What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log For Casagalindo

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Could someone please help me out?

Logfile of HijackThis v1.97.7
Scan saved at 11:40:16 AM, on 5/29/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\CANON\MULTIPASS4\MONITR32.EXE
C:\WINDOWS\SYSTEM\MPS.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {00006236-A927-4979-9F45-AB915FB9AADE} - C:\WINDOWS\SYSTEM\SITEHE~1.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [AC2ICYX.EXE] C:\WINDOWS\SYSTEM\AC2ICYX.EXE
O4 - HKCU\..\RunOnce: [AC2ICYX.EXE] C:\WINDOWS\SYSTEM\AC2ICYX.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Canon MultiPASS Status Monitor.lnk = C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/public/investor/v9.5/investor.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://dmz.socalgas.com/viewer/activeXView…tivexviewer.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8102.7336458333
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/27a75444f7118ad8ec16/…ip/RdxIE601.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {16F2EA75-DF7F-4DA1-9F72-72EF6019AF79} (SHInst Class) - http://www.clinkc.com/bars/Sitehelper.cab

Thank You!
Post #2
Download and Install AdAware , keeping the default options. However you will need to change some of the settings before your first scan
Go to Start > Programs > Lavasoft and click on AdAware 6 to open the program
Look at the icons on the top right of the page and click on the ‘world’ and let AdAware update the spyware reference list
Once the update is finished click on the ‘Gear’ icon (second from the left) to access the preferences/settings window
In the ‘General’ window make sure the following are selected:
# Automatically save log-file
# Automatically quarantine objects prior to removal
# Safe Mode (always request confirmation)
Click on the ‘Scanning’ button on the left and select :
# Scan Within Archives
# Scan Active Processes
# Scan Registry
# Deep Scan Registry
# Scan my IE favorites for banned URL’s
# Scan my Hosts file
# Under ‘Click here to select drives + folders’, choose:
# All of your hard drives
Click on the ‘Advanced’ button on the left and select:
# Include additional process information
# Include additional file information
# Include environment information
# Include additional object details
Click the ‘Tweak’ button and select:
# Under the ‘Scanning Engine’:
# Unload recognized processes during scanning
# Include basic Ad-aware settings in logfile
# Include additional Ad-aware settings in logfile
# Under the ‘Cleaning Engine’:
# Let Windows remove files in use at next reboot
Click on ‘Proceed’ to save the settings.
Click ‘Start’ and on the next screen choose ‘Activate in-depth Scan’ at the bottom of the page and then choose:
# Use Custom Scanning Options
Click ‘Next’ and AdAware will scan your hard drive(s) with the options you have selected.
Save the log file when it asks and then click ‘finish’
Exit AdAware and reboot. Make sure nothing (new) seems broken.
NOTE: It's important to be able to tell which program removed what, in case of trouble. So as to know which program to use to restore with.

Downloaded and Install Spybot Search & Destroy, accepting the Default Settings
Go to Start > Programs >Spybot – Search & Destroy and choose ‘Spybot S&D – easy mode’
Close ALL windows except Spybot S&D
Click the button to ‘Search for Updates’ and download and install the Updates.
Next click the button ‘Check for Problems’
When Spybot is complete, it will be showing ‘RED’ (RED) entries ‘BLACK’ entries and ‘GREEN’ (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED (RED) entries.
Exit Spybot S&D and reboot.

RESCAN with HijackThis and POST your logfile in the same thread using ‘Add Reply’. Do not attempt to fix anything in Hijackthis yourself!

NOTE: Make sure you keep the links if you are copying and pasting this.

For your protection and so that you dont have the same reoccurring problem download, install,and update: http://www.javacoolsoftware.com/spywareblaster.html
SpywareBlaster will block bad ActiveX and malevolent cookies.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYADIE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Both are very small free programs that you run once, and then just occasionally to check for updates.
And also see
So how did I get infected in the first place?
Post #3
little eagle-

I did everything you told me to. Here is my new HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 3:23:02 PM, on 5/29/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\CANON\MULTIPASS4\MONITR32.EXE
C:\WINDOWS\SYSTEM\MPS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {00006236-A927-4979-9F45-AB915FB9AADE} - C:\WINDOWS\SYSTEM\SITEHE~1.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [AC2ICYX.EXE] C:\WINDOWS\SYSTEM\AC2ICYX.EXE
O4 - HKCU\..\RunOnce: [AC2ICYX.EXE] C:\WINDOWS\SYSTEM\AC2ICYX.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Canon MultiPASS Status Monitor.lnk = C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/public/investor/v9.5/investor.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://dmz.socalgas.com/viewer/activeXView…tivexviewer.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8102.7336458333
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/27a75444f7118ad8ec16/…ip/RdxIE601.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {16F2EA75-DF7F-4DA1-9F72-72EF6019AF79} (SHInst Class) - http://www.clinkc.com/bars/Sitehelper.cab

What do I do next?
Post #5
I scanned using "HouseCall" and it found "TROJ STILEN A." It was already in the recycle bin, but I deleted it anyway using the option at the end of the scan since it was "uncleanable."

As requested, here is my fresh Hijack This log:


Logfile of HijackThis v1.97.7
Scan saved at 5:35:15 PM, on 5/29/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\CANON\MULTIPASS4\MONITR32.EXE
C:\WINDOWS\SYSTEM\MPS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {00006236-A927-4979-9F45-AB915FB9AADE} - C:\WINDOWS\SYSTEM\SITEHE~1.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [cjtjt0v.exe] C:\WINDOWS\SYSTEM\cjtjt0v.exe
O4 - HKCU\..\RunOnce: [cjtjt0v.exe] C:\WINDOWS\SYSTEM\cjtjt0v.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Canon MultiPASS Status Monitor.lnk = C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/public/investor/v9.5/investor.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://dmz.socalgas.com/viewer/activeXView…tivexviewer.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8102.7336458333
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/27a75444f7118ad8ec16/…ip/RdxIE601.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {16F2EA75-DF7F-4DA1-9F72-72EF6019AF79} (SHInst Class) - http://www.clinkc.com/bars/Sitehelper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2e52972…all/xscan53.cab
Post #6 last edited
Go to
http://www.spywareinfo.com/~merijn/downloads.html
CWshreadder it is updated often.
A small utility for removing CoolWebSearch

Close -all- browser windows. Run CWShredder. Let it fix whatever it finds.
Reboot.
Post back with another log and let
us know how you make out with it. :blink:
Post #7
I ran the CWShreadder and it says everything is clean. After reboot, I ran HijackThis. Here you are:

Logfile of HijackThis v1.97.7
Scan saved at 5:00:49 PM, on 5/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\CANON\MULTIPASS4\MONITR32.EXE
C:\WINDOWS\SYSTEM\MPS.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {00006236-A927-4979-9F45-AB915FB9AADE} - C:\WINDOWS\SYSTEM\SITEHE~1.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [LLWC3.EXE] C:\WINDOWS\SYSTEM\LLWC3.EXE
O4 - HKCU\..\RunOnce: [LLWC3.EXE] C:\WINDOWS\SYSTEM\LLWC3.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Canon MultiPASS Status Monitor.lnk = C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/public/investor/v9.5/investor.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://dmz.socalgas.com/viewer/activeXView…tivexviewer.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8102.7336458333
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/27a75444f7118ad8ec16/…ip/RdxIE601.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {16F2EA75-DF7F-4DA1-9F72-72EF6019AF79} (SHInst Class) - http://www.clinkc.com/bars/Sitehelper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2e52972…all/xscan53.cab

What's the next step?
Post #8

I ran the CWShreadder and it says everything is clean. After reboot, I ran HijackThis. Here you are:

What's the next step?

:rofl: Blow it up…………just kidding.

How to make a permanent folder
Click My Computer, then C:\
In the menu bar, File->New->Folder.
That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ folder. Put your HijackThis.exe there, and double click to run it.
Close all Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {00006236-A927-4979-9F45-AB915FB9AADE} - C:\WINDOWS\SYSTEM\SITEHE~1.DLL
O2 - BHO: (no name) - {D537A3D0-8C07-4D62-953F-162207F5090D} - C:\WINDOWS\SYSTEM\regsvrac32.dll

O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O4 - HKLM\..\RunOnce: [LLWC3.EXE] C:\WINDOWS\SYSTEM\LLWC3.EXE
O4 - HKCU\..\RunOnce: [LLWC3.EXE] C:\WINDOWS\SYSTEM\LLWC3.EXE

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/27a75444f7118ad8ec16/…ip/RdxIE601.cab

Reboot afterwards in SAFE MODE. If you don't know how follow this link
http://service1.symantec.com/SUPPORT/tsgen…001052409420406

Delete the following files and folder listed
C:\WINDOWS\SYSTEM\LLWC3.EXE

Some of these files and folders might have the hidden atribute
How to show hidden files and folders in Windows
http://www.xtra.co.nz/help/0%2C%2C4155-1916458%2C00.html

That's all I see in your log that needs to go .
Cleaning out your temp and temporary internet files would be a good idea.
You may want to read the post at this link, it will explain how you got infected in the first place and it has suggestions on what you need to help protect your PC.
Here is the link.
http://forums.net-integration.net/index.php?showtopic=3051
And reboot and post another log.

GOOD LUCK
Post #9
Did everything you told me to. Haven't seen a pop-up ad yet!

Here's a new HijackThis log.

What do you think of all those Startups in the Q4 section. Before I disabled them, my computer would always try and search for them while Windows finished loading.
I would try and delete the shortcuts (that made the computer search for them in the first place), but new ones would always appear.

Am I making any sense?


Logfile of HijackThis v1.97.7
Scan saved at 10:46:52 PM, on 5/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\TPPALDR.EXE
C:\PROGRAM FILES\CANON\MULTIPASS4\MONITR32.EXE
C:\WINDOWS\SYSTEM\MPS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Canon MultiPASS Status Monitor.lnk = C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/public/investor/v9.5/investor.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://dmz.socalgas.com/viewer/activeXView…tivexviewer.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLCD.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8102.7336458333
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {16F2EA75-DF7F-4DA1-9F72-72EF6019AF79} (SHInst Class) - http://www.clinkc.com/bars/Sitehelper.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2e52972…all/xscan53.cab
Post #10
How to make a permanent folder
Click My Computer, then C:\
In the menu bar, File->New->Folder.
That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ folder. Put your HijackThis.exe there, and double click to run it.
The reason for this is that Hijackthis cannot create backup files

If I mess up you have no back up files

Thank you.
Post #11
Close all Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)



That's all I see in your log that needs to go .
Cleaning out your temp and temporary internet files would be a good idea.
You may want to read the post at this link, it will explain how you got infected in the first place and it has suggestions on what you need to help protect your PC.
Here is the link.
http://forums.net-integration.net/index.php?showtopic=3051
If you have any more problems, just post back.
Have a nice day.
Read this too
http://www.wilderssecurity.com/showthread.php?t=27971

I'll have somebody better that me check out,

O4 - Startup: 73JR49KJ.lnk.disabled
O4 - Startup: HFR8KRAT.lnk.disabled
O4 - Startup: UG4PI04E.lnk.disabled
O4 - Startup: J98FI4YE.lnk.disabled
O4 - Startup: Z1OYYKHY.lnk.disabled
O4 - Startup: 9NPEN307.lnk.disabled
O4 - Startup: 6D1PP0FU.lnk.disabled
O4 - Startup: 41AOEOQ0.lnk.disabled
O4 - Startup: 71PK10F0.lnk.disabled
O4 - Startup: QD50IGBM.lnk.disabled
O4 - Startup: Q1DIKHN3.lnk.disabled
O4 - Startup: YHNC28OA.lnk.disabled
O4 - Startup: UEDZBLP3.lnk.disabled
O4 - Startup: C8TH8TUE.lnk.disabled
O4 - Startup: D3JXJGF5.lnk.disabled
O4 - Startup: UP0ZK5YD.lnk.disabled
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: 7CDEV9BK.lnk.disabled
O4 - Startup: 1O7ZEMZX.lnk.disabled
O4 - Startup: KZQWRTR5.lnk.disabled
O4 - Startup: DBH06JCN.lnk.disabled
O4 - Startup: TZPCFR4X.lnk.disabled
O4 - Startup: AJ1BTQOA.lnk.disabled
O4 - Startup: MT7IQFA0.lnk.disabled
O4 - Startup: Q9063BRU.lnk.disabled
O4 - Startup: 6VL86AFJ.lnk.disabled
O4 - Startup: KH8HHABL.lnk.disabled
O4 - Startup: O9NRPLH8.lnk.disabled
O4 - Startup: YDGVZMFZ.lnk.disabled
O4 - Startup: XY4N6L5J.lnk.disabled
O4 - Startup: PW8HEQOP.lnk.disabled
O4 - Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: HFR8KRAT.lnk.disabled
O4 - Global Startup: WI98UWM8.lnk.disabled
O4 - Global Startup: 73JR49KJ.lnk.disabled
O4 - Global Startup: J98FI4YE.lnk.disabled
O4 - Global Startup: YDGVZMFZ.lnk.disabled
O4 - Global Startup: 9NPEN307.lnk.disabled
O4 - Global Startup: 6D1PP0FU.lnk.disabled
O4 - Global Startup: 41AOEOQ0.lnk.disabled
O4 - Global Startup: 71PK10F0.lnk.disabled
O4 - Global Startup: QD50IGBM.lnk.disabled
O4 - Global Startup: Q1DIKHN3.lnk.disabled
O4 - Global Startup: YHNC28OA.lnk.disabled
O4 - Global Startup: UEDZBLP3.lnk.disabled
O4 - Global Startup: C8TH8TUE.lnk.disabled
O4 - Global Startup: D3JXJGF5.lnk.disabled
O4 - Global Startup: UP0ZK5YD.lnk.disabled
O4 - Global Startup: 7CDEV9BK.lnk.disabled
O4 - Global Startup: 1O7ZEMZX.lnk.disabled
O4 - Global Startup: KZQWRTR5.lnk.disabled
O4 - Global Startup: DBH06JCN.lnk.disabled
O4 - Global Startup: TZPCFR4X.lnk.disabled
O4 - Global Startup: AJ1BTQOA.lnk.disabled
O4 - Global Startup: MT7IQFA0.lnk.disabled
O4 - Global Startup: Q9063BRU.lnk.disabled
O4 - Global Startup: 6VL86AFJ.lnk.disabled
O4 - Global Startup: KH8HHABL.lnk.disabled
O4 - Global Startup: O9NRPLH8.lnk.disabled
O4 - Global Startup: Z1OYYKHY.lnk.disabled
O4 - Global Startup: XY4N6L5J.lnk.disabled
O4 - Global Startup: PW8HEQOP.lnk.disabled
Post #13
Hi about the startups please do this. –Go to: C:\WINDOWS\All Users\Start Menu\Programs\StartUp Find and delete any shortcuts with <"8 chars.lnk.disabled"> –Same for: WINDOWS\Start Menu\Programs\StartUp folder. After that rescan with HJT and post a new log here. Also please describe how your computer behaves.
Post #14
I was unable to find the "8 chars.lnk.disabled" in either of the folders. I could see all the shortcuts that are listed in the Q4 Section of the HijackThis log, but could not find the "8 chars.link." Perhaps I misread your directions… As of now, the computer seems to be running great. After fixing what little eagle told me to fix, I have not experienced anymore pop-up ads. But as I mentioned to him/her in one of my replies, before I disabled these shortcuts in the startup menu (using SpyBot S&D), my computer would always try and search for them while Windows desktop finished loading. I would try and delete the shortcuts (that made the computer search for them in the first place), but new ones would always appear. Also, before little eagle's adivse (and after I disabled the shortcuts), the computer would stall after the Windows logo on startup. All I would see was the hour glass, which would occasionally blink. To get windows to finish loading I would Ctrl+Alt+Delete to stop whatever shady program was running in the background. It was usuaully just some weird program alongside "Runonce" or "Regsvr32" and sometimes with "Explorer." The program that I had to end to get to the desktop to show was "Ac2icyx." After doing some research online I determined that this program could be deleted with out a problem, but after deleting it, I would just get a new program stalling the start-up on the next reboot.
Post #15
Sorry about that :( I should have explained a bit more… I meant all the disabled startups that look like for example like this O4 - Startup: QD50IGBM.lnk.disabled (8 chars). Please remove them and after that post a new log fron HJT

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI