What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

nasty, look2me, monnet, smitfraud

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Well,
I got it good, been trying to remove a bunch of items, and once I run the programs and reboot,
it all seems to come back.
I have been running some look2me fixes, smitfraud fix, ad-aware, defender, spybot,
last nite did ewido, and grisoft avg.
they all find the stuff, but i get a lot of "file in use" problems trying to fix them,
and even if one program says it fixed them, they all come back.
I'm disconnected from the net, and have been using another computer and a usb floppy
to save logs, and transfer some of the fixes and programs. SO, I haven't been online
to update all the above mentioned programs either.
here is HJT log:


Logfile of HijackThis v1.98.2
Scan saved at 1:09:05 PM, on 7/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\msn93.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\HSMIDI.EXE
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\HJT\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MIDI Sound Handler] HSMIDI.EXE
O4 - HKLM\..\Run: [aieef15f] RUNDLL32.EXE w004b67b.dll,n 001ef15e0000000a004b67b
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\RunOnce: [MIDI Sound Handler] HSMIDI.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp2.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
Post #2
here is the X-RayPC log:

Logfile of X-RayPc Build 38852 (Installed 1154091772)
Scan saved at 7/28/2006 1:08:06 PM

C:\WINDOWS\system32\services.exe (108032 c6ce6eec82f187615d1002bb3bb50ed4)
C:\WINDOWS\system32\lsass.exe (13312 84885f9b82f4d55c6146ebf6065d75d2)
C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
C:\Program Files\Windows Defender\MsMpEng.exe (14032 e7e81c6bcd697f5921df6d6781d2673d)
C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
C:\WINDOWS\system32\spoolsv.exe (57856 da81ec57acd4cdc3d4c51cf3d409af9f)
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (336896 9bf46d959f713d64c8ff3de2b2437863)
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (84480 66093610fa61142f6bcfd83afb7e8a29)
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe (280576 e431814c506fd4fd1df82d56f178b4a5)
C:\Program Files\ewido anti-spyware 4.0\guard.exe (172032 f8d982556a9e0795829632ff0812dc2d)
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (102400 213958aca6aaa546d467bf27768bcaa2)
C:\WINDOWS\msn93.exe (1182720 bcc31b96071633fcf0b11894aea81615)
c:\PROGRA~1\mcafee.com\vso\mcshield.exe (225375 97addee4dc70929a8b482a7ae7842920)
C:\Program Files\Dell\Media Experience\PCMService.exe (204800 3f22eaad167797f2de16fa7968593d59)
C:\PROGRA~1\mcafee.com\agent\mcagent.exe (200704 124f953f5b123fbaf3ee2dd4b5149013)
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe (118784 621f6788b37b090ebba33f61be61d685)
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe (159744 15e14e786ed0b5ecb2e3adf4b42eb531)
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe (53248 2c4060fb422d1e8f6a4467769a24da72)
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe (111816 a36e74ba7528a67a51bc4aff3a50333d)
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (28672 ec0f1ec573a0346f89b8e87e04e9d32a)
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (36975 61a3a9d5d98bf0331df5b716144a8100)
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (49152 ac116f16a7716a720a45d7ea47cfd983)
C:\WINDOWS\system32\hkcmd.exe (77824 01018f75f3f18ce629fac9689954a2ae)
C:\WINDOWS\system32\igfxpers.exe (114688 996abac2332de28f3b6a179c6da20205)
C:\Program Files\Windows Defender\MSASCui.exe (777424 3207bba7a51043ff2c5d64df4c3b6310)
C:\WINDOWS\system32\HSMIDI.EXE (94114 061bd4200a976ea98dccc5e52ecd0de5)
C:\Program Files\ewido anti-spyware 4.0\ewido.exe (6283264 10c40f37ac87a18f624143d4fe6e8dec)
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe (357888 679093afd939b3c1b88110ebf859984d)
C:\Program Files\Dell Support\DSAgnt.exe (306688 cea4715092cb7984420dbc9f51fb4c35)
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (217190 ef0df7c71c25793a156dc370d552903f)
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (282624 5597d0075861cb0a6e6087752d205c0d)
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (204800 2db4d4386ac0f8cc367e1aa8ab1004ef)
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe (77824 227dfed8580f7ac64d7ae18bc3a8a23a)
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (89136 7a56cf3e3f12e8af599963b16f50fb6a)
C:\WINDOWS\explorer.exe (1032192 a0732187050030ae399b241436565e64)
C:\DOCUME~1\SCOTTD~1\LOCALS~1\Temp\Temporary Directory 1 for xraypc.zip\x-raypc.exe (346880 e4926469d1e9d33dc41f47475cba1255)

