Options

Spyware popuper.exe Help

Unknown
edited May 2005 in Spyware & Virus Removal
My bro's computer is really infested with spywares. So I ran Adaware to remove most of em but a couple of the slimy things refused to go away! One more problem is whenever I clicked on Favorites in IE, an error window pops up & IE will shut down.
Included below is a HijackThis log (No open IE, programs & windows).. Need advice please, thanks!

Logfile of HijackThis v1.99.1
Scan saved at 4:04:23 PM, on 5/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\shnlog.exe
C:\WINDOWS\system32\bcmwltry.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\intmonp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\program files\steam\steam.exe
C:\WINDOWS\system32\intmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\popuper.exe
C:\Documents and Settings\Paulz\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.startsearches.net/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.startsearches.net/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.startsearches.net/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.startsearches.net/
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp7644.tmp
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [removecpl] RemoveCpl.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Atomlongantitest] C:\Documents and Settings\All Users\Application Data\default meal atom long\user beep.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\system32\msmsgs.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [Spy Toaster] C:\Program Files\SpyToaster\SpyToaster.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [fast download] C:\DOCUME~1\Paulz\APPLIC~1\WINDOW~1\title 4 once.exe
O4 - HKCU\..\Run: [Spyware Vanisher] c:\spywarevanisher-free\FreeScanner.exe -FastScan
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {64C09F76-DBC3-3197-0887-0D07768875E1} - http://216.118.71.185/1/rdgSG1828.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E20352D0-48EF-49E6-A042-981AA9958EE2} (Launcher Control) - http://hyperrelay.edenii.com/activex/v1.1.0.1/TWOLauncher.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited May 2005
    Please read these instructions carefully and print them out! Be sure to follow ALL instructions!

    Please right-click: HERE and go to Save As (in Internet Explorer it's "Save Target As") in order to download Grinler's reg file. Save it to your desktop.

    Locate "smitfraud.reg" on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the "merged successfully" prompt then follow the rest of the instructions below.

    Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found:

    Security IGuard
    Virtual Maid
    Search Maid

    Exit Add/Remove Programs.

    *IMPORTANT*CLICK THIS LINK TO LEARN HOW TO VIEW HIDDEN FILES

    I need you to copy all of the Killbox file paths below and paste them into Notepad.

    * Please download the Killbox by Option^Explicit. *In the event you already have Killbox, this is a new version that I need you to download.

    * Save it to your desktop.

    * Please double-click Killbox.exe to run it.

    * Select "Delete on Reboot".

    * Open the Notepad file where you saved the file paths earlier and copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C

    C:\wp.exe
    C:\wp.bmp
    C:\bsw.exe
    C:\Windows\sites.ini
    C:\Windows\popuper.exe
    C:\Windows\system32\hhk.dll
    C:\Windows\System32\wldr.dll
    C:\Windows\System32\helper.exe
    C:\Windows\System32\intmon.exe
    C:\Windows\System32\shnlog.exe
    C:\Windows\System32\intmonp.exe
    C:\Windows\System32\msmsgs.exe
    C:\Windows\system32\msole32.exe
    C:\Windows\System32\ole32vbs.exe

    * Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

    * Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

    If your computer does not restart automatically, please restart it manually.

    While your computer is restarting, tap the F8 key continually until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

    Make sure you can view hidden files.

    Using Windows Explorer, delete the following, if found, (please do NOT try to find them by "search" because they will not show up that way)

    FOLDERS to delete (in bold) if found:

    C:\Program Files\Search Maid
    C:\Program Files\Virtual Maid
    C:\Windows\System32\Log Files
    C:\Program Files\Security IGuard
    C:\Documents and Settings\All Users\Application Data\default meal atom long
    C:\DOCUME~1\Paulz\APPLIC~1\WINDOW~1


    While still in Safe Mode, do the following:

    Make sure all programs and windows are closed. Run HiJackThis and place a check next to the following items, if found, then click FIX CHECKED

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.startsearches.net/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.startsearches.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.startsearches.net/

    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe

    O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp7644.tmp

    O4 - HKLM\..\Run: [Atomlongantitest] C:\Documents and Settings\All Users\Application Data\default meal atom long\user beep.exe
    O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\system32\msmsgs.exe
    O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
    O4 - HKCU\..\Run: [fast download] C:\DOCUME~1\Paulz\APPLIC~1\WINDOW~1\title 4 once.exe

    O9 - Extra button: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)


    Close HiJackThis.

    Reboot into normal mode.

    1.) Download The Hoster Press "Restore Original Hosts" and press "OK". Exit Program.

    2.) Right-Click HERE and Save As to download DelDomains.inf to your desktop.
    To use: RIGHT-CLICK DelDomains.inf on your desktop and select: Install (no need to restart)
    Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

    3.) Download, install, and run CleanUp!

    4.) Run this online virus scan: ActiveScan - Save the results from the scan!

    Post a new HiJackThis log along with the results from ActiveScan.
  • jimmy_ojm
    edited May 2005
    IE seems to be working fine (no browser hijack & it didn't crash after clicking on Favorites).

    ActiveScan Results:

    Incident Status Location

    Virus:Trj/Cloak.A Disinfected Operating system
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Paulz\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/EliteBar No disinfected C:\WINDOWS\Downloaded Program Files\v?.dll
    Adware:Adware/SuperSpider No disinfected C:\Documents and Settings\Paulz\Favorites\online dating.url
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Black Jack Online.url
    Adware:Adware/Virmaid No disinfected Windows Registry
    Virus:Trj/Clicker.FD Disinfected C:\Documents and Settings\Paulz\Desktop\backups\backup-20050523-185147-658.dll
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Black Jack Online.url
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Home Loan.url
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Network Security.url
    Adware:Adware/SuperSpider No disinfected C:\Documents and Settings\Paulz\Favorites\Online Dating.url
    Adware:Adware/CWS No disinfected C:\Documents and Settings\Paulz\Favorites\Online Gambling\Online Gambling.url
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Online Gambling.url
    Adware:Adware/Popuper No disinfected C:\Documents and Settings\Paulz\Favorites\Online Pharmacy.url
    Possible Virus. No disinfected C:\Program Files\Internet Explorer\yzntznhs.exe
    Virus:Trj/Cloak.A Disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc1\UT5172000.so
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\Bib tons.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\Body Mags.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\Fast Ref.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\GreyPlus.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\idlenew.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\Kind Fork.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\Meal Defy.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\mediacorn.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc2\user beep.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\hdyayanr.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\leaeoskm.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\mailonelog.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\nijileeg.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\nuaugrgh.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\ofgvoxmy.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\pckrixwg.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\qukeromq.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\rbwnjiwj.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\store wipe stop flaw.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\title 4 once.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\uktnfllu.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\yoycheaj.exe
    Adware:Adware/Lop No disinfected C:\RECYCLER\S-1-5-21-789336058-1078081533-682003330-500\Dc3\ziuplvzf.exe
    Adware:Adware/EliteBar No disinfected C:\WINDOWS\blocklist.reg
    Adware:Adware/EliteBar No disinfected C:\WINDOWS\Downloaded Program Files\v2.dll
    Adware:Adware/IGuard No disinfected C:\WINDOWS\system\Loader.dll
    Virus:Trj/Cloak.A Disinfected C:\WINDOWS\system32\oleadm.dll
    Adware:Adware/Virmaid No disinfected C:\WINDOWS\system32\perfcii.ini

    Logfile of HijackThis v1.99.1
    Scan saved at 7:33:14 PM, on 5/23/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\bcmwltry.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Messenger Plus! 3\MsgPlus.exe
    C:\WINDOWS\Mixer.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    C:\program files\steam\steam.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Paulz\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.startsearches.net/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.startsearches.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.startsearches.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.startsearches.net/
    O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
    O4 - HKLM\..\Run: [removecpl] RemoveCpl.exe
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
    O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [fast download] C:\DOCUME~1\Paulz\APPLIC~1\WINDOW~1\title 4 once.exe
    O4 - HKCU\..\Run: [Spyware Vanisher] c:\spywarevanisher-free\FreeScanner.exe -FastScan
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {5442FEB1-D386-48DA-9A85-276B300D9971} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788AB4EC-C70F-41D4-A433-B49BFB753C6B} - (no file) (HKCU)
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {64C09F76-DBC3-3197-0887-0D07768875E1} - http://216.118.71.185/1/rdgSG1828.exe
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
    O16 - DPF: {E20352D0-48EF-49E6-A042-981AA9958EE2} (Launcher Control) - http://hyperrelay.edenii.com/activex/v1.1.0.1/TWOLauncher.cab
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited May 2005
    First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run the Lop Remover from:
    http://www.thespykiller.co.uk/downloads.htm

    You need to go to your favourites folder and remove the entries that activescan found.

    Now I need you to find and delete these;

    C:\WINDOWS\Downloaded Program Files\v?.dll
    C:\Program Files\Internet Explorer\yzntznhs.exe
    C:\WINDOWS\blocklist.reg
    C:\WINDOWS\Downloaded Program Files\v2.dll
    C:\WINDOWS\system\Loader.dll
    C:\WINDOWS\system32\oleadm.dll
    C:\WINDOWS\system32\perfcii.ini

    Are the startsearches there legitimately? If not, you need to fix them with hijackthis.

    Clear out your Temporary internet files and other temp files.
    Go to Start > Settings > Control Panel >Internet Options.
    Under the General tab click the Delete temporary internet files,
    delete all Offline content as well. Clear out Cookies.

    Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.

    Reboot and post another hijackthis log please.
Sign In or Register to comment.