Hey Guys, Here is my hijack this logfile. I get a popup from www.atoque.com everytime I close out Internet Explorer. Can someone check it out, and let me know what I should get rid of? Thank you. Pete Logfile of HijackThis v1.97.2 Scan saved at 7:05:05 PM, on 2/20/2004 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\ibmpmsvc.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\Ati2evxx.exe C:\Program Files\Network Associates\VirusScan\avsynmgr.exe C:\Program Files\Cisco systems\VPN Client\cvpnd.exe C:\Program Files\Network Associates\VirusScan\VsStat.exe C:\Program Files\1598_Fiberlink\Fgrd.exe C:\WINNT\system32\regsvc.exe C:\Program Files\Network Associates\VirusScan\Vshwin32.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\Program Files\Common Files\Network Associates\McShield\mcshield.exe C:\Program Files\Network Associates\VirusScan\Avconsol.exe C:\Program Files\Network Associates\VirusScan\Webscanx.exe C:\WINNT\Explorer.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINNT\System32\PRPCUI.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe C:\WINNT\System32\RunDll32.exe C:\WINNT\AGRSMMSG.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\WINNT\system32\dla\tfswctrl.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\WINNT\wt\updater\wcmdmgr.exe C:\WINNT\System32\lbc.exe C:\Program Files\1598_Fiberlink\FgrServ.exe C:\Program Files\Cisco systems\VPN Client\vpngui.exe C:\PROGRA~1\MICROS~2\Office\OUTLOOK.exe C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.exe C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe C:\Program Files\AIM\aim.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Documents and Settings\FowlerPT\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.exe O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [wcmdmgr] C:\WINNT\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [lbc] C:\WINNT\System32\lbc.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco systems\VPN Client\vpngui.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: paldpack - http://tag/PAWeb/paldpack/paldpack.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} - http://download.microsoft.com/download/vizact2000/Install/10/WIN98Me/EN-US/msorun.cab O16 - DPF: {C1145550-A454-11D4-9020-00D0B7239081} - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{990E74C8-D336-4E6D-81FD-B554A7F75DFA}: Domain = enterprisenet.org nmrlan.net us.enterprisenet.org nielsenmedia.com vnulinks.org nmrcrx.net stat.nielsenmedia.com vnuinc.org O17 - HKLM\System\CCS\Services\Tcpip\..\{990E74C8-D336-4E6D-81FD-B554A7F75DFA}: NameServer = 10.9.10.71,10.38.69.32 O17 - HKLM\System\CCS\Services\Tcpip\..\{C2AD56C9-13C1-495A-B132-F9FDA022218A}: Domain = nielsenmedia.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = nielsenmedia.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = nielsenmedia.com

Have you done the basic work for yourself??? http://www.computing.net/windowsxp/wwwboard/forum/87147.html http://www.computing.net/security/wwwboard/forum/6433.html Good luck V...

Valerie, Yes. I have tried the links you mentioned. I wouldn't have posted a "hijack this" log without trying to get rid of stuff myself. I'm sorry I didn't make that clear. With Spybot, the only thing that was found was Wild Tangent. And that is for java based games, correct? I updated and ran Adaware, I removed the 4 tracking cookies that were found. That was it. CW Shredder: Nothing was present with this tool either. Any other input guys? Once again... I get www.atoque.com pop ups once I close out IE. Thanks for your help. Sorry I didn't tell about what I had initially tried. Thanks again. Pete

Valerie, Yes. I have tried the links you mentioned. I wouldn't have posted a "hijack this" log without trying to get rid of stuff myself. I'm sorry I didn't make that clear. With Spybot, the only thing that was found was Wild Tangent. And that is for java based games, correct? I updated and ran Adaware, I removed the 4 tracking cookies that were found. That was it. CW Shredder: Nothing was present with this tool either. Any other input guys? Once again... I get www.atoque.com pop ups once I close out IE. Thanks for your help. Sorry I didn't tell about what I had initially tried. Thanks again. Pete

Pete: READ THIS IMPORTANT NOTE: I AM NOT AN EXPERT USER OF HIJACK THIS, THEREFORE I AM NOT DEEMED AND SHOULD NOT BE CONSIDERED A TRUSTED SOURCE FOR INFORMATION REGARDING ITS USE. THIS POST IS INTENDED ONLY FOR USERS WHO UNDERSTAND HOW TO USE HIJACK THIS. IF YOU DO NOT KNOW HOW TO USE THIS PROGRAM, I IMPLORE YOU NOT TO USE THIS POST AS THE BASIS FOR MAKING ANY MODIFICATIONS TO YOUR SYSTEM. HAVING WRITTEN THIS WARNING, THIS POST SERVES TO AFFIRM THAT NEITHER THE HOSTING ENTITY OF THIS POST NOR I SHALL BE HELD ANY IN PART RESPONSIBLE FOR MODIFICATIONS YOU MAKE TO ANY MACHINE WHICH RESULTS IN LOSS OF DATA, LOSS OF APPLICATION USE OR FUNCTIONALITY, MACHINE FAILURE OR ANY OTHER FAILURE OF A MACHINE. That said, whatever atoque.com is, I hate it with passion... I just resolved this problem on a machine and wanted to spread the word; I don't know if anyone has solved it yet... What you have on your machine is a worm, and it's a doozy. It's difficult for even Hijack This to identify it completely, but it is really the only thing that I have found so far that came even close to addressing this horrible piece of adware... This is a worm application that was installed on your machine either through accepting a browser installation or through an application or game that otherwise appeared to be safe (have not identified it)... The application is in the c:\windows\system32 folder. What is the name of the app causing the problem? I can't tell you, because the name changes literally every time it is run, which means every time you run Internet Explorer. In fact, this is what it does: 1. Installs initially (by you, probably unintentionally). 2. Adds a line similar to the following to your registry: O4 - HKLM\..\Run: [AFRCDLGS] C:\WINDOWS\System32\AFRCDLGS.exe (The closest one I see in the above log from you is: O4 - HKLM\..\Run: [lbc] C:\WINNT\System32\lbc.exe And although that might be a valid app, even if that was the worm it has unfortunately but surely changed its name by now...) 3. You close your browser and, bam, you get pop-ups... but that's not all... 4. The next time you open Internet Explorer, that registry key tells the app to run, and it does, literally changing the name of the .exe itself (from lbc.exe to some other random file name, no specific count of alphanumeric characters), removing the registry key for the old app name and adding a new one for the new name! 5. You end up closing your browser window, you get pop-ups, and, close those, then, inevitably, you realize you are in the cycle of pop-up hell as the next time you open up IE you get the damned pop-ups again... So how do you solve the problem when you don't know the name of the file!!! I have managed to solve this problem with relative reliability (so far, anyway). Here's how: 1. Run Hijack This and do a search. Notice the registry entries as logged by Hijack This. Pay particular attention to the ones found in the C:\Windows\System32 folder, with entries which begins with an 04. These 2 references are the first clues to let you know you have found the worm app. 2. Go to c:\windows\system32. Show the window with details so you can see both name and SIZE of the files. SORT BY SIZE. Start looking at the .exe files identified above. 3. Is the file 64kb in size? When you mouse-over the file, is it from a company called 'tmax'? If yes, you have found the worm. But watch out; there is probably more than one bad file in that folder. Look for all files from tmax with that file size to find them all. You won't believe the names which show up. 4. To get rid of the bug, stop the worm's running process, delete all those .exe files in the system32 folder, get rid of the registry entries, and you're done, BUT... 5. If you want to be adventurous and test if this is actually a worm (this is optional, obviously, but proof of how evil programmers can be), do the following: a. Delete the registy entry using the infected file. Stop the running process for the file. Delete all files by tmax EXCEPT one of them. Now, execute that one file, and watch as it adds a new registry entry with a completely different file name(beginning in the hijack this log with 04), and renames itself, then kicks the process off to pop those pop-ups as soon as you close your browser. Arrrgh! I hate how insidious people can be! And the worst part is, they get MONEY from advertisers every time you close your browser! To clean it off again, go back to step 4. Finally, to be thorough, for anyone doing a google search on this evil problem, let me put some text in here so that the post will appear in search results as a relevant item to resolving this issue (hopefully for good!) atoque atoque.com www.atoque.com popups when I close my browser pop-ups when I close my browser tmax If I go to atoque.com all I get is United States 68.49.97.228 help! file name randomly changes bug worm HiJack This can be downloaded at http://www.soft32.com/download-HijackThis-19015-5.html or http://www.soft32.com/download_19015.html

Well Done Wilson !, your method worked great! You must have only just posted it.. I was struggling for hours trying to download Hijackthis( Meijn is off line)and various other Spyware stuff. Thanks Dave

O4 - HKLM\..\Run: [poolsss] C:\WINNT\System32\poolsss.exe Thats the one file Ive found so far that matches your specific instructions. So you said "get rid of registry entries". Without sheer mockery and in my face laughter, do ya think you could tell me how? Thanks Wilson.