constant popups

Welcome to the forum

Download VundoFix.exe to your desktop from here:

VundoFix.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

1. Double-click VundoFix.exe to run it.
2. Click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. If it doesn't find anything, in the main program window, choose "Add more files?".
Type the following file names into the box EXACTLY AS SHOWN:

C:\Windows\System32\DEBiew.dll
C:\Windows\System32\vtutt.dll
C:\Windows\System32\mljjh.dll

Click Close Window, then Remove Vundo.

5. You will receive a prompt asking if you want to remove the files, click YES.
6. Once you click yes, your desktop will go blank as it starts removing Vundo.
7. When completed, it will prompt that it will shutdown your computer, click OK.
8. Turn your computer back on.

Post a new HijackThis! log, along with the contents of this file:

C:\vundofix.txt

into this thread.

I ran the vundofix, it found nothing again. I added the files and when I closed, it said that no files were found. I double-checked the files and realized that vtutt and mljjh aren't dll's, but are applications. I'm not sure why it didn't find DEBview. I tried this twice and got the same result: VundoFix V6.1.6 Checking Java version… Java version is 1.5.0.6 Scan started at 6:03:25 PM 9/27/2006 Listing files found while scanning…. No infected files were found. Beginning removal…

Download L2mfix from one of these two locations:

l2mfix.exe (© Shadowwar)

l2mfix.exe (© Shadowwar)

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing .

This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log. Copy/paste the contents of that log into this thread.


IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder!

Here you go. I really do appreciate your helping me!! I must admit I'm afraid of the registry! L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DEBiew] "Asynchronous"=dword:00000000 "Dllname"="DEBiew.dll" "Impersonate"=dword:00000000 "Startup"="OnStartup" "Shutdown"="OnShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "Shutdown"="WLEventShutdown" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000000 "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Event"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings] "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\ 00,00,5b,0c,f9,74,c0,9f,97,4c,8a,f4,07,c3,d6,79,ed,a5,04,00,00,00,04,00,00,\ 00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,bd,4c,e0,15,01,95,1f,b8,\ 29,6d,6f,f7,6b,90,a7,a2,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,19,\ 15,3b,7a,4b,63,48,13,30,4c,7f,89,22,62,b2,c6,08,06,00,00,4a,a1,a2,2b,9c,31,\ 99,07,96,14,af,d9,da,37,26,63,53,a6,6e,7b,59,e1,7d,7f,2b,bb,2f,80,d2,5d,55,\ 99,cb,21,b8,4d,eb,24,d9,a6,39,1b,8c,fc,33,10,91,da,a4,84,7d,8b,f0,63,92,41,\ 0e,b6,7c,97,92,61,aa,e8,45,60,2c,82,75,b1,86,92,ad,b7,f4,90,63,ef,2d,f8,32,\ bb,c2,82,cb,fb,db,c9,a4,b7,cf,13,84,a2,8b,55,2b,bb,d9,b9,4a,43,11,e5,7c,e1,\ 2d,e1,c7,59,8a,35,ea,9b,99,b2,95,bd,16,8c,0b,3d,20,d9,7d,29,1e,c4,21,85,ef,\ af,eb,fa,21,da,c2,45,b2,a9,4a,96,07,41,c3,b2,8e,25,c5,ce,c0,9f,97,80,60,88,\ 79,a1,7f,ff,3f,58,0b,28,fc,6e,29,0c,fa,43,6e,41,aa,a2,78,f3,59,dd,8e,cb,10,\ ee,da,15,d0,b2,91,9b,3b,bf,37,8f,e5,f8,f1,5d,af,65,f4,de,e5,c2,67,17,c4,d6,\ 30,f9,8d,b3,bf,df,c3,b1,df,56,c9,a5,22,21,3a,2f,8b,2b,11,63,d6,cb,eb,0c,32,\ 45,40,18,cd,c2,34,6f,45,c9,f4,c4,9e,54,46,e5,09,d4,be,39,47,ca,2c,da,59,0d,\ 76,0b,3b,3b,10,22,2f,3e,51,d1,59,e7,54,9f,60,53,f7,a3,c1,eb,b3,8a,f2,5e,bc,\ 7b,86,ec,da,9a,96,c0,33,37,27,7a,2c,92,5f,54,de,9f,73,b6,0c,46,96,2c,f9,01,\ de,83,db,75,b7,20,b1,65,b2,2e,27,d7,d5,c9,58,a6,55,44,ab,e9,23,51,52,ee,36,\ cf,99,3f,dc,88,fc,08,81,c8,69,c3,89,b0,4b,c5,c8,7c,0e,49,02,c3,c8,9a,fe,ee,\ 39,7c,46,b1,10,b9,4f,66,5f,91,ba,ce,81,f4,87,fc,61,84,64,fc,9b,54,00,93,1c,\ f4,68,b0,1c,f9,c1,72,d1,93,15,0e,be,8c,9a,38,06,01,a2,3a,ee,28,1c,0d,36,c2,\ 96,52,93,bc,1a,89,8e,d8,2b,03,33,96,b6,b3,a3,1e,7e,fb,90,f2,21,23,72,4d,51,\ 99,11,3d,a1,46,31,5d,46,5f,b8,d6,c9,c8,1d,1d,f8,2f,10,ac,60,4c,70,16,45,69,\ be,0e,85,f5,a2,8b,fa,ce,7a,19,6e,6c,a7,aa,8e,99,9a,e0,77,ee,1e,ff,59,5e,71,\ 17,15,46,ea,9b,85,16,9f,46,aa,31,5f,96,2c,08,8e,a4,37,5f,1d,7a,3e,3c,fe,26,\ 7c,85,88,fd,c2,09,99,4a,a0,e6,36,97,99,e0,8f,9c,47,51,fe,bb,dc,2b,fc,28,5b,\ 55,10,9f,0e,b1,48,d7,c3,e8,49,70,3d,97,73,0b,97,95,c9,fc,e3,9b,d5,bb,5e,6c,\ cb,24,a4,5b,cf,c2,68,a6,16,4a,43,55,1a,2c,f4,77,80,f8,ac,39,1f,af,cf,50,8d,\ 7b,f3,d5,fb,77,3c,ce,11,ca,9f,23,96,ac,12,db,50,c7,27,27,9b,41,80,8d,af,10,\ 55,20,50,da,5e,36,00,28,15,ea,c9,69,2a,a5,c7,40,b6,8a,91,dd,04,b9,15,7f,28,\ ce,05,e7,1c,2c,35,0c,39,ce,91,8d,fb,6b,fb,91,d9,ba,9d,44,79,47,f4,e3,fc,ba,\ d0,06,e6,f0,c6,ed,48,e5,f5,9b,3b,f1,41,e2,7d,91,b9,f3,92,19,ec,14,11,68,53,\ 07,e8,c4,fb,2c,24,92,f3,f9,c6,fb,3c,e0,07,05,46,b6,12,15,5c,42,02,7d,c8,88,\ 31,9e,78,75,48,ba,61,fb,30,4d,2f,f6,c4,2e,f6,0e,3a,f4,54,3b,ab,14,ec,39,1b,\ 7b,8d,b3,01,64,f2,7d,26,e9,b6,2a,57,cd,64,6a,cd,95,1d,91,cd,77,52,5c,29,80,\ e9,49,2f,cd,eb,4a,51,d8,fd,11,8e,37,b3,ef,f6,62,2a,31,9a,c7,60,7d,a8,3f,8a,\ c2,bc,46,53,36,31,bf,d9,0f,eb,33,63,60,21,5f,24,c1,2c,2f,e1,f9,8e,12,52,8b,\ 3a,b1,55,85,a6,8b,41,a5,4f,a7,6f,28,75,67,e2,ac,bd,eb,58,0b,ae,dc,c9,b4,e1,\ a4,f4,4d,58,0a,f6,88,ac,95,70,b8,8e,fb,52,34,fa,40,4b,35,26,9b,41,c3,fb,94,\ 0b,80,a0,a4,24,67,42,be,db,e9,ba,e9,bf,dd,fd,8b,5f,13,07,ff,39,ad,6e,d8,ae,\ 4e,2a,35,a8,d8,4d,31,bd,22,f2,d0,8d,f6,95,f5,ac,e4,8c,ba,07,b8,0a,e3,48,da,\ c2,ae,74,59,ea,37,29,9a,13,c5,16,29,83,0f,fd,e4,81,02,54,74,c2,92,79,3d,4e,\ 40,e8,a7,5f,9b,cb,08,a0,92,0c,a6,9d,35,a4,06,b7,b6,ef,e6,23,46,ff,9e,ca,ce,\ 50,f1,0f,c4,7f,77,6c,c7,80,b9,59,e6,4c,ab,de,53,31,79,05,51,d8,57,d0,90,89,\ 40,02,09,8d,11,f9,4e,4f,b6,6d,e5,1f,11,29,b6,75,b9,70,e0,e5,3c,07,83,8e,d2,\ 9c,cf,ef,35,b0,ed,a9,bd,e7,df,39,28,33,c5,b4,e5,68,a3,91,d2,72,7d,f1,e8,c9,\ 15,35,bc,0e,c5,8b,b7,71,43,1e,30,4f,f0,45,88,f9,97,6f,6c,3e,10,59,d3,9c,2d,\ 45,81,64,f3,95,0b,bd,2f,e9,43,47,12,47,97,85,aa,f3,fd,23,ab,c5,be,c7,e9,a6,\ 9b,ce,bd,45,6e,c0,92,e2,78,6f,e7,ac,1b,e2,97,ca,50,11,3d,ca,36,a4,66,97,88,\ 38,60,28,be,a6,d7,ff,a0,11,0d,9a,b9,7e,c8,5b,63,38,64,11,27,95,25,1d,d6,33,\ e4,df,c0,bb,04,8f,a2,6f,bb,36,bd,77,e3,78,e7,37,ae,f3,d2,56,8a,b4,e4,70,28,\ 07,d4,ac,e2,42,87,31,10,c7,d2,1e,91,13,df,e0,ed,c2,9a,b9,25,40,c5,e8,f6,c2,\ 30,7b,24,be,49,7d,05,63,63,aa,cf,c1,f5,24,b3,6a,b7,02,2e,f1,c0,51,fd,ba,8e,\ 56,06,85,4d,9d,cb,31,05,79,26,d5,6c,f4,35,3f,74,a7,d8,d5,87,20,38,c1,1b,fa,\ ff,ae,6c,1a,28,46,c2,a2,21,a8,44,f8,c6,23,8f,3b,b2,e0,f3,4d,db,cd,ea,d2,bc,\ 1a,d4,03,82,52,6a,a7,be,48,3e,01,e1,cd,2b,ea,2e,20,d6,4c,b9,4a,d5,81,a0,1f,\ 77,00,f7,4f,b1,c8,0d,5e,1d,df,bb,e1,b6,9b,0d,ef,e2,8f,1f,fc,5f,30,df,e6,a8,\ de,63,b4,7f,f1,7c,03,f2,d5,78,02,61,c6,3b,cf,e7,31,15,20,c2,ba,32,99,80,f5,\ e3,00,34,b3,2e,d2,7e,bc,1a,50,ec,97,2f,d2,6e,e7,09,98,40,27,0c,e9,e8,b7,35,\ e9,8c,1f,b0,0d,aa,c3,20,ca,a0,4d,98,44,fc,ba,fb,28,b5,cd,f8,11,b6,1c,4e,90,\ de,ed,1b,4d,e3,4b,95,a1,2c,3d,65,c2,40,31,73,d7,c6,2b,42,b6,0c,a9,be,d1,62,\ 4f,83,1a,6d,e9,56,00,b7,fa,d5,5a,0b,34,75,49,b8,f6,68,aa,6f,e4,34,09,2b,95,\ ef,cd,bb,a5,21,d7,ec,78,37,78,c6,32,ad,62,9f,70,e0,27,9b,16,61,cd,b7,ae,cf,\ 56,fc,1b,e0,74,33,96,0a,9a,22,62,55,94,a5,7b,bb,a3,ef,1a,f8,39,8d,bc,3d,b8,\ 74,fb,6b,f3,d2,53,22,38,bc,86,70,3d,68,08,93,a4,bf,2c,5d,59,7a,06,14,7f,15,\ 15,63,16,6e,25,d1,66,45,44,7b,bf,11,01,86,06,1c,fd,1f,34,7a,7f,8f,cc,66,c3,\ 3b,77,76,c4,03,0a,c5,ad,4a,42,2c,af,59,14,00,00,00,d0,fb,b5,f5,a0,91,b2,f6,\ 95,d9,49,50,ea,6b,cf,91,f5,6a,b4,78 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{acb4a560-3606-11d3-aef4-00104bd0f92d}"="KodakShellExtension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ debiew.dll Sat Sep 23 2006 5:26:20a A…. 16,934 16.54 K fltlib.dll Mon Aug 21 2006 8:21:06a A…. 16,896 16.50 K hlink.dll Fri Jul 21 2006 4:24:44a A…. 72,704 71.00 K inetcomm.dll Thu Jul 27 2006 9:24:46a A…. 679,424 663.50 K kernel32.dll Wed Jul 5 2006 6:55:02a A…. 984,064 961.00 K mshtml.dll Fri Jul 28 2006 7:30:52a A…. 3,058,176 2.91 M netapi32.dll Fri Jul 14 2006 11:31:40a A…. 332,288 324.50 K shell32.dll Thu Jul 13 2006 9:33:28a A…. 8,453,632 8.06 M symneti.dll Mon Aug 7 2006 4:02:32p A…. 534,208 521.69 K symredir.dll Mon Aug 7 2006 4:02:30p A…. 161,472 157.69 K urlmon.dll Tue Jul 25 2006 4:42:24p A…. 615,424 601.00 K 11 items found: 11 files, 0 directories. Total of file sizes: 14,925,222 bytes 14.23 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 44FD-3662 Directory of C:\WINDOWS\System32 09/26/2006 11:21 PM DLLCACHE 05/11/2002 11:54 AM Microsoft 0 File(s) 0 bytes 2 Dir(s) 63,039,492,096 bytes free

OKIE DOKIE.

Not seeing very many bad files in the list.

Let's give this a shot, and see what happens.

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop. <— VERY IMPORTANT!!!

Go to Start –> Run and copy/paste in the following:

"%userprofile%\desktop\combofix.exe" /v debiew

Then hit or click OK

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Delete these files:

C:\WINDOWS\SYSTEM32\vtutt.exe

C:\WINDOWS\SYSTEM32\mljjh.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall…w.viewpoint.com

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe

Then click "Fix checked" and close Hijack This!.

Reboot.

Things working better for you now?


Securing Your PC After An Attack

So far, so good, you're wonderful! I've not got any popups and I'm not hearing that constant annoying clicking noise that lets you know something is going on. I did a disk cleanup and reset my system restore. Thanks so much for your help!!!!

Thank you for choosing TomCoyote for your malware removal solutions.

M68

Securing Your PC After An Attack

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.