HJT Log

  1. 27-05-2005  #1
    rachel21
    rachel21 is offline Newbie

    Exclamation HJT Log

    Hi. First off thank you for doing this. It is greatly appreciated

    Second, I got that pesky looking-for.cc search thing on my computer(I did a search on it to see if I can remove it myself). So I did everything you asked of me before posting this only to find out it was just more than that damn thing. So yeah here is my log:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:32:22 PM, on 5/26/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSDTCW.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\IRMON.EXE
    C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\JASC SOFTWARE INC\PAINT SHOP PRO 8\PAINT SHOP PRO.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\MFCMK.EXE
    C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
    C:\WINDOWS\SYSTEM\MSBI.EXE
    C:\PROGRAM FILES\GLOBALSCAPE\CUTEHTML\CUTEHTML.EXE
    C:\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\qbbya.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O2 - BHO: Class - {EC359119-1A6C-52A9-D03C-E373C5AAC363} - C:\WINDOWS\MSJQ32.DLL
    O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\GDS.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
    O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
    O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [bpcpost.exe] c:\windows\SYSTEM\bpcpost.exe
    O4 - HKLM\..\Run: [IrMon] IrMon.exe
    O4 - HKLM\..\Run: [KeyMaestro] C:\KMAESTRO\KMaestro.exe
    O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [KodakCCS] c:\windows\System32\Drivers\KodakCCS.exe
    O4 - HKLM\..\Run: [utilidadesus-htm] RunDll32 UDConn.dll,RunAsIcon utilidadesus
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    O4 - HKLM\..\Run: [CRKF.EXE] C:\WINDOWS\CRKF.EXE
    O4 - HKLM\..\Run: [MSBI.EXE] C:\WINDOWS\SYSTEM\MSBI.EXE
    O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
    O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
    O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [IEZO32.EXE] C:\WINDOWS\SYSTEM\IEZO32.EXE /s
    O4 - HKLM\..\RunServices: [IPBD32.EXE] C:\WINDOWS\SYSTEM\IPBD32.EXE /s
    O4 - HKLM\..\RunServices: [MFCMK.EXE] C:\WINDOWS\MFCMK.EXE /s
    O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [msjava critical update] c:\windows\jjfixer.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\CIS600X\UNINST.EXE
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: (no name) - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra 'Tools' menuitem: Block This Popup - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/sa/1033/.../bin/cabsa.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security1.norton.com/nav/1033...in/avsniff.cab
    O16 - DPF: {943991EA-0D3E-11D2-ABF8-A46C24763832} (EBCard Control) - http://neptune.guestworld.lycos.com/wgb/ebcard.ocx
    O16 - DPF: {E9AE575A-FA4A-11D3-90F7-00C0CA1618FF} (BuzMeSetup Class) - http://www.buzme.com/ActiveX/BMAXSetup.cab
    O16 - DPF: {CF25C291-E91C-11D3-873F-0000B4A2973D} (SoundCtl Class) - http://www.buzme.com/ActiveX/NPBMCtrl.cab
    O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - http://www.msnbc.com/download/nr1228.cab
    O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab
    O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.25.44/102f0268a86ce41...tzip/RdxIE.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/...ditControl.cab
    O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
    O16 - DPF: {776706AE-CACA-4EA3-93DF-BB83D9259DA9} (MailConfigure Class) - http://supportservices.msn.com/us/smtptool/MailCfg.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/Nrsg...1.0.0.2ie.cab?
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab
    O16 - DPF: {11111111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\01234567\explorer2 8[1].cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1241513f...p/RdxIE601.cab
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!http://67.15.120.3/server.exe
    O16 - DPF: {45231111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\27K36PGB\epl99[1].cab

    Any help is much appreciated. Thanks again! :-)

  3. 27-05-2005  #2
    HJThis
    HJThis is offline Senior Member
    Hello,rachel21 & Welcome

    Please perform the following steps:

    1. Download Cwshredder.exe and save it to a folder of its own. Start the program and click on the Check for Update button. If an update is available then download and install it. Close the program (do not run it yet).

