Custom Search
Join the PC homebuilding revolution! Read the all-new, FREE 200-page online guide: How to Build Your Own PC!
NOTE: Using robot software to mass-download the site degrades the server and is prohibited. See here for more.
Find The PC Guide helpful? Please consider a donation to The PC Guide Tip Jar. Visa/MC/Paypal accepted.
Page 1 of 3 123 LastLast
Results 1 to 25 of 55

Thread: urgent, pls take a look: HijackThis log

  1. #1

    urgent, pls take a look: HijackThis log

    hello, i had a spyware programme (spysheriff) uninstalled using TuneUp, disabled everything on start-up via msconfig and ran cwshredder (removed 1 item). random Globe7 web pages would pop up while running firefox. couldnt run spybot & ad-aware probably due to spyware, so here's the log, thanks.


    Logfile of HijackThis v1.99.1
    Scan saved at 11:43:13 AM, on 16/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Network Monitor\netmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\batserv2.exe
    C:\WINDOWS\system32\mpcsvc.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\system32\sysc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e
    C:\Program Files\Mozilla Firefox\firefox.exe

    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
    O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
    O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
    O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)


    O20 - Winlogon Notify: access98 - C:\WINDOWS\SYSTEM32\access98.dll
    O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll
    O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
    O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

  2. #2
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    Did you edit out part of this log?? If so, we need to see the whole thing to know what is going on... In the meanwhile, run Ewido in Safe Mode to see what it can clean up... Run Spybot and Ad-Aware in Safe Mode as well... Update all of them before going into Safe Mode...

    Please download, install, and update the NEW free version of Ewido trojan scanner:
    1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
    2. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
    3. From the main ewido screen, click on update in the left menu, then click the Start update button.
    4. After the update finishes (the status bar at the bottom will display "Update successful")
    5. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
    6. Check "Perform action with all infections".
    7. When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.


    Reboot and post the complete HJT log and the Ewido log... You can leave out the cookie deletions in the Ewido log to shorten it... You have some major problems here...
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

  3. #3
    without the cookies
    + Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : Cleaned with backup
    HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Internet Explorer\Keywords -> Adware.CoolWebSearch : Cleaned with backup
    HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{06849E9F-C8D7-4D59-B87D-784B7D6BE083} -> Logger.Agent.io : Error during cleaning
    HKU\S-1-5-21-725345543-1229272821-2147250837-1003\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{6001CDF7-6F45-471B-A203-0225615E35A7} -> Adware.Generic : Error during cleaning
    [1504] C:\WINDOWS\system32\access98.dll -> Logger.Goldun.ib : Cleaned with backup
    [380] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Cleaned with backup
    [448] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
    [1052] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
    [1064] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
    [2092] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
    [2504] C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Error during cleaning
    [972] c:\program files\creative\creative zen microphoto\auto tag cleaner\jisnlk32.dll -> Trojan.Zapchast : Cleaned with backup

  4. #4
    C:\Documents and Settings\Christopher\Local Settings\Temp\368.tmp -> Trojan.Agent.fs : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\1052.tmp -> Downloader.Agent.afl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2408.tmp -> Downloader.Small.ckn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2452.tmp -> Downloader.Small.atl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2516.tmp -> Downloader.Small.skn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2540.tmp -> Downloader.Agent.agg : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2700.tmp -> Logger.ProAgent.u : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2788.tmp -> Downloader.Agent.agg : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2800.tmp -> Logger.ProAgent.u : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2812.tmp -> Downloader.Small.ckn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2840.tmp -> Downloader.CWS.s : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2856.tmp -> Downloader.CWS.s : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\2912.tmp -> Trojan.Dialer.ay : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3036.tmp -> Downloader.Tiny.ap : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3048.tmp -> Downloader.Agent.agg : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3076.tmp -> Dropper.Delf.th : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3096.tmp -> Dropper.Delf.th : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3116.tmp -> Downloader.Small.cnr : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3212.tmp -> Logger.ProAgent.u : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3244.tmp -> Logger.ProAgent.u : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3272.tmp -> Downloader.CWS.s : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3352.tmp -> Downloader.CWS.s : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3520.tmp -> Downloader.Small.cnr : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\3604.tmp -> Downloader.Small.cnr : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\501517636\4040.tmp -> Downloader.Tiny.ap : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\6.qtdfmp -> Downloader.Small.atl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\7.qtdfmp -> Downloader.Tibs.bu : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\dmx5.tmp -> Worm.Locksky.al : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\dmxE.tmp -> Dropper.Small.ame : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\maxdd.game -> Trojan.Dialer.ay : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\qvxt2.game -> Downloader.Tiny.ap : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\tatus_4bd.exe -> Downloader.Agent.afl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\tatus_6bd.exe -> Logger.Small.ak : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vx1.game -> Downloader.Agent.agg : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vx2.game -> Logger.ProAgent.u : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vx3.game -> Downloader.CWS.s : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vx6.game -> Downloader.Small.cnr : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vxt1.game -> Downloader.Small.ckn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vxt2.game -> Downloader.Small.skn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temp\vxt3.game -> Dropper.Delf.th : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\0B8TOPWX\MTE3NDI6ODoxNg[1].exe -> Downloader.Small.buy : Cleaned with backup

  5. #5
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\0B8TOPWX\tool4[1].txt -> Proxy.Wopla.r : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\52VHPMKY\paytime[1].txt -> Hijacker.StartPage.adi : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\7RD7ZHOW\kl[1].txt -> Logger.Small.dg : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\A2R15Z1Z\din[1] -> Trojan.Agent.fs : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\A2R15Z1Z\mousepad2[1].exe -> Hijacker.VB.li : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\F61CTFJ7\din[1].dll -> Downloader.Agent.afl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\F61CTFJ7\Installer[1].exe -> Adware.Look2Me : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\I5ZKDGVM\drsmartload[1].exe -> Downloader.Adload.x : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\S9Y1W74R\keyboard2[1].exe -> Downloader.VB.yn : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\S9Y1W74R\l[1].exe -> Downloader.Agent.afl : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\TWSND945\1000mails[1].exe -> Logger.Small.ak : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\TWSND945\toolbar[1].txt -> Downloader.Adload.w : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\WVVRM8DT\tool2[1].txt -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup
    C:\drsmartload1.exe -> Downloader.Adload.x : Cleaned with backup
    C:\Installer.exe -> Adware.Look2Me : Cleaned with backup
    C:\keyboard2.exe -> Downloader.VB.yn : Cleaned with backup
    C:\ld.exe -> Downloader.Small.cke : Cleaned with backup
    C:\ld.exe.bak -> Downloader.Small.cke : Cleaned with backup
    C:\mousepad2.exe -> Hijacker.VB.li : Cleaned with backup
    C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup
    C:\Program Files\Adobe\Photoshop 6.0\rwxqm4.dll -> Trojan.Small : Cleaned with backup
    C:\Program Files\Common Files\InstallShield\Professional\RunTime\09\01\Int el32\whvspr32.dll -> Trojan.Small : Cleaned with backup
    C:\Program Files\Creative\Creative Zen MicroPhoto\Auto Tag Cleaner\jisnlk32.dll -> Trojan.Zapchast : Cleaned with backup
    C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup
    C:\Program Files\SpySheriff -> Adware.SpySheriff : Cleaned with backup
    C:\Program Files\SpySheriff\Uninstall.exe -> Adware.SpySheriff : Cleaned with backup
    C:\WINDOWS\avalon_4.txt -> Trojan.Agent.fs : Cleaned with backup
    C:\WINDOWS\DH.dll -> Hijacker.Small.jf : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1015.dll -> Adware.Gator : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\WUInst.dll -> Adware.SaveNow : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\CONFLICT.2\WUInst.dll -> Adware.SaveNow : Cleaned with backup
    C:\WINDOWS\Downloaded Program Files\WUInst.dll -> Adware.SaveNow : Cleaned with backup
    C:\WINDOWS\inet20004\3.02.00.dll -> Adware.Ihbo : Cleaned with backup
    C:\WINDOWS\inet20004\alg.exe -> Worm.Delf.i : Cleaned with backup
    C:\WINDOWS\inet20004\alg.exe.bak -> Worm.Delf.i : Cleaned with backup
    C:\WINDOWS\inet20004\mm5.exe -> Logger.Delf.ig : Cleaned with backup
    C:\WINDOWS\inet20004\mm6.exe -> Logger.Delf.ig : Cleaned with backup
