jkasj71
Topic Starter
Well here I am still messing with the Ghosts in the machine man I have tried everything that the techs have told me to do so far. Updated to the hilt All Windows security patches to date all the MSIE patches all of the Outlook Express updates for 6.0 NO kidding I spent all of yesterday from 7:30 am to 4:00 am today Updating and installing I installed the newest version of MSIE I uninstalled Java VM reinstalled java with the newest version to date It doesn’t matter how I delete this it just comes back every every time.I set all of the java and Active-x specs to the highest security settings possible and still be able to surf. By the way I did all this after I had thought that I had beat the beast and it seemed to work for a while anyway but sure enough it’s back I mean WTH? I might consider my self an advance computer user with a reasonable Idea of how pc’s work and function but I am truly stumped so far Three weeks on this now and still at step one I have also downloaded Adware remover AVG antivirus BHO Demon 1.0 Browser Hijack Blaster 1.0 CWshredder spy ware IE-SPYAD.EXE IE-ENOUGH.ZIP EasyCleaner Hijackthis KazzaBegone KillBox Spy bot search & destroy Zerosrealm all are updated and all are functioning correctly Here’s the story after two weeks of just screwing with this and only this.I am at a brick wall now here in week three Daemon and I took a mean crack at defeating this SON OF A B!@$!!!!! But no luck Since I work from home there is no way that I can rebuild it’s just not an option I have toooo much work to lose and really no way in backing it ALL up. It is here and so far to stay but if an EXE file can be written it sure as hell can be unwritten Can’t it ?By the way after all of this I did find a file that had a lot of the same characteristics when I opened it with a hex tool to take a look at the guts I had over looked it several times before and never thought twice about it but it was a file I didn’t recognize so I took a closer look in to it opening it to properties and copying the name and pasting it to my web browser to conduct a search on this unknown file and came up with some very suspicious similarities it took me to a website that offers Webmasters a way to aggressively advertise. The name of the file is (!SUBMIT) and here is where it lead me too http://uswebsites.com/submit/ take a look and give me some feed back if you can. I don’t know could it be the home of the CWS Trojan Hijacker ?So Please,Please help me While I still have a Hair left. I am at system idle And waiting for your response
P.S If I every met the DUMBASS retard that wrote this FN Virus on the streets I would not hesitate to take my 3 & ½ pound sledge hammer and go to town on just his lill criminal file writing digits till they resembled some Road Island road KILL man I am not kidding about that with out hesitation now try and dial a phone for an ambulance much less write more CRAPWARE hum how does that feel their Cupcake? Well it’s only a fantasy so far. Maybe some day who knows? Maybe at a computer convention
One more P.S if it wasn’t for firefox 0.8 Web Browser I would not be able to even get a message thread to you all. Huge Kudos to the Developers of Mozilla Firefox it seems that since it is a user interface system it can not run any Microsoft Windows Applications so all the Hijackers Trojans Viruses Bugs Ad-ware Spy-ware CRAPWARE can not execute their malicious code and from what I can tell from the forums of the enemies HACKERS websites They all use firefox 0.8 to surf and get their malicious code to the rest of us. And they also use Linux since all the Crap that they write to Destroy Microsoft’s OS won’t affect them So if you like I have this unwanted guest like the bum friend that Drinks all your beer and eats all your food and just won’t go away Then I suggest you Install and run Firefox as your Default web browser I HIGHLY HIGHLY RECAMEND this here is where you can get it http://www.mozilla.org/products/firefox/
Also here is my Hijackthis current log
Logfile of HijackThis v1.97.7
Scan saved at 10:54:32 AM, on 5/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\PROGRA~1\AVGANT~1\avgserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
E:\PROGRA~1\AVGANT~1\avgcc32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\System32\devldr32.exe
E:\temp\ADWARE~1\ADWARE~1\AD-AWA~1\Ad-aware.exe
E:\temp\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - E:\Program Files\surf pal\Surf Pal\CCHelper.dll
O2 - BHO: (no name) - {531930D2-7E2B-4D7F-BB4C-384966F5B5F7} - C:\WINDOWS\System32\eejbhba.dll (disabled by BHODemon)
O2 - BHO: (no name) - {56AF3E71-8A33-4815-A1AF-919841AD2527} - C:\WINDOWS\System32\eejbhba.dll (disabled by BHODemon)
O3 - Toolbar: Merriam-Webster - {9E1128F1-53FA-11D5-8490-0048548030CA} - C:\WINDOWS\Downloaded Program Files\m-wtoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Panicware Surf &Pal - {0ADCDFE7-8490-406D-91BF-88F71FD7F8AE} - E:\Program Files\surf pal\Surf Pal\pwicc.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG_CC] E:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Startup: BHODemon.lnk = E:\temp\BHO Demon 1.0\BHO Demon os files\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Collegiate &Dictionary - C:\Program files\Merriam-Webster Toolbar\dictionary.htm