Service: AudioSrv C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: Avg7Alrt C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe (336896 9bf46d959f713d64c8ff3de2b2437863)
Service: Avg7UpdSvc C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe (84480 66093610fa61142f6bcfd83afb7e8a29)
Service: AVGEMS C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe (280576 e431814c506fd4fd1df82d56f178b4a5)
Service: Browser C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: CryptSvc C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: DcomLaunch C:\WINDOWS\system32\svchost -k DcomLaunch
Service: Dhcp C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: Dnscache C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: ERSvc C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: Eventlog C:\WINDOWS\system32\services.exe (108032 c6ce6eec82f187615d1002bb3bb50ed4)
Service: EventSystem C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: ewido anti-spyware 4.0 guard C:\Program Files\ewido anti-spyware 4.0\guard.exe (172032 f8d982556a9e0795829632ff0812dc2d)
Service: FastUserSwitchingCompatibility C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: helpsvc C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: HidServ C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: lanmanserver C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: lanmanworkstation C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: LmHosts C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: McShield c:\PROGRA~1\mcafee.com\vso\mcshield.exe (225375 97addee4dc70929a8b482a7ae7842920)
Service: MCVSRte c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe (102400 213958aca6aaa546d467bf27768bcaa2)
Service: Netman C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: Nla C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (89136 7a56cf3e3f12e8af599963b16f50fb6a)
Service: PlugPlay C:\WINDOWS\system32\services.exe (108032 c6ce6eec82f187615d1002bb3bb50ed4)
Service: PolicyAgent C:\WINDOWS\System32\lsass.exe (13312 84885f9b82f4d55c6146ebf6065d75d2)
Service: ProtectedStorage C:\WINDOWS\system32\lsass.exe (13312 84885f9b82f4d55c6146ebf6065d75d2)
Service: RasMan C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: RpcSs C:\WINDOWS\system32\svchost -k rpcss
Service: rundll.exe C:\WINDOWS\msn93.exe (1182720 bcc31b96071633fcf0b11894aea81615)
Service: SamSs C:\WINDOWS\system32\lsass.exe (13312 84885f9b82f4d55c6146ebf6065d75d2)
Service: Schedule C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: seclogon C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: SENS C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: ShellHWDetection C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: Spooler C:\WINDOWS\system32\spoolsv.exe (57856 da81ec57acd4cdc3d4c51cf3d409af9f)
Service: srservice C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: SSDPSRV C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: TapiSrv C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: TermService C:\WINDOWS\System32\svchost -k DComLaunch
Service: Themes C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: TrkWks C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: UMWdf C:\WINDOWS\System32\wdfmgr.exe (38912 c81b8635dee0d3ef5f64b3dd643023a5)
Service: w32time C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: WebClient C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: WinDefend C:\Program Files\Windows Defender\MsMpEng.exe (14032 e7e81c6bcd697f5921df6d6781d2673d)
Service: winmgmt C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: wuauserv C:\WINDOWS\system32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)
Service: WZCSVC C:\WINDOWS\System32\svchost.exe (14336 8f078ae4ed187aaabc0a305146de6716)


O3 - Toolbar: Adobe PDF {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (143360 4970544d10652e0e7aba88f008972794)

O4 - HKLM\..\Run: [PCMService] C:\Program Files\Dell\Media Experience\PCMService.exe (204800 3f22eaad167797f2de16fa7968593d59)
O4 - HKLM\..\Run: [VSOCheckTask] c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe (122880 2b6bd4f12674f32e1f8ef69c4b42d025)
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe (200704 124f953f5b123fbaf3ee2dd4b5149013)
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe (159744 988dc9a3041812e7bd146f0ba573d550)
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe (118784 621f6788b37b090ebba33f61be61d685)
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe (159744 15e14e786ed0b5ecb2e3adf4b42eb531)
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe (53248 2c4060fb422d1e8f6a4467769a24da72)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe (111816 a36e74ba7528a67a51bc4aff3a50333d)
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (28672 ec0f1ec573a0346f89b8e87e04e9d32a)
O4 - HKLM\..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (98304 76a3a30b58405c2c6d833895253a51a9)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (36975 61a3a9d5d98bf0331df5b716144a8100)
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (49152 ac116f16a7716a720a45d7ea47cfd983)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe (94208 3f2c8dd08549bb3419cda372f5999ffa)
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (77824 01018f75f3f18ce629fac9689954a2ae)
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (114688 996abac2332de28f3b6a179c6da20205)
O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (777424 3207bba7a51043ff2c5d64df4c3b6310)
O4 - HKLM\..\Run: [MIDI Sound Handler] C:\WINDOWS\system32\HSMIDI.EXE (94114 061bd4200a976ea98dccc5e52ecd0de5)
O4 - HKLM\..\Run: [aieef15f]
O4 - HKLM\..\Run: [!ewido] C:\Program Files\ewido anti-spyware 4.0\ewido.exe (6283264 10c40f37ac87a18f624143d4fe6e8dec)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe (357888 679093afd939b3c1b88110ebf859984d)
O4 - HKCU\..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (306688 cea4715092cb7984420dbc9f51fb4c35)
O4 - HKLM\..\RunOnce: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (3948032 9d7660564cf9a8226dc8d44679f3a64b)
O4 - HKCU\..\RunOnce: [MIDI Sound Handler] C:\WINDOWS\system32\HSMIDI.EXE (94114 061bd4200a976ea98dccc5e52ecd0de5)
O4 - HKLM\..\ShellServiceObjectDelayLoad: [PostBootReminder] C:\WINDOWS\system32\SHELL32.dll (8452096 6ddc1304fc3e6849d2bad23d95e9573b)
O4 - HKLM\..\ShellServiceObjectDelayLoad: [CDBurn] C:\WINDOWS\system32\SHELL32.dll (8452096 6ddc1304fc3e6849d2bad23d95e9573b)
O4 - HKLM\..\ShellServiceObjectDelayLoad: [WebCheck] C:\WINDOWS\System32\webcheck.dll (276480 6501db5182d5a8c0f1f1707286161d66)
O4 - HKLM\..\ShellServiceObjectDelayLoad: [SysTray] C:\WINDOWS\System32\stobject.dll (121856 297101a925ecffdcdf7f6341ffbb6c1a)


O16 - DPF: {00000075-9980-0010-8000-00aa00389b71} - http://codecs.microsoft.com/codecs/i386/voxacm.CAB - C:\WINDOWS\Downloaded Program Files\voxacm.inf (3072 f162ef78523302e92919fe3e1c7ccab2)
O16 - DPF: {02bf25d5-8c17-4b23-bc80-d3488abddc6b} (QuickTime Object)- http://www.apple.com/qtactivex/qtplugin.cab - C:\WINDOWS\Downloaded Program Files\QTPlugin.inf (144 70e662fe81ba2014e95db257f8ca2597)
O16 - DPF: {17492023-c23a-453e-a040-c7c580bbf700} (Windows Genuine Advantage Validation Tool)- http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409 - C:\WINDOWS\Downloaded Program Files\LegitCheckControl.inf (493 656947472d0599150434c6d58bfbb10d)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class)- http://download.yahoo.com/dl/installs/yinst0401.cab - C:\WINDOWS\Downloaded Program Files\yinst.inf (856 da765d8f8a69aabd79241c595cef80a2)
O16 - DPF: {33564d57-0000-0010-8000-00aa00389b71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB - C:\WINDOWS\Downloaded Program Files\WMV9VCM.inf (1689 6149cb46f6ed71c2d13aac6eb74935f4)
O16 - DPF: {38578bf0-0abb-11d3-9330-0080c6f796a1} (Create & Print ActiveX Plug-in)- http://www.imgag.com/cp/install/AxCtp.cab - C:\WINDOWS\Downloaded Program Files\AxCtp.inf (224 3c68805be9da9b3712c4f3277e8676e0)
O16 - DPF: {8ad9c840-044e-11d1-b3e9-00805f499d93} (Java Plug-in)- http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (184423 f01726f7ca8538fdd4663c9db8feaedc)
O16 - DPF: {9f1c11aa-197b-4942-ba54-47a8489bb47f} - http://v4.windowsupdate.microsoft.com/CAB/…8385.8709837963 - C:\WINDOWS\Downloaded Program Files\iuctl.inf (1096 bd5daf951a3c65ac4a3ca26a23f9e5f6)
O16 - DPF: {bb383206-6da1-4e80-b62a-3df950fcc697} (Create & Print ActiveX Plug-in)- http://www.imgag.com/cp/install/AxCtp2.cab - C:\WINDOWS\Downloaded Program Files\AxCtp2.inf (230 d068f10b978931d0db4f69c0aeb38fc0)
O16 - DPF: {cafeefac-0015-0000-0001-abcdeffedcba} (Java Plug-in)- http://java.sun.com/products/plugin/autodl…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (184423 f01726f7ca8538fdd4663c9db8feaedc)
O16 - DPF: {cafeefac-0015-0000-0002-abcdeffedcba} (Java Plug-in)- http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (184423 f01726f7ca8538fdd4663c9db8feaedc)
O16 - DPF: {cafeefac-0015-0000-0005-abcdeffedcba} (Java Plug-in)- http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (184423 f01726f7ca8538fdd4663c9db8feaedc)
O16 - DPF: {cafeefac-0015-0000-0006-abcdeffedcba} (Java Plug-in)- http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (184423 f01726f7ca8538fdd4663c9db8feaedc)
O16 - DPF: {cafeefac-ffff-ffff-ffff-abcdeffedcba} (Java Plug-in 1.5.0_06)- http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll (69746 d2cf6bb5e9020e6707b62575f8083954)
O16 - DPF: {d27cdb6e-ae6d-11cf-96b8-444553540000} (Shockwave Flash Object)- http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab - C:\WINDOWS\Downloaded Program Files\swflash.inf (3759 60b7c507c4804edf26cc2a3066899c29)
O16 - DPF: {df780f87-ff2b-4df8-92d0-73db16a1543a} - http://download.games.yahoo.com/games/web_…aploader_v6.cab - C:\WINDOWS\Downloaded Program Files\popcaploader.inf (241 933c27be4088e5a69809b040dd6db4f3)
Post #3 last edited
sdutcher :D

Welcome to the forum, sorry for the delay , to say we are overwhelmed with logs would be an understatement.

You are using an outdated version of HJT and its not showing us the whole picture. Go to C:\HJT and delete the whole folder, then use the link in my signature at the bottom of this page and download and install the newest version. Then open HJT Scan and Save a Log File, it will open in Notepad, go to Format and make sure that Word Wrap is checked, then to Edit> Select All…..Edit > Copy and Paste a new log into this thread by using the Add-Reply and not New Topic.

Ken :D
Post #4
Logfile of HijackThis v1.99.1
Scan saved at 8:54:58 PM, on 8/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\msn93.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Scott Dutcher\Desktop\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MIDI Sound Handler] HSMIDI.EXE
O4 - HKLM\..\Run: [aieef15f] RUNDLL32.EXE w004b67b.dll,n 001ef15e0000000a004b67b
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp2.cab
O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\h22olcf31f2.dll (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\CYMCAT.DLL (file missing)
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\cxwmdm.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: rundll.exe - Unknown owner - C:\WINDOWS\msn93.exe
Post #5
sdutcher, :D

You have quite a mess going on and to run all the programs to clean everything will be a bit ovewhelming.

You have two Anti Virus programs running, thats not a good thing as they will interfere with each other and cause multiple problems on your system. I need you to go into the Add-Remove programs in the Control Panel and uninstall the one of your choice.


Lets do this to start.

Your HIJACKTHIS program is current, but it is very important that it resides in its own folder.
We will use Hijackthis (HJT) to make changes to your system and HJT will make backups of those changes,
If HJT is not in its own folder, those backups could be lost.

Easy to fix,
* just go to My Computer > YOUR C:\ DRIVE > Program Files and create a new folder and name it Hijackthis .
* Now scroll to where you have HJT currently, right click on the HJT icon and select CUT .
* Now open the new folder you just created and right click within that folder and select PASTE .
* Now HJT should reside in C:\Program Files\Hijackthis\Hijackthis.exe

Please do not proceed until you have moved HJT






Open HJT Scan Only, close your browser and all open windows, check these entries and click on Fix Checked.

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [aieef15f] RUNDLL32.EXE w004b67b.dll,n 001ef15e0000000a004b67b

O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\h22olcf31f2.dll (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\CYMCAT.DLL (file missing)
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\cxwmdm.dll (file missing)

O23 - Service: rundll.exe - Unknown owner - C:\WINDOWS\msn93.exe





Please download Look2Me-Destroyer.exe to your desktop.

Close all windows before continuing.
Double-click Look2Me-Destroyer.exe to run it.
Put a check next to Run this program as a task.

You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
Once it's done scanning, click the Remove L2M button.

You will receive a Done Scanning message, click OK.
When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
Your computer will then shutdown.

Turn your computer back on.
Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log into your next reply.
If you receive a message from your firewall about this program accessing the internet please allow it.



Download: DelDomains.inf
http://mvps.org/winhelp2002/DelDomains.inf, and save it to the desktop.

Close all open browsers
Right-click DelDomains.inf and select: Install

Reboot.


Post a new log please along with the log from Lookeme Destroyer. There is still more to do
Post #6
Logfile of HijackThis v1.99.1
Scan saved at 12:34:27 PM, on 8/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Documents and Settings\Scott Dutcher\Desktop\hjt\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MIDI Sound Handler] HSMIDI.EXE
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp2.cab
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe



Look2Me-Destroyer V1.0.12

Scanning for infected files…..
Scan started at 8/3/2006 10:09:02 PM

Infected! C:\WINDOWS\system32\h22olcf31f2.dll
Infected! C:\WINDOWS\system32\CYMCAT.DLL
Infected! C:\WINDOWS\system32\cxwmdm.dll

Attempting to delete infected files…

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ModuleUsage
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Syncmgr
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WebCheck

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded
Post #7 last edited
sdutcher

Good job :thumbup: It looks like we got most of it. You have Ewido installed , have it set up this way and run the scan and let me see the report. There where a few things on your log that were questionable and are gone, we just want to make sure.


We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.



Lets also run this quick scan for Cool Web Search. It s possible there may be some left we need to remove.


Download the stand alone version of
CWShredder to your desktop.


* Open CWShredder
* Check for Updates
* Close out the program. <– Dont run it yet





* Once you have downloaded Ewido Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
* Once the setup is complete you will need run Ewido and update the definition files.
* On the main screen select the icon Update then select the Update now link.
* Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
* Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
* Once in the Settings screen click on Recommended actions and then select Quarantine
* Under Reports
* Select Automatically generate report after every scan
* Un-Select Only if threats were found
* Close Ewido Anti-Spyware <– Do not run the scan yet.