    C:\WINDOWS\inet20004\mm6.exe.bak -> Logger.Delf.ig : Cleaned with backup
    C:\WINDOWS\inet20004\services.exe -> Downloader.CWS.s : Cleaned with backup
    C:\WINDOWS\kl1.exe -> Logger.Small.dg : Cleaned with backup
    C:\WINDOWS\Q2hyaXN0b3BoZXI\asappsrv.dll -> Adware.CommAd : Cleaned with backup
    C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe -> Adware.CommAd : Cleaned with backup
    C:\WINDOWS\sachostx.exe -> Worm.Locksky.al : Cleaned with backup
    C:\WINDOWS\sysldr32.exe -> Downloader.Agent.agg : Cleaned with backup
    C:\WINDOWS\system32\70tovmto.ini -> Adware.Sahat : Cleaned with backup
    C:\WINDOWS\system32\cddhmpbn.exe -> Proxy.Wopla.r : Cleaned with backup
    C:\WINDOWS\system32\dajoamki.exe -> Proxy.Wopla.r : Cleaned with backup
    C:\WINDOWS\system32\dflgpjig.dll -> Proxy.Wopla.s : Cleaned with backup
    C:\WINDOWS\system32\intell321.exe -> Trojan.Small.ev : Cleaned with backup
    C:\WINDOWS\system32\maxd64.exe -> Trojan.Dialer.ay : Cleaned with backup
    C:\WINDOWS\system32\mspostsp.exe -> Trojan.Inject.i : Cleaned with backup
    C:\WINDOWS\system32\msupdate32.dll -> Downloader.Delf.aic : Cleaned with backup
    C:\WINDOWS\system32\msvcrl.dll -> Worm.Locksky.al : Cleaned with backup
    C:\WINDOWS\system32\nvwks.dll -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\system32\o4840elqehqe0.dll -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\system32\oleext.dll -> Trojan.Small.ev : Cleaned with backup
    C:\WINDOWS\system32\paytime.exe -> Hijacker.StartPage.adi : Cleaned with backup
    C:\WINDOWS\system32\pqh.dll -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\system32\qvxgamet2.exe -> Downloader.Tiny.ap : Cleaned with backup
    C:\WINDOWS\system32\qvxgamet4.exe -> Downloader.Agent.afl : Cleaned with backup
    C:\WINDOWS\system32\sachostp.exe -> Worm.Locksky.al : Cleaned with backup
    C:\WINDOWS\system32\sachosts.exe -> Worm.Locksky.al : Cleaned with backup
    C:\WINDOWS\system32\sndmixex.dll -> Downloader.Agent.afl : Cleaned with backup
    C:\WINDOWS\system32\vxgame1.exe -> Downloader.Agent.agg : Cleaned with backup
    C:\WINDOWS\system32\vxgame3.exe -> Downloader.CWS.s : Cleaned with backup
    C:\WINDOWS\system32\vxgame6.exe -> Downloader.Small.cnr : Cleaned with backup
    C:\WINDOWS\system32\vxgamet1.exe -> Downloader.Small.ckn : Cleaned with backup
    C:\WINDOWS\system32\vxgamet2.exe -> Downloader.Small.skn : Cleaned with backup
    C:\WINDOWS\system32\vxgamet3.exe -> Dropper.Delf.th : Cleaned with backup
    C:\WINDOWS\system32\vxh8jkdq6.exe -> Downloader.Small.atl : Cleaned with backup
    C:\WINDOWS\system32\vxh8jkdq7.exe -> Downloader.Tibs.bu : Cleaned with backup
    C:\WINDOWS\system32\Xcite.exe -> Adware.F1Organizer : Cleaned with backup
    C:\WINDOWS\system32\zdib.dll -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\sysvx_.exe -> Downloader.Small.cnr : Cleaned with backup
    C:\WINDOWS\tool2.exe -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup
    C:\WINDOWS\toolbar.exe -> Downloader.Adload.w : Cleaned with backup
    C:\WINDOWS\uninstDsk.exe -> Trojan.Small.ev : Cleaned with backup
    C:\winstall.exe -> Not-A-Virus.Hoax.Win32.Renos.bw : Cleaned with backup


    ::Report End

  6. #6
    Logfile of HijackThis v1.99.1
    Scan saved at 12:56:02 PM, on 16/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\Network Monitor\netmon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\batserv2.exe
    C:\WINDOWS\system32\mpcsvc.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\system32\sysc.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\SecuritySuite.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
    O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
    O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
    O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)


    O20 - Winlogon Notify: access98 - access98.dll (file missing)
    O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
    O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
    O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll (file missing)
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

  7. #7
    i cant get spybot to load, as for ad aware, it just hangs at C://windows/system32/netrap.dll

    i didnt modify the first hijack log, i added blank lines for easy reading

  8. #8
    Join Date
    Feb 2005
    Location
    At my Computer
    Posts
    1,818
    Is that an un-altered log? Budfred needs to see the whole thing to correctly analyse it.
    Apathy: If we don't take care of the customer,maybe they'll stop bugging us.

    Customer Disservice: Because we're not satisfied until you're not satisfied.

    (Maybe BB's approach?)
    ~Despair.com

  9. #9
    i'm still having random webpages popping up though

    e.g. hxxp://www.uniqueoffer-s.com/normal/yyy102.html
    Last edited by Budfred; 03-16-2006 at 09:00 AM.

  10. #10
    i ran ad-aware smart search and there were over 80 objects. should i remove them or wait for your analysis

  11. #11
    Don't do anything untill Budfred or Classic software tells you to! Be patient, you'll get all the help you need.
    I know a lot about nothing, and a little bit about everything.........Usually just enough to get me into trouble.

  12. #12
    i'm so tempted to remove whatever ad-aware caught... tired of popping web pages

  13. #13
    after running Ewido, ad-aware & spybot are running fine

  14. #14
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    Please do not post active malware links and please do not put the spaces in the log for easy reading, it makes them harder to read.... I edited your malware link to disable it... It would have been a good idea to fix whatever Ad-Aware found and I was indicating you should do so when I asked you to run it again... Go ahead and run it before these HJT fixes... If you don't find any of these things, it is hopefully because Ad-Aware took care of them already:

    Open and HJT scan and put checks by:

    R3 - Default URLSearchHook is missing
    F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe"
    O4 - HKLM\..\Run: [BatSrv] C:\WINDOWS\batserv2.exe
    O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels8.exe
    O20 - Winlogon Notify: access98 - access98.dll (file missing)
    O20 - Winlogon Notify: msupdate - msupdate32.dll (file missing)
    O20 - Winlogon Notify: Reinstall - C:\WINDOWS\system32\e0202afmgd2a2.dll
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
    O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - C:\WINDOWS\system32\dflgpjig.dll (file missing)
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (file missing)
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

    I couldn't find reliable information on this one... Unless you recognize the program, I suggest you fix it too:

    O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe

    Close all open windows except HJT and press Fix checked...

    Enter each of the following one at a time into the command prompt (Start > Run > type cmd):

    sc delete cmdService
    sc delete Network Monitor

    Find and delete:

    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe
    C:\WINDOWS\batserv2.exe
    C:\WINDOWS\system32\kernels8.exe
    C:\WINDOWS\system32\e0202afmgd2a2.dll
    c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
    C:\WINDOWS\system32\dflgpjig.dll
    C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (folder)
    C:\Program Files\Network Monitor\netmon.exe (folder)
    C:\WINDOWS\system32\mpcsvc.exe
    C:\WINDOWS\system32\sysc.exe

    Use Windows Search to find and delete:

    access98.dll
    msupdate32.dll

    The item with all the ~~ in it is abbreviated, so you will need to look for folders that start with the letters noted... It is likely that the whole folder that begins with "profes" is what needs to be deleted, but I can't be sure based on the info here... Check what is in the folder and post back if you are not sure what to do...

    Once you complete all of these steps, run Ewido, Spybot and Ad-Aware again, letting them fix whatever they find...

    Reboot and post a fresh HJT log and the Ewido log...
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

  15. #15
    Find and delete:

    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe
    C:\WINDOWS\batserv2.exe
    C:\WINDOWS\system32\kernels8.exe
    C:\WINDOWS\system32\e0202afmgd2a2.dll
    c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll
    C:\WINDOWS\system32\dflgpjig.dll
    C:\WINDOWS\Q2hyaXN0b3BoZXI\command.exe (folder)
    C:\Program Files\Network Monitor\netmon.exe (folder)
    C:\WINDOWS\system32\mpcsvc.exe
    C:\WINDOWS\system32\sysc.exe

    Use Windows Search to find and delete:

    access98.dll
    msupdate32.dll
    should i delete these files as well?:

    ibm00003.dll
    IBM00003.EXE-184AC576.pf
    _IBM00003.EXE-08FDF596.pf
    MPCSVC.EXE-126E1191.pf
    SYSC.EXE-1EE5211B.pf


    ran ad-aware and found but i cant delete:
    j2j60c1sef.dll
    reason given: used by another person or program

    after running spybot, adaware, cwshredder, latest hijack log:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
    O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker1] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker2] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker3] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker4] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker5] C:\Program Files\BootLocker\Msgsvr32.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\j2j60c1sef.dll
    O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file)
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    i still have random web pages popping up, and when after start-up a dialog box says: an exception occured while trying to run"

    c:\\windows\system32\ejfpixaudio.dll", DIIGetVersion"
    Last edited by jkr48625; 03-16-2006 at 11:29 AM.

  16. #16
    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 11:53:41 PM, 16/03/2006
    + Report-Checksum: B8B8D964

    + Scan result:

    [300] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Cleaned with backup
    :mozilla.20:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.21:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.22:C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\osb8lshi.jonathan\co okies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Christopher\Local Settings\Temporary Internet Files\Content.IE5\WVVRM8DT\1[1].exe -> Downloader.Small.ckt : Cleaned with backup
    C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Cleaned with backup
    C:\WINDOWS\system32\__delete_on_reboot__sbcur32.dl l -> Adware.Look2Me : Cleaned with backup


    ::Report End

    BootLocker is a program to password-protect the pc. i re-installed it and now it doesnt work.
    Last edited by jkr48625; 03-16-2006 at 12:00 PM.

  17. #17
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    Where did you see these??
    ibm00003.dll
    IBM00003.EXE-184AC576.pf
    _IBM00003.EXE-08FDF596.pf
    MPCSVC.EXE-126E1191.pf
    SYSC.EXE-1EE5211B.pf
    It looks like most of them were in Prefetch... You can certainly delete them if they are still there....

    Do this to see if we got rid of the worst infection:

    Download haxfix.exe.
    Save it to your desktop.
    Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
    Checkmark "Create a desktop icon".
    Click "Next".
    When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed.
    Click "Finish".
    A red "dos window" (dos box) will open.
    Select option 1. Make logfile by typing 1 and then pressing Enter.
    Haxfix will start scanning the computer. When it is finished a logfile will open.
    Copy the contents of that logfile and paste it into this thread.

    Where did you get BootLocker and why do you need it... These look like they are bad and that suggests this could be a rogue:

    O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe

    Unless you are certain that this program can be trusted, I suggest uninstalling the program and fixing these with HJT:

    O4 - HKLM\..\Run: [BootLocker] C:\Program Files\BootLocker\BootLockerStartup.exe
    O4 - HKLM\..\RunServices: [BootLocker0] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker1] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker2] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker3] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker4] C:\Program Files\BootLocker\Msgsvr32.exe
    O4 - HKLM\..\RunServices: [BootLocker5] C:\Program Files\BootLocker\Msgsvr32.exe

    And fix these regardless:

    O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\j2j60c1sef.dll
    O21 - SSODL: SysTray.Exbr - {6368D1FC-6F5C-4f1b-B164-E67214F678E9} - (no file)
    O21 - SSODL: CADI - {82566CF7-AAE6-0E2A-6CF5-2E3C8BA8C95C} - c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll (file missing)

    Then:

    Open HJT, go to Config and then to Misc Tools and use the "delete on reboot" option to enter the whole location and file for each of these one at a time... Click through to close HJT and reboot... Please note if you are still having any problems when you post back....

    C:\WINDOWS\system32\j2j60c1sef.dll
    c:\progra~1\common~1\instal~1\profes~1\runtime\09\ 01\intel32\whvspr32.dll

    Then reboot and post the HaxFix log and a fresh HJT log...
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

  18. #18
    HijackThis:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe


    HAXFIX logfile - by Marckie
    --------------
    Fri 17/03/2006 10:54:14.53

    checking for ps.a3d....
    ps.a3d not found

    checking for matching notify keys....
    no matching notify keys found

    checking for matching services....
    matching services found
    Aspi32

    checking for matching safeboot services....
    no matching safeboot services found

    ----------
    - now this pops on start up
    an exception occured while trying to run"c:\\windows\system32\mcorc32r.dll", DIIGetVersion"

    - random web pages still pops up on firefox

    - should i re-reun cwsshredder, ewidos, ad-aware & spybot?

  19. #19
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    You need to run another tool now:

    Please download Look2Me-Remover.exe to your desktop.
    • Close all windows before continuing.
    • Double-click Look2Me-Remover.exe to run it.
    • Put a check next to Run this program as a task.
    • You will receive a message saying Look2Me-Remover will close and re-open in approximately 10 seconds. Click OK
    • When Look2Me-Remover re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
    • Once it's done scanning, click the Remove L2M button.
    • You will receive a Done Scanning message, click OK.
    • When completed, you will receive this message: Done removing infected files! Look2Me-Remover will now shutdown your computer, click OK.
    • Your computer will then shutdown.
    • Turn your computer back on.
    • Please post the contents of C:\Look2Me-Remover.txt and a new HiJackThis log.
    If you receive a message from your firewall about this program accessing the internet please allow it.

    If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
    http://www.ascentive.com/support/new...b/MSWINSCK.OCX

    Then use HJT to fix:

    O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll

    Post the fresh HJT log and L2M log after reboot...
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

  20. #20
    Look2Me-Destroyer V1.0.11

    Scanning for infected files.....
    Scan started at 3/17/2006 11:58:02 AM

    Infected! C:\WINDOWS\system32\dn2u01f9e.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll
    Infected! C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll
    Infected! C:\WINDOWS\system32\guard.tmp

  21. #21
    Attempting to delete infected files...

    Attempting to delete: C:\WINDOWS\system32\dn2u01f9e.dll
    C:\WINDOWS\system32\dn2u01f9e.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276120.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276124.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276140.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276148.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276150.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276155.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276198.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276201.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276216.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276233.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276237.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276272.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276279.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276287.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276336.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276343.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276348.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276353.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276359.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP500\A0276418.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276435.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276441.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276442.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276443.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276444.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP501\A0276445.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276460.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276467.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276469.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276476.dll could not be deleted!

    Attempting to delete: C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll
    C:\System Volume Information\_restore{7467C20A-AAA7-4AF1-9821-959281C830DE}\RP502\A0276531.dll could not be deleted!

    Attempting to delete: C:\WINDOWS\system32\guard.tmp
    C:\WINDOWS\system32\guard.tmp could not be deleted!

    Making registry repairs.

    Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx

    Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{59C2E740-FD25-4C53-93C0-6C9953210A97}"
    HKCR\Clsid\{59C2E740-FD25-4C53-93C0-6C9953210A97}

    Restoring Windows certificates.

    Replaced hosts file with default windows hosts file

    Restoring SeDebugPrivilege for Administrators - Succeeded

  22. #22
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Documents and Settings\Christopher\Desktop\Melissa\HijackThis.ex e
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

    ------------------------

    Then use HJT to fix:

    O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\dn2u01f9e.dll
    hijackthis didnt show this but it did show up under window search

  23. #23
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    It looks like L2M is still there... Try running Look2Me-Remover in Safe Mode and see if that will kill it... If it doesn't, run this:

    You have the latest version of VX2. Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

  24. #24
    Try running Look2Me-Remover in Safe Mode and see if that will kill it...
    that didnt work, Look2Me-Remover's Scan for L2M couldn't be clicked

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer.
    after the command box appeared, this popped up:

    c:\windows\system32\cmd.exe
    c:\windows\SYSTEM32\AUTOEXEC.NT.
    the system file is not suitable for running MS_DOS and MS applications. choose 'Close' to terminate the application

    l2mfix asked for a password but i clicked 'enter'. after reboot:

    L2mfix 010406
    Creating Account.
    The command completed successfully.

    Adding Administrative privleges.
    The command completed successfully.
    Checking for L2MFix account(0=no 1=yes):
    1
    Granting SeDebugPrivilege to L2MFIX ... successful
    Checking for L2MFix account(0=no 1=yes):
    0
    Zipping up files for submission:
    zip warning: name not matched: dlls\*.*

    zip error: Nothing to do! (backup.zip)
    adding: backregs/notibac.reg (164 bytes security) (deflated 87%)

  25. #25
    Join Date
    Jul 2002
    Location
    Minn
    Posts
    17,373
    that didnt work, Look2Me-Remover's Scan for L2M couldn't be clicked
    I am not sure what you mean... Did you try it in Safe Mode??

    I don't know what all that other stuff means and what you are quoting versus what you are saying... Please post a fresh HJT log and let me know if you are still having the popups...
    Budfred ..... Caveat Emptor....

    Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

    Post a complaint about malware here!!
    So how did I get infected in the first place??

    MS MVP 2006 and ASAP member since 2004...

    If you PM me for help, expect an irritated response... Post in the forum...

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •