Can't remove Lootseek trojan!

Hi ettevroc28,
I did look over your log again and I see nothing that looks like maleware or virus, so the clicking noise may be from your start ups,
Lets try this and see if we can stop some of the start ups. Locking them in this program will not delete them just stop them from running on start up.
There is a few thing running in the back ground on start up.
Lets try this:to help speed up your PC.
This will help you decide what you want to start up when turning on PC.

Please download System Security Suite. here.
http://www.forums.security-central.us/showthread.php?t=318
Extract it from the zip file into a folder.

Run 3S under “Items To Clear” tab place a checkmark in all of them but the last.
Post back as to how your doing now.
Just as a second thought, did you try a different mouse?
If you don't have one shut down your PC and take mouse off and restart. You can use the windows key and
the arrow keys to navigate.
Don't need another log, just post back.
Good luck mschroe919

Hi again, Well, I did what you suggested, although I don't understand what it has to do with start ups. It looked to me like just another program that clears history, cookies, etc. First, I was confused by your instruction to check all boxes except the last one. Because there are 3 sets of boxes (i.e., 3 categories) on the "Items to Clear" tab. They are "Windows Exporer", "My computer" and "Windows Media Player". In all those boxes, I see absolutely nothing that deals with "start ups". So you kinda lost me there. Regarding the mouse. Yes, I've tried 2 mice and both usb ports. The problem is not a constant thing…it comes and goes, but often enough (every 5-10 minutes maybe). I will see if it happens again now. Speaking of start up programs. I did a search on "start" and opened every folder that had that in the name (start or startup) but found nothing with a list of the things that I see in the task bar. (near the clock) Why is that? Used to be you could delete things out of a folder and they would not start when the computer was rebooted. Thanks

Hi ettevroc28,

Well, I did what you suggested, although I don't understand what it has to do with start ups.

First off
When you went to this site:
http://www.forums.security-central.us/showthread.php?t=318
Did you read the part here:

For killing your startup's the 04's in hijackthis.
Check the box be side the startup and press "Lock" checked.
Unless you know what the start-up is I would not Lock them.
If you have questions about the startups post you log in this forum
Note the black dot you can expand the list area for a better look of the program.
===========================================

Speaking of start up programs. I did a search on "start" and opened every folder that had that in the name (start or startup) but found nothing with a list of the things that I see in the task bar. (near the clock) Why is that? Used to be you could delete things out of a folder and they would not start when the computer was rebooted.

With windows XP I would not want to DELETE as often!

Another way to see whats running at start up is lets do this:
Pretty much the same as doing the killing your startup's the 04's

Lets try this go to start/Run/in the comand (open) box type in msconfig and click ok. When ulility box opens go to top and click on the start up box.
There you will see whats running at start up, disabling any does not delete them just stop them.
You can take down the the .exe file and google it, this will tell you if needed at start up.
then disable the ones not needed. you must restart after disabling anything.


Good luck mschroe919

I didn't read anything at that site. I followed your link to it, and downloaded the program. What I read was your note. That's all.

I googled all the startup items. Most said they should not be disables. Couple said only if suspected of causing errors. There was one entry that I could not find a recommendation on, but the hits that came up on the search talked about browser hijacking. That one is called "prunonce.exe" Should I disable it? Is it bad? Should it be deleted?

Hi ettevroc28

C:\util\prunonce\PRunOnce.exe

You can disable it for the time being and see how the PC works. Don't forget to restart after you disable it.

I Have researched all over and can't find out what this prunonce\PRunOnce.exe is supposed to be.
Can you go to your C:\ drive
Find the Folder C:\util\prunonce\PRunOnce.exe
See if there is a read file so we can at least find out what it does. I am sure it isn't a OS needed file.

So at least for now lets go back to MS config and disable it.
Just post back if the PC is doing anything.

Remember disabling it is not deleting it.

Another thing you may try, is if no read file, click on the PRunOnce.exe
in the folder C:\util\prunonce\PRunOnce.exe.
This will start the program as to where you can see what it is .
Let me know.
mschroe919

Sorry, no readme file….just the 108kb application, modified on 6 Aug 2004. I've unchecked that box in the startup and will see what happens when I reboot. RE the Lootseek virus, I just had another popup saying it was found and removed by norton. First one in a few days though.

Hi ettevroc28 Did you install this: C:\util\prunonce\PRunOnce.exe I would like to try and go to this file and start the applicatin, PRunOnce.exe just to see what it is? When it starts just watch and see what it does. Let me know what it is.

Nothing happens when I single click, double click, or right click and select open. The properties of the application show the following: Company: Matsushita Electric Industrial Co Ltd Product name: Panasonic RunOnce (note, my computer is a panasonic laptop)

Hi ettevroc28 Lets do this: click on HijackThis.exe click on open misc tool section click on open uninstall manager click on save list save it where you want, then go there open it,copy and paste it here. close hjt I will review it and get back to you How is your PC behaving mschroe919

I guess it's behaving ok. As I said, the lootseek came back after 2-3 days without seeing it, when it has been 10 or more a day easy. Had 2 of them last night or this morning. Here's the log: Ad-Aware SE Personal Adobe Acrobat - Reader 6.0.2 Update Adobe Reader 6.0.1 Battery Recalibration Canon Camera Access Library Canon Camera Support Core Library Canon Camera Window DC_DV 5 for ZoomBrowser EX Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window DSLR 5 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon ZoomBrowser EX (E) ccCommon CCleaner (remove only) DMI Viewer ewido anti-spyware 4.0 Football Mogul Fujitsu Touch Panel (USB) Google Toolbar for Internet Explorer HijackThis 1.99.1 HotKey Appendix Hotkey Driver for Panasonic PC Hotkey Settings Icon Enlarger Intel® Graphics Media Accelerator Driver for Mobile Intel® PROSet/Wireless Software Internet Worm Protection InterVideo WinDVD IrfanView (remove only) J2SE Runtime Environment 5.0 Update 6 LiveReg (Symantec Corporation) LiveUpdate 3.0 (Symantec Corporation) Loupe Utility Macromedia Flash Player 8 mCore mDriver mDrWiFi mHelp Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB886903) mIWA mIWCA mLogView mMHouse mPfMgr mPfWiz mProSafe MSN Music Assistant mWlsSafe mXML mZConfig Norton AntiVirus 2005 Norton AntiVirus 2005 (Symantec Corporation) Norton AntiVirus Help Norton AntiVirus Parent MSI Norton AntiVirus SYMLT MSI Norton WMI Update Panasonic V.92 MDC Modem Drivers PC Information Viewer Registry Mechanic 5.1 Scrabble v2.0 SD Utility Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Seekmo Toolbar SMC2635W 11Mbps Wireless Cardbus Adapter SPBBC Spybot - Search & Destroy 1.4 SpywareBlaster v3.5.1 Symantec Symantec Script Blocking Installer SymNet Synaptics Pointing Device Driver System Security Suite 1.04 Tomb Raider II Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Windows Defender Windows Defender Signatures Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver Wireless LAN Switch

Hi ettevroc28
Seekmo Toolbar

We need to find this little guy and get rid of it.

A couple of ways to try and get rid of it:
FIRST
go to control panel/add remove programs
look through the list for:
Seekmo Toolbar
If can't get it there
Go to start/search/click on all files a folders/copy and paste this:
Seekmo Toolbar in the box "a word or phrase in the file"
click on search amd if found go an delete it.
Earier I asked that you delete this and appeared as though it was,But still some sign of it.
maybe you can go back and see if it is still ther?
C:\Program Files\Seekmo Programs\Seekmo Toolbar\SeekmoTB.dll
Then if that fails [/b[
Lets do thi again:
click on HijackThis.exe
click on open misc tool section
click on open uninstall manager
Then in window scroll and highlite Seekmo Toolbar then click on delete this entry.
After delete reboot.
Let me know what happens.
mschroe919

Ok, found seekmo in the add/remove programs and it said it was removed. Opened hjt anyway and confirmed it was not in the list. You're right, I did delete it once. Will see if it shows up again. Now, this list of software I have on my computer is getting long: spybot adaware se windows defender nav registry mechanic spyware blaster ewido hjt combofix ccleaner atf cleaner cw shredder 3ssetup104 (?) I have only 13gb out of 90 free.

Hi like a bad penny I am back.
As far as I can tell there isn't anything on your PC as far as a trojan, malware etc.
So as far as I can tell I am not needed.
It was a pleasure working with you.
Let me know on one more post are you glad you came her?
Good luck mschroe919

spybot
adaware se
windows defender
nav
registry mechanic
spyware blaster
ewido
hjt
combofix
ccleaner
atf cleaner
cw shredder
3ssetup104>>>>>This is the System Security Suite I had you download
These are okay I wouldn't get rid of them off my Pc.

I have only 13gb out of 90 free.
The programs you listed arn't nothing as far as space.
What takes up space is pictures, games etc.
There is a lot of very inexpensive Hard Drives out there. I would like I did to all mine, added mor drives.
Good night mschroe919

Of course I'm glad I came to this site. Thanks for your help! By the way, I was running a scan using Adaware after my last post, and during the scan, Norton popped up saying a trojan dropper was found and removed. This happens fairly frequently. Then Adaware finished and found one critical object, a tracking cookie. Then I ran Ewido and it found about 6 more things of "medium" urgency. All were removed and both had been updated just before the scans.