    2. Download SpSeHjfix.zip and unzip it to it's own folder. Do not run it yet.

    3. Download CleanUp! and install it. Start CleanUp! and click on the CleanUp! button. Let it run to completion. It may take a few minutes depending on the size of your hard drive so be patient.

    4. Start in Safe Mode Using the F8 method:
    * Restart the computer.
    * As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
    * Use the arrow keys to select the Safe Mode menu item.
    * Press the Enter key.

    5. Disconnect from the net and Close ALL OPEN PROGRAMS.

    6. Run SpSeHjfix and click on Start Disinfection.
    When it's finished it will reboot your machine to finish the cleaning process.
    The tool creates a log of the fix which will appear in the folder that SpSeHjfix is located in.

    7. Now run CWShredder and click on the Fix -> button.

    8. Reboot and repeat the above process.


    Reboot and post a fresh HijackThis log and the log that was created by SpSeHjfix.

    HGD
  4. 27-05-2005  #3
    rachel21
    rachel21 is offline Newbie
    Ok I did everything you told me. I still have the problem so it seems so here are my new logs:

    Logfile of HijackThis v1.99.1
    Scan saved at 1:33:10 PM, on 5/27/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\MSDTCW.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\IRMON.EXE
    C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\APPJQ32.EXE
    C:\WINDOWS\NOTEPAD.EXE
    C:\PROGRAM FILES\GLOBALSCAPE\CUTEHTML\CUTEHTML.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\HIJACKTHIS\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O2 - BHO: Class - {EC359119-1A6C-52A9-D03C-E373C5AAC363} - C:\WINDOWS\MSJQ32.DLL
    O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\GDS.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
    O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
    O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [bpcpost.exe] c:\windows\SYSTEM\bpcpost.exe
    O4 - HKLM\..\Run: [IrMon] IrMon.exe
    O4 - HKLM\..\Run: [KeyMaestro] C:\KMAESTRO\KMaestro.exe
    O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [KodakCCS] c:\windows\System32\Drivers\KodakCCS.exe
    O4 - HKLM\..\Run: [utilidadesus-htm] RunDll32 UDConn.dll,RunAsIcon utilidadesus
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    O4 - HKLM\..\Run: [CRKF.EXE] C:\WINDOWS\CRKF.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\Run: [MSBI.EXE] C:\WINDOWS\SYSTEM\MSBI.EXE
    O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
    O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
    O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [IEZO32.EXE] C:\WINDOWS\SYSTEM\IEZO32.EXE /s
    O4 - HKLM\..\RunServices: [IPBD32.EXE] C:\WINDOWS\SYSTEM\IPBD32.EXE /s
    O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunServices: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\RunServices: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\CIS600X\UNINST.EXE
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: (no name) - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra 'Tools' menuitem: Block This Popup - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/sa/1033/.../bin/cabsa.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security1.norton.com/nav/1033...in/avsniff.cab
    O16 - DPF: {943991EA-0D3E-11D2-ABF8-A46C24763832} (EBCard Control) - http://neptune.guestworld.lycos.com/wgb/ebcard.ocx
    O16 - DPF: {E9AE575A-FA4A-11D3-90F7-00C0CA1618FF} (BuzMeSetup Class) - http://www.buzme.com/ActiveX/BMAXSetup.cab
    O16 - DPF: {CF25C291-E91C-11D3-873F-0000B4A2973D} (SoundCtl Class) - http://www.buzme.com/ActiveX/NPBMCtrl.cab
    O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - http://www.msnbc.com/download/nr1228.cab
    O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab
    O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.25.44/102f0268a86ce41...tzip/RdxIE.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/...ditControl.cab
    O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
    O16 - DPF: {776706AE-CACA-4EA3-93DF-BB83D9259DA9} (MailConfigure Class) - http://supportservices.msn.com/us/smtptool/MailCfg.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/Nrsg...1.0.0.2ie.cab?
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/instal...sinstaller.cab
    O16 - DPF: {11111111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\01234567\explorer2 8[1].cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1241513f...p/RdxIE601.cab
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!http://67.15.120.3/server.exe
    O16 - DPF: {45231111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\27K36PGB\epl99[1].cab



    (5/27/05 1:14:50 PM) SPSeHjFix started v1.09
    (5/27/05 1:14:50 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:14:50 PM) Language: english
    (5/27/05 1:14:54 PM) Disinfect started
    (5/27/05 1:14:54 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:14:54 PM) UBF: 4
    (5/27/05 1:14:54 PM) UBB: 2
    (5/27/05 1:14:54 PM) UBR: 30
    (5/27/05 1:14:54 PM) Bad IE-pages:
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    (5/27/05 1:14:54 PM) Stealth-String not found:
    (5/27/05 1:14:54 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:07 PM) Disinfect started
    (5/27/05 1:15:07 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:15:07 PM) UBF: 4
    (5/27/05 1:15:07 PM) UBB: 2
    (5/27/05 1:15:07 PM) UBR: 30
    (5/27/05 1:15:07 PM) Bad IE-pages:
    (5/27/05 1:15:07 PM) Stealth-String not found:
    (5/27/05 1:15:07 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:09 PM) Disinfect started
    (5/27/05 1:15:09 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:15:09 PM) UBF: 4
    (5/27/05 1:15:09 PM) UBB: 2
    (5/27/05 1:15:09 PM) UBR: 30
    (5/27/05 1:15:09 PM) Bad IE-pages:
    (5/27/05 1:15:09 PM) Stealth-String not found:
    (5/27/05 1:15:09 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:23 PM) SPSeHjFix 2nd Step
    (5/27/05 1:15:23 PM) RunServicesOnce-Key: (edited)
    (5/27/05 1:15:29 PM) Cleaned


    (5/27/05 1:16:07 PM) SPSeHjFix started v1.09
    (5/27/05 1:16:07 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:16:07 PM) Language: english
    (5/27/05 1:16:08 PM) Disinfect started
    (5/27/05 1:16:08 PM) Bad-Dll(IEP): (not found)
    (5/27/05 1:16:08 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 1:16:08 PM) UBF: 4
    (5/27/05 1:16:08 PM) UBB: 2
    (5/27/05 1:16:08 PM) UBR: 30
    (5/27/05 1:16:08 PM) Bad IE-pages:
    (5/27/05 1:16:08 PM) Stealth-String not found:
    (5/27/05 1:16:08 PM) Not infected->END


    (5/27/05 1:26:45 PM) SPSeHjFix started v1.09
    (5/27/05 1:26:45 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:26:45 PM) Language: english
    (5/27/05 1:26:47 PM) Disinfect started
    (5/27/05 1:26:47 PM) Bad-Dll(IEP): (not found)
    (5/27/05 1:26:47 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 1:26:47 PM) UBF: 4
    (5/27/05 1:26:47 PM) UBB: 2
    (5/27/05 1:26:47 PM) UBR: 30
    (5/27/05 1:26:47 PM) Bad IE-pages:
    (5/27/05 1:26:48 PM) Stealth-String not found:
    (5/27/05 1:26:48 PM) Not infected->END

    Thanks once again. You have no idea how much I appreciate this.
  5. 27-05-2005  #4
    HJThis
    HJThis is offline Senior Member
    Hi,Rachel21

    Sorry about that ran in to a problem on my end

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R3 - Default URLSearchHook is missing

    O2 - BHO: Class - {EC359119-1A6C-52A9-D03C-E373C5AAC363} - C:\WINDOWS\MSJQ32.DLL

    This item here any idea what it is????
    O4 - HKLM\..\Run: [utilidadesus-htm] RunDll32 UDConn.dll,RunAsIcon utilidadesus
    O4 - HKLM\..\Run: [CRKF.EXE] C:\WINDOWS\CRKF.EXE
    O4 - HKLM\..\Run: [MSBI.EXE] C:\WINDOWS\SYSTEM\MSBI.EXE
    O4 - HKLM\..\RunServices: [IEZO32.EXE] C:\WINDOWS\SYSTEM\IEZO32.EXE /s
    O4 - HKLM\..\RunServices: [IPBD32.EXE] C:\WINDOWS\SYSTEM\IPBD32.EXE /s
    O4 - Startup: PowerReg Scheduler.exe

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    O16 - DPF: {943991EA-0D3E-11D2-ABF8-A46C24763832} (EBCard Control) - http://neptune.guestworld.lycos.com/wgb/ebcard.ocx
    O16 - DPF: {E9AE575A-FA4A-11D3-90F7-00C0CA1618FF} (BuzMeSetup Class) - http://www.buzme.com/ActiveX/BMAXSetup.cab
    O16 - DPF: {CF25C291-E91C-11D3-873F-0000B4A2973D} (SoundCtl Class) - http://www.buzme.com/ActiveX/NPBMCtrl.cab
    O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
    O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.25.44/102f0268a86ce4...etzip/RdxIE.cab
    O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} - http://dm.screensavers.com/dm/insta.../sinstaller.cab
    O16 - DPF: {11111111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\01234567\explorer2 8[1].cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1241513...ip/RdxIE601.cab
    O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!http://67.15.120.3/server.exe
    O16 - DPF: {45231111-1111-1111-1111-111111113458} - file://C:\WINDOWS\Tempor~1\Content.IE5\27K36PGB\epl99[1].cab

    Make sure you can view hidden and system files: Instructions here

    Then Boot to safe mode: Instructions here

    Delete the following files\folders IF still present:
    C:\WINDOWS\SYSTEM\IPBD32.EXE << This file
    C:\WINDOWS\SYSTEM\IEZO32.EXE << This file
    C:\WINDOWS\SYSTEM\MSBI.EXE << This file
    C:\WINDOWS\CRKF.EXE << This file
    C:\WINDOWS\MSJQ32.DLL << This file

    Before you do the above work download this prog here
    to clean all Temp files & more

    popular programs for doing this, is a freeware program Called Crap Cleaner. Crap Cleaner is a single utility that lets you clear your Cookies, Internet Explorer History, Empty the Recycle Bin, Uninstall Programs, Clear Usage Tracks and much more. As well as this, it has an Advanced Registry Scanner. Using a program like this is one of the easiest methods.

    Then lit us know how it gos show us new logfile

    HGD
    Last edited by HJThis; 27-05-2005 at 08:50 PM.
  6. 27-05-2005  #5
    rachel21
    rachel21 is offline Newbie
    New log file.......so far so good. Although I still have that lookin-for.cc thing on my add/remove programs list. But the rest of the crap tha was lurking on my comp is now gone. :-)

    Logfile of HijackThis v1.99.1
    Scan saved at 4:40:24 PM, on 5/27/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSDTCW.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\IRMON.EXE
    C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\HIJACKTHIS\HIJACKTHIS.EXE
    C:\WINDOWS\NOTEPAD.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\GDS.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
    O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
    O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [bpcpost.exe] c:\windows\SYSTEM\bpcpost.exe
    O4 - HKLM\..\Run: [IrMon] IrMon.exe
    O4 - HKLM\..\Run: [KeyMaestro] C:\KMAESTRO\KMaestro.exe
    O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [KodakCCS] c:\windows\System32\Drivers\KodakCCS.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
    O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
    O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\CIS600X\UNINST.EXE
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: (no name) - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra 'Tools' menuitem: Block This Popup - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/sa/1033/.../bin/cabsa.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security1.norton.com/nav/1033...in/avsniff.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - http://www.msnbc.com/download/nr1228.cab
    O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/...ditControl.cab
    O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
    O16 - DPF: {776706AE-CACA-4EA3-93DF-BB83D9259DA9} (MailConfigure Class) - http://supportservices.msn.com/us/smtptool/MailCfg.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/Nrsg...1.0.0.2ie.cab?

    Anything else that I must do? Thank you very much!
  7. 27-05-2005  #6
    HJThis
    HJThis is offline Senior Member
    Hey,rachel21

    It's back the thing is that when working on this try not
    running around the web till we have you all clean.

    Please perform the following steps:

    1. Download Cwshredder.exe and save it to a folder of its own. Start the program and click on the Check for Update button. If an update is available then download and install it. Close the program (do not run it yet).

    2. Download SpSeHjfix.zip and unzip it to it's own folder. Do not run it yet.

    3. Download CleanUp! and install it. Start CleanUp! and click on the CleanUp! button. Let it run to completion. It may take a few minutes depending on the size of your hard drive so be patient.


    If you are using Windows 98, ME, copy the contents of the Quote Box below to Notepad. Name the file as cwsresfix.reg. Change the Save as Type to All Files, Save this file on the desktop. Please DO NOT include the word QUOTE when saving the file.

    QUOTE

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\HSA]

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SE]

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SW]

    [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall\HSA]

    [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall\SE]

    [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall\SW]


    4. Start in Safe Mode Using the F8 method:
    * Restart the computer.
    * As soon as the BIOS is loaded begin tapping the F8 key until the boot menu appears.
    * Use the arrow keys to select the Safe Mode menu item.
    * Press the Enter key.

    5. Disconnect from the net and Close ALL OPEN PROGRAMS.

    6. Run SpSeHjfix and click on Start Disinfection.
    When it's finished it will reboot your machine to finish the cleaning process.
    The tool creates a log of the fix which will appear in the folder that SpSeHjfix is located in.

    7. Now run CWShredder and click on the Fix -> button.

    8. Reboot and repeat the above process.


    Reboot and post a fresh HijackThis log and the log that was created by SpSeHjfix.

    HGD

    Please come right back here after doing the fix.
    Last edited by HJThis; 27-05-2005 at 11:49 PM.
  8. 28-05-2005  #7
    rachel21
    rachel21 is offline Newbie
    I think we got it! I can not thank you enough for all your help!

    Here are the logs:

    Logfile of HijackThis v1.99.1
    Scan saved at 6:49:08 PM, on 5/27/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\MSDTCW.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\TEXTBRIDGE CLASSIC 2.0\BIN\INSTANTACCESS.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\IRMON.EXE
    C:\WINDOWS\SYSTEM32\DRIVERS\KODAKCCS.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\NOTEPAD.EXE
    C:\WINDOWS\NOTEPAD.EXE
    C:\HIJACKTHIS\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\GDS.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [PWSTray] PwsTray.exe
    O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
    O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [bpcpost.exe] c:\windows\SYSTEM\bpcpost.exe
    O4 - HKLM\..\Run: [IrMon] IrMon.exe
    O4 - HKLM\..\Run: [KeyMaestro] C:\KMAESTRO\KMaestro.exe
    O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [KodakCCS] c:\windows\System32\Drivers\KodakCCS.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
    O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
    O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunServices: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\RunServices: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\CIS600X\UNINST.EXE
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE
    O9 - Extra button: (no name) - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra 'Tools' menuitem: Block This Popup - {2F099F5D-7003-4441-82C2-707C7C273FEB} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/sa/1033/.../bin/cabsa.cab
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security1.norton.com/nav/1033...in/avsniff.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - http://www.msnbc.com/download/nr1228.cab
    O16 - DPF: {451FCDEE-DCED-11D3-87DD-0090278F1040} (Yahoo! Voicemail Engine) - http://phone.yahoo.com/plugin/yumscom.cab
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/...ditControl.cab
    O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
    O16 - DPF: {776706AE-CACA-4EA3-93DF-BB83D9259DA9} (MailConfigure Class) - http://supportservices.msn.com/us/smtptool/MailCfg.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} (UDConnect Class) - http://17.sharedsource.org/html/Nrsg...1.0.0.2ie.cab?




    (5/27/05 1:14:50 PM) SPSeHjFix started v1.09
    (5/27/05 1:14:50 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:14:50 PM) Language: english
    (5/27/05 1:14:54 PM) Disinfect started
    (5/27/05 1:14:54 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:14:54 PM) UBF: 4
    (5/27/05 1:14:54 PM) UBB: 2
    (5/27/05 1:14:54 PM) UBR: 30
    (5/27/05 1:14:54 PM) Bad IE-pages:
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://C:\WINDOWS\ubpkr.dll/sp.html#12047
    (5/27/05 1:14:54 PM) Stealth-String not found:
    (5/27/05 1:14:54 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:07 PM) Disinfect started
    (5/27/05 1:15:07 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:15:07 PM) UBF: 4
    (5/27/05 1:15:07 PM) UBB: 2
    (5/27/05 1:15:07 PM) UBR: 30
    (5/27/05 1:15:07 PM) Bad IE-pages:
    (5/27/05 1:15:07 PM) Stealth-String not found:
    (5/27/05 1:15:07 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:09 PM) Disinfect started
    (5/27/05 1:15:09 PM) Bad-Dll(IEP): ubpkr.dll
    (5/27/05 1:15:09 PM) UBF: 4
    (5/27/05 1:15:09 PM) UBB: 2
    (5/27/05 1:15:09 PM) UBR: 30
    (5/27/05 1:15:09 PM) Bad IE-pages:
    (5/27/05 1:15:09 PM) Stealth-String not found:
    (5/27/05 1:15:09 PM) No Files to delete. End without Reboot
    (5/27/05 1:15:23 PM) SPSeHjFix 2nd Step
    (5/27/05 1:15:23 PM) RunServicesOnce-Key: (edited)
    (5/27/05 1:15:29 PM) Cleaned


    (5/27/05 1:16:07 PM) SPSeHjFix started v1.09
    (5/27/05 1:16:07 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:16:07 PM) Language: english
    (5/27/05 1:16:08 PM) Disinfect started
    (5/27/05 1:16:08 PM) Bad-Dll(IEP): (not found)
    (5/27/05 1:16:08 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 1:16:08 PM) UBF: 4
    (5/27/05 1:16:08 PM) UBB: 2
    (5/27/05 1:16:08 PM) UBR: 30
    (5/27/05 1:16:08 PM) Bad IE-pages:
    (5/27/05 1:16:08 PM) Stealth-String not found:
    (5/27/05 1:16:08 PM) Not infected->END


    (5/27/05 1:26:45 PM) SPSeHjFix started v1.09
    (5/27/05 1:26:45 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 1:26:45 PM) Language: english
    (5/27/05 1:26:47 PM) Disinfect started
    (5/27/05 1:26:47 PM) Bad-Dll(IEP): (not found)
    (5/27/05 1:26:47 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 1:26:47 PM) UBF: 4
    (5/27/05 1:26:47 PM) UBB: 2
    (5/27/05 1:26:47 PM) UBR: 30
    (5/27/05 1:26:47 PM) Bad IE-pages:
    (5/27/05 1:26:48 PM) Stealth-String not found:
    (5/27/05 1:26:48 PM) Not infected->END


    (5/27/05 6:38:05 PM) SPSeHjFix started v1.09
    (5/27/05 6:38:05 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 6:38:05 PM) Language: english
    (5/27/05 6:38:08 PM) Disinfect started
    (5/27/05 6:38:08 PM) Bad-Dll(IEP): (not found)
    (5/27/05 6:38:08 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 6:38:08 PM) UBF: 4
    (5/27/05 6:38:08 PM) UBB: 1
    (5/27/05 6:38:08 PM) UBR: 25
    (5/27/05 6:38:08 PM) Bad IE-pages:
    deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
    deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
    (5/27/05 6:38:08 PM) Stealth-String not found:
    (5/27/05 6:38:08 PM) Not infected->END


    (5/27/05 6:46:28 PM) SPSeHjFix started v1.09
    (5/27/05 6:46:28 PM) OS: Win98SE A (4.10.67766446)
    (5/27/05 6:46:28 PM) Language: english
    (5/27/05 6:46:29 PM) Disinfect started
    (5/27/05 6:46:29 PM) Bad-Dll(IEP): (not found)
    (5/27/05 6:46:29 PM) Bad-Dll(IEP) in BHO: (not found)
    (5/27/05 6:46:29 PM) UBF: 4
    (5/27/05 6:46:29 PM) UBB: 1
    (5/27/05 6:46:29 PM) UBR: 25
    (5/27/05 6:46:29 PM) Bad IE-pages:
    (5/27/05 6:46:29 PM) Stealth-String not found:
    (5/27/05 6:46:29 PM) Not infected->END

    Again thank you!!!
  9. 28-05-2005  #8
    HJThis
    HJThis is offline Senior Member
    Hi,rachel21

    Great work again on this now before you start running on the net
    do this here right away.

    click start->settings->control panel->internet options->programs tab->RESET WEB SETTINGS

    That will change everything back to defaults (M$)......

    Change your homepage and search engines to whatever you wish and reset your pc.

    When it boots back up, open IE and see if the page stays the way that you set it.

    & this here

    Make your Internet Explorer more secure - This can be done by following these simple instructions:

    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    1. Change the Download signed ActiveX controls to Prompt
    2. Change the Download unsigned ActiveX controls to Disable
    3. Change the Initialize and script ActiveX controls not marked as safe to Disable
    4. Change the Installation of desktop items to Prompt
    5. Change the Launching programs and files in an IFRAME to Prompt
    6. Change the Navigate sub-frames across different domains to Prompt
    7. When all these settings have been made, click on the OK button.
    8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
    5. Next press the Apply button and then the OK to exit the Internet Properties page.

    After you do the above do this here also

    Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows, including the latest version of Internet Explorer. This can patch many of the security holes through which attackers can gain access to your computer.

    & now some tools download them update them

    SpywareBlaster - Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
    http://www.javacoolsoftware.com/spywareblaster.html

    SpywareGuard - An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware!
    http://www.javacoolsoftware.com/spywareguard.html

    IE-SPYAD is a Registry file (IE-ADS.REG) that adds a long list of sites and domains associated with known advertisers, marketers, and crapware pushers to the Restricted sites zone of Internet Explorer.
    https://netfiles.uiuc.edu/ehowes/www/resource.htm

    Blocking Unwanted Parasites with a Hosts File
    http://www.mvps.org/winhelp2002/hosts.htm

    and this prog here will help keep your PC clean.

    popular programs for doing this, is a freeware program Called Crap Cleaner. Crap Cleaner is a single utility that lets you clear your Cookies, Internet Explorer History, Empty the Recycle Bin, Uninstall Programs, Clear Usage Tracks and much more. As well as this, it has an Advanced Registry Scanner. Using a program like this is one of the easiest methods.

    You should also think about using Firefox & Mozilla & us IE for updates

    Get your Firefox here

    Mo who

    if you have any problems lit us know

    HGD
  10. 28-05-2005  #9
    rachel21
    rachel21 is offline Newbie
    I've done all that except downloading the programs. But I'm going to! Again thank you for all the help. And I'm going to stick to Firefox from now on. :-)
  11. 28-05-2005  #10
    HJThis
    HJThis is offline Senior Member
    Save 20% on AVG Internet Security 2012 Suite!
    Hey,rachel21

    Great to hear it & make sure to get them tools
    just as said keep them updated.

    HGD
+ Reply to Thread
« do I have a virus? | search42 browser hijack »