What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

New Member Help

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.0
Scan saved at 8:27:53 PM, on 10/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Pyrenean\eDexter\eDexter.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShopSafeBrowserHelper Class - {333F6B96-3992-4D58-A499-145A10FE48C3} - C:\WINDOWS\system32\BhoSSafe.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: WarnBar Class - {C709AC25-FF3B-4DCD-BBBC-AFB8B240CE4A} - C:\Documents and Settings\Richard Nelson\My Documents\SpoofGuard\SpoofGuard.dll
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: eDexter.lnk = C:\Program Files\Pyrenean\eDexter\eDexter.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…99/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8…pdatePortal.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125465631156
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://www.streamingfaith.com/common/mbrow…MINIBrowser.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: Sandra Data Service - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
Post #2
What did I do wrong? Why am I getting no replies??? Did I post in the wrong forum (Tom Coyote's), or is somthing else the problem? I posted on Oct 17th >>> "Looking for analysis". If I'm in the wrong forum, … How do I change Forums?
Post #3 last edited
Hello and welcome to TomCoyote forum. Since you are a new member I'll see if I can help.

1) Here you ask: Posted on: Oct 20 2005, 04:46 AM

What did I do wrong? Why am I getting no replies???

and you started a new topic to ask the question which will help no one, let alone you.

2) All volunteers, we are extremely busy. We all have real lives and families from which we take valuable time to help out here. Patience is required because the wait is long, but our administrators set up a place to post if your wait goes beyond five days so no one should drop though a crack, that place is here: http://forums.tomcoyote.org/index.php?showtopic=31622

3) You have no folder for HJT and you are using an outdated version. We are currently working logs with version 1.99.1. HJT can be updated from within the program like this: Open HJT > Open the Misc Tools section > Scroll to Check for update online > Follow instructions.
Or can be downloaded from here: http://www.malwareremoval.com/downloads.html I suggest you place the folder where you have the HJT.exe located now like this: C:\Program Files\HJT\HijackThis.exe

4) I have no idea what your problem is or if you even have a problem. It helps to know stuff like this. Keep in mind folks who work the logs are few and everyone who views your log is not capable of doing anything with it. Now taking all of this into consideration, if you still need help, I am going to try to give it to you. I will start by combining your two posts and using HJT to remove what obviously need to be removed from your log. You can correct the isues mentioned above and follow the instruction I am about to post.

5) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp and please do not run it until I ask you to.

6) Download, update, configure and run these two programs: http://tomcoyote.org/aawsb.php
The newest version of Ad-aware is 1.06 and Spybot 1.04. Even if you have these programs, use the link to get the newest version, update and configure them as in the link. Run Spybot first, reboot then run Ad-aware. Both programs back up what they remove so delete anything the programs say should be removed.

This item is new to me, let me know if it is a valid program in your next post.
O3 - Toolbar: WarnBar Class - {C709AC25-FF3B-4DCD-BBBC-AFB8B240CE4A} - C:\Documents and Settings\Richard Nelson\My Documents\SpoofGuard\SpoofGuard.dll

7) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

8) Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do. Then restart the computer and post a new HJT log in this same thread along with any feedback you have. At this point, run your computer a bit and then tell me what your malware problems are. I especially need any error messages you are receiving "word for word"
Once I have some information I will know better how to proceed.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #4 last edited
Greetings pskelley

Thank you for responding to my post and explaining how things work.

Yes it is quite obvious that I am a total novas when it comes to these forums and the like (This not only my 1st post experience, but also the 1st time I have ever entered any forum)….know also that everything I know about computers is completely self taught. I know mostly what I need to know , to do what I want to do,…but I'm always trying to learn more.
I don't blame you for lambasting me, because this whole thing is new to me. I don't even know what a thread IS.(let alone, how to get back to my last thread, or combine them or anything like that). I only hope that I'm replying correctly to your response.

So, that said, … If you still don't mind working with this idiot, I will do my best to be your best student, and I would greatly appreciate it!

I will now reply, line by line by number to your post to me.

1) I had no idea what the correct protocol for starting a post was.

2) I apologize for thinking replies would come right away, and I see clearer now. I will be patient from now on.

3) According to my "About" tab within HJT, it says that I Am running version 1.99.1, but thanks for the tip just the same.

I have now created a folder for HJT in my C:\Program file as you suggested.

4) My intent was only to have my scan analyzed and advised on. I was going to save my problem for after the initial clean up,to see if it was still there …but since you mentioned it, I do have one problem that no one seems to be able to solve.
Problem>> My Internet explorer and my E-mail (Incredimail) programs arbitrarily shut down in the middle of anything I might be doing at the time with no warning, & no error message. there's no pattern & no apparent reason. And this does not happen when I use FireFox.

5) I downloaded CCleaner and reviewed the instructions, but did not run here, as per your instructions.