O8 - Extra context menu item: Collegiate &Thesaurus - C:\Program files\Merriam-Webster Toolbar\thesaurus.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Add to Restricted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone (HKLM)
O9 - Extra button: Merriam-Webster (HKLM)
O9 - Extra button: Add to Trusted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://www.seventeenlive.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7875.3880439815
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {F798683C-FE05-436C-B0FF-35B9122E9787} - http://www.m-w.com/tools/toolbar/cabs/m-w.cab
Daemon if you are around can you give me some insite into this once again thanks your friend in the Cyber World jkasj71
P.S If I every met the DUMBASS retard that wrote this FN Virus on the streets I would not hesitate to take my 3 & ½ pound sledge hammer and go to town on just his lill criminal file writing digits till they resembled some Road Island road KILL man I am not kidding about that with out hesitation now try and dial a phone for an ambulance much less write more CRAPWARE hum how does that feel their Cupcake? Well it’s only a fantasy so far. Maybe some day who knows? Maybe at a computer convention
One more P.S if it wasn’t for firefox 0.8 Web Browser I would not be able to even get a message thread to you all. Huge Kudos to the Developers of Mozilla Firefox it seems that since it is a user interface system it can not run any Microsoft Windows Applications so all the Hijackers Trojans Viruses Bugs Ad-ware Spy-ware CRAPWARE can not execute their malicious code and from what I can tell from the forums of the enemies HACKERS websites They all use firefox 0.8 to surf and get their malicious code to the rest of us. And they also use Linux since all the Crap that they write to Destroy Microsoft’s OS won’t affect them So if you like I have this unwanted guest like the bum friend that Drinks all your beer and eats all your food and just won’t go away Then I suggest you Install and run Firefox as your Default web browser I HIGHLY HIGHLY RECAMEND this here is where you can get it http://www.mozilla.org/products/firefox/
Also here is my Hijackthis current log
Logfile of HijackThis v1.97.7
Scan saved at 10:54:32 AM, on 5/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\PROGRA~1\AVGANT~1\avgserv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
E:\PROGRA~1\AVGANT~1\avgcc32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton Utilities\SYSDOC32.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Speed Disk\nopdb.exe
C:\WINDOWS\system32\ssoftsrv.exe
C:\WINDOWS\System32\devldr32.exe
E:\temp\ADWARE~1\ADWARE~1\AD-AWA~1\Ad-aware.exe
E:\temp\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\eejbhba.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - E:\Program Files\surf pal\Surf Pal\CCHelper.dll
O2 - BHO: (no name) - {531930D2-7E2B-4D7F-BB4C-384966F5B5F7} - C:\WINDOWS\System32\eejbhba.dll (disabled by BHODemon)
O2 - BHO: (no name) - {56AF3E71-8A33-4815-A1AF-919841AD2527} - C:\WINDOWS\System32\eejbhba.dll (disabled by BHODemon)
O3 - Toolbar: Merriam-Webster - {9E1128F1-53FA-11D5-8490-0048548030CA} - C:\WINDOWS\Downloaded Program Files\m-wtoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Panicware Surf &Pal - {0ADCDFE7-8490-406D-91BF-88F71FD7F8AE} - E:\Program Files\surf pal\Surf Pal\pwicc.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AVG_CC] E:\PROGRA~1\AVGANT~1\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Startup: BHODemon.lnk = E:\temp\BHO Demon 1.0\BHO Demon os files\BHODemon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Collegiate &Dictionary - C:\Program files\Merriam-Webster Toolbar\dictionary.htm
O8 - Extra context menu item: Collegiate &Thesaurus - C:\Program files\Merriam-Webster Toolbar\thesaurus.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Add to Restricted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone (HKLM)
O9 - Extra button: Merriam-Webster (HKLM)
O9 - Extra button: Add to Trusted Zone (HKLM)
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://www.seventeenlive.com
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7875.3880439815
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {F798683C-FE05-436C-B0FF-35B9122E9787} - http://www.m-w.com/tools/toolbar/cabs/m-w.cab
Daemon if you are around can you give me some insite into this once again thanks your friend in the Cyber World jkasj71
I have read on several forums and amn refer to this as a Trojan Horse Which is a hidden folder and that is Why I can't seem to find it And trust me I have been through this pc inside and out completely Through the very guts of the computer I think that if I can learn how to use the Attrib cmd windows tool to unhide these suckers I may Gain some ground here I don't know? If any one is familiar here knows how to unhide folders please leave me a post here THAT WOULD BE COOL !!! 
But I have one question for ya Is'nt this file C:\WINDOWS\olge.dll/sp.html a hidden file I have heard that that there are two parts to it bothe hidden in the applint read only system32 folder and to delete it only leaves the hidden file to regenarate itself and start this mess all over again I don't know maby you can give me a little insight to this on the next post
