What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Your Help, Please!

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This has been driving me nuts for the past week or so… AdAware can do some cleanup, but does not eliminate the source of the problem. I've had Spybot's immunization on for over 6 months - it does not find anything more than AdAware.

1. There are frequent (every few minutes) crashes that indicate a wininet32 page fault.
2. If the system is left up overnight, task manager (Win98 Close Program) will find a dozen or more Iexplorer tasks, even though there are none on the task bar.
2. IE's home page keeps being changed to http://www.searchmeup.com/search.php?aid=1057
3. AdAware keeps finding a bunch of "Possible Browser Hijack Attempt's" that also point to www.searchmeup.com.

I just downloaded HijackThis today. I “fixed” a few things that seemed “obvious” to me, but I’ve recently noticed a few disturbing problems:

1. I tried using the Win98 SE setup disk to create a boot floppy a few days ago – but there were files it could not find.
2. I tried burning a CD, but Nero v5.5.6.4 would not start – it was missing olepro32.dll. I downloaded a copy of olepro32.dll and put it in C:\Windows\system. That got the Nero Burning ROM software up, but my system locked up as I started the job.
3. The boot up messages indicate my virus protection software (NAV) was not able to start up. Once Windows boots, NAV seems “happy”.

Can you help?

========================================================================

Logfile of HijackThis v1.97.7
Scan saved at 4:40:22 PM, on 5/15/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 WLAN MONITOR\WLAN_CFG.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RUNWIN32.EXE
C:\PROGRAM FILES\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\GETTIME\GETSERV.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 CONFIG UTILITY\WUSB11CFG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOWNLOADS\SPYCHECKER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8000;https=localhost:8000
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R3 - Default URLSearchHook is missing
F1 - win.ini: run=hpfsched
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [bpcpost.exe] C:\WINDOWS\SYSTEM\bpcpost.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\Linksys\WUSB11 WLAN Monitor\WLAN_Cfg.exe
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [VirtualDrive] C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\vdtask.exe /AutoRestore
O4 - HKLM\..\Run: [vcdplayx] "C:\WINDOWS\vcdplayx.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe
O4 - Startup: GetTime Server.lnk = C:\Program Files\GetTime\GetServ.exe
O4 - Startup: Wireless USB Network Adapter Config Utility.lnk = C:\Program Files\Linksys\WUSB11 Config Utility\WUSB11Cfg.exe
O4 - Startup: TClockEx.lnk = C:\Program Files\TClockEx\tclockex.exe
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: xxx (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/…uditControl.cab
O16 - DPF: {FEC3E5A3-50F7-4B0C-97D8-01CF69DFBFC7} (Measurement Service Client) - http://ccon.madonion.com/global/msc.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.brightstreet.com/cif/download/bin/actxcab.cab
O16 - DPF: {26AFD6EF-C017-4063-B2B1-E515DE98A1B7} - http://download.kodak.com/digital/software…are/install.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7862.0130324074
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.techonline.com/vl/Citrix/Web/ac…6.20/wficat.cab
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai.net/7/19/7125/1267/ftp…/v6/brix6ie.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…mbs/install.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://digitalflip.biz/fvlite/fvliteY.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://otx.ifilm.com/OTXMedia/OTXMedia.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4007/ftp…20/cpbrxpie.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwa…are/awswaxf.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://usercenter.cox.net/rsuite/sdccommon…/cx_tgctlcm.jsp
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.221.30.3,24.221.30.4
Post #2
Hi Billjr_58,

Welcome to TomCoyote Forums. Thank you for being so patient while we got to your log. It appears that you may have a very dangerous piece of spyware on your computer- one that steals passwords and other personal information. For information about it, follow this link: http://symantec.com/avcenter/venc/data/pwsteal.allight.html and read Symantec's assessment of the threat.

I would recommend doing a couple of online scans, to see what they can find and remove before we get to the manual clean-up phase. Go to these sites for the scans:
http://housecall.trendmicro.com/
http://www.bitdefender.com/scan/licence.php

When you go to these sites, allow them to install a file on your computer to do the scan, and be sure the box to FIX WHATEVER IS FOUND is checked. Run the scan on ALL PARTS of your computer, and if anything is found that they can't clean, WRITE DOWN THE FULL PATH AND FILENAMES of any such files; then include that information in your next post.

After doing the scans, TURN YOUR COMPUTER OFF FOR AT LEAST 30 SECONDS, then reboot and post a fresh log so we can see what else is needed.
Post #3
I followed your instructions. Here's the result.

Now what?

==========================================================================

Found by HouseCall (http://housecall.trendmicro.com/) v5.70.0 Engine: 7.000-1004 Pattern: 1.891.00
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\EI3BDCMT\arch[1].jar "Dummy.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\EI3BDCMT\arch[1].jar "VerifierBug.class"
JAVA BYTEVER.A-1 Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\ZEMAM65W\ar3[1].jar "VerifierBug.class"
JAVA BYTEVER.A-1 Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\ILQ8GG4J\ar3[1].jar "VerifierBug.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "BlackBox.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "VerifierBug.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "Dummy.class"
TROJ PORNDIAL.BP Non Cleanable C:\RECYCLED\DC287.TMP

I don't know why HouseCall couldn't just delete these files - I did.

Found by bitdefender:

Memory unable to check
C:\WINDOWS\SYSTEM\lstb4drc.exe infected: Trojan.Dropper.Small.FF
C:\WINDOWS\SYSTEM\lstb4drc.exe unable to disinfect
C:\WINDOWS\SYSTEM\nslite.dll=>(Upx) infected: Trojan.Downloader.Agent.P
C:\WINDOWS\SYSTEM\nslite.dll=>(Upx) unable to disinfect
C:\WINDOWS\TEMP\ICD1.tmp\roing17.INF infected: Trojan.Downloader.M
C:\WINDOWS\TEMP\ICD1.tmp\roing17.INF unable to disinfect
C:\WINDOWS\TEMP\THI66AC.TMP\twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\WINDOWS\TEMP\THI66AC.TMP\twaintec.dll unable to disinfect
C:\WINDOWS\TEMP\THI1AC4.TMP\twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\WINDOWS\TEMP\THI1AC4.TMP\twaintec.dll unable to disinfect
C:\WINDOWS\Desktop\TI-83 Games\games\Ion\asm.bat suspect: BAT.Gen
C:\WINDOWS\Desktop\TI-83 Games\games\Ion\asm.bat copied
D:\Outlook Express\Breakpoint.dbx=>(message 163)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>(message body) suspect: Exploit.Iframe.Vulnerability
D:\Outlook Express\Breakpoint.dbx=>(message 163)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>please.scr infected: Win32.Klez.H@mm
D:\Outlook Express\Michael.dbx=>(message 13)=>[Subject: Fw: W32.Klez.E removal tools][Date: Thu, 16 May 2002 20:40:18 -0700]=>(MIME part)=>setup.exe infected: Win32.Klez.H@mm
E:\Outlook Express\Breakpoint.dbx=>(message 116)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>(message body) suspect: Exploit.Iframe.Vulnerability
E:\Outlook Express\Breakpoint.dbx=>(message 116)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>please.scr infected: Win32.Klez.H@mm
E:\Outlook Express\Michael.dbx=>(message 11)=>[Subject: Fw: W32.Klez.E removal tools][Date: Thu, 16 May 2002 20:40:18 -0700]=>(MIME part)=>setup.exe infected: Win32.Klez.H@mm


Logfile of HijackThis v1.97.7
Scan saved at 8:48:17 AM, on 5/19/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 WLAN MONITOR\WLAN_CFG.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RUNWIN32.EXE
C:\PROGRAM FILES\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\GETTIME\GETSERV.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 CONFIG UTILITY\WUSB11CFG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8000;https=localhost:8000
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R3 - Default URLSearchHook is missing
F1 - win.ini: run=hpfsched
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [bpcpost.exe] C:\WINDOWS\SYSTEM\bpcpost.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\Linksys\WUSB11 WLAN Monitor\WLAN_Cfg.exe
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [VirtualDrive] C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\vdtask.exe /AutoRestore
O4 - HKLM\..\Run: [vcdplayx] "C:\WINDOWS\vcdplayx.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe
O4 - Startup: GetTime Server.lnk = C:\Program Files\GetTime\GetServ.exe
O4 - Startup: Wireless USB Network Adapter Config Utility.lnk = C:\Program Files\Linksys\WUSB11 Config Utility\WUSB11Cfg.exe
O4 - Startup: TClockEx.lnk = C:\Program Files\TClockEx\tclockex.exe
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: xxx (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/…uditControl.cab
O16 - DPF: {FEC3E5A3-50F7-4B0C-97D8-01CF69DFBFC7} (Measurement Service Client) - http://ccon.madonion.com/global/msc.cab
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.brightstreet.com/cif/download/bin/actxcab.cab
O16 - DPF: {26AFD6EF-C017-4063-B2B1-E515DE98A1B7} - http://download.kodak.com/digital/software…are/install.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7862.0130324074
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.techonline.com/vl/Citrix/Web/ac…6.20/wficat.cab
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai.net/7/19/7125/1267/ftp…/v6/brix6ie.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…mbs/install.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://digitalflip.biz/fvlite/fvliteY.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://otx.ifilm.com/OTXMedia/OTXMedia.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4007/ftp…20/cpbrxpie.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwa…are/awswaxf.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://usercenter.cox.net/rsuite/sdccommon…/cx_tgctlcm.jsp
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae0…all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.221.30.3,24.221.30.4
Post #4
Hi Billjr_58,

Sorry to take so long getting back to you- I had to consult one of our experts about your case. As you know better than I, it's a difficult problem. Let's try this…

Delete the files those scans found manually, and also the infected emails (WITHOUT opening them!) - the details are in the scans. The ".bat" file is probably OK - it looks game-related. If you recognize it, I'm sure it's OK. I have also included the ones you said you'd deleted earlier, just in case they may have come back- some trojans and such will reinstall themselves, so it's worthwhile to use a couple of minutes looking, just to be sure.

Found by HouseCall:
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\EI3BDCMT\arch[1].jar "Dummy.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\EI3BDCMT\arch[1].jar "VerifierBug.class"
JAVA BYTEVER.A-1 Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\ZEMAM65W\ar3[1].jar "VerifierBug.class"
JAVA BYTEVER.A-1 Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\ILQ8GG4J\ar3[1].jar "VerifierBug.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "BlackBox.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "VerifierBug.class"
JAVA BYTEVER.A Non Cleanable C:\WINDOWS\Temporary Internet Files\Content.IE5\8PAT2P4T\archive3[1].jar "Dummy.class"
TROJ PORNDIAL.BP Non Cleanable C:\RECYCLED\DC287.TMP

Found by bitdefender:
C:\WINDOWS\SYSTEM\lstb4drc.exe infected: Trojan.Dropper.Small.FF
C:\WINDOWS\SYSTEM\lstb4drc.exe unable to disinfect
C:\WINDOWS\SYSTEM\nslite.dll=>(Upx) infected: Trojan.Downloader.Agent.P
C:\WINDOWS\SYSTEM\nslite.dll=>(Upx) unable to disinfect
C:\WINDOWS\TEMP\ICD1.tmp\roing17.INF infected: Trojan.Downloader.M
C:\WINDOWS\TEMP\ICD1.tmp\roing17.INF unable to disinfect
C:\WINDOWS\TEMP\THI66AC.TMP\twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\WINDOWS\TEMP\THI66AC.TMP\twaintec.dll unable to disinfect
C:\WINDOWS\TEMP\THI1AC4.TMP\twaintec.dll infected: Trojan.Spy.BiSpy.C
C:\WINDOWS\TEMP\THI1AC4.TMP\twaintec.dll unable to disinfect
C:\WINDOWS\Desktop\TI-83 Games\games\Ion\asm.bat suspect: BAT.Gen
C:\WINDOWS\Desktop\TI-83 Games\games\Ion\asm.bat copied
D:\Outlook Express\Breakpoint.dbx=>(message 163)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>(message body) suspect: Exploit.Iframe.Vulnerability
D:\Outlook Express\Breakpoint.dbx=>(message 163)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>please.scr infected: Win32.Klez.H@mm
D:\Outlook Express\Michael.dbx=>(message 13)=>[Subject: Fw: W32.Klez.E removal tools][Date: Thu, 16 May 2002 20:40:18 -0700]=>(MIME part)=>setup.exe infected: Win32.Klez.H@mm
E:\Outlook Express\Breakpoint.dbx=>(message 116)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>(message body) suspect: Exploit.Iframe.Vulnerability
E:\Outlook Express\Breakpoint.dbx=>(message 116)=>[Subject: [breakpoint] Customer assistance pleas][Date: Sat, 19 Apr 2003 13:55:34 -0400]=>(MIME part)=>please.scr infected: Win32.Klez.H@mm
E:\Outlook Express\Michael.dbx=>(message 11)=>[Subject: Fw: W32.Klez.E removal tools][Date: Thu, 16 May 2002 20:40:18 -0700]=>(MIME part)=>setup.exe infected: Win32.Klez.H@mm

Now use System Security Suite (you can download it here: http://igorshpak.net/software/3ssetup104.zip ) to clear out unnecessary files, and then do the scans again.

We'll clean the rest up manually. After you have done the above steps, reboot your computer and run CWShredder; it's a special program to eliminate the CoolWebSearch parasite. You can download it here: http://www.spywareinfo.com/~merijn/files/cwshredder.zip and unzip it to any convenient PERMANENT folder (such as C:\CWS) and run it. Click on "Search for Updates" and install any updates it finds. After updating, click on FIX (not SCAN, which will NOT fix anything), and let it fix everything it finds. Follow the prompts that appear, and do as they say.

After the program finishes, REBOOT and run HijackThis, as before. Mark the following lines, and then click FIX CHECKED and let 'er rip!


(This is a baddie)
C:\WINDOWS\RUNWIN32.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchmeup.com/search.php?aid=1057

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
R3 - Default URLSearchHook is missing

(TROJAN)
O4 - HKLM\..\Run: [bpcpost.exe] C:\WINDOWS\SYSTEM\bpcpost.exe

O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc

O4 - HKLM\..\RunServices: [VidSvr]

O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe

O9 - Extra button: xxx (HKLM)

O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab

O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.brightstreet.com/cif/download/bin/actxcab.cab

O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai.net/7/19/7125/1267/ftp…/v6/brix6ie.cab

O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://digitalflip.biz/fvlite/fvliteY.cab

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {C6B086D2-146B-47A4-A218-B82DCAF2D872} (cpbrxpie Control) - http://a19.g.akamai.net/7/19/7125/4007/ftp…20/cpbrxpie.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundl…ArcadeRdxIE.cab


When the program finishes, reboot into SAFE MODE (tap F8 after the BIOS loads, or use whatever other procedure your computer may require). Be sure you are configured to SHOW ALL FILES AND FOLDERS, including System and Hidden Files. If you don't know how to do that, follow this link http://www.xtra.co.nz/help/0,,4155-1916458,00.html and follow the step-by-step directions for your Windows version.

Now find and DELETE the following files and folder (if they are still there):

DELETE FILE
C:\WINDOWS\RUNWIN32.EXE
C:\WINDOWS\SYSTEM\bpcpost.exe

DELETE ENTIRE FOLDER
C:\WINDOWS\SYSTEM\inetsrv\

Finally, REBOOT into Normal Mode and post a fresh log so we can see what else may be needed.
Post #5
Thank you for your help! The error message on bootup is gone and the IE hijack is gone.

I followed all your instructions - except for leaving the following line:

O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab

I left this because I believe it is OK. It's related to the Vendor support for a game I play. Blizzard is a reputable company.

Also, I used MSConfig to turn back on several things that I had disabled from the startup:

1. A few weeks ago I renamed a file from DvzMsgr.exe to DvzMsgr.exe.NOT - the change was propagated to the startup line.
2. I installed a program to help find the source of the problem, but I was not sure I wanted to let it perform any fixes. After uninstalling it, it is still on my system and comes up on bootup - PC Doctor On Call Reall Time Reporting - Health Status. It says there are 118 problems. I tried launching it from the icon on the task bar, but it fails to come up due to a missing .dll.

======================================================================
Logfile of HijackThis v1.97.7
Scan saved at 9:44:38 AM, on 5/22/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 WLAN MONITOR\WLAN_CFG.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\ICSERVER.EXE
C:\WINDOWS\TBPANEL.EXE
C:\WINDOWS\REALTIME.EXE
C:\PROGRAM FILES\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\GETTIME\GETSERV.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 CONFIG UTILITY\WUSB11CFG.EXE
C:\PROGRAM FILES\STARFISH\TRUESYNC\TSTOOL.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\CACHE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\OBJXFR.EXE
C:\WINDOWS\SYSTEM\VBISRV32.EXE
C:\MY DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8000;https=localhost:8000
R3 - Default URLSearchHook is missing
F1 - win.ini: run=hpfsched hpfsched
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\Linksys\WUSB11 WLAN Monitor\WLAN_Cfg.exe
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [VirtualDrive] C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\vdtask.exe /AutoRestore
O4 - HKLM\..\Run: [vcdplayx] "C:\WINDOWS\vcdplayx.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ICServer] C:\PROGRAM FILES\INTERCAST\COMPONENTS\ICSERVER.EXE
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [1 wma] C:\PROGRA~1\GlobalWebBin\inter bleh.exe
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\PROGRAM FILES\ACEGAIN\LIVEUPDATE\LIVEUPDATE.EXE
O4 - HKLM\..\Run: [plulzltz] C:\WINDOWS\actd.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe
O4 - Startup: GetTime Server.lnk = C:\Program Files\GetTime\GetServ.exe
O4 - Startup: Wireless USB Network Adapter Config Utility.lnk = C:\Program Files\Linksys\WUSB11 Config Utility\WUSB11Cfg.exe
O4 - Startup: TClockEx.lnk = C:\Program Files\TClockEx\tclockex.exe
O4 - Startup: TrueSync Launcher.lnk = C:\Program Files\Starfish\TrueSync\tstool.exe
O4 - Startup: Dataviz Messenger.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{4E7E8E6A-15F1-4E26-9352-26AD235131E9}\NewShortcut4_1.exe
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/…uditControl.cab
O16 - DPF: {FEC3E5A3-50F7-4B0C-97D8-01CF69DFBFC7} (Measurement Service Client) - http://ccon.madonion.com/global/msc.cab
O16 - DPF: {26AFD6EF-C017-4063-B2B1-E515DE98A1B7} - http://download.kodak.com/digital/software…are/install.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7862.0130324074
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.techonline.com/vl/Citrix/Web/ac…6.20/wficat.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…mbs/install.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://otx.ifilm.com/OTXMedia/OTXMedia.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwa…are/awswaxf.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://usercenter.cox.net/rsuite/sdccommon…/cx_tgctlcm.jsp
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae0…all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.221.30.3,24.221.30.4
Post #6 last edited
Hi Bill, I see from the member listing that you're here right now. Don't go too far, I'll have a detailed reply to you as soon as I can. There are still several bad entries in your log, but I want to research them before I say anything. I'll post in about half an hour or so.
Post #7
Hi Bill,

1) Here is some information about one entry in your log that I think you need to see: http://securityresponse.symantec.com/avcen…al.allight.html

2) This entry is fine: O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab I was just being cautious. Actually those O16 entries are always safe to delete- they will reinstall when you visit the site again; we just want to be sure the really bad ones get removed, as they can initiate downloads of the very junk we're trying to remove. :( Another thing that's OK is this one: DvzMsgr.exe. It has to do with synchronizing a palm computer or such, and is OK to rename back to what it was.

3) The MSConfig items you turned back on that were disabled from the startup should not be any concern. If that one keeps complaining, just remove it from your Start List if you don't plan to use it.

4) Start HijackThis, with the usual precautions, and FIX the following items:

R3 - Default URLSearchHook is missing

(This is VERY SUSPICIOUS- If you DO NOT KNOW what it is, I'd say remove it.)
O4 - HKLM\..\Run: [1 wma] C:\PROGRA~1\GlobalWebBin\inter bleh.exe

(SAME COMMENT)
O4 - HKLM\..\Run: [plulzltz] C:\WINDOWS\actd.exe

(This program has a VERY BAD reputation. I recommend UNINSTALLING it via "Add/Remove Programs".)
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe

(THIS IS THE ITEM I GAVE YOU THAT LINK FOR)
O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe

(I don't know what this is, and CANNOT find anything about it- that's STRANGE! If you don't KNOW what it is, I would recommend REMOVING IT.)
O4 - Startup: Dataviz Messenger.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{4E7E8E6A-15F1-4E26-9352-26AD235131E9}\NewShortcut4_1.exe

When the program finishes, reboot into SAFE MODE (tap F8 after the BIOS loads, or use whatever other procedure your computer may require). Be sure you are configured to SHOW ALL FILES AND FOLDERS, including System and Hidden Files. If you don't know how to do that, follow this link http://www.xtra.co.nz/help/0,,4155-1916458,00.html and follow the step-by-step directions for your Windows version.

Now find and DELETE the following files and folder (if they are still there):

DELETE FILE
C:\WINDOWS\actd.exe
C:\WINDOWS\realtime.exe
C:\WINDOWS\runwin32.exe
C:\WINDOWS\Application Data\Microsoft\Installer\{4E7E8E6A-15F1-4E26-9352-26AD235131E9}\NewShortcut4_1.exe


DELETE ENTIRE FOLDER
C:\PROGRAM FILES\GlobalWebBin\

REBOOT into Normal Mode and post a fresh log so we can see what else may be needed.
Post #8
You guys rock! My computer's got it's pep back. Thanks.

Here's the new scan log.

==================================================================
Logfile of HijackThis v1.97.7
Scan saved at 4:38:57 PM, on 5/22/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MSDTCW.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PWSTRAY.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 WLAN MONITOR\WLAN_CFG.EXE
C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\VDTASK.EXE
C:\WINDOWS\VCDPLAYX.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\ICSERVER.EXE
C:\WINDOWS\TBPANEL.EXE
C:\PROGRAM FILES\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\GETTIME\GETSERV.EXE
C:\PROGRAM FILES\LINKSYS\WUSB11 CONFIG UTILITY\WUSB11CFG.EXE
C:\PROGRAM FILES\STARFISH\TRUESYNC\TSTOOL.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\CACHE.EXE
C:\PROGRAM FILES\INTERCAST\COMPONENTS\OBJXFR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\VBISRV32.EXE
C:\MY DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8000;https=localhost:8000
F1 - win.ini: run=hpfsched hpfsched
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\Linksys\WUSB11 WLAN Monitor\WLAN_Cfg.exe
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [VirtualDrive] C:\PROGRAM FILES\FARSTONE\VIRTUALDRIVE\vdtask.exe /AutoRestore
O4 - HKLM\..\Run: [vcdplayx] "C:\WINDOWS\vcdplayx.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ICServer] C:\PROGRAM FILES\INTERCAST\COMPONENTS\ICSERVER.EXE
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\PROGRAM FILES\ACEGAIN\LIVEUPDATE\LIVEUPDATE.EXE
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\hotsync.exe
O4 - Startup: GetTime Server.lnk = C:\Program Files\GetTime\GetServ.exe
O4 - Startup: Wireless USB Network Adapter Config Utility.lnk = C:\Program Files\Linksys\WUSB11 Config Utility\WUSB11Cfg.exe
O4 - Startup: TClockEx.lnk = C:\Program Files\TClockEx\tclockex.exe
O4 - Startup: TrueSync Launcher.lnk = C:\Program Files\Starfish\TrueSync\tstool.exe
O8 - Extra context menu item: Add to filterlist (WebWasher) - http://-Web.Washer-/ie_add
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/…uditControl.cab
O16 - DPF: {FEC3E5A3-50F7-4B0C-97D8-01CF69DFBFC7} (Measurement Service Client) - http://ccon.madonion.com/global/msc.cab
O16 - DPF: {26AFD6EF-C017-4063-B2B1-E515DE98A1B7} - http://download.kodak.com/digital/software…are/install.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7862.0130324074
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://www.techonline.com/vl/Citrix/Web/ac…6.20/wficat.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…mbs/install.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac…/ActiveData.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://otx.ifilm.com/OTXMedia/OTXMedia.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://download.macromedia.com/pub/shockwa…are/awswaxf.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://usercenter.cox.net/rsuite/sdccommon…/cx_tgctlcm.jsp
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…72/mcinsctl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac…ta/SymAData.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7d90ae0…all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} - http://akamai.downloadv3.com/binaries/IA/netpe32_EN.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.221.30.3,24.221.30.4
Post #9
Hi Bill,

Thanks for the kind words. Actually I'm a CLASSICAL musician, though. ;)

Your log looks good- now the trick is to KEEP it that way. Here are some tips; they're really painless, I assure you.

First, KEEP YOUR WINDOWS AND BROWSER UPDATED. As new security problems are found, Microsoft issues UPDATES to plug the holes that have been found. The top entry on your START menu should be "Windows Update," so this one is as easy as falling off a log.

Next, I recommend installing SpywareBlaster. It "inoculates" your computer against literally THOUSANDS of known malware items, and it works in such a way that it DOES NOT need to be running (and consuming system resources) to protect you. The program sets a "Kill-Bit" for each malware item, and then that thing can't download to your computer, or run if it's there. I don't know just how it works, but I can assure you IT DOES! Once the protection is set, all you have to do is check for updates about once a week, install them and run SB to set protection against the new items on the list. Once a Kill-Bit is set, you have PERMANENT protection from that item unless you remove it. Best of all, this is FREEWARE. Follow this link to download it: http://www.javacoolsoftware.com/spywareblaster.html

For a good overview of basic Internet security, this is a good article: http://boards.cexx.org/viewtopic.php?t=957 If I can leave you with one thought, it's this: Security is NOT a destination, it's an endless journey.
Post #10
Glad we could help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI