Guys i have this backdoor virus in my windows.exe and my messenger.exe, my dad if fliping out..i think he is gona kill me. Do any of yall know anything i can do? Apparently it will not let norton run, and i DL the 30 day trial from symatec so i dont have the disk. Is there any hope or do we need to reformat? - Damian Aim: Nizmo87

Hi Quite detailed removal instructions here: http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optixpro.13.html Once cleaned up you should consider changing any passwords used to log onto any sites, and ISP, banking sites... If you need further help post back. _______________________________________ I never give up! Windows Update

Well that sit eis nice and all however, norton cant run, sop i can disable the virus, but i cant delete it..so it just continues to reinfect my copmuter :( - Damian Aim: Nizmo87

Damian Download HijackThis from here: http://www.lurkhere.com/~nicefiles/ First one on the list.. Save it to its own folder...not a temporary folder or he desktop. Unzip it, run its scan, scan button changes to "save log" button. Click "save log" save it to same folder. It will popup in notepad, hit ctrl+a to select all the text, right click, select copy, right click here, select paste. Dont fix anything yet in scan results...most of what you see is safe or even esential. If you get error about MSVBVM60.DLL is missing you need MSvb6 runtime files. Download that from here: vbrunsp5.exe Save that download to disk, double click the exe file to set it up. Hijack will run now. We will see what next. ________________________________ I never give up! Windows Update

Logfile of HijackThis v1.97.7 Scan saved at 11:11:02 PM, on 3/16/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSTASK.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\IJ75P2PS.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\WINDOWS\SYSTEM\STIMON.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\WINDOWS\SYSTEM\QTTASK.exe C:\WINDOWS\SYSTEM\MESSENGER.exe C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.exe C:\PROGRAM FILES\DIAMOND\INCONTROL TOOLS 99\DMHKEY.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\ANTIVIRUS\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 164.58.183.116:80 O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {1AFBD80E-60B2-39EE-F8DA-92FBA38F062D} - C:\windows\system\vxvlwfrf.dll (file missing) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\SYSTEM\BPKWB.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe O4 - HKLM\..\Run: [IJ75P2PSERVER] IJ75P2PS.exe O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.exe O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.exe" -atboottime O4 - HKLM\..\Run: [system] C:\WINDOWS\SYSTEM\MESSENGER.exe O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [BELT] C:\WINDOWS\TEMP\BELT.exe O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\AV.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [system] C:\WINDOWS\SYSTEM\MESSENGER.exe O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" O4 - Startup: InControl Desktop Manager.lnk = C:\Program Files\Diamond\InControl Tools 99\DMHKEY.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_2.0.95-DELEON.DLL/cmtrans.html O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37886.6461921296 O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe O16 - DPF: {D68217F4-1DF9-45C1-BFA6-61DBD5464527} (Genealogy Browser) - http://66.119.139.74/cabs/zinst.cab O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiqonline.com/WebIQ/bin/WebIQ.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.lizardtech.com/software/expressview/webinstall/isetup.cab O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.bravetree.com/downloader/BTDownloadCtrl.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/229/webolr/OCX/FlashAX.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4337/mcfscan.cab - Damian Aim: Nizmo87

Damian Start hijackthis while offline and check the following items: O2 - BHO: (no name) - {1AFBD80E-60B2-39EE-F8DA-92FBA38F062D} - C:\windows\system\vxvlwfrf.dll (file missing) O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\SYSTEM\BPKWB.DLL O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe O4 - HKLM\..\Run: [system] C:\WINDOWS\SYSTEM\MESSENGER.exe O4 - HKLM\..\Run: [BELT] C:\WINDOWS\TEMP\BELT.exe O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\AV.exe O4 - HKLM\..\RunServices: [system] C:\WINDOWS\SYSTEM\MESSENGER.exe O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiqonline.com/WebIQ/bin/WebIQ.cab O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/229/webolr/OCX/FlashAX.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab Once checked close all windows except hijack and click "fix checked" Shut down computer for at least 30 seconds to clear trojan(s) from memory. Reboot the computer to SAFE mode (tap f8 on boot) Remove the following files: c:\windows\system\messanger.exe <-file c:\windows\temp\belt.exe <-file c:\windows\av.exe <-file While still in safe mode run a full system scan with Norton, repair/quarentine/delete infected files found. You will also need to delete the link in your Aim profile. It will either be: buddypictures.net realphx.net There are several...but you should know what I mean...your friends are likely telling you that you are sending them to infected site...Aim automatically sends the infected site link to all your buddies. It will say something like: Hey! check out the new cam I got! Something about New Years Paarty! I don't run Aim so I dont know how to edit the profile...whatever you didn't put there....get rid of it. Post new hijack log when done. ___________________________________ I never give up! Windows Update

look dude forget all that crap the other guy told you about HijackThis. this is the quickest way: 1) download a exe file association fix for your operating system, when u have done that DO NOT run it yet. leave it on da desktop. 2) delete the files: c:\windows\system\messenger.exe c:\windows\system\windows.exe 3) after doing that restart computer, you should find that you cannot run any exe files (programs) thats ok cuz all you got to do is run the exe file association fix that you previously downloaded and everything will work perfectly!! send me an e-mail if it works so i can prove to me m8s. Akikur7143@hotmail.com