6) I had already been using Ad-aware and Spybot (both latest versions) for a couple of years now. I run them everyday.

Here is a link to SpoofGuard >> http://crypto.stanford.edu/SpoofGuard/

7) I scanned, checked and fixed the items you instructed me to.

8) I followed all of your directions to the letter. I have used up all the time I have right now in composing this reply. So I didn't have time to play around on the computer yet to see what happins, but as soon as I do, I will let you know. All I notice so far is when I highlite something to copy, .. after I copy it, I can't un-highlite til after about 30 seconds.(and everything freezes for about 20 seconds) Also, My "taskbar hide" option is acting up (sometimes leaving a ghost trail when hiding. and none of these are producing error messages.

My Log file is attached below


Thanks Again,
Will await your reply

RAN

Logfile of HijackThis v1.99.1
Scan saved at 6:05:40 AM, on 10/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Pyrenean\eDexter\eDexter.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Highjack This\HijackThis 1.99.1.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShopSafeBrowserHelper Class - {333F6B96-3992-4D58-A499-145A10FE48C3} - C:\WINDOWS\system32\BhoSSafe.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: WarnBar Class - {C709AC25-FF3B-4DCD-BBBC-AFB8B240CE4A} - C:\Documents and Settings\Richard Nelson\My Documents\SpoofGuard\SpoofGuard.dll
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: eDexter.lnk = C:\Program Files\Pyrenean\eDexter\eDexter.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…99/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8…pdatePortal.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamesoduser.comcast.net/classes/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125465631156
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {C432C4BD-3566-411C-8F3C-E5E0D3AE5D33} (CBrowser Class) - http://www.streamingfaith.com/common/mbrow…MINIBrowser.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
Post #5 last edited
Hello RAN, You are certainly welcome, remembering my first venture into forums at Dell Forum, where I barely knew how to plug my new computer in, and had managed to pick up some malware, I can easily relate to you and your first time. This is why I tried to help you get off to a good start. I wish you well with future ventures into forums where much information is available.

So, that said, … If you still don't mind working with this idiot, I will do my best to be your best student, and I would greatly appreciate it!

I do not believe you are and idiot, but rather a student who is trying to increase their knowledge as are we all. It just happens that we are all on different rungs of the ladder of knowledge. It is important to know that you must reach up to be pulled by those above, and reach down to pull those below.

I will not respond to the numbered posts unless I feel a response is required. You may assume I have read and agreed with what you had to say unless I respond to it, thanks.
I also want you to know that I did not see much malware in the HJT log, but HJT shows only the usual places malware writers put their junk. Not forgetting that this is all about the $$, these malware writers are realizing we can see their junk with HJT, more and more they are hiding it thus requiring us to use other tools to feret out the junk. Having been long winded and said all of this, I'll look to see what you found.

Your item #3 The version of HJT being used shows clearly at the top of the log:
Logfile of HijackThis v1.99.0
Scan saved at 8:27:53 PM, on 10/13/2005
Check to make sure you do not have two versions, if so, delete all but version 1.99.1

Problem>> My Internet explorer and my E-mail (Incredimail) programs arbitrarily shut down in the middle of anything I might be doing at the time with no warning, & no error message. there's no pattern & no apparent reason. And this does not happen when I use FireFox.

This may or may not be malware related. Not a great lover of the incredimail software because of the amount of resources it asks for considering the little it does, I have seen many folks have problems concerning it and after they removed it, the problems went away. As far as IE goes, once we are sure you are clean of malware, if the issue does not clear up, I do have troubleshooting suggestions. It is good to know you can switch to Firefox because that seems to tell us the issue is with IE and not your system. I am going to add here instuctions for checking to see if you may have a corrupted or missing file. This proceedure often fixes issues such as this. If a corrupted or missing file is found, Widows will replace it if you have it on your system. If not you will be asked for your Windows CD. If Windows can repair what it may find or if there are no issues, the program will simply close when it is done, so do not be concerned if that happens:

Click Start>Run, type in sfc /scannow, hit Enter.
Note: there is a space between sfc and /scannow
This should replace any corrupted/missing system files and will hopefully fix things. You will need your XP disc in your CD drive for this.
Let me know if that helps.

At times the software at the forum is a little slow to respond. Once you have given one solid click to the add reply key that will do it. Seems you have posted the same log four times. You can use the EDIT key at the bottom to remove the extra logs but the last one is the one I am scanning.

Is this a new program: C:\Program Files\Pyrenean\eDexter\eDexter.exe New one on me, I just want to make sure it is not the culprint since it seems to be involved in browser processes:
http://castlecops.com/startuplist-1083.html

http://crypto.stanford.edu/SpoofGuard/ <<< I was able to find this link, just wanted to be sure. My scanners sure don't like it…think it is a trojan. Because of what it does, I just want to be sure this was not added recently. If that is the case for this item or any program added recently that may coincide with the problems, you should try turning the program off to see if the problem goes away.

Nice to find someone http://www.streamingfaith.com instead of porn…PTL. I see nothing in this HJT log
Logfile of HijackThis v1.99.1 Scan saved at 6:05:40 AM, on 10/25/2005
other than what has been mentioned. At this point I will give you some time to look things over. If something is hiding that HJT can't see that is causing the issues, then I will have to run some deep scans looking for what it could be. If you wish me to do this, just let me know.

Thanks…pskelley
TomCoyote forum
Expert Member
Post #6
Hello back pskelley,

It is certainly good news to know that you can still remember what it was like to be in my shoes. …And it is always a good thing to connect with another Believer. In addition to your obvious expertise, It adds an extra measure of confidence & trust, that makes it that much more comfortable. I am truly Thankful for you!

I am really impressed with how you put those > block paragraph Quotes < wherever you want in your replies. Is that something that only works in this forum, or can it be done anywhere? (i.e. …E-mail, … Word, ..etc). I would like to learn how to do that.

OK, I’ve taken enough time to surf & play around, and here is my report.

I deleted all traces of all versions of HJT other than 1.99.1

I ran the “sfc /scannow”, as you suggested (I had ran it once or twice before). …But Now, in conjunction with uninstalling “SpoofGuard”, IE hasn’t shut down again since. So, it looks like we won’t have to do the deeper scan. Yes, you are truly The Man!

Next, …About “eDexter” (a free open source program). …When Ad-blocking programs block Ads on the web, they leave an icon, or a flag, or a message, or something in that space. All I use eDexter for, is to make that space completely blank (even though eDexter can do several other things). I’ve been using it for about 3-4 years now, without any problems (even when I still had Windows 98). Here’s a link to it, if you haven’t found it already, and you want to check it out. >>> http://accs-net.com/hosts/eDexter.html <<< This is NOT the Pyrenean site, but it seems to give a better explantion of what eDexter does.

I don't know if this means anything, or if anything can be done about it, … but, since I've instatuted these last procedures, I've been getting two or three blank E-mails (having no sender and no subject lines filled in) every time I go to my mail box. Of course, I just delete them without opening them. If you know anything I can do to stop them, let me know.

There you have it. …And I want to say once again, I can’t tell you how much I appreciate your time, patience, talents And help.

Be Blessed,
RAN

Note:For the life of me, I looked and looked, but could not find an EDIT button(to remove those extra log files) at the bottom of the page (or anywhere). Maybe, I'm not returning to the right place to send my replies! I looked for about 15-20 min.
I did see the quote buttons though. Now, all I have to do Is figure out, how to use them.
Post #7
Hello again Ran, your name in the forum is clickable, click it and the near the top choose "Help". That will help you a lot as you get orientated to the new information. While there, click on My Controls and then in the Personal Profile to the left, choose Edit Personal Profile and add at least your location so we will know where you are. There is a PM feature but you can't use that until you get above 10 or so posts. Folks were abusing the feature and manangement decided to take away the toy instead of dealing with the problem children.

I am not sure if the "quote" feature is available in other programs, I looked at my CorelWordPerfect 10 and did not see it. It may be just the forum software that makes it available. Like you I always use "quote" or (quote), etc. Here is a Google, you may find some information there.
http://www.google.com/search?hl=en&lr=&q=u…ord&btnG=Search

SpoofGuard may very well have been a valid program and SFC may have replaced something bad or corrupted, it happens so fast and if the file is on your computer you would not be notified, so we may never know what fixed it? That it seems to be working is a plus. You would have to reinstall SG to see if the problem came back, I just did not like the symptoms you were getting and the fact this software was right in there checking Urls.

Those were some very good programs we installed and ran earlier. Here are tutorials for Spybot and Ad-aware:
http://www.bleepingcomputer.com/forums/tutorial43.html
http://www.bleepingcomputer.com/forums/tutorial48.html
Other excellant freeware programs will be mentioned in the links I provide below.

Thanks for the link to eDexter, I'll look it over when time permits, and I will now know it is valid if I see it in the log, and will add it to our scanner database.

email…there are so many different email programs and it is not something I keep up with except when malware is interfering with it. My suggestion would be to contact your email provider and ask them for help, I would also do my best to investigate where they are coming from (sometimes a simple mouse over will provide the information). Next, if your email program has filters, you want to follow the advice for handling trash such as this. Often the software can be taught to send this stuff to junk, and most folks just delete it instead of deleting it as "junk" and the filters never learn not to put it in the inbox. I hope this helps.

Edit: look at the bottom of your post, there should be four buttons (when signed in) with Edit being the second. A click will give you two ways to edit. You have to edit the information in the box where you post, and the change will occur in the actual post when you complete the edit. In this case, I did the edit for you to clean up a little.

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

Safe surfing…Phil

Thanks…pskelley
TomCoyote forum
Expert Member
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.
Post #8
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI