Blue Toolbar!!!!?????!!!!!!!!!

Unknown · September 2004

Everytime i open IE i get this stupid blue toolbar at the bottom

Tried spybot/adaware....VERY frustrated

Any help would be appreciated

Hijackthis log:

Logfile of HijackThis v1.98.2
Scan saved at 10:17:03 PM, on 24/09/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\WINDOWS\SYSTEM\FPDISP5A.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\KAZAA LITE K++\KAZAALITE.KPP
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\TEMP\TD_0003.DIR\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.joolyxjkotebf.uk/Nnsoo6NFSmxNq8sDx8tl8rYOnz8fM5QY1XO1ndn9KRWVQ/cayoMCNtb2lGrWOmyU.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://0websearch.com/
R3 - Default URLSearchHook is missing
F1 - win.ini: run=C:\WINDOWS\INETDATA\SERVICES.EXE
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {BBAB4E51-94E1-45A3-AB16-011A4A0DBB93} - C:\WINDOWS\MWSHELP.DLL (file missing)
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\QUESTMOD.DLL
O2 - BHO: (no name) - {E1BFE771-6B52-0A40-F6A2-31C789D1BCB9} - C:\PROGRAM FILES\AMOK RECT\BEEPNEW.EXE
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1721.0\EN-CA\MSNTB.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TheAxis] C:\PROGRA~1\STARTT~1\Dart time bib.exe
O4 - HKLM\..\Run: [Comp body chin bolt] C:\WINDOWS\All Users\Application Data\Bindbytecompbody\intra second.exe
O4 - HKLM\..\Run: [saap] c:\windows\180solutions\saap.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\SYSTEM\fpdisp5a.exe
O4 - HKLM\..\Run: [fot] C:\WINDOWS\fot.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-L88UD.exe /REG
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1382ff13ada79713e914/netzip/RdxIE601.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/NrsgroupUD_1.0.0.3ie.cab?
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

SpywareShooter · September 2004

Welcome to Short Media forums.

Before doing the following, please Set your computer to show hidden files and folders, Disable System Restore, and Reboot in Safe Mode.

Once you have done that, Run HijackThis and have it fix the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.joolyxjkotebf.uk/Nnsoo6N...b2lGrWOmyU.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://0websearch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {BBAB4E51-94E1-45A3-AB16-011A4A0DBB93} - C:\WINDOWS\MWSHELP.DLL (file missing)
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\QUESTMOD.DLL
O2 - BHO: (no name) - {E1BFE771-6B52-0A40-F6A2-31C789D1BCB9} - C:\PROGRAM FILES\AMOK RECT\BEEPNEW.EXE
O4 - HKLM\..\Run: [saap] c:\windows\180solutions\saap.exe
O4 - HKLM\..\Run: [fot] C:\WINDOWS\fot.exe

Then find and locate the files listed above and Quarentine Them.

Once you have done that, reboot, scan with HiijackThis again, and post a new log.

hova · September 2004

SpywareShooter wrote:

Welcome to Short Media forums.

Before doing the following, please Set your computer to show hidden files and folders, Disable System Restore, and Reboot in Safe Mode.

Once you have done that, Run HijackThis and have it fix the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.joolyxjkotebf.uk/Nnsoo6N...b2lGrWOmyU.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://0websearch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {BBAB4E51-94E1-45A3-AB16-011A4A0DBB93} - C:\WINDOWS\MWSHELP.DLL (file missing)
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\QUESTMOD.DLL
O2 - BHO: (no name) - {E1BFE771-6B52-0A40-F6A2-31C789D1BCB9} - C:\PROGRAM FILES\AMOK RECT\BEEPNEW.EXE
O4 - HKLM\..\Run: [saap] c:\windows\180solutions\saap.exe
O4 - HKLM\..\Run: [fot] C:\WINDOWS\fot.exe

Then find and locate the files listed above and Quarentine Them.

Once you have done that, reboot, scan with HiijackThis again, and post a new log.

Thanks For The Reply....I Did as You asked, Here is my new Log

Any help is greatly appreciated.

Logfile of HijackThis v1.98.2
Scan saved at 9:10:36 PM, on 26/09/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\WINDOWS\SYSTEM\FPDISP5A.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zlmodehgxa.com/Nnsoo6NFSmxNq8sDx8tl8rYOnz8fM5QY1XO1ndn9KRWi7pb8KYbvmtb2lGrWOmyU.html
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1721.0\EN-CA\MSNTB.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TheAxis] C:\PROGRA~1\STARTT~1\Dart time bib.exe
O4 - HKLM\..\Run: [Comp body chin bolt] C:\WINDOWS\All Users\Application Data\Bindbytecompbody\intra second.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\SYSTEM\fpdisp5a.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0521.DLL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1382ff13ada79713e914/netzip/RdxIE601.cab
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/NrsgroupUD_1.0.0.3ie.cab?
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

SpywareShooter · September 2004

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zlmodehgxa.com/Nnsoo6NFS...b2lGrWOmyU.html

That appears to be the only bad part in your log. Are you still having any problems?

hova · September 2004

SpywareShooter wrote:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zlmodehgxa.com/Nnsoo6NFS...b2lGrWOmyU.html

That appears to be the only bad part in your log. Are you still having any problems?

SpywareShooter · September 2004

O4 - HKLM\..\Run: [TheAxis] C:\PROGRA~1\STARTT~1\Dart time bib.exe
O4 - HKLM\..\Run: [Comp body chin bolt] C:\WINDOWS\All Users\Application Data\Bindbytecompbody\intra second.exe

Those could be causing the problem. I'm sure they are not required system files. Fix those entries then find and quarentine the files.

hova · September 2004

SpywareShooter wrote:

O4 - HKLM\..\Run: [TheAxis] C:\PROGRA~1\STARTT~1\Dart time bib.exe
O4 - HKLM\..\Run: [Comp body chin bolt] C:\WINDOWS\All Users\Application Data\Bindbytecompbody\intra second.exe

Those could be causing the problem. I'm sure they are not required system files. Fix those entries then find and quarentine the files.

THANK YOU!!
Fixed, Found those files and erased them

Blue Toolbar GONE, "Iexplore" GONE.......I appreciate the help

Just 2 more minor things, in the prosess the "search" option from my start menu has now disappeared

And everytime i open a folder Now I get a "Security Alert" saying

"The file or folder you are opening contains Web content that may be unsafe the web content has either been modified or is from an unknown source. Do you want it to be initiallized and accessed by the scripts?"

I have been clicking No just cause it sounds kinda scary, This happens for ever folder i click on including "My Computer"

Whats with that?? Any Ideas?

SpywareShooter · September 2004

Can you please post a new log? Maybe there is a piece of spyware doing it. I'm not exactly sure though, as I've never heard of that problem.

hova · September 2004

SpywareShooter wrote:

Can you please post a new log? Maybe there is a piece of spyware doing it. I'm not exactly sure though, as I've never heard of that problem.

Sorry I cannot Post A LOG, Everytime I Run HijackThis it Frezzes half way thorough the scan, And my computer then shuts down, I then have to keep it off for like 3-4 hours before it will turn on again.....

I am finding that I am getting ALOT of those blue screen errors in windows as well.......

I think It is Time to Format and start over new....ANY Suggestions????

Thank You

primesuspect · September 2004

Don't reformat.

First download and run OmegaKiller SM 1.2 from our security downloads page (link in my sig). Then, after you've run that, boot into safe mode and get a HJT log.

Reboot and then post the HJT log.

hova · September 2004

primesuspect wrote:

Don't reformat.

First download and run OmegaKiller SM 1.2 from our security downloads page (link in my sig). Then, after you've run that, boot into safe mode and get a HJT log.

Reboot and then post the HJT log.

If i try to run OMEGAKILLER it errors saying

"The PSAPI.Dll file is linked to missing export NTDLL.DLL:wcslen"

???????????????????

primesuspect · October 2004

Oh, I'm sorry, I neglected to see that you have windows ME. OmegaKiller only runs on 2000/XP.

If your computer is hard freezing, it might be a hardware problem. Perhaps you should check your memory first....

www.memtest.org

Blue Toolbar!!!!?????!!!!!!!!!

Comments