What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Look2Me adware

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi Gang,

It's been a year and a half since my last HJ scan. Recently I've been getting a lot of pop-ups.
This is a corporate laptop and our I.T. folks can't seem to resolve my problem. Symantec scans
keep revealing Look2Me adware but can't offer a fix. Also getting many ads for Win… software
products. Can you help please?

Thanks

Logfile of HijackThis v1.98.2
Scan saved at 8:44:50 PM, on 8/5/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Neoteris\Installer Service\NeoterisSetupService.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Softex\Winroute\WinRServ.exe
C:\Program Files\Softex\Winroute\WinRoute.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
C:\Program Files\Lexmark 7100 Series\ezprint.exe
C:\WINNT\system32\ekuxpv3.exe
C:\WINNT\system32\uvzgi.exe
C:\WINNT\system32\zkdmg.exe
C:\CENTRA~1\bin\centraSystray.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\ASKS~1\javaw.exe
C:\Documents and Settings\vleavej\Application Data\??mbols\w?nword.exe
C:\WINNT\system32\lxbxcoms.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\WINNT\system32\rundll32.exe
C:\Documents and Settings\vleavej\My Documents\Spyware Info\Hijack This\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.benjaminmoore1.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Benjamin Moore & Co.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = bmproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.benjaminmoore1.com;10*;bmus*;;localhost;
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [ad8rIU3s] C:\WINNT\system32\cvn0.exe
O4 - HKLM\..\Run: [zbXb] C:\WINNT\system32\ekuxpv3.exe
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Centra Launcher] C:\CENTRA~1\bin\centraSystray.exe /startup
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [Tlib] "C:\WINNT\system32\ASKS~1\javaw.exe" -vt yazr
O4 - HKCU\..\Run: [ntdll.dll] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Tdpmucdp] C:\Documents and Settings\vleavej\Application Data\??mbols\w?nword.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = C:\Program Files\Dell\Bluetooth Software\BTTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office Xp\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI7E46~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.benjaminmoore1.com
O16 - DPF: {02AA9E0F-B4EB-4BE9-A769-FD09543FEEC2} (UniInstaller Class) - http://www.webcamnow.com/fs5/voice/voice-installer.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://corpnet2.benjaminmoore.com/dana-cac…oterisSetup.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122336548136
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/broadcast/ActiveXWebCam.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O20 - AppInit_DLLs: cmd.dll
Post #2
Thats an old version of hijackthis it is now up to 1.99.1 which you can get here >>>> http://www.majorgeeks.com/download3155.html

Delete the old one.

Please download Look2Me-Destroyer.exe to your desktop.
  • Close all windows before continuing.
  • Double-click Look2Me-Destroyer.exe to run it.
  • Put a check next to Run this program as a task .
  • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  • When Look2Me-Destroyer re-opens, click the Scan for L2M button , your desktop icons will disappear, this is normal.
  • Once it's done scanning, click the Remove L2M button .
  • You will receive a Done Scanning message, click OK .
  • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK .
  • Your computer will then shutdown.
  • Turn your computer back on.
  • Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339'. please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32. Directory
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

Then post a new hijackthis log please.
Post #3
Hi

Thanks for your help!
Requested scans below…
My security software is still detecting "Adware.Purityscan" File name "javaw.exe"

Look2Me-Destroyer V1.0.12

Scanning for infected files…..
Scan started at 8/9/2006 10:30:05 PM

Infected! C:\WINNT\system32\p84ulih9184.dll
Infected! C:\WINNT\system32\h8l2li3o18.dll
Infected! C:\WINNT\system32\iaxsap.dll
Infected! C:\WINNT\system32\ioengine.dll
Infected! C:\WINNT\system32\p84ulih9184.dll
Infected! C:\WINNT\system32\q6rqlg9516.dll
Infected! C:\WINNT\system32\guard.tmp

Attempting to delete infected files…

Attempting to delete: C:\WINNT\system32\p84ulih9184.dll
C:\WINNT\system32\p84ulih9184.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\h8l2li3o18.dll
C:\WINNT\system32\h8l2li3o18.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\iaxsap.dll
C:\WINNT\system32\iaxsap.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\ioengine.dll
C:\WINNT\system32\ioengine.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\p84ulih9184.dll
C:\WINNT\system32\p84ulih9184.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\q6rqlg9516.dll
C:\WINNT\system32\q6rqlg9516.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\guard.tmp
C:\WINNT\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\CSCSettings

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CAA33B63-3103-44AC-B394-5392903904E2}"
HKCR\Clsid\{CAA33B63-3103-44AC-B394-5392903904E2}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{46DA5F52-EEC7-4D39-8C88-4033FFB2047D}"
HKCR\Clsid\{46DA5F52-EEC7-4D39-8C88-4033FFB2047D}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded


Logfile of HijackThis v1.99.1
Scan saved at 10:53:41 PM, on 8/9/2006
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Neoteris\Installer Service\NeoterisSetupService.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Softex\Winroute\WinRServ.exe
C:\Program Files\Softex\Winroute\WinRoute.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
C:\Program Files\Lexmark 7100 Series\ezprint.exe
C:\WINNT\system32\ekuxpv3.exe
C:\WINNT\system32\uvzgi.exe
C:\WINNT\system32\zkdmg.exe
C:\CENTRA~1\bin\centraSystray.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINNT\system32\lxbxcoms.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\ASKS~1\javaw.exe
C:\Documents and Settings\vleavej\Application Data\??mbols\w?nword.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Dell\Bluetooth Software\BTTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\vleavej\LOCALS~1\Temp\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.benjaminmoore1.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Benjamin Moore & Co.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = bmproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.benjaminmoore1.com;10*;bmus*;;localhost;
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Autodesk DWF - {F03966D3-8EA0-47b4-BBE0-85BFE6CBC8AC} - C:\Program Files\Autodesk\Autodesk DWF Writer\DWF Addin\DWFIEAddin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [LXBXCATS] rundll32 C:\WINNT\system32\spool\DRIVERS\W32X86\3\LXBXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxbxmon.exe] "C:\Program Files\Lexmark 7100 Series\lxbxmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer4_in_1] "C:\Program Files\Lexmark 7100 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7100 Series\ezprint.exe"
O4 - HKLM\..\Run: [ad8rIU3s] C:\WINNT\system32\cvn0.exe
O4 - HKLM\..\Run: [zbXb] C:\WINNT\system32\ekuxpv3.exe
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Centra Launcher] C:\CENTRA~1\bin\centraSystray.exe /startup
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [Tlib] "C:\WINNT\system32\ASKS~1\javaw.exe" -vt yazr
O4 - HKCU\..\Run: [ntdll.dll] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Tdpmucdp] C:\Documents and Settings\vleavej\Application Data\??mbols\w?nword.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = C:\Program Files\Dell\Bluetooth Software\BTTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office Xp\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI7E46~1\OFFICE11\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.benjaminmoore1.com
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {02AA9E0F-B4EB-4BE9-A769-FD09543FEEC2} (UniInstaller Class) - http://www.webcamnow.com/fs5/voice/voice-installer.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://corpnet2.benjaminmoore.com/dana-cac…oterisSetup.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1122336548136
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/broadcast/ActiveXWebCam.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = benjaminmoore1.com
O20 - AppInit_DLLs: cmd.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxbx_device - Lexmark International, Inc. - C:\WINNT\system32\lxbxcoms.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINNT\SYSTEM32\LxrJD31s.exe
O23 - Service: Neoteris Setup Service - Juniper Networks - C:\Program Files\Neoteris\Installer Service\NeoterisSetupService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Softex WinRoute Service (WinRServ) - Unknown owner - C:\Program Files\Softex\Winroute\WinRServ.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe
Post #4
First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan.
Post #5
I wasn't able to operate the ewido program in safe mode so, I allowed it to run in normal mode. Since doing so, I have not seen a pop-up nor have I been redirected. My symantec program has been quiet as well. Thanks…Next step(s)? ——————————————————— ewido anti-spyware - Scan Report ——————————————————— + Created at: 8:34:25 AM 8/10/2006 + Scan result: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAssistantUtility -> Adware.CoolWebSearch : Cleaned with backup (quarantined). HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ISTbarISTbar -> Adware.HotBar : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Local Settings\Temp\mmxsnet.exe -> Adware.MediaMotor : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Local Settings\Temp\NNBar_VCSetup_876075.exe -> Adware.Mirar : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Application Data\ѕуmbols\wіnword.exe -> Adware.PurityScan : Cleaned with backup (quarantined). C:\WINNT\system32\__delete_on_reboot__c_m_d_._d_l_l_ -> Adware.PurityScan : Cleaned with backup (quarantined). [1040] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1072] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1144] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1188] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1212] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1240] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1268] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1276] C:\WINNT\System32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1304] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1328] C:\WINNT\System32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1536] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1584] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1592] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1628] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1648] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1724] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1728] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1752] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1776] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1812] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1848] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1864] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1892] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1920] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1948] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [1960] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2052] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2172] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [220] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2232] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2256] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2284] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [2340] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [276] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [288] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [428] C:\WINNT\System32\cmd.dll -> Adware.PurityScan : Error during cleaning. [524] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [556] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [588] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [684] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [744] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [768] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [792] C:\WINNT\System32\cmd.dll -> Adware.PurityScan : Error during cleaning. [808] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [840] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [848] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [868] C:\WINNT\System32\cmd.dll -> Adware.PurityScan : Error during cleaning. [916] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. [972] C:\WINNT\system32\cmd.dll -> Adware.PurityScan : Error during cleaning. C:\WINNT\system32\ekuxpv3.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32\ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32\tpsd.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32\zkdmg.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32ghynf.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32tpsd.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32zkdmg.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined). C:\WINNT\system32\hauc.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\WINNT\system32\uvzgi.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\WINNT\system32\zqskw.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\WINNT\system32uvzgi.exe -> Adware.Suggestor : Cleaned with backup (quarantined). C:\WINNT\system32\GroupPolicy.UserCache\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf -> Backdoor.SdBot.ry : Cleaned with backup (quarantined). C:\WINNT\system32\GroupPolicy.WMOriginal\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf -> Backdoor.SdBot.ry : Cleaned with backup (quarantined). C:\WINNT\system32\GroupPolicy\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf -> Backdoor.SdBot.ry : Cleaned with backup (quarantined). C:\WINNT\cs2m6f.exe -> Downloader.Agent.ala : Cleaned with backup (quarantined). C:\fym9bvo.exe -> Downloader.Agent.ala : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Local Settings\Temp\drsmartload180a.exe -> Downloader.Pakes : Cleaned with backup (quarantined). C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\7ZRAKUVW\!update-4095[1].0000 -> Downloader.PurityScan.co : Cleaned with backup (quarantined). C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OGZISTLV\!update-4095[1].0000 -> Downloader.PurityScan.co : Cleaned with backup (quarantined). C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Z01KLVWO\!update-4095[1].0000 -> Downloader.PurityScan.co : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Application Data\ѕуstem\arpa.exe -> Downloader.PurityScan.co : Cleaned with backup (quarantined). C:\WINNT\Temp\!update.exe -> Downloader.PurityScan.co : Cleaned with backup (quarantined). C:\WINNT\system32\Тasks\javaw.exe -> Downloader.PurityScan.cu : Cleaned with backup (quarantined). C:\dfndrff_7.exe -> Hijacker.VB.ly : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-56461923-733eeedf.zip/Gummy.class -> Not-A-Virus.Exploit.ByteVerify : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][1].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). C:\Documents and Settings\vleavej\Cookies\vleavej@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined). C:\WINNT\system32\net2.exe -> Trojan.Scagent.k : Cleaned with backup (quarantined). ::Report end

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI