Download Adaware SE from this link http://www.lavasoftusa.com/software/adaware/ up date it then download the vx2 cleaner plugin on the right side of the page and install it. Set-up to scan as it is on step 4 at this link Adaware SE set-up instructions The instructions on how to run the vx2 cleaner are on the Adaware SE download page, just click vx2 cleaner. Download silentrunners from this link http://www.silentrunners.org/Silent%20Runners.vbs Save it to the desktop and double-click on it. If you get any kind of warning message about scripts, please choose to allow the script to run. When the scan is finished, it will create a logfile on the desktop. Please post the entire contents of this logfile.

0

here goes the log "Silent Runners.vbs", revision 41, http://www.silentrunners.org/ Operating System: Windows 98 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: ---- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CU1" = "C:\Arquivos de programas\Common Files\VCClient\VCClient.exe" [null data] "CU2" = "C:\Arquivos de programas\Common Files\VCClient\VCMain.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS] "TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS] "AVG7_CC" = "C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGCC.exe /STARTUP" ["GRISOFT, s.r.o."] "AVG7_EMC" = "C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGEMC.exe" ["GRISOFT, s.r.o."] "AVG7_AMSVR" = "C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.exe" ["GRISOFT, s.r.o."] "SystemTray" = "SysTray.Exe" [MS] "LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++} "KB891711" = "C:\WINDOWS\SYSTEM\KB891711\KB891711.exe" [MS] "SchedulingAgent" = "C:\WINDOWS\SYSTEM\mstask.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] "{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Microsoft Office\Office\soa800.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Exchange" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Windows Messaging\mlshext.dll" [MS] "{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Explode" -> {CLSID}\InProcServer32\(Default) = "C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\UNBIND.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Microsoft Office\Office\olkfstub.dll" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\ARQUIV~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\ARQUIV~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {CLSID}\InProcServer32\(Default) = "C:\Arquivos de programas\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {CLSID}\InProcServer32\(Default) = "C:\ARQUIV~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Startup items in "Startup" & "All Users...Startup" folders: - C:\WINDOWS\Menu Iniciar\Programas\Iniciar "WinZip Quick Pick" -> shortcut to: "C:\Arquivos de programas\WinZip\WZQKPICK.exe" ["WinZip Computing, Inc."] "Inicialização do Office" -> shortcut to: "C:\Arquivos de programas\Microsoft Office\Office\OSA.exe -b" [MS] "Localização acelerada da Microsoft" -> shortcut to: "C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.exe" [MS] Enabled Scheduled Tasks: ------------------------ "Aplicativo de ajuste" -> launches: "walign" [MS] "Notificação de atualização crítica do Windows" -> launches: "C:\WINDOWS\SYSTEM\WUCRTUPD.exe" [MS] "XoftSpy" -> launches: "C:\ARQUIVOS DE PROGRAMAS\XOFTSPY\XoftSpy.exe -t" [file not found] Winsock2 Service Provider DLLs: -- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "C:\WINDOWS\SYSTEM\rnr20.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range: C:\WINDOWS\SYSTEM\mswsosp.dll [MS], 1 C:\WINDOWS\SYSTEM\msafd.dll [MS], 2 - 4 C:\WINDOWS\SYSTEM\rsvpsp.dll [MS], 5 - 6 Miscellaneous IE Hijack Points - C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp" [Strings]: SAFESITE_VALUE="search.msn.com.br" Missing lines (compared with English-language version): [Strings]: 2 lines ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 34 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 60 seconds. ---------- (total run time: 141 seconds) the VX2 said the system is clear

0

Go to start>settings>control panel>add/remove programs and uninstall "Microsoft Windows Critical Updates Notification" if found. Navigate to and delete tis folder if found: C:\ARQUIVOS DE PROGRAMAS\XOFTSPY Next run a Hijack This scan>config>misc tools>check the two boxes to the right of "General Stratup Log" then click "general startup log" and copy the result and post that log please. Did you run "Hoster" yet. Post a new HT log also.

0

here the HJ log Logfile of HijackThis v1.99.1 Scan saved at 13:01:13, on 20/12/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\KB891711\KB891711.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\RUNDLL32.exe C:\WINDOWS\TASKMON.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGCC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGEMC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGAMSVR.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\ARQUIVOS DE PROGRAMAS\COMMON FILES\VCCLIENT\VCCLIENT.exe C:\ARQUIVOS DE PROGRAMAS\COMMON FILES\VCCLIENT\VCMAIN.exe C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\OSA.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\FINDFAST.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\ARQUIVOS DE PROGRAMAS\INTERNET EXPLORER\IEXPLORE.exe C:\HJT\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGCC.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGEMC.exe O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.exe O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe O4 - HKCU\..\Run: [CU1] C:\Arquivos de programas\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Arquivos de programas\Common Files\VCClient\VCMain.exe O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.exe O4 - Startup: Inicialização do Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA.exe O4 - Startup: Localização acelerada da Microsoft.lnk = C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab yes I run the hoster

0

here the hoster file 127.0.0.1 sds-qckads.com 127.0.0.1 status.qckads.com 127.0.0.1 www.qoolaid.com 127.0.0.1 www.qoologic.com 127.0.0.1 www.CLKPrecision.com 127.0.0.1 www.urllogic.com 127.0.0.1 www.clkoptimizer.com 127.0.0.1 www.isearch.com 127.0.0.1 isearch.com 127.0.0.1 www.idownload.com 127.0.0.1 idownload.com 127.0.0.1 www.mytotalsearch.com 127.0.0.1 mytotalsearch.com 127.0.0.1 www.lop.com 127.0.0.1 lop.com 127.0.0.1 www.websearch.com 127.0.0.1 websearch.com 127.0.0.1 www.page-not-found.net 127.0.0.1 page-not-found.net 127.0.0.1 www.isearchhere.com 127.0.0.1 isearchhere.com 127.0.0.1 as.adwave.com 127.0.0.1 sr.adwave.com 127.0.0.1 www.adwave.com 127.0.0.1 adwave.com EVENT:HOST:127.0.0.1 127.0.0.1 www.pacimedia.com 127.0.0.1 www.exactsearch.net 127.0.0.1 www.contextplus.net I clicked in the restore original hosts button

0

And what about the popups?

0

still here, nothing change

0

Run a HT scan>click config(bottom right), click misc. tools> check the two boxes to the right of "Generate Startup Log" next click Generate Startup Log and copy/paste that into your next post.

0

here goes the start up log StartupList report, 20/12/05, 21:32:28 StartupList version: 1.52.2 Started from : C:\HJT\HIJACKTHIS.exe Detected: Windows 98 SE (Win9x 4.10.2222A) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options * Including empty and uninteresting sections * Showing rarely important sections ================================================== Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\KB891711\KB891711.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\RUNDLL32.exe C:\WINDOWS\TASKMON.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGCC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGEMC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGAMSVR.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\ARQUIVOS DE PROGRAMAS\COMMON FILES\VCCLIENT\VCCLIENT.exe C:\ARQUIVOS DE PROGRAMAS\COMMON FILES\VCCLIENT\VCMAIN.exe C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\OSA.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\FINDFAST.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\ARQUIVOS DE PROGRAMAS\INTERNET EXPLORER\IEXPLORE.exe C:\HJT\HIJACKTHIS.exe --------------------- Listing of startup folders: Shell folders Startup: [C:\WINDOWS\Menu Iniciar\Programas\Iniciar] WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.exe Inicialização do Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA.exe Localização acelerada da Microsoft.lnk = C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.exe Shell folders AltStartup: *Folder not found* User shell folders Startup: *Folder not found* User shell folders AltStartup: *Folder not found* Shell folders Common Startup: [C:\WINDOWS\All Users\Menu Iniciar\Programas\Iniciar] *No files* Shell folders Common AltStartup: *Folder not found* User shell folders Common Startup: *Folder not found* User shell folders Alternate Common Startup: *Folder not found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ScanRegistry = C:\WINDOWS\scanregw.exe /autorun TaskMonitor = C:\WINDOWS\taskmon.exe AVG7_CC = C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGCC.exe /STARTUP AVG7_EMC = C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGEMC.exe AVG7_AMSVR = C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.exe SystemTray = SysTray.exe LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No values found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices KB891711 = C:\WINDOWS\SYSTEM\KB891711\KB891711.exe SchedulingAgent = C:\WINDOWS\SYSTEM\mstask.exe --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CU1 = C:\Arquivos de programas\Common Files\VCClient\VCClient.exe CU2 = C:\Arquivos de programas\Common Files\VCClient\VCMain.exe --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *No values found* --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\Run *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices *No subkeys found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run *Registry key not found* --------------------- File association entry for .EXE: HKEY_CLASSES_ROOT\exefile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .COM: HKEY_CLASSES_ROOT\comfile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .BAT: HKEY_CLASSES_ROOT\batfile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .PIF: HKEY_CLASSES_ROOT\piffile\shell\open\command (Default) = "%1" %* --------------------- File association entry for .SCR: HKEY_CLASSES_ROOT\scrfile\shell\open\command (Default) = "%1" /S --------------------- File association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = C:\WINDOWS\SYSTEM\MSHTA.exe "%1" %* --------------------- File association entry for .TXT: HKEY_CLASSES_ROOT\txtfile\shell\open\command (Default) = C:\WINDOWS\NOTEPAD.exe %1 --------------------- Enumerating Active Setup stub paths: HKLM\Software\Microsoft\Active Setup\Installed Components (* = disabled by HKCU twin) [SetupcPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SetupcPerUser 64 C:\WINDOWS\INF\setupc.inf [AppletsPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection AppletsPerUser 64 C:\WINDOWS\INF\applets.inf [FontsPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection FontsPerUser 64 C:\WINDOWS\INF\fonts.inf [{5A8D6EE0-3E18-11D0-821E-444553540000}] * StubPath = rundll32.exe advpack.dll,LaunchINFSectionEx C:\WINDOWS\INF\icw.inf,PerUserStub,,36 [PerUser_ICW_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICW_Inis 0 C:\WINDOWS\INF\icw97.inf [{89820200-ECBD-11cf-8B85-00AA005B4383}] * StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383} [>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] * StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP [{89820200-ECBD-11cf-8B85-00AA005B4395}] * StubPath = rundll32.exe advpack.dll,LaunchINFSectionEx C:\WINDOWS\SYSTEM\ie4uinit.inf,Shell.UserStub,,36 [{CA0A4247-44BE-11d1-A005-00805F8ABE06}] * StubPath = RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf [PerUser_Msinfo] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo 64 C:\WINDOWS\INF\msinfo.inf [PerUser_Msinfo2] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo2 64 C:\WINDOWS\INF\msinfo.inf [MotownMmsysPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMmsysPerUser 64 C:\WINDOWS\INF\motown.inf [MotownAvivideoPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownAvivideoPerUser 64 C:\WINDOWS\INF\motown.inf [MotownMPlayPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 C:\WINDOWS\INF\mplay98.inf [PerUser_Base] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Base 64 C:\WINDOWS\INF\msmail.inf [ShellPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection ShellPerUser 64 C:\WINDOWS\INF\shell.inf [Shell2PerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell2PerUser 64 C:\WINDOWS\INF\shell2.inf [PerUser_winbase_Links] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winbase_Links 64 C:\WINDOWS\INF\subase.inf [PerUser_winapps_Links] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winapps_Links 64 C:\WINDOWS\INF\subase.inf [PerUser_LinkBar_URLs] * StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L [TapiPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection TapiPerUser 64 C:\WINDOWS\INF\tapi.inf [{73fa19d0-2d75-11d2-995d-00c04f98bbc9}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\webfdr16.inf,PerUserStub.Install,1 [PerUserOldLinks] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUserOldLinks 64 C:\WINDOWS\INF\appletpp.inf [MmoptRegisterPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRegisterPerUser 64 C:\WINDOWS\INF\mmopt.inf [PerUser_Paint_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Paint_Inis 64 C:\WINDOWS\INF\applets.inf [PerUser_Calc_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Calc_Inis 64 C:\WINDOWS\INF\applets.inf [PerUser_CVT_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf [MotownRecPerUser] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser 64 C:\WINDOWS\INF\motown.inf [PerUser_Vol] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Vol 64 C:\WINDOWS\INF\motown.inf [PerUser_MSWordPad_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 C:\WINDOWS\INF\wordpad.inf [PerUser_RNA_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_RNA_Inis 64 C:\WINDOWS\INF\rna.inf [PerUser_Dialer_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Dialer_Inis 64 C:\WINDOWS\INF\appletpp.inf [PerUser_CDPlayer_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 C:\WINDOWS\INF\mmopt.inf [{44BBA842-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.W95 [{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] * StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C} [{7790769C-0471-11d2-AF11-00C04FA35D02}] * StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02} [{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] * StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl [{89B4C1CD-B018-4511-B0A1-5476DBF70820}] * StubPath = C:\WINDOWS\SYSTEM\Rundll32.exe C:\WINDOWS\SYSTEM\mscories.dll,Install [PerUser_Wingames_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Wingames_Inis 64 C:\WINDOWS\INF\appletpp.inf [PerUser_DCC_Inis] * StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_DCC_Inis 64 C:\WINDOWS\INF\rna.inf [{6BF52A52-394A-11d3-B153-00C04F79FAA6}] * StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub [>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] * StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP --------------------- Enumerating ICQ Agent Autostart apps: HKCU\Software\Mirabilis\ICQ\Agent\Apps *Registry key not found* --------------------- Load/Run keys from C:\WINDOWS\WIN.INI: load= run= --------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=explorer.exe SCRNSAVE.EXE= drivers=mmsystem.dll power.drv --------------------- Checking for EXPLORER.exe instances: C:\WINDOWS\Explorer.exe: PRESENT! C:\Explorer.exe: not present C:\WINDOWS\Explorer\Explorer.exe: not present C:\WINDOWS\System\Explorer.exe: not present C:\WINDOWS\System32\Explorer.exe: not present C:\WINDOWS\Command\Explorer.exe: not present C:\WINDOWS\Fonts\Explorer.exe: not present --------------------- C:\WINDOWS\WININIT.INI listing: *File not found* --------------------- C:\WINDOWS\WININIT.BAK listing: (Created 20/12/2005, 18:12:54) [rename] NUL=C:\WINDOWS\SYSTEM\WSASF.DLL ¥ --------------------- C:\AUTOEXEC.BAT listing: C:\ARQUIV~1\GRISOFT\AVGFRE~1\BOOTUