Novice- Spyware headache

Unknown
edited May 2005 in Spyware & Virus Removal
Hello, I've cleaned up most of the spyware on my computer through ad-aware and spybot, but there are a few pesky ones remaining that are driving me NUTS. [i.e. www.z1.adserver.com and ads1.searchassistant. Please help me get my computer back on track. Thank You.


Logfile of HijackThis v1.99.1
Scan saved at 8:40:54 PM, on 5/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\oybo\hyietsnu.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Bmted\Fslih.exe
C:\WINDOWS\system32\winupdt.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\rzvnia.exe
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
C:\WINDOWS\seeve.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\msw\BMan.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\system32\wintask.exe
C:\windows\system32\tfckvaqgoy.exe
C:\WINDOWS\system32\drnagktk\weje.exe
C:\windows\system32\cxdxregt.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\lffml3a.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\nroko\rrfjint.exe
C:\WINDOWS\system32\ktygnl\vqaf.exe
C:\WINDOWS\system32\ckjrwll\druc.exe
C:\WINDOWS\system32\bkgyeyv\fmdmdfd.exe
C:\WINDOWS\system32\yawp\gqdxb.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\autodrop.exe
C:\WINDOWS\system32\autodrop.exe
C:\WINDOWS\system32\sew.exe
C:\WINDOWS\system32\sew.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC07.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ssysqzd8.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Michelle\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A3F78287-46E2-BA88-A74F-94C5F29107FB} - C:\WINDOWS\system32\lcdnbojd\ugwolnhl.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Vehojil] C:\Program Files\Bmted\Fslih.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdt.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exe
O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\system32\psoft1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [tgng] C:\WINDOWS\system32\ubmh\tgng.exe
O4 - HKLM\..\Run: [ihpgoa] C:\WINDOWS\system32\hegw\ihpgoa.exe
O4 - HKLM\..\Run: [ymqjwvvy] C:\WINDOWS\system32\bwqax\ymqjwvvy.exe
O4 - HKLM\..\Run: [cvbuee] C:\WINDOWS\system32\awlqih\cvbuee.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitezhb32.exe
O4 - HKLM\..\Run: [xxeb] C:\WINDOWS\system32\mjyhi\xxeb.exe
O4 - HKLM\..\Run: [qmqw] C:\WINDOWS\system32\lxlu\qmqw.exe
O4 - HKLM\..\Run: [wvoai] C:\WINDOWS\system32\scgxs\wvoai.exe
O4 - HKLM\..\Run: [njlql] C:\WINDOWS\system32\ltcjxot\njlql.exe
O4 - HKLM\..\Run: [daan] C:\WINDOWS\system32\lfigy\daan.exe
O4 - HKLM\..\Run: [rtibof] C:\WINDOWS\system32\ywcep\rtibof.exe
O4 - HKLM\..\Run: [nsye] C:\WINDOWS\system32\ehdqy\nsye.exe
O4 - HKLM\..\Run: [ZStart] C:\windows\system32\cxdxregt.exe 0
O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Michelle\LOCALS~1\Temp\ncvgyd.exe
O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Michelle\LOCALS~1\Temp\hinnms.exe
O4 - HKLM\..\Run: [hyietsnu] C:\WINDOWS\system32\oybo\hyietsnu.exe
O4 - HKLM\..\Run: [weje] C:\WINDOWS\system32\drnagktk\weje.exe
O4 - HKLM\..\Run: [gqdxb] C:\WINDOWS\system32\yawp\gqdxb.exe
O4 - HKLM\..\Run: [rrfjint] C:\WINDOWS\system32\nroko\rrfjint.exe
O4 - HKLM\..\Run: [jjqol] C:\WINDOWS\system32\gnsxnx\jjqol.exe
O4 - HKLM\..\Run: [vqaf] C:\WINDOWS\system32\ktygnl\vqaf.exe
O4 - HKLM\..\Run: [yolm] C:\WINDOWS\system32\qqvjwpgs\yolm.exe
O4 - HKLM\..\Run: [druc] C:\WINDOWS\system32\ckjrwll\druc.exe
O4 - HKLM\..\Run: [fmdmdfd] C:\WINDOWS\system32\bkgyeyv\fmdmdfd.exe
O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\system32\ssysqzd8.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [foo6RVj6U] lffml3a.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MBKWBarManager] C:\Program Files\MBKWBar\TManager.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\ssysqzd8.exe
O4 - Startup: Zstart.lnk = C:\WINDOWS\SYSTEM32\zxinst12.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c10.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0015.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {FDCC1518-6A63-11D9-AAC8-91EC5E497716} - http://www.ouchvideo.com/mmviewer_emg11.cab
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: hyietsnuoybo - Unknown owner - C:\WINDOWS\system32\oybo\hyietsnu.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: xxebmjyhi - Unknown owner - C:\WINDOWS\system32\mjyhi\xxeb.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Make sure that you can VIEW ALL HIDDEN FILES.


    Please download and install A-Squared. You will have to register with them in order to install the updates, but it's free. Once updated, run a full scan and remove everything that is found.

    http://www.majorgeeks.com/download4281.html


    Reboot and post a new hijackthis log.
  • mmai80
    edited May 2005
    Buckeye_Sam wrote:
    Make sure that you can VIEW ALL HIDDEN FILES.

    Please download and install A-Squared. You will have to register with them in order to install the updates, but it's free. Once updated, run a full scan and remove everything that is found.

    http://www.majorgeeks.com/download4281.html


    Reboot and post a new hijackthis log.

    This is my updated hijackthis log: Please review and advise. Thank You.

    Logfile of HijackThis v1.99.1
    Scan saved at 10:03:34 PM, on 5/4/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\oybo\hyietsnu.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINDOWS\system32\winupdt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rzvnia.exe
    C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\WINDOWS\seeve.exe
    C:\DOCUME~1\ALLUSE~1\APPLIC~1\msw\BMan.exe
    C:\WINDOWS\system32\psoft1.exe
    C:\WINDOWS\system32\lxlu\qmqw.exe
    C:\WINDOWS\system32\ckjrwll\druc.exe
    C:\WINDOWS\system32\bkgyeyv\fmdmdfd.exe
    C:\WINDOWS\system32\ltcjxot\njlql.exe
    C:\WINDOWS\system32\yawp\gqdxb.exe
    C:\WINDOWS\system32\ywcep\rtibof.exe
    C:\WINDOWS\system32\ehdqy\nsye.exe
    C:\windows\system32\qodxregx.exe
    C:\WINDOWS\system32\drnagktk\weje.exe
    C:\DOCUME~1\Michelle\LOCALS~1\Temp\aypv.exe
    C:\WINDOWS\system32\nroko\rrfjint.exe
    C:\WINDOWS\system32\gnsxnx\jjqol.exe
    C:\WINDOWS\system32\ktygnl\vqaf.exe
    C:\WINDOWS\system32\qqvjwpgs\yolm.exe
    C:\WINDOWS\system32\ssysqzd8.exe
    C:\Program Files\Microsoft Money\System\mnyexpr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\AIM\aim.exe
    C:\PROGRA~1\ezula\mmod.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\DOCUME~1\Michelle\LOCALS~1\Temp\tfxtov.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: 216.39.69.102 view.atdmt.com
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {A3F78287-46E2-BA88-A74F-94C5F29107FB} - C:\WINDOWS\system32\lcdnbojd\ugwolnhl.dll
    O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [Vehojil] C:\Program Files\Bmted\Fslih.exe
    O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdt.exe
    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe
    O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
    O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
    O4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exe
    O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\system32\psoft1.exe
    O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
    O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
    O4 - HKLM\..\Run: [tgng] C:\WINDOWS\system32\ubmh\tgng.exe
    O4 - HKLM\..\Run: [ihpgoa] C:\WINDOWS\system32\hegw\ihpgoa.exe
    O4 - HKLM\..\Run: [ymqjwvvy] C:\WINDOWS\system32\bwqax\ymqjwvvy.exe
    O4 - HKLM\..\Run: [cvbuee] C:\WINDOWS\system32\awlqih\cvbuee.exe
    O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitezhb32.exe
    O4 - HKLM\..\Run: [xxeb] C:\WINDOWS\system32\mjyhi\xxeb.exe
    O4 - HKLM\..\Run: [qmqw] C:\WINDOWS\system32\lxlu\qmqw.exe
    O4 - HKLM\..\Run: [wvoai] C:\WINDOWS\system32\scgxs\wvoai.exe
    O4 - HKLM\..\Run: [njlql] C:\WINDOWS\system32\ltcjxot\njlql.exe
    O4 - HKLM\..\Run: [daan] C:\WINDOWS\system32\lfigy\daan.exe
    O4 - HKLM\..\Run: [rtibof] C:\WINDOWS\system32\ywcep\rtibof.exe
    O4 - HKLM\..\Run: [nsye] C:\WINDOWS\system32\ehdqy\nsye.exe
    O4 - HKLM\..\Run: [ZStart] C:\windows\system32\qodxregx.exe 0
    O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Michelle\LOCALS~1\Temp\nfsgk.exe
    O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Michelle\LOCALS~1\Temp\aypv.exe
    O4 - HKLM\..\Run: [hyietsnu] C:\WINDOWS\system32\oybo\hyietsnu.exe
    O4 - HKLM\..\Run: [weje] C:\WINDOWS\system32\drnagktk\weje.exe
    O4 - HKLM\..\Run: [gqdxb] C:\WINDOWS\system32\yawp\gqdxb.exe
    O4 - HKLM\..\Run: [rrfjint] C:\WINDOWS\system32\nroko\rrfjint.exe
    O4 - HKLM\..\Run: [jjqol] C:\WINDOWS\system32\gnsxnx\jjqol.exe
    O4 - HKLM\..\Run: [vqaf] C:\WINDOWS\system32\ktygnl\vqaf.exe
    O4 - HKLM\..\Run: [yolm] C:\WINDOWS\system32\qqvjwpgs\yolm.exe
    O4 - HKLM\..\Run: [druc] C:\WINDOWS\system32\ckjrwll\druc.exe
    O4 - HKLM\..\Run: [fmdmdfd] C:\WINDOWS\system32\bkgyeyv\fmdmdfd.exe
    O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\system32\ssysqzd8.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\tfxtov.exe
    O4 - HKLM\..\Run: [qwlt] C:\WINDOWS\system32\ecwfdy\qwlt.exe
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [foo6RVj6U] lffml3a.exe
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [MBKWBarManager] C:\Program Files\MBKWBar\TManager.exe
    O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
    O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\ssysqzd8.exe
    O4 - Startup: Zstart.lnk = C:\WINDOWS\SYSTEM32\cxdxregt.exe
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Image Transfer.lnk = ?
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.popuppers.com
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c10.cab
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
    O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab
    O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0015.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O16 - DPF: {FDCC1518-6A63-11D9-AAC8-91EC5E497716} - http://www.ouchvideo.com/mmviewer_emg11.cab
    O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: hyietsnuoybo - Unknown owner - C:\WINDOWS\system32\oybo\hyietsnu.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: xxebmjyhi - Unknown owner - C:\WINDOWS\system32\mjyhi\xxeb.exe
  • mmai80
    edited May 2005
    Also, shortly after I ran the a-squared program and rebooted my computer... I am having BIG problems with computer speed. The error message states I do not have enough memory to access some web pages I've tried pulling up. (i know this is a REALLY bad message to get) It also states it is now missing a file that is needed to run msdos correctly.

    Please advise. thank you.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    You are heavily infected so it's no surprise that your computer is running very poorly. You have a nasty trojan that may take a few steps to completely clean up.


    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: 216.39.69.102 view.atdmt.com
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr51.dll
    O2 - BHO: (no name) - {A3F78287-46E2-BA88-A74F-94C5F29107FB} - C:\WINDOWS\system32\lcdnbojd\ugwolnhl.dll
    O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
    O4 - HKLM\..\Run: [Vehojil] C:\Program Files\Bmted\Fslih.exe
    O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdt.exe
    O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
    O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe
    O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
    O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
    O4 - HKLM\..\Run: [seeve] C:\WINDOWS\seeve.exe
    O4 - HKLM\..\Run: [PSoft1] C:\WINDOWS\system32\psoft1.exe
    O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
    O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
    O4 - HKLM\..\Run: [tgng] C:\WINDOWS\system32\ubmh\tgng.exe
    O4 - HKLM\..\Run: [ihpgoa] C:\WINDOWS\system32\hegw\ihpgoa.exe
    O4 - HKLM\..\Run: [ymqjwvvy] C:\WINDOWS\system32\bwqax\ymqjwvvy.exe
    O4 - HKLM\..\Run: [cvbuee] C:\WINDOWS\system32\awlqih\cvbuee.exe
    O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitezhb32.exe
    O4 - HKLM\..\Run: [xxeb] C:\WINDOWS\system32\mjyhi\xxeb.exe
    O4 - HKLM\..\Run: [qmqw] C:\WINDOWS\system32\lxlu\qmqw.exe
    O4 - HKLM\..\Run: [wvoai] C:\WINDOWS\system32\scgxs\wvoai.exe
    O4 - HKLM\..\Run: [njlql] C:\WINDOWS\system32\ltcjxot\njlql.exe
    O4 - HKLM\..\Run: [daan] C:\WINDOWS\system32\lfigy\daan.exe
    O4 - HKLM\..\Run: [rtibof] C:\WINDOWS\system32\ywcep\rtibof.exe
    O4 - HKLM\..\Run: [nsye] C:\WINDOWS\system32\ehdqy\nsye.exe
    O4 - HKLM\..\Run: [ZStart] C:\windows\system32\qodxregx.exe 0
    O4 - HKLM\..\Run: [SkyH2] C:\DOCUME~1\Michelle\LOCALS~1\Temp\nfsgk.exe
    O4 - HKLM\..\Run: [hshnin] C:\DOCUME~1\Michelle\LOCALS~1\Temp\aypv.exe
    O4 - HKLM\..\Run: [hyietsnu] C:\WINDOWS\system32\oybo\hyietsnu.exe
    O4 - HKLM\..\Run: [weje] C:\WINDOWS\system32\drnagktk\weje.exe
    O4 - HKLM\..\Run: [gqdxb] C:\WINDOWS\system32\yawp\gqdxb.exe
    O4 - HKLM\..\Run: [rrfjint] C:\WINDOWS\system32\nroko\rrfjint.exe
    O4 - HKLM\..\Run: [jjqol] C:\WINDOWS\system32\gnsxnx\jjqol.exe
    O4 - HKLM\..\Run: [vqaf] C:\WINDOWS\system32\ktygnl\vqaf.exe
    O4 - HKLM\..\Run: [yolm] C:\WINDOWS\system32\qqvjwpgs\yolm.exe
    O4 - HKLM\..\Run: [druc] C:\WINDOWS\system32\ckjrwll\druc.exe
    O4 - HKLM\..\Run: [fmdmdfd] C:\WINDOWS\system32\bkgyeyv\fmdmdfd.exe
    O4 - HKLM\..\Run: [SysStart] C:\WINDOWS\system32\ssysqzd8.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\tfxtov.exe
    O4 - HKLM\..\Run: [qwlt] C:\WINDOWS\system32\ecwfdy\qwlt.exe
    O4 - HKCU\..\Run: [foo6RVj6U] lffml3a.exe
    O4 - HKCU\..\Run: [MBKWBarManager] C:\Program Files\MBKWBar\TManager.exe
    O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
    O4 - Startup: Zeno.lnk = C:\WINDOWS\SYSTEM32\ssysqzd8.exe
    O4 - Startup: Zstart.lnk = C:\WINDOWS\SYSTEM32\cxdxregt.exe
    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.popuppers.com
    O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c10.cab
    O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0015.exe
    O23 - Service: hyietsnuoybo - Unknown owner - C:\WINDOWS\system32\oybo\hyietsnu.exe
    O23 - Service: xxebmjyhi - Unknown owner - C:\WINDOWS\system32\mjyhi\xxeb.exe



    Reboot your computer into SAFE MODE

    Then delete these files or directories (Do not be concerned if they do not exist):

    lffml3a.exe
    AUNPS2.DLL
    C:\WINDOWS\system32\lcdnbojd <-- this folder
    C:\WINDOWS\system32\winupdt.exe
    C:\WINDOWS\system32\rzvnia.exe
    C:\WINDOWS\cfgmgr51.dll
    C:\WINDOWS\seeve.exe
    C:\WINDOWS\system32\psoft1.exe
    C:\WINDOWS\system32\exp.exe
    C:\WINDOWS\system32\wintask.exe
    C:\WINDOWS\system32\ubmh <-- this folder
    C:\WINDOWS\system32\hegw <-- this folder
    C:\WINDOWS\system32\bwqax <-- this folder
    C:\WINDOWS\system32\awlqih <-- this folder
    C:\windows\system32\elitezhb32.exe
    C:\WINDOWS\system32\mjyhi <-- this folder
    C:\WINDOWS\system32\lxlu <-- this folder
    C:\WINDOWS\system32\scgxs <-- this folder
    C:\WINDOWS\system32\ltcjxot <-- this folder
    C:\WINDOWS\system32\lfigy <-- this folder
    C:\WINDOWS\system32\ywcep <-- this folder
    C:\WINDOWS\system32\ehdqy <-- this folder
    C:\windows\system32\qodxregx.exe
    C:\WINDOWS\system32\oybo <-- this folder
    C:\WINDOWS\system32\drnagktk <-- this folder
    C:\WINDOWS\system32\yawp <-- this folder
    C:\WINDOWS\system32\nroko <-- this folder
    C:\WINDOWS\system32\gnsxnx <-- this folder
    C:\WINDOWS\system32\ktygnl <-- this folder
    C:\WINDOWS\system32\qqvjwpgs <-- this folder
    C:\WINDOWS\system32\ckjrwll <-- this folder
    C:\WINDOWS\system32\bkgyeyv <-- this folder
    C:\WINDOWS\system32\ssysqzd8.exe
    C:\WINDOWS\system32\tfxtov.exe
    C:\WINDOWS\system32\ecwfdy <-- this folder
    C:\Program Files\MBKWBar <-- this folder
    C:\PROGRA~1\ezula <-- this folder
    C:\Program Files\Bmted <-- this folder
    C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe


    Delete temp files

    Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.

    Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

    Empty the Recycle Bin.


    Reboot your computer to go back to normal mode and post a new log.
  • mmai80
    edited May 2005
    I followed your instructions and here is my updated hijackthis log:
    Thank You!

    Logfile of HijackThis v1.99.1
    Scan saved at 5:56:20 PM, on 5/5/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\WINDOWS\system32\tfxtov.exe
    C:\WINDOWS\system32\rzvnia.exe
    C:\Program Files\Microsoft Money\System\mnyexpr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\AIM\aim.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\HiJackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedfo32.exe
    O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\tfxtov.exe
    O4 - HKLM\..\Run: [hyietsnu] C:\WINDOWS\system32\oybo\hyietsnu.exe
    O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: Image Transfer.lnk = ?
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
    O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
    O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
    O16 - DPF: {FDCC1518-6A63-11D9-AAC8-91EC5E497716} - http://www.ouchvideo.com/mmviewer_emg11.cab
    O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
  • mmai80
    edited May 2005
    Ive noticed that after I deleted the files you recommended, I am getting quite a bit more pop-ups from one particular site named www.ads1.searchmiracle.com or another variation of he prefix "ads1.xxxx" such as www.ads1.revenue.net.

    Also, when I run Spybot, there is one particular file that I can never fully delete named coolwebsearch.

    if you can advise me on the steps to get rid of these also. I really appreciate you help.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    You are still infected. This may take several additional steps to completely remove the trojans that are still on your computer. We will get you cleaned up, but it's not an immediate fix.

    Now I need to see two new log files that will help identify hidden files on your computer that need to be deleted.


    Download rkfiles.zip
    http://skads.org/special/rkfiles.zip
    Unzip the contents to a permanent folder.

    Reboot your computer into Safe Mode


    Doubleclick rkfiles.bat
    It will scan for a while, so please be patient.
    Wait till the DOS window closes and reboot back to normal mode.

    Post the contents of C:\log.txt in your next reply.



    Please download FindQoologic from here:
    http://forums.net-integration.net/index.php?act=Attach&type=post&id=134981
    Save it to the desktop and run Find-Qoologic2.bat. This will generate a log file; please post the entire contents of the log file here for me to see.
  • mmai80-2
    edited May 2005
    Sorry about the delayed response, I've had trouble logging onto short-media.com from my computer at home. But, here are the two logs you requested to view. Thank You!

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

    »»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»





    »»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»»



    (fstarts by IMM - test ver. 0.001) NOT using address check -- 0x7c90df5e



    Global Startup:

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup

    .

    ..

    dant.exe

    DESKTOP.INI

    hp psc 1000 series.lnk

    hpoddt01.exe.lnk

    Image Transfer.lnk



    User Startup:

    C:\Documents and Settings\Michelle\Start Menu\Programs\Startup

    .

    ..

    DESKTOP.INI



    »»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»»



    ! REG.EXE VERSION 3.0



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\gyfqmsyt

    <NO NAME> REG_SZ {4fa48fd9-3492-491c-ae7f-0aa8e2df7eeb}



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files

    <NO NAME> REG_SZ {750fdf0e-2a26-11d1-a3ea-080036587f03}



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With

    <NO NAME> REG_SZ {09799AFB-AD67-11d1-ABCD-00C04FC30936}



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu

    <NO NAME> REG_SZ {A470F8CF-A1E8-4f65-8335-227475AA5C46}



    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}

    <NO NAME> REG_SZ Start Menu Pin



    »»»»»»»»»»»»»»»»»»»»»»»»» Active setup »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»



    "Find activesetup", version1, launched at: 18:54

    Operating System: Windows XP SP2





    HKLM\Software\Microsoft\Active Setup\Installed Components\

    ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "Microsoft Windows Media Player"

    \StubPath = "C:\WINDOWS\inf\unregmp2.exe /ShowWMP" [MS]

    "ba5c5fda-9845-4469-a0d6-0cf4d2cdf1e3\(Default)" = ""

    \StubPath = "C:\WINDOWS\system32\cabodxa.exe" [null data]



    SECOND LOG with SKADS
    ::
    C:\Program Files\Skads\Skads



    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

    Files Found in system Folder............

    C:\WINDOWS\SYSTEM32\1800414.dll: UPX!

    C:\WINDOWS\SYSTEM32\delfin0414.dll: UPX!

    C:\WINDOWS\SYSTEM32\fbsd.exe: UPX!

    C:\WINDOWS\SYSTEM32\fxgwtxdb.exe: UPX!

    C:\WINDOWS\SYSTEM32\goldnew2b0414.dll: UPX!

    C:\WINDOWS\SYSTEM32\jvish.exe: UPX!

    C:\WINDOWS\SYSTEM32\kgcqvh.exe: UPX!

    C:\WINDOWS\SYSTEM32\msclock32.dll: UPX!

    C:\WINDOWS\SYSTEM32\nhkavnqw.exe: UPX!

    C:\WINDOWS\SYSTEM32\nraad.dll: UPX!

    C:\WINDOWS\SYSTEM32\poker.exe: UPX!

    C:\WINDOWS\SYSTEM32\psoft1.exe: UPX!

    C:\WINDOWS\SYSTEM32\pytgsey.dll: UPX!

    C:\WINDOWS\SYSTEM32\qool414.dll: UPX!

    C:\WINDOWS\SYSTEM32\qupvw.dat: UPX!

    C:\WINDOWS\SYSTEM32\rzvnia.exe: UPX!

    C:\WINDOWS\SYSTEM32\utwcnxy.exe: UPX!

    C:\WINDOWS\SYSTEM32\winup2date.dll: UPX!

    C:\WINDOWS\SYSTEM32\winupdt.exe: UPX!

    C:\WINDOWS\SYSTEM32\wmconfig.cpl: UPX!

    C:\WINDOWS\SYSTEM32\elitecoc32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitedfo32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitedno32.exe: FSG!

    C:\WINDOWS\SYSTEM32\eliteduh32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitedza32.exe: FSG!

    C:\WINDOWS\SYSTEM32\eliteezi32.exe: FSG!

    C:\WINDOWS\SYSTEM32\eliteflf32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitefmw32.exe: FSG!

    C:\WINDOWS\SYSTEM32\eliteklf32.exe: FSG!

    C:\WINDOWS\SYSTEM32\eliteowm32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitepbh32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitersk32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitersv32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitesae32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitetbm32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitexsf32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitexut32.exe: FSG!

    C:\WINDOWS\SYSTEM32\elitexxp32.exe: FSG!

    C:\WINDOWS\SYSTEM32\temperror32.dat: FSG!

    C:\WINDOWS\SYSTEM32\DFRG.MSC: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213



    Files Found in all users startup Folder............

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dant.exe: UPX!

    Files Found in all users windows Folder............

    C:\WINDOWS\del.tmp: UPX!

    C:\WINDOWS\mynewimurl.exe: UPX!

    C:\WINDOWS\ss3unstl.exe: UPX!

    Finished

    bye
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Now we can see where the problem files are.

    Download the Pocket Killbox.

    Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.
    • Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:


        C:\WINDOWS\SYSTEM32\1800414.dll
        C:\WINDOWS\SYSTEM32\delfin0414.dll
        C:\WINDOWS\SYSTEM32\fbsd.exe
        C:\WINDOWS\SYSTEM32\fxgwtxdb.exe
        C:\WINDOWS\SYSTEM32\goldnew2b0414.dll
        C:\WINDOWS\SYSTEM32\jvish.exe
        C:\WINDOWS\SYSTEM32\kgcqvh.exe
        C:\WINDOWS\SYSTEM32\msclock32.dll
        C:\WINDOWS\SYSTEM32\nhkavnqw.exe
        C:\WINDOWS\SYSTEM32\nraad.dll
        C:\WINDOWS\SYSTEM32\poker.exe
        C:\WINDOWS\SYSTEM32\psoft1.exe
        C:\WINDOWS\SYSTEM32\pytgsey.dll
        C:\WINDOWS\SYSTEM32\qool414.dll
        C:\WINDOWS\SYSTEM32\qupvw.dat
        C:\WINDOWS\SYSTEM32\rzvnia.exe
        C:\WINDOWS\SYSTEM32\utwcnxy.exe
        C:\WINDOWS\SYSTEM32\winup2date.dll
        C:\WINDOWS\SYSTEM32\winupdt.exe
        C:\WINDOWS\SYSTEM32\wmconfig.cpl
        C:\WINDOWS\SYSTEM32\elitecoc32.exe
        C:\WINDOWS\SYSTEM32\elitedfo32.exe
        C:\WINDOWS\SYSTEM32\elitedno32.exe
        C:\WINDOWS\SYSTEM32\eliteduh32.exe
        C:\WINDOWS\SYSTEM32\elitedza32.exe
        C:\WINDOWS\SYSTEM32\eliteezi32.exe
        C:\WINDOWS\SYSTEM32\eliteflf32.exe
        C:\WINDOWS\SYSTEM32\elitefmw32.exe
        C:\WINDOWS\SYSTEM32\eliteklf32.exe
        C:\WINDOWS\SYSTEM32\eliteowm32.exe
        C:\WINDOWS\SYSTEM32\elitepbh32.exe
        C:\WINDOWS\SYSTEM32\elitersk32.exe
        C:\WINDOWS\SYSTEM32\elitersv32.exe
        C:\WINDOWS\SYSTEM32\elitesae32.exe
        C:\WINDOWS\SYSTEM32\elitetbm32.exe
        C:\WINDOWS\SYSTEM32\elitexsf32.exe
        C:\WINDOWS\SYSTEM32\elitexut32.exe
        C:\WINDOWS\SYSTEM32\elitexxp32.exe
        C:\WINDOWS\SYSTEM32\temperror32.dat
        C:\WINDOWS\del.tmp
        C:\WINDOWS\mynewimurl.exe
        C:\WINDOWS\ss3unstl.exe
        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dant.exe


      [*]Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
      [*]Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

      You system will reboot now.



      Please post a new hijackthis log and a new rkfiles log.
    • mmai80-2
      edited May 2005
      Thanks for your responses..here are the logs you requested:

      MY Hijackthis log:

      Logfile of HijackThis v1.99.1
      Scan saved at 9:15:18 PM, on 5/10/2005
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Dell\Media Experience\DMXLauncher.exe
      C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
      C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
      C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
      C:\Program Files\Real\RealPlayer\RealPlay.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\Program Files\Microsoft Money\System\mnyexpr.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\AIM\aim.exe
      C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
      C:\WINDOWS\system32\msiexec.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\DOCUME~1\Michelle\LOCALS~1\Temp\Temporary Directory 2 for
      hijackthis.zip\HijackThis.exe
      C:\WINDOWS\system32\wuauclt.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL
      = http://www.dell4me.com/myway
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      http://www.dell4me.com/myway
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
      C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
      Files\Java\j2re1.4.2_03\bin\jusched.exe
      O4 - HKLM\..\Run: [IntelWireless] C:\Program
      Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI
      Control Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media
      Experience\DMXLauncher.exe
      O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common
      Files\Sonic\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch
      Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch
      Jukebox\mmtask.exe
      O4 - HKLM\..\Run: [RealTray] C:\Program
      Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
      Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common
      Files\Dell\EUSW\Support.exe
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft
      IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedfo32.exe
      O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\tfxtov.exe
      O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft
      Money\System\mnyexpr.exe"
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
      /background
      O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
      O4 - Global Startup: hp psc 1000 series.lnk = ?
      O4 - Global Startup: hpoddt01.exe.lnk = ?
      O4 - Global Startup: Image Transfer.lnk = ?
      O8 - Extra context menu item: &AIM Search - res://C:\Program
      Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
      - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console -
      {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
      Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
      C:\PROGRA~1\AIM\aim.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
      - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
      - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger -
      {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
      Files\Messenger\msmsgs.exe
      O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl
      Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
      O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl
      Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} -
      http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
      O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class)
      - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
      http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
      O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl
      Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
      O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online
      Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
      O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl
      Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
      O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader
      Object) -
      http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
      O16 - DPF: {FDCC1518-6A63-11D9-AAC8-91EC5E497716} -
      http://www.ouchvideo.com/mmviewer_emg11.cab
      O20 - Winlogon Notify: IntelWireless - C:\Program
      Files\Intel\Wireless\Bin\LgNotify.dll
      O23 - Service: Ati HotKey Poller - Unknown owner -
      C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: EvtEng - Intel Corporation - C:\Program
      Files\Intel\Wireless\Bin\EvtEng.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: RegSrvc - Intel Corporation - C:\Program
      Files\Intel\Wireless\Bin\RegSrvc.exe
      O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel
      Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program
      Files\Intel\Wireless\Bin\WLKeeper.exe



      the rkfiles log:
      C:\Program Files\Skads\Skads

      PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES,
      THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING.
      IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
      Files Found in system Folder............
      C:\WINDOWS\SYSTEM32\msclock32.dll: UPX!
      C:\WINDOWS\SYSTEM32\msplock32.dll: UPX!
      C:\WINDOWS\SYSTEM32\DFRG.MSC:
      AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213

      Files Found in all users startup Folder............
      Files Found in all users windows Folder............
      Finished
      bye
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited May 2005
      Fix these lines with Hijackthis.

      O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedfo32.exe
      O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\tfxtov.exe
      O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rzvnia.exe


      Delete these files, if present.

      C:\windows\system32\elitedfo32.exe
      C:\WINDOWS\system32\tfxtov.exe
      C:\WINDOWS\system32\rzvnia.exe


      Reboot and post a new hijackthis log.
    • mmai80-2
      edited May 2005
      Here's my most update Hijackthis log:

      Logfile of HijackThis v1.99.1
      Scan saved at 5:59:23 PM, on 5/12/2005
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
      C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Dell\Media Experience\DMXLauncher.exe
      C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
      C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
      C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
      C:\Program Files\Real\RealPlayer\RealPlay.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\Program Files\Microsoft Money\System\mnyexpr.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\AIM\aim.exe
      C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
      C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
      C:\WINDOWS\system32\msiexec.exe
      C:\WINDOWS\system32\HPZipm12.exe
      C:\Program Files\HiJackThis\HijackThis.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqDIREC.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqWRG.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL
      = http://www.dell4me.com/myway
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      http://www.dell4me.com/myway
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
      C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
      Files\Java\j2re1.4.2_03\bin\jusched.exe
      O4 - HKLM\..\Run: [IntelWireless] C:\Program
      Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
      O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI
      Control Panel\atiptaxx.exe
      O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media
      Experience\DMXLauncher.exe
      O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common
      Files\Sonic\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch
      Jukebox\mm_tray.exe
      O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch
      Jukebox\mmtask.exe
      O4 - HKLM\..\Run: [RealTray] C:\Program
      Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
      Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common
      Files\Dell\EUSW\Support.exe
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft
      IntelliPoint\point32.exe"
      O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft
      Money\System\mnyexpr.exe"
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
      /background
      O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
      O4 - Global Startup: hp psc 1000 series.lnk = ?
      O4 - Global Startup: hpoddt01.exe.lnk = ?
      O4 - Global Startup: Image Transfer.lnk = ?
      O8 - Extra context menu item: &AIM Search - res://C:\Program
      Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
      - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console -
      {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
      Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
      C:\PROGRA~1\AIM\aim.exe
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
      - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
      - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger -
      {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
      Files\Messenger\msmsgs.exe
      O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl
      Class) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
      O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl
      Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
      O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} -
      http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
      O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class)
      - http://sympatico.zone.msn.com/binGame/ZAxRcMgr.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
      http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
      O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl
      Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
      O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online
      Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab
      O16 - DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} (SCEWebLauncherCtl
      Object) - http://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab
      O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader
      Object) -
      http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
      O16 - DPF: {FDCC1518-6A63-11D9-AAC8-91EC5E497716} -
      http://www.ouchvideo.com/mmviewer_emg11.cab
      O20 - Winlogon Notify: IntelWireless - C:\Program
      Files\Intel\Wireless\Bin\LgNotify.dll
      O23 - Service: Ati HotKey Poller - Unknown owner -
      C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: EvtEng - Intel Corporation - C:\Program
      Files\Intel\Wireless\Bin\EvtEng.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: RegSrvc - Intel Corporation - C:\Program
      Files\Intel\Wireless\Bin\RegSrvc.exe
      O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel
      Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
      O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program
      Files\Intel\Wireless\Bin\WLKeeper.exe
    • Buckeye_SamBuckeye_Sam Columbus, Ohio
      edited May 2005
      Your log is clean!

      Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
      1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

        You can find instructions on how to enable and reenable system restore here:

        Managing Windows Millenium System Restore

        or

        Windows XP System Restore Guide

        Renable system restore with instructions from tutorial above

      2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
        1. From within Internet Explorer click on the Tools menu and then click on Options.
        2. Click once on the Security tab
        3. Click once on the Internet icon so it becomes highlighted.
        4. Click once on the Custom Level button.
          1. Change the Download signed ActiveX controls to Prompt
          2. Change the Download unsigned ActiveX controls to Disable
          3. Change the Initialize and script ActiveX controls not marked as safe to Disable
          4. Change the Installation of desktop items to Prompt
          5. Change the Launching programs and files in an IFRAME to Prompt
          6. Change the Navigate sub-frames across different domains to Prompt
          7. When all these settings have been made, click on the OK button.
          8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
        5. Next press the Apply button and then the OK to exit the Internet Properties page.

      3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

        See this link for a listing of some online & their stand-alone antivirus programs:

        Virus, Spyware, and Malware Protection and Removal Resources

      4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

      5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

        For a tutorial on Firewalls and a listing of some available ones see the link below:

        Understanding and Using Firewalls

      6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

      7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

        A tutorial on installing & using this product can be found here:

        Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

      8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

        A tutorial on installing & using this product can be found here:

        Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

      9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

        A tutorial on installing & using this product can be found here:

        Using SpywareBlaster to protect your computer from Spyware and Malware

      10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
      Follow this list and your potential for being infected again will reduce dramatically.
    This discussion has been closed.