pttrp.dll Removed File! : C:\Windows\dtkuz.dll Removed File! : C:\Windows\qoqsq.dll Removed File! : C:\Windows\akqmi.dll ———————————————— Scan was COMPLETED SUCCESSFULLY at 1:11:46 AM AboutBuster 5.0 reference file 28 Scan started on [8/5/2005] at [3:40:03 PM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— No Files Found! ———————————————— Scan was COMPLETED SUCCESSFULLY at 4:09:19 PM AboutBuster 5.0 reference file 28 Scan started on [8/7/2005] at [10:38:13 PM] ———————————————— Streams(ADS) not scanned: System not NTFS ———————————————— No Files Found! ———————————————— Scan was COMPLETED SUCCESSFULLY at 11:07:49 PM Logfile of HijackThis v1.99.1 Scan saved at 10:11:42 AM, on 8/8/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE C:\HIJACKTHIS.EXE O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [IrMon] irmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54CFG.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3 Thanks E!