Boot your computer into Safemode

* Go to Start> Shut Off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to SAFEMODE
* Then press the Enter on your Keyboard

IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:

* Lauch Ewido-Anti-Spyware by double-clicking the icon on your desktop.
* Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
* Ewido will now begin the scanning process, be patient this may take a little time.
* Once the scan is complete do the following:
* If you have any infections you will prompted, then select Apply all actions
* Next select the Reports icon at the top.
* Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
*** make sure to remember where you saved that file, this is important
* Close Ewido


Still in Safemode.

* Double-click on CWShredder.exe.
* Click "Fix ->" and click "OK" at the prompt.
* CWShredder will scan and clean your system of CWS files.
* Click "Next->" and then "Exit".




While in Safemode, make sure these are gone, let me know which if any are still present.

C:\WINDOWS\msn93.exe

C:\WINDOWS\system32\CYMCAT.DLL
C:\WINDOWS\system32\cxwmdm.dll
C:\WINDOWS\system32\h22olcf31f2.dll



Reboot normall and lets run a safe system cleaner to get into all the nooks and cranies.


Installing this program will by default install the Yahoo Toolbar. You can remove the Yahoo Toolbar if you wish via the Add-Remove Programs in the Control Panel.
Download and Install CCleaner
* Click on Run Cleaner
Tutorial for CCleaner


Let me see the Ewido Report , let me know if CWS found anything and post one last HJT log.
Post #8
Thanks for the quick response.. It will be tonight before I get home to work on the system again, and when i do, i'll post the requested logs.. things are already running a little better, but I am also leaving the system offline unless absolutely necessary due to the speed of which this stuff can come back if there is still a downloader hiding someplace.. thanks again
Post #9
Logfile of HijackThis v1.99.1
Scan saved at 8:52:12 PM, on 8/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Documents and Settings\Scott Dutcher\Desktop\hjt\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Profiles\default\hk3brhg4.slt\prefs.js)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MIDI Sound Handler] HSMIDI.EXE
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp2.cab
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe


———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 11:48:47 AM 8/6/2006

+ Scan result:



C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP786\A0080932.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP786\A0080933.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP794\A0081227.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP794\A0081228.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP794\A0081229.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP794\A0081230.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP794\A0081231.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP743\A0076222.exe -> Downloader.Adload.de : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP747\A0076255.exe -> Downloader.Adload.de : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\81EB01AJ\loader[1].exe -> Downloader.Adload.di : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP789\A0081173.exe -> Downloader.Adload.di : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OT6N85YN\nwnmff_7[1].exe -> Downloader.Adload.dj : Cleaned with backup (quarantined).
C:\nwnmff_7.exe -> Downloader.Adload.dj : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\81EB01AJ\kybrdff_7[1].exe -> Downloader.Adload.dl : Cleaned with backup (quarantined).
C:\kybrdff_7.exe -> Downloader.Adload.dl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080887.exe -> Downloader.VB.air : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080890.exe -> Downloader.VB.air : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ENIDAH4R\drsmartload45a[1].exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GNU96RM3\drsmartload849a[1].exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OT6N85YN\drsmartload292a[1].exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OT6N85YN\drsmartload46a[1].exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP740\A0075198.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP742\A0075211.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP742\A0075222.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP743\A0076220.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP747\A0076252.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP747\A0076254.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP753\A0076499.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP760\A0077746.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP770\A0079798.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP775\A0079836.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080886.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\bintheredunthat\drsmartload292a.exe -> Downloader.VB.aiw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080888.exe -> Downloader.VB.aiy : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080891.exe -> Downloader.VB.aiy : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ENIDAH4R\dfndrff_7[1].exe -> Hijacker.VB.ly : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP766\A0079774.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080889.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP783\A0080892.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined).
C:\dfndrff_7.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined).
:mozilla.21:C:\Documents and Settings\Scott Dutcher\Application Data\Mozilla\Firefox\Profiles\default.ttc\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\I386\REG.EXE -> Worm.Randon : Cleaned with backup (quarantined).


::Report end

CWS found 3 items, but I didn't note what they were.
Post #10
sdutcher,

Welcome back, your log looks ok :thumbup: , I am not seeing anything bad on it.

We ran Look2meDestroyer and it got rid of that infection, if you look at your Ewido report , if found a lot of Look2me entries in your System Restore program, there harmless there unless you ever have to revert your system to an earlier date and then you can reinfect your self all over again. :rant2:

So lets flush that out and also your temp internet files as well. Just follow these instructions.

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this




* Clean out your TEMP FILES
* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer / Local Settings
and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.


NOW RE-BOOT NORMALLY


* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

Now Empty your Recycle Bin



Let me know how your doing and if all is well I have some free tools for you to install to help keep you more secure on the internet.

Ken
Post #11
ok Ken, everything went ok, did what you asked, even ran some more spybot and ewido scans.. they found a few things and then cleaned them up, and now they don't find anything,,, let's hope nothing comes back! anything else I should do at this point? the system does seem a little slow., does Ewido take up a lot of resources? thanks for your help
Post #12
sdutcher, :D

Ewido is one of the best programs out there, after the 30 day trial, you will still be able to check for updates, run scans and fix what it finds, you will just lose the background guard feature, you should disable that anyway because it does use some resources.



These are all starting up when you turn on your computer and using system resources, look them over, its totally your call what you remove and what you don't. You can always restore them if you need to by opening HJT > View the List of Backups and restore the ones you want.


These can all be run manually when you need them.
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup


HPQTRA08.EXE is installed alongside the drivers for Hewlett Packard imaging devices and installs an easy-to-use traybar icon for quick access to diagnostics. This is a non-essential process. Disabling or enabling this is down to user preference
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe


Application which launches common MS Office components to help speed up the launch of Office programs. It's somewhat of a resource hog, and some users claim there's no difference with or without it but it usually isn't required. Note - if you make use of the Microsoft Office Shortcut Bar outside an office program this application will need to be enabled for it to show
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EX



Here are some tips and free tools to install to help keep you more secure on the internet.

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

* Here are Free Anti-Virus Programs if you need one
AVG Free Edition
AntVir Personal Edition



* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.


* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.


* Spyware Blaster It will prevent most spyware from ever being installed.


* Spyware Guard It offers realtime protection from spyware installation attempts.


* Win Patrol This program will warn you when any changes are being made to your system and
give you the option to deny the change.


* IE- Spyad IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents downloads and (cookies etc) from the sites listed, although you will still be able to connect to the sites.


* Firefox Browser
It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both. When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you use this for awhile, you will want to make it your default.


* Thunderbird Mail There companion mail program was highly favored in PCWorld Magazine, this has a good spam filter and is more secure than Outlook Express.


* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.


* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/Click on PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Go to START/ CONTROL PANEL> PERFORMANCE AND MAINTENANCE> REARRANGE ITEMS ON YOUR HARD DISK TO MAKE PROGRAMS RUN FASTER
This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.



Some reading…..for speeding up windows.
http://reviews.cnet.com/4520-10165_7-5554402-1.html
http://www.connectedinternet.co.uk/2005/12/5/652


Ken :D
Post #13
Those items, if i want to change it so they don't start, do I use HJT and remove those items? when i installed that printer, i noticed the huge amount of software that went with it, of which i didn't want. If i knew enough, I would have just installed some basic printer drivers, I had AVG, but I thought you said it interveres with Ewido? I run Spybot often, and I've use windows defender, what combination of programs would be the best?
Post #14

I had AVG, but I thought you said it interveres with Ewido?

Nope, I said that having two anti virus programs running would interfere with each other, you had Mcaffe and AVG Free



Those items, if i want to change it so they don't start, do I use HJT and remove those items?


Yes, Open HJT Scan Only, close your browser and all open windows.
Post #15
ok, the macafee was what came on the computer, and not a full program, maybe i'll get rid of that, and use the AVG, it seemed much better. thanks for your help!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI