What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Having Major Problems with my Work PC

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I think I have something seriously wrong with my pc. This is my work pc, and it used on the weekends by my boss's kids. It seems they've really messed it up this time. I've got tons of popups, especially WinFixer. I keep having aol aim windows popup with links to download files, Etc. Here is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 9:32:40 AM, on 9/26/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\lockx.exe
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM\aim.exe
C:\HijackThis\HijackThis.exe

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Keith\Application Data\Mozilla\Profiles\default\t33hxyjs.slt\prefs.js)
O1 - Hosts: comments (such as these) may be inserted on individual
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\java\dvdtcp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\l4pdsk.exe reg_run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [stratas] lockx.exe
O4 - HKLM\..\Run: [SECRETSERVICE] C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
O4 - HKLM\..\RunServices: [stratas] lockx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [stratas] lockx.exe
O4 - Startup: Reboot.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc…bridge-c420.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120406660687
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: dvdtcp - C:\WINDOWS\java\dvdtcp.dll
O20 - Winlogon Notify: javainet - C:\WINDOWS\msagent\javainet.dll
O20 - Winlogon Notify: msvckey - C:\WINDOWS\Fonts\msvckey.dll
O20 - Winlogon Notify: tcpdrv - C:\WINDOWS\system\tcpdrv.dll
O20 - Winlogon Notify: utilacc - C:\WINDOWS\system\utilacc.dll
O20 - Winlogon Notify: vgautil - C:\WINDOWS\repair\vgautil.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SSH Sentinel (SSHIPM) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe" -d (file missing)
O23 - Service: SSH Sentinel Monitor (SSHMONITOR) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Tomcat 5.0.25\bin\tomcat5.exe" //RS//Tomcat5 (file missing)

Please Help!
Post #2
Greetings and welcome to TomCoyote.org!

These entries:

O4 - HKLM\..\Run: [stratas] lockx.exe

Are indications of this virus:

W32/Sdbot-ADD

Download Killbox from here:

Killbox.zip

Unzip it, but don't run it yet.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

C:\WINDOWS\system32\lockx.exe
C:\WINDOWS\system32\msdirectx.sys


CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O1 - Hosts: comments (such as these) may be inserted on individual

O4 - HKLM\..\Run: [stratas] lockx.exe

O4 - HKLM\..\RunServices: [stratas] lockx.exe

O4 - HKCU\..\Run: [stratas] lockx.exe

Then click "Fix checked".

Run Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread. :)

Then we'll work on Winfixer, and lastly the Qoologic trojan you have acquired.
:)
Post #3
Thanks For the help.

When I tried to delete the file with killbox it said it was unable to delete the file. But I don't see it in my log anymore:

Logfile of HijackThis v1.99.1
Scan saved at 1:29:14 PM, on 9/26/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Keith\Application Data\Mozilla\Profiles\default\t33hxyjs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\java\dvdtcp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\l4pdsk.exe reg_run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SECRETSERVICE] C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Reboot.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc…bridge-c420.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120406660687
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: dvdtcp - C:\WINDOWS\java\dvdtcp.dll
O20 - Winlogon Notify: javainet - C:\WINDOWS\msagent\javainet.dll
O20 - Winlogon Notify: msvckey - C:\WINDOWS\Fonts\msvckey.dll
O20 - Winlogon Notify: tcpdrv - C:\WINDOWS\system\tcpdrv.dll
O20 - Winlogon Notify: utilacc - C:\WINDOWS\system\utilacc.dll
O20 - Winlogon Notify: vgautil - C:\WINDOWS\repair\vgautil.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SSH Sentinel (SSHIPM) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe" -d (file missing)
O23 - Service: SSH Sentinel Monitor (SSHMONITOR) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Tomcat 5.0.25\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
Post #4
Run Hijack This!

Click the "Open the Misc Tools section" button.

Click the "Open process manager" button.

Check the "Show DLLs" box (upper right).

Click on each item in the upper window, then look in the lower window.

Check to see which processes are using these DLL's:

C:\WINDOWS\java\dvdtcp.dll
C:\WINDOWS\msagent\javainet.dll
C:\WINDOWS\Fonts\msvckey.dll
C:\WINDOWS\system\tcpdrv.dll
C:\WINDOWS\system\utilacc.dll
C:\WINDOWS\repair\vgautil.dll


Post back letting me know all processes using those DLL's.

Copy the text in the following quote box into Notepad:

dir C:\WINDOWS\java\ /ah > files.txt
dir C:\WINDOWS\java\ >> files.txt
dir C:\WINDOWS\msagent\ /ah >> files.txt
dir C:\WINDOWS\msagent\ >> files.txt
dir C:\WINDOWS\Fonts\ /ah >> files.txt
dir C:\WINDOWS\Fonts\ >> files.txt
dir C:\WINDOWS\system\ /ah >> files.txt
dir C:\WINDOWS\system\ >> files.txt
dir C:\WINDOWS\repair\ /ah >> files.txt
dir C:\WINDOWS\repair\ >> files.txt
notepad files.txt

Save it to your desktop as ff.bat.

Close Notepad.

Now, the ff.bat file on the desktop.

Wait for a Notepad window to open up.

Please paste it's contents into your next post.
:)
Post #5
C:\WINDOWS\system32\winlogon.exe

>C:\WINDOWS\java\dvdtcp.dll
>C:\WINDOWS\msagent\javainet.dll
>C:\WINDOWS\Fonts\msvckey.dll
>C:\WINDOWS\system\tcpdrv.dll
>C:\WINDOWS\system\utilacc.dll
>C:\WINDOWS\repair\vgautil.dll


C:\WINDOWS\Explorer.EXE

>C:\WINDOWS\java\dvdtcp.dll

Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\java

08/26/2005 04:30 PM 516,116 dvdtcp.dll
09/14/2005 11:32 AM 524,353 pctdvd.bak1
09/26/2005 01:28 PM 422,641 pctdvd.bak2
08/26/2005 10:42 PM 180,017 pctdvd.ini
09/26/2005 02:40 PM 424,971 pctdvd.ini2
08/26/2005 07:23 PM 180,017 pctdvd.tmp
6 File(s) 2,248,115 bytes
0 Dir(s) 69,312,765,952 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\java

09/26/2005 02:40 PM .
09/26/2005 02:40 PM ..
06/06/2005 11:27 AM classes
09/22/2005 08:51 PM 0 mcrh.tmp
08/28/2003 10:09 AM trustlib
1 File(s) 0 bytes
4 Dir(s) 69,312,761,856 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\msagent

09/08/2005 09:03 AM 516,116 javainet.dll
09/08/2005 09:03 AM 303 teniavaj.ini
2 File(s) 516,419 bytes
0 Dir(s) 69,312,761,856 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\msagent

09/08/2005 09:03 AM .
09/08/2005 09:03 AM ..
08/23/2001 08:00 AM 22,016 agentanm.dll
08/23/2001 08:00 AM 204,288 agentctl.dll
08/23/2001 08:00 AM 35,840 agentdp2.dll
08/23/2001 08:00 AM 50,688 agentdpv.dll
08/23/2001 08:00 AM 44,032 agentmpx.dll
08/23/2001 08:00 AM 21,504 agentpsh.dll
08/23/2001 08:00 AM 39,936 agentsr.dll
08/23/2001 08:00 AM 235,008 agentsvr.exe
08/23/2001 08:00 AM 17,920 agtctl15.tlb
08/23/2001 08:00 AM 21,504 agtintl.dll
12/09/2004 02:35 PM chars
08/28/2003 10:19 AM intl
08/23/2001 08:00 AM 36,352 mslwvtts.dll
11 File(s) 729,088 bytes
4 Dir(s) 69,312,761,856 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\Fonts

08/23/2001 08:00 AM 10,976 8514fix.fon
08/23/2001 08:00 AM 10,976 8514fixe.fon
08/23/2001 08:00 AM 11,520 8514fixg.fon
08/23/2001 08:00 AM 10,976 8514fixr.fon
08/23/2001 08:00 AM 11,488 8514fixt.fon
08/23/2001 08:00 AM 12,288 8514oem.fon
08/23/2001 08:00 AM 13,248 8514oeme.fon
08/23/2001 08:00 AM 12,800 8514oemg.fon
08/23/2001 08:00 AM 13,200 8514oemr.fon
08/23/2001 08:00 AM 12,720 8514oemt.fon
08/23/2001 08:00 AM 9,280 8514sys.fon
08/23/2001 08:00 AM 9,504 8514syse.fon
08/23/2001 08:00 AM 9,856 8514sysg.fon
08/23/2001 08:00 AM 10,064 8514sysr.fon
08/23/2001 08:00 AM 9,792 8514syst.fon
08/23/2001 08:00 AM 12,304 85775.fon
08/23/2001 08:00 AM 12,256 85855.fon
08/23/2001 08:00 AM 10,976 85f1257.fon
08/23/2001 08:00 AM 9,472 85s1257.fon
08/23/2001 08:00 AM 35,808 app775.fon
08/23/2001 08:00 AM 36,672 app850.fon
08/23/2001 08:00 AM 36,656 app852.fon
08/23/2001 08:00 AM 37,296 app855.fon
08/23/2001 08:00 AM 36,672 app857.fon
08/23/2001 08:00 AM 37,472 app866.fon
11/18/2004 03:05 PM 6,315 cbdoniw.bak1
11/18/2004 05:59 PM 8,924 cbdoniw.ini
08/23/2001 08:00 AM 7,216 cga40737.fon
08/23/2001 08:00 AM 6,352 cga40850.fon
08/23/2001 08:00 AM 6,672 cga40852.fon
08/23/2001 08:00 AM 6,672 cga40857.fon
08/23/2001 08:00 AM 7,232 cga40866.fon
08/23/2001 08:00 AM 7,216 cga40869.fon
08/23/2001 08:00 AM 6,336 cga40woa.fon
08/23/2001 08:00 AM 5,168 cga80737.fon
08/23/2001 08:00 AM 4,320 cga80850.fon
08/23/2001 08:00 AM 5,200 cga80852.fon
08/23/2001 08:00 AM 4,640 cga80857.fon
08/23/2001 08:00 AM 5,168 cga80866.fon
08/23/2001 08:00 AM 5,168 cga80869.fon
08/23/2001 08:00 AM 4,304 cga80woa.fon
08/23/2001 08:00 AM 23,440 coue1257.fon
08/23/2001 08:00 AM 31,760 couf1257.fon
08/23/2001 08:00 AM 23,408 coure.fon
08/23/2001 08:00 AM 23,440 couree.fon
08/23/2001 08:00 AM 25,024 coureg.fon
08/23/2001 08:00 AM 23,440 courer.fon
08/23/2001 08:00 AM 25,024 couret.fon
08/23/2001 08:00 AM 31,712 courf.fon
08/23/2001 08:00 AM 31,776 courfe.fon
08/23/2001 08:00 AM 33,344 courfg.fon
08/23/2001 08:00 AM 31,808 courfr.fon
08/23/2001 08:00 AM 33,360 courft.fon
08/28/2003 05:29 PM 67 desktop.ini
08/23/2001 08:00 AM 36,336 dos737.fon
08/23/2001 08:00 AM 36,656 dosapp.fon
08/23/2001 08:00 AM 9,248 ega40737.fon
08/23/2001 08:00 AM 8,384 ega40850.fon
08/23/2001 08:00 AM 8,368 ega40852.fon
08/23/2001 08:00 AM 8,704 ega40857.fon
08/23/2001 08:00 AM 9,232 ega40866.fon
08/23/2001 08:00 AM 9,248 ega40869.fon
08/23/2001 08:00 AM 8,368 ega40woa.fon
08/23/2001 08:00 AM 6,192 ega80737.fon
08/23/2001 08:00 AM 5,328 ega80850.fon
08/23/2001 08:00 AM 5,344 ega80852.fon
08/23/2001 08:00 AM 5,648 ega80857.fon
08/23/2001 08:00 AM 5,280 ega80866.fon
08/23/2001 08:00 AM 6,192 ega80869.fon
08/23/2001 08:00 AM 5,312 ega80woa.fon
08/23/2001 08:00 AM 24,124 marlett.ttf
08/30/2005 03:53 PM 516,116 msvckey.dll
08/23/2001 08:00 AM 59,024 sere1257.fon
08/23/2001 08:00 AM 84,080 serf1257.fon
08/23/2001 08:00 AM 57,936 serife.fon
08/23/2001 08:00 AM 59,952 serifee.fon
08/23/2001 08:00 AM 60,752 serifeg.fon
08/23/2001 08:00 AM 63,296 serifer.fon
08/23/2001 08:00 AM 61,024 serifet.fon
08/23/2001 08:00 AM 81,728 seriff.fon
08/23/2001 08:00 AM 85,360 seriffe.fon
08/23/2001 08:00 AM 86,256 seriffg.fon
08/23/2001 08:00 AM 90,736 seriffr.fon
08/23/2001 08:00 AM 84,848 serifft.fon
08/23/2001 08:00 AM 24,672 smae1257.fon
08/23/2001 08:00 AM 19,904 smaf1257.fon
08/23/2001 08:00 AM 26,112 smalle.fon
08/23/2001 08:00 AM 24,784 smallee.fon
08/23/2001 08:00 AM 28,912 smalleg.fon
08/23/2001 08:00 AM 24,832 smaller.fon
08/23/2001 08:00 AM 29,200 smallet.fon
08/23/2001 08:00 AM 21,504 smallf.fon
08/23/2001 08:00 AM 19,600 smallfe.fon
08/23/2001 08:00 AM 23,120 smallfg.fon
08/23/2001 08:00 AM 19,760 smallfr.fon
08/23/2001 08:00 AM 23,008 smallft.fon
08/23/2001 08:00 AM 65,456 ssee1257.fon
08/23/2001 08:00 AM 90,336 ssef1257.fon
08/23/2001 08:00 AM 64,656 sserife.fon
08/23/2001 08:00 AM 66,464 sserifee.fon
08/23/2001 08:00 AM 65,328 sserifeg.fon
08/23/2001 08:00 AM 68,848 sserifer.fon
08/23/2001 08:00 AM 64,400 sserifet.fon
08/23/2001 08:00 AM 89,856 sseriff.fon
08/23/2001 08:00 AM 92,032 sseriffe.fon
08/23/2001 08:00 AM 90,288 sseriffg.fon
08/23/2001 08:00 AM 98,256 sseriffr.fon
08/23/2001 08:00 AM 89,456 sserifft.fon
08/23/2001 08:00 AM 56,336 symbole.fon
08/23/2001 08:00 AM 5,168 vga737.fon
08/23/2001 08:00 AM 5,168 vga775.fon
08/23/2001 08:00 AM 5,232 vga850.fon
08/23/2001 08:00 AM 6,160 vga852.fon
08/23/2001 08:00 AM 5,120 vga855.fon
08/23/2001 08:00 AM 5,552 vga857.fon
08/23/2001 08:00 AM 5,184 vga860.fon
08/23/2001 08:00 AM 5,200 vga863.fon
08/23/2001 08:00 AM 5,184 vga865.fon
08/23/2001 08:00 AM 6,128 vga866.fon
08/23/2001 08:00 AM 5,184 vga869.fon
08/23/2001 08:00 AM 5,376 vgaf1257.fon
08/23/2001 08:00 AM 5,360 vgafix.fon
08/23/2001 08:00 AM 5,376 vgafixe.fon
08/23/2001 08:00 AM 6,112 vgafixg.fon
08/23/2001 08:00 AM 5,600 vgafixr.fon
08/23/2001 08:00 AM 6,112 vgafixt.fon
08/23/2001 08:00 AM 5,168 vgaoem.fon
08/23/2001 08:00 AM 6,656 vgas1257.fon
08/23/2001 08:00 AM 7,280 vgasys.fon
08/23/2001 08:00 AM 6,608 vgasyse.fon
08/23/2001 08:00 AM 7,008 vgasysg.fon
08/23/2001 08:00 AM 6,912 vgasysr.fon
08/23/2001 08:00 AM 6,912 vgasyst.fon
08/30/2005 03:53 PM 303 yekcvsm.ini
134 File(s) 3,885,033 bytes
0 Dir(s) 69,312,749,568 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\Fonts

08/25/2005 10:08 PM 61,212 ABAEXBC.TTF
11/19/2002 10:43 AM 60,656 AGENCYB.TTF
11/19/2002 10:43 AM 58,920 AGENCYR.TTF
10/29/1999 12:42 PM 75,272 ALGER.TTF
11/12/1998 08:18 AM 151,000 ANTQUAB.TTF
11/12/1998 08:18 AM 150,416 ANTQUABI.TTF
11/12/1998 08:18 AM 149,092 ANTQUAI.TTF
08/23/2001 08:00 AM 296,712 arial.ttf
09/26/1997 08:36 PM 144,404 Arialb.ttf
08/23/2001 08:00 AM 288,496 arialbd.ttf
08/23/2001 08:00 AM 226,748 arialbi.ttf
08/23/2001 08:00 AM 207,808 ariali.ttf
11/12/1998 02:39 PM 134,200 arialn.ttf
11/12/1998 02:39 PM 139,128 arialnb.ttf
11/12/1998 02:39 PM 138,568 arialnbi.ttf
11/12/1998 02:39 PM 141,408 arialni.ttf
11/18/2002 05:44 PM 23,275,812 ARIALUNI.TTF
09/26/1997 08:36 PM 164,396 Arialz.ttf
08/23/2001 08:00 AM 117,028 ariblk.ttf
08/18/1999 12:13 PM 45,260 ARLRDBD.TTF
11/01/2004 03:33 PM 36,645 avenida.TTF
08/18/1999 12:13 PM 54,976 BASKVILL.TTF
08/18/1999 12:13 PM 46,176 BAUHS93.TTF
06/30/1997 03:00 AM 36,020 Beesknee.ttf
08/18/1999 12:13 PM 84,840 BELL.TTF
08/18/1999 12:13 PM 82,580 BELLB.TTF
08/18/1999 12:13 PM 82,192 BELLI.TTF
08/18/1999 12:13 PM 70,656 BERNHC.TTF
11/12/1998 08:18 AM 155,528 BKANT.TTF
11/27/2002 02:42 PM 74,440 BOD_B.TTF
11/27/2002 02:42 PM 85,308 BOD_BI.TTF
11/27/2002 02:42 PM 83,816 BOD_BLAI.TTF
11/27/2002 02:42 PM 73,616 BOD_BLAR.TTF
11/27/2002 02:42 PM 74,092 BOD_CB.TTF
11/27/2002 02:42 PM 81,072 BOD_CBI.TTF
11/27/2002 02:42 PM 80,536 BOD_CI.TTF
11/27/2002 02:42 PM 80,580 BOD_CR.TTF
11/27/2002 02:42 PM 89,940 BOD_I.TTF
11/27/2002 02:42 PM 91,592 BOD_PSTC.TTF
11/27/2002 02:42 PM 77,884 BOD_R.TTF
11/04/1998 05:30 PM 160,940 BOOKOS.TTF
11/04/1998 05:30 PM 154,576 BOOKOSB.TTF
11/04/1998 05:30 PM 162,460 BOOKOSBI.TTF
08/18/1999 01:53 PM 161,020 BOOKOSI.TTF
10/15/1999 09:55 AM 105,296 BRADHITC.TTF
08/18/1999 12:13 PM 40,728 BRITANIC.TTF
07/14/1998 01:41 PM 96,880 BRLNSB.TTF
07/14/1998 01:41 PM 96,852 BRLNSDB.TTF
07/14/1998 01:41 PM 97,284 BRLNSR.TTF
05/03/2002 04:04 PM 60,372 BROADW.TTF
08/18/1999 12:13 PM 53,456 BRUSHSCI.TTF
07/11/1997 03:00 AM 63,448 bssym1.ttf
07/11/1997 03:00 AM 35,800 bssym2.ttf
07/11/1997 03:00 AM 25,252 bssym3.ttf
12/12/2003 03:42 PM 54,412 BSSYM7.TTF
07/14/1998 01:42 PM 80,620 CALIFB.TTF
07/14/1998 01:42 PM 98,748 CALIFI.TTF
07/14/1998 01:42 PM 105,300 CALIFR.TTF
04/02/1999 03:31 PM 80,148 CALIST.TTF
04/02/1999 03:32 PM 85,080 CALISTB.TTF
04/02/1999 03:32 PM 84,960 CALISTBI.TTF
04/02/1999 03:32 PM 59,372 CALISTI.TTF
10/15/1999 09:55 AM 48,252 CASTELAR.TTF
03/17/1999 03:07 PM 162,380 CENSCBK.TTF
10/15/1999 09:55 AM 82,760 CENTAUR.TTF
11/12/2002 10:26 AM 165,248 CENTURY.TTF
10/15/1999 09:55 AM 96,452 CHILLER.TTF
08/18/1999 12:13 PM 54,952 COLONNA.TTF
08/23/2001 08:00 AM 126,364 comic.ttf
08/23/2001 08:00 AM 111,476 comicbd.ttf
08/18/1999 12:13 PM 80,388 COOPBL.TTF
08/18/1999 12:13 PM 61,552 COPRGTB.TTF
08/18/1999 12:13 PM 62,716 COPRGTL.TTF
08/23/2001 08:00 AM 303,296 cour.ttf
09/26/1997 08:36 PM 174,596 Courb.ttf
08/23/2001 08:00 AM 312,920 courbd.ttf
08/23/2001 08:00 AM 236,148 courbi.ttf
08/23/2001 08:00 AM 245,032 couri.ttf
09/26/1997 08:36 PM 180,160 Courz.ttf
02/02/2000 05:28 PM 69,480 CURLZ___.TTF
06/24/1999 11:40 AM 51,652 ELEPHNT.TTF
06/24/1999 11:40 AM 54,324 ELEPHNTI.TTF
06/25/1999 12:23 PM 49,768 ENGR.TTF
03/17/1999 03:07 PM 57,508 ERASBD.TTF
03/17/1999 03:07 PM 59,996 ERASDEMI.TTF
03/17/1999 03:07 PM 68,656 ERASLGHT.TTF
03/17/1999 03:07 PM 60,772 ERASMD.TTF
06/30/1997 03:00 AM 54,424 ERASULT.TTF
08/23/2001 08:00 AM 79,744 estre.ttf
04/23/1999 04:22 PM 45,952 FELIXTI.TTF
09/22/2003 05:51 PM 54,712 font114.ttf
09/22/2003 05:58 PM 42,892 font129.ttf
09/22/2003 05:55 PM 34,392 font134.ttf
09/22/2003 06:22 PM 61,580 font166.ttf
09/22/2003 06:17 PM 33,988 font179.ttf
09/22/2003 06:29 PM 35,960 font184.ttf
09/23/2003 11:55 AM 41,648 font231.ttf
09/23/2003 12:15 PM 122,460 font276.ttf
09/23/2003 12:54 PM 133,500 font353.ttf
09/23/2003 01:16 PM 81,448 font414.ttf
09/22/2003 05:39 PM 52,396 font78.ttf
11/21/2002 05:17 PM 61,776 FORTE.TTF
01/10/2001 02:32 PM 152,700 FRABK.TTF
01/10/2001 02:32 PM 169,620 FRABKIT.TTF
04/23/1999 04:22 PM 142,932 FRADM.TTF
04/23/1999 04:22 PM 116,940 FRADMCN.TTF
04/23/1999 04:22 PM 135,904 FRADMIT.TTF
04/23/1999 04:22 PM 139,400 FRAHV.TTF
04/23/1999 04:22 PM 152,700 FRAHVIT.TTF
08/23/2001 08:00 AM 135,984 framd.ttf
05/05/1999 08:02 PM 132,516 FRAMDCN.TTF
08/23/2001 08:00 AM 152,844 framdit.ttf
11/26/2001 12:43 PM 15,296 FreeHandXSym.FON
10/15/1999 09:55 AM 69,876 FREESCPT.TTF
04/23/1999 04:22 PM 58,580 FRSCRIPT.TTF
01/02/2003 03:08 PM 61,480 ft.ttf
01/02/2003 03:09 PM 31,900 ft1.ttf
01/02/2003 03:10 PM 33,688 ft10.ttf
01/02/2003 03:10 PM 29,860 ft11.ttf
01/02/2003 03:12 PM 26,980 ft12.ttf
01/02/2003 03:13 PM 27,080 ft13.ttf
01/02/2003 03:14 PM 35,804 ft14.ttf
01/02/2003 03:15 PM 24,404 ft15.ttf
01/02/2003 03:16 PM 19,156 ft16.ttf
01/02/2003 03:18 PM 26,684 ft17i.ttf
01/02/2003 03:17 PM 24,012 ft17n.ttf
01/02/2003 03:19 PM 110,084 ft18.ttf
01/02/2003 03:21 PM 65,212 ft19.ttf
01/02/2003 03:22 PM 66,684 ft2.ttf
01/02/2003 03:23 PM 36,432 ft20.ttf
01/02/2003 03:24 PM 49,492 ft21.ttf
01/02/2003 03:26 PM 40,988 ft22.ttf
01/02/2003 03:27 PM 174,516 ft23.ttf
01/02/2003 03:28 PM 64,128 ft24.ttf
01/02/2003 03:29 PM 37,084 ft25.ttf
01/02/2003 03:30 PM 38,700 ft26.ttf
01/02/2003 03:32 PM 91,508 ft27.ttf
01/02/2003 03:33 PM 30,704 ft28.ttf
01/02/2003 03:34 PM 85,876 ft29.ttf
01/02/2003 03:38 PM 84,400 ft3.ttf
01/02/2003 03:40 PM 60,864 ft30.ttf
01/02/2003 03:42 PM 43,308 ft31.ttf
01/02/2003 03:44 PM 42,404 ft32.ttf
01/02/2003 03:44 PM 37,688 ft33.ttf
01/02/2003 03:46 PM 194,560 ft34.ttf
01/02/2003 03:47 PM 37,328 ft35.ttf
01/02/2003 03:48 PM 53,464 ft36.ttf
01/02/2003 03:49 PM 66,932 ft37.ttf
01/02/2003 03:50 PM 89,060 ft38.ttf
01/02/2003 03:51 PM 70,884 ft39.ttf
01/02/2003 03:52 PM 77,888 ft4.ttf
01/02/2003 03:54 PM 54,336 ft40.ttf
01/02/2003 04:52 PM 47,132 ft41.ttf
01/02/2003 04:53 PM 34,612 ft42.ttf
01/02/2003 04:54 PM 83,868 ft43b.ttf
07/06/1995 09:41 PM 76,652 ft43i.ttf
01/02/2003 04:57 PM 86,268 ft43n.ttf
01/02/2003 04:58 PM 39,724 ft44.ttf
01/02/2003 04:59 PM 54,468 ft45.ttf
01/02/2003 05:01 PM 59,996 ft46.ttf
01/02/2003 05:02 PM 47,036 ft47.ttf
01/02/2003 05:02 PM 53,436 ft48.ttf
01/02/2003 05:07 PM 41,160 ft49.ttf
01/02/2003 05:08 PM 38,752 ft50.ttf
01/02/2003 05:09 PM 69,984 ft51.ttf
01/02/2003 05:11 PM 41,620 ft52.ttf
01/02/2003 05:12 PM 140,048 ft53.ttf
01/02/2003 05:13 PM 55,476 ft54.ttf
01/02/2003 05:15 PM 46,248 ft55.ttf
01/02/2003 05:16 PM 71,076 ft56.ttf
01/02/2003 05:18 PM 53,600 ft57.ttf
01/02/2003 05:19 PM 44,380 ft58.ttf
01/02/2003 05:20 PM 43,416 ft59.ttf
01/02/2003 04:21 PM 41,016 ft5b.ttf
01/02/2003 03:57 PM 42,228 ft5i.ttf
01/02/2003 03:57 PM 41,352 ft5n.ttf
01/02/2003 05:20 PM 47,336 ft60.ttf
01/02/2003 05:21 PM 67,992 ft61.ttf
01/02/2003 05:23 PM 62,068 ft62.ttf
01/02/2003 05:24 PM 51,712 ft63.ttf
01/02/2003 05:25 PM 67,400 ft64.ttf
01/02/2003 05:29 PM 55,192 ft65.ttf
01/02/2003 05:32 PM 69,864 ft66.ttf
01/02/2003 05:33 PM 43,528 ft67.ttf
01/02/2003 05:34 PM 43,440 ft68.ttf
01/02/2003 05:37 PM 128,656 ft69.ttf
01/02/2003 03:58 PM 51,396 ft7.ttf
01/02/2003 06:23 PM 256,856 ft71.ttf
01/02/2003 06:23 PM 41,064 ft72.ttf
01/02/2003 06:33 PM 41,280 ft73.ttf
01/02/2003 06:34 PM 69,936 ft74.ttf
01/02/2003 06:35 PM 19,156 ft75.ttf
01/02/2003 06:36 PM 76,948 ft76.ttf
01/02/2003 06:36 PM 56,612 ft77.ttf
01/02/2003 06:38 PM 126,140 ft78.ttf
01/02/2003 06:38 PM 70,816 ft79.ttf
01/02/2003 06:39 PM 74,556 ft80.ttf
01/02/2003 06:40 PM 41,704 ft81.ttf
01/02/2003 06:41 PM 105,868 ft82.ttf
01/02/2003 06:42 PM 134,244 ft83.ttf
01/02/2003 06:42 PM 92,912 ft84.ttf
01/02/2003 06:43 PM 57,576 ft85.ttf
01/02/2003 06:44 PM 42,324 ft86.ttf
01/02/2003 06:45 PM 50,488 ft87.ttf
01/03/2003 11:37 AM 48,308 ft88.ttf
01/03/2003 11:38 AM 51,756 ft89.ttf
01/02/2003 04:01 PM 73,700 ft8b.ttf
01/02/2003 04:02 PM 74,416 ft8r.ttf
01/02/2003 04:03 PM 27,104 ft9.ttf
01/03/2003 11:39 AM 105,532 ft90.ttf
01/03/2003 11:40 AM 41,684 ft91.ttf
01/03/2003 11:41 AM 53,568 ft92.ttf
01/03/2003 11:43 AM 48,956 ft93.ttf
01/03/2003 11:53 AM 19,156 ft94.ttf
01/03/2003 11:55 AM 134,264 ft95.ttf
08/18/1999 12:13 PM 83,580 FTLTLT.TTF
01/03/2003 10:45 AM 73,964 fts.ttf
01/03/2003 10:46 AM 50,712 fts1.ttf
01/03/2003 10:59 AM 27,924 fts11.ttf
01/03/2003 11:02 AM 51,068 fts12.ttf
01/03/2003 11:03 AM 144,380 fts13.ttf
01/03/2003 11:26 AM 39,628 fts2.ttf
01/03/2003 11:15 AM 127,168 fts3.ttf
01/03/2003 11:16 AM 50,320 fts4.ttf
01/03/2003 10:57 AM 72,420 fts5.ttf
01/03/2003 11:22 AM 89,248 fts6.ttf
01/03/2003 11:23 AM 39,024 fts7.ttf
01/03/2003 11:23 AM 73,688 fts8.ttf
01/03/2003 11:25 AM 40,216 fts9.ttf
11/10/1998 02:52 PM 196,616 GARA.TTF
11/10/1998 02:52 PM 198,604 GARABD.TTF
11/10/1998 02:52 PM 188,988 GARAIT.TTF
08/23/2001 08:00 AM 214,936 gautami.ttf
08/29/1995 08:53 PM 30,374 GAZRUBPL.TTF
08/23/2001 08:00 AM 149,628 georgia.ttf
08/23/2001 08:00 AM 141,032 georgiab.ttf
08/23/2001 08:00 AM 157,388 georgiai.ttf
08/23/2001 08:00 AM 159,736 georgiaz.ttf
10/15/1999 09:55 AM 142,072 GIGI.TTF
03/17/1999 03:07 PM 71,496 GILBI___.TTF
03/17/1999 03:07 PM 68,304 GILB____.TTF
04/02/1999 03:32 PM 60,320 GILC____.TTF
03/17/1999 03:07 PM 69,436 GILI____.TTF
04/02/1999 03:32 PM 72,408 GILLUBCD.TTF
04/02/1999 03:32 PM 73,136 GILSANUB.TTF
03/17/1999 03:07 PM 67,416 GIL_____.TTF
08/18/1999 12:13 PM 72,676 GLECB.TTF
04/02/1999 03:32 PM 84,668 GLSNECB.TTF
11/12/1998 04:39 PM 137,568 GOTHIC.TTF
11/12/1998 04:39 PM 129,676 GOTHICB.TTF
11/12/1998 04:39 PM 139,084 GOTHICBI.TTF
11/12/1998 04:39 PM 148,520 GOTHICI.TTF
08/18/1999 12:13 PM 81,376 GOUDOS.TTF
08/18/1999 12:13 PM 82,796 GOUDOSB.TTF
08/18/1999 12:13 PM 80,280 GOUDOSI.TTF
05/03/2002 04:05 PM 55,956 GOUDYSTO.TTF
12/20/2002 01:20 AM 8,348 GPro.ttf
10/15/1999 09:55 AM 55,060 HARLOWSI.TTF
08/18/1999 12:14 PM 70,440 HARNGTON.TTF
11/14/1998 03:12 PM 108,664 HATTEN.TTF
01/24/1997 09:47 AM 33,496 HE______.PFB
10/24/2001 09:12 PM 2,742 HE______.PFM
07/14/1998 01:42 PM 92,736 HTOWERT.TTF
07/14/1998 01:42 PM 74,712 HTOWERTI.TTF
10/20/1999 08:10 AM 35,256 HVCB____.PFB
05/13/2003 01:35 PM 2,165 HVCB____.PFM
08/23/2001 08:00 AM 136,076 impact.ttf
08/18/1999 12:14 PM 60,488 IMPRISHA.TTF
10/15/1999 09:55 AM 74,968 INFROMAN.TTF
10/15/1999 09:55 AM 132,372 ITCBLKAD.TTF
10/15/1999 09:55 AM 64,056 ITCEDSCR.TTF
10/15/1999 09:55 AM 59,712 ITCKRIST.TTF
10/15/1999 09:56 AM 69,752 JOKERMAN.TTF
10/15/1999 09:56 AM 62,884 JUICE___.TTF
10/15/1999 09:56 AM 63,392 KUNSTLER.TTF
08/23/2001 08:00 AM 73,292 latha.ttf
08/18/1999 12:14 PM 44,824 LATINWD.TTF
03/06/1996 10:37 AM 58,480 LBLACK.TTF
10/27/1999 10:26 AM 70,748 LBRITE.TTF
10/27/1999 10:26 AM 66,724 LBRITED.TTF
10/27/1999 10:26 AM 71,456 LBRITEDI.TTF
10/27/1999 10:26 AM 71,000 LBRITEI.TTF
10/27/1999 03:34 PM 55,464 LCALLIG.TTF
10/27/1999 10:26 AM 61,912 LFAX.TTF
10/27/1999 10:26 AM 62,100 LFAXD.TTF
10/27/1999 10:26 AM 71,472 LFAXDI.TTF
10/27/1999 10:26 AM 67,420 LFAXI.TTF
10/27/1999 03:34 PM 62,484 LHANDW.TTF
11/15/1999 11:09 AM 64,608 LSANS.TTF
11/15/1999 11:09 AM 59,976 LSANSD.TTF
11/15/1999 11:09 AM 66,320 LSANSDI.TTF
11/15/1999 11:09 AM 65,412 LSANSI.TTF
11/18/1999 10:29 AM 55,984 LTYPE.TTF
11/18/1999 10:29 AM 52,868 LTYPEB.TTF
11/18/1999 10:29 AM 54,620 LTYPEBO.TTF
11/18/1999 10:29 AM 65,412 LTYPEO.TTF
08/23/2001 08:00 AM 115,068 lucon.ttf
08/23/2001 08:00 AM 323,980 l_10646.ttf
07/14/1998 01:42 PM 65,284 MAGNETOB.TTF
06/24/1999 07:53 AM 61,384 MAIAN.TTF
08/23/2001 08:00 AM 143,864 mangal.ttf
06/30/1997 03:00 AM 55,240 matisse_.ttf
08/18/1999 12:14 PM 51,296 MATURASC.TTF
06/02/2004 03:53 PM 65,344 MGBLACK.TTF
06/02/2004 03:54 PM 69,136 MGBOLD.TTF
08/25/2005 10:08 PM 54,272 MICROSBE.TTF
08/23/2001 08:00 AM 305,724 micross.ttf
08/18/1999 12:14 PM 191,716 MISTRAL.TTF
08/18/1999 12:14 PM 62,612 MOD20.TTF
08/23/2001 08:00 AM 8,704 modern.fon
11/10/1998 02:52 PM 157,360 MTCORSVA.TTF
07/11/1997 03:00 AM 7,656 mtextra.ttf
08/23/2001 08:00 AM 40,500 mvboli.ttf
07/14/1998 01:42 PM 95,904 NIAGENG.TTF
07/14/1998 01:42 PM 74,012 NIAGSOL.TTF
06/24/1999 09:33 AM 55,400 OCRAEXT.TTF
10/15/1999 09:56 AM 93,068 OLDENGL.TTF
08/18/1999 12:14 PM 81,044 ONYX.TTF
04/08/2003 01:41 PM 17,672 OUTLOOK.TTF
08/23/2001 08:00 AM 489,884 pala.ttf
08/23/2001 08:00 AM 434,004 palab.ttf
08/23/2001 08:00 AM 344,288 palabi.ttf
08/23/2001 08:00 AM 430,800 palai.ttf
06/29/1999 01:57 PM 51,404 PALSCRI.TTF
05/10/2002 03:19 PM 163,476 PAPYRUS.TTF
10/15/1999 09:56 AM 151,256 PARCHM.TTF
06/29/1999 07:54 AM 75,620 PERBI___.TTF
06/29/1999 07:54 AM 58,512 PERB____.TTF
06/29/1999 07:54 AM 76,080 PERI____.TTF
06/28/1999 11:17 AM 48,320 PERTIBD.TTF
06/28/1999 11:17 AM 43,800 PERTILI.TTF
06/29/1999 11:15 AM 60,216 PER_____.TTF
08/18/1999 12:14 PM 46,164 PLAYBILL.TTF
10/15/1999 09:56 AM 76,588 POORICH.TTF
10/15/1999 09:56 AM 82,680 PRISTINA.TTF
08/23/2001 08:00 AM 57,348 raavi.ttf
06/24/1999 09:33 AM 132,600 RAGE.TTF
07/14/1998 01:42 PM 74,416 RAVIE.TTF
05/06/1999 11:59 AM 220,172 REFSAN.TTF
09/03/1998 03:14 PM 53,288 REFSPCL.TTF
06/29/1999 10:55 AM 59,444 ROCCB___.TTF
06/29/1999 10:55 AM 55,824 ROCC____.TTF
06/29/1999 10:56 AM 72,272 ROCK.TTF
06/29/1999 10:56 AM 68,780 ROCKB.TTF
06/29/1999 10:56 AM 73,700 ROCKBI.TTF
06/29/1999 01:57 PM 49,168 ROCKEB.TTF
06/29/1999 10:56 AM 76,756 ROCKI.TTF
08/23/2001 08:00 AM 13,312 roman.fon
03/17/1999 03:07 PM 168,756 SCHLBKB.TTF
03/17/1999 03:07 PM 160,964 SCHLBKBI.TTF
03/17/1999 03:07 PM 163,164 SCHLBKI.TTF
08/23/2001 08:00 AM 12,288 script.fon
06/24/1999 09:33 AM 55,500 SCRIPTBL.TTF
07/14/1998 01:42 PM 52,316 SHOWG.TTF
08/23/2001 08:00 AM 234,280 shruti.ttf
10/15/1999 09:56 AM 63,196 SNAP____.TTF
02/29/2000 01:42 PM 8,004 Sshlined.ttf
08/18/1999 12:14 PM 55,596 STENCIL.TTF
08/23/2001 08:00 AM 221,676 sylfaen.ttf
08/23/2001 08:00 AM 69,464 symbol.ttf
08/23/2001 08:00 AM 310,752 tahoma.ttf
08/23/2001 08:00 AM 296,872 tahomabd.ttf
06/29/1999 07:54 AM 73,856 TCBI____.TTF
06/29/1999 07:54 AM 74,656 TCB_____.TTF
06/25/1999 03:11 PM 66,020 TCCB____.TTF
11/19/2002 10:42 AM 74,708 TCCEB.TTF
06/25/1999 03:11 PM 66,804 TCCM____.TTF
06/29/1999 07:54 AM 78,236 TCMI____.TTF
06/29/1999 07:54 AM 76,252 TCM_____.TTF
10/15/1999 09:56 AM 76,100 TEMPSITC.TTF
08/23/2001 08:00 AM 347,988 times.ttf
09/26/1997 08:36 PM 182,604 Timesb.ttf
08/23/2001 08:00 AM 334,944 timesbd.ttf
08/23/2001 08:00 AM 239,692 timesbi.ttf
08/23/2001 08:00 AM 248,368 timesi.ttf
09/26/1997 08:36 PM 171,284 Timesz.ttf
08/23/2001 08:00 AM 126,796 trebuc.ttf
08/23/2001 08:00 AM 123,096 trebucbd.ttf
08/23/2001 08:00 AM 131,188 trebucbi.ttf
08/23/2001 08:00 AM 139,288 trebucit.ttf
08/23/2001 08:00 AM 148,636 tunga.ttf
08/23/2001 08:00 AM 149,752 verdana.ttf
08/23/2001 08:00 AM 137,616 verdanab.ttf
08/23/2001 08:00 AM 155,076 verdanai.ttf
08/23/2001 08:00 AM 154,800 verdanaz.ttf
10/05/2000 07:19 AM 217,624 verdref.ttf
10/15/1999 09:56 AM 104,372 VINERITC.TTF
10/15/1999 09:56 AM 64,748 VIVALDII.TTF
10/15/1999 09:56 AM 54,308 VLADIMIR.TTF
08/23/2001 08:00 AM 118,752 webdings.ttf
08/23/2001 08:00 AM 81,000 wingding.ttf
01/22/2002 04:22 PM 65,788 WINGDNG2.TTF
01/22/2002 04:22 PM 35,328 WINGDNG3.TTF
08/23/2001 08:00 AM 18,880 wst_czec.fon
08/23/2001 08:00 AM 18,880 wst_engl.fon
08/23/2001 08:00 AM 18,880 wst_fren.fon
08/23/2001 08:00 AM 18,880 wst_germ.fon
08/23/2001 08:00 AM 18,880 wst_ital.fon
08/23/2001 08:00 AM 18,880 wst_span.fon
08/23/2001 08:00 AM 18,880 wst_swed.fon
400 File(s) 59,774,474 bytes
0 Dir(s) 69,312,716,800 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\system

08/28/2005 03:24 PM 303 ccalitu.ini
09/07/2005 12:08 AM 516,116 tcpdrv.dll
08/28/2005 03:24 PM 516,116 utilacc.dll
09/07/2005 12:08 AM 303 vrdpct.ini
4 File(s) 1,032,838 bytes
0 Dir(s) 69,312,733,184 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\system

09/26/2005 01:12 PM .
09/26/2005 01:12 PM ..
12/23/2003 12:09 AM 222,208 actskn43.ocx
08/23/2001 08:00 AM 69,584 AVICAP.DLL
08/23/2001 08:00 AM 109,456 AVIFILE.DLL
07/11/1997 03:00 AM 81,104 COMDLG16.OCX
08/23/2001 08:00 AM 32,816 COMMDLG.DLL
07/11/1997 03:00 AM 27,632 CTL3DV2.DLL
02/26/2001 08:01 PM 28,672 FILTER.AX
04/21/2005 05:20 PM 209 gtx280.dll
08/23/2001 08:00 AM 2,000 KEYBOARD.DRV
08/23/2001 08:00 AM 9,936 LZEXPAND.DLL
07/11/1997 03:00 AM 222,656 MAPIFORM.VBX
07/11/1997 03:00 AM 4,571 MAPIFVBX.TLB
08/23/2001 08:00 AM 73,376 MCIAVI.DRV
08/23/2001 08:00 AM 25,264 MCISEQ.DRV
08/23/2001 08:00 AM 28,160 MCIWAVE.DRV
07/11/1997 03:00 AM 121,856 MLCTRL.DLL
08/23/2001 08:00 AM 68,928 MMSYSTEM.DLL
08/23/2001 08:00 AM 1,152 MMTASK.TSK
08/23/2001 08:00 AM 2,032 MOUSE.DRV
07/11/1997 03:00 AM 79,104 MSRICHED.VBX
08/23/2001 08:00 AM 126,912 MSVIDEO.DLL
07/11/1997 03:00 AM 536,048 OC25.DLL
08/23/2001 08:00 AM 82,944 OLECLI.DLL
08/23/2001 08:00 AM 24,064 OLESVR.DLL
07/11/1997 03:00 AM 246,720 RICHED.DLL
08/23/2001 08:00 AM 59,167 setup.inf
08/23/2001 08:00 AM 5,120 SHELL.DLL
08/23/2001 08:00 AM 1,744 SOUND.DRV
08/23/2001 08:00 AM 5,532 stdole.tlb
08/23/2001 08:00 AM 3,360 SYSTEM.DRV
08/23/2001 08:00 AM 19,200 TAPI.DLL
07/11/1997 03:00 AM 177,824 THREED16.OCX
08/23/2001 08:00 AM 4,048 TIMER.DRV
07/11/1997 03:00 AM 9,136 VAEN2.DLL
07/11/1997 03:00 AM 35,200 VAEN21.OLB
07/11/1997 03:00 AM 935,632 VB40016.DLL
07/11/1997 03:00 AM 19,616 VB4EN16.DLL
08/23/2001 08:00 AM 9,008 VER.DLL
08/23/2001 08:00 AM 2,176 VGA.DRV
08/23/2001 08:00 AM 13,600 WFWNET.DRV
08/23/2001 08:00 AM 131,584 WINSPOOL.DRV
07/11/1997 03:00 AM 1,255,616 WMSUI.DLL
42 File(s) 4,914,967 bytes
2 Dir(s) 69,312,729,088 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\repair

09/05/2005 11:58 PM 303 lituagv.ini
08/28/2003 05:30 PM 233,472 ntuser.dat
09/05/2005 11:58 PM 516,116 vgautil.dll
3 File(s) 749,891 bytes
0 Dir(s) 69,312,729,088 bytes free
Volume in drive C is DSK1_VOL1
Volume Serial Number is 59AA-39C0

Directory of C:\WINDOWS\repair

09/05/2005 11:58 PM .
09/05/2005 11:58 PM ..
08/23/2001 08:00 AM 1,688 autoexec.nt
08/28/2003 05:30 PM 2,577 config.nt
08/28/2003 05:32 PM 233,472 default
08/28/2003 05:32 PM 24,576 sam
08/28/2003 05:30 PM 787,682 secsetup.inf
08/28/2003 05:32 PM 28,672 security
08/28/2003 05:28 PM 208,874 setup.log
08/28/2003 05:32 PM 8,175,616 software
08/28/2003 05:32 PM 1,363,968 system
9 File(s) 10,827,125 bytes
2 Dir(s) 69,312,729,088 bytes free
Post #6
Step 1:

Please download Process Explorer by Systernals from:

Process Explorer


Step 2:

Download this file and save it to your desktop:

FixVundo Registry File

Copy/paste the text in the Quote box below into Notepad, and save it on the desktop as "killme.txt"

C:\WINDOWS\java\dvdtcp.dll
C:\WINDOWS\java\pctdvd.bak1
C:\WINDOWS\java\pctdvd.bak2
C:\WINDOWS\java\pctdvd.ini1
C:\WINDOWS\java\pctdvd.ini2
C:\WINDOWS\java\pctdvd.tmp
C:\WINDOWS\msagent\javainet.dll
C:\WINDOWS\msagent\teniavaj.ini
C:\WINDOWS\Fonts\msvckey.dll
C:\WINDOWS\Fonts\yekcvsm.ini
C:\WINDOWS\system\tcpdrv.dll
C:\WINDOWS\system\ccalitu.ini
C:\WINDOWS\system\vrdpct.ini
C:\WINDOWS\system\utilacc.dll
C:\WINDOWS\repair\vgautil.dll
C:\WINDOWS\repair\lituagv.ini


Step 3:

Print out the following instructions as you will not have Internet Access for the rest of this fix.

Reboot in "safe" mode.

The rest of this fix must be done in safe mode.

Unzip Process Explorer and double click on procexp.exe

In the top section of the Process Exlporer screen double-click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of:

dvdtcp.dll

once and then click the kill button.

After you have killed all of:

dvdtcp.dll

under winlogon click OK.

If you see any of the files listed below, kill them as well.

Files to look for:
————————–
javainet.dll
msvckey.dll
tcpdrv.dll
utilacc.dll
vgautil.dll
pctdvd.bak1
pctdvd.bak2
pctdvd.ini1
pctdvd.ini2
pctdvd.tmp
teniavaj.ini
yekcvsm.ini
ccalitu.ini
vrdpct.ini
lituagv.ini

BE SURE TO KILL ONLY THESE FILES!!!

Probably not all of them will be present. That is OK.

Next double-click on explorer.exe, select the Threads tab, and again click once on each instance of:

dvdtcp.dll

then click the kill button.

If you see any of the files listed below kill them as well.

Files to look for:
————————–
javainet.dll
msvckey.dll
tcpdrv.dll
utilacc.dll
vgautil.dll
pctdvd.bak1
pctdvd.bak2
pctdvd.ini1
pctdvd.ini2
pctdvd.tmp
teniavaj.ini
yekcvsm.ini
ccalitu.ini
vrdpct.ini
lituagv.ini

BE SURE TO KILL ONLY THESE FILES!!!

Probably not all of them will be present. That is OK

Once you have done that click OK again.

Next run Hijack This! and place a check beside each of the following.

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\java\dvdtcp.dll

O20 - Winlogon Notify: dvdtcp - C:\WINDOWS\java\dvdtcp.dll

O20 - Winlogon Notify: javainet - C:\WINDOWS\msagent\javainet.dll

O20 - Winlogon Notify: msvckey - C:\WINDOWS\Fonts\msvckey.dll

O20 - Winlogon Notify: tcpdrv - C:\WINDOWS\system\tcpdrv.dll

O20 - Winlogon Notify: utilacc - C:\WINDOWS\system\utilacc.dll

O20 - Winlogon Notify: vgautil - C:\WINDOWS\repair\vgautil.dll

Now click Fix checked and close HijackThis.

Now double-click on the vundo.reg file that you saved on your desktop earlier and allow it to merge with the registry.

Step 4:

On the desktop, open the "killme.txt" file with Notepad.

Then copy the all file names in the "killme.txt" to the clipboard by highlighting them and pressing C (hold the key down, then press C):

Close "killme.txt".

Run Killbox and then check the Delete on reboot button.

In Killbox, click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new Hijack This! log file into this thread. :)
Post #7
Logfile of HijackThis v1.99.1
Scan saved at 3:57:51 PM, on 9/26/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Keith\Application Data\Mozilla\Profiles\default\t33hxyjs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\l4pdsk.exe reg_run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SECRETSERVICE] C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Reboot.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc…bridge-c420.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120406660687
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SSH Sentinel (SSHIPM) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe" -d (file missing)
O23 - Service: SSH Sentinel Monitor (SSHMONITOR) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Tomcat 5.0.25\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
Post #8
So far, so good. :thumbup:

This is the entry in the log that betrays the presence of the Qoologic (Narrator) trojan:

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\l4pdsk.exe reg_run

It deposits files on your machine that don't show up in a Hijack This! log. And unless we kill them all in "one fell swoop", it will return.

Download FindQoologic-Narrator.zip save it to your Desktop.
http://forums.net-integration.net/index.ph…=post&id;=134981

Extract (unzip) the files inside into their own folder called FindQoologic.
Open the FindQoologic folder. Preferable to your desktop.
Locate and double-click the Find-Qoologic.bat file to run it.

Wait until a text opens.

It may take a few minutes to complete, so be patient.

Post it in your next reply.
:)
Post #9
While Running that .bat file, several windows dialog boxes popped up saying the file was being used. I clicked Ignore and this is the text file returned: Find Qoologic last edited 9/02/2005 PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. some examples are MRT.EXE NTDLL.DLL. »»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»» (fstarts by IMM - test ver. 0.001) NOT using address check – 0x77f5bbd8 Global Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup . .. Acrobat Assistant.lnk desktop.ini HP Digital Imaging Monitor.lnk HP Image Zone Fast Start.lnk npat.exe User Startup: C:\Documents and Settings\Keith\Start Menu\Programs\Startup . .. desktop.ini Reboot.exe »»»»» Search by size and name… »»»»» Files found by this method are not necessarily bad… »»»»» Example PNGFILT.DLL ctl3d32.dll are windows files…
Post #10
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe

http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #5 by typing 5 and then pressing .


IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!


Then re-run the Find-Qoologic.bat file, and post the new log it creates.
:)
Post #11
Find Qoologic last edited 9/02/2005 PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. some examples are MRT.EXE NTDLL.DLL. »»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * winsync C:\WINDOWS\System32\JOABE.DLL * winsync C:\WINDOWS\System32\SKSGFDD.DLL »»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * exe C:\docume~1\alluse~1\startm~1\programs\startup\NPAT.EXE »»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»» (fstarts by IMM - test ver. 0.001) NOT using address check – 0x77f5bbd8 Global Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup . .. Acrobat Assistant.lnk desktop.ini HP Digital Imaging Monitor.lnk HP Image Zone Fast Start.lnk npat.exe User Startup: C:\Documents and Settings\Keith\Start Menu\Programs\Startup . .. desktop.ini Reboot.exe »»»»» Search by size and name… »»»»» Files found by this method are not necessarily bad… »»»»» Example PNGFILT.DLL ctl3d32.dll are windows files… C:\WINDOWS\SYSTEM32\L4PDSK.EXE C:\WINDOWS\SYSTEM32\BRAODCQ.EXE C:\WINDOWS\SYSTEM32\JOABE.DLL C:\WINDOWS\SYSTEM32\SKSGFDD.DLL C:\WINDOWS\SYSTEM32\PBUVW.DAT C:\DOCUME~1\ALLUSE~1\STARTM~1\PROGRAMS\STARTUP\NPAT.EXE
Post #12
Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

C:\WINDOWS\SYSTEM32\L4PDSK.EXE
C:\WINDOWS\System32\JOABE.DLL
C:\WINDOWS\System32\SKSGFDD.DLL
C:\WINDOWS\SYSTEM32\BRAODCQ.EXE
C:\WINDOWS\SYSTEM32\PBUVW.DAT
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NPAT.EXE


CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\l4pdsk.exe reg_run

Then click "Fix checked and close Hijack This!.

Run Killbox.

In Killbox select "Delete on Reboot".

Click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, "copy/paste" a new log file into this thread. :)
Post #13
Logfile of HijackThis v1.99.1
Scan saved at 10:42:19 AM, on 9/27/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe
C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HijackThis\HijackThis.exe

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Keith\Application Data\Mozilla\Profiles\default\t33hxyjs.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SECRETSERVICE] C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\help\v1rg1n.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Reboot.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc…bridge-c420.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120406660687
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SSH Sentinel (SSHIPM) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshipm.exe" -d (file missing)
O23 - Service: SSH Sentinel Monitor (SSHMONITOR) - Unknown owner - C:\Program Files\SSH Communications Security\SSH Sentinel\sshmonitor.exe
O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Tomcat 5.0.25\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
Post #14
Looks like all the "known" malware is gone. :thumbup:

I would suggest the following to check for things that don't appear in a Hijack This! log file:

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from Spybot Search and Destroy
(This is the NEW Version 1.4)
Get AdAware SE Personal from Lavasoft
(This is the NEW Build 1.6)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

Configure Adaware

Configure Spybot

Reboot after running each program.

Try this online virus scan:

Trend-Micro Housecall

Choose "fix" or "clean".

Let it remove any infections found.

Reboot after the scan.

If any of those programs find anything they can't "fix" or "remove", or you are still experiencing problems, let me know.

Otherwise, you should be "good to go".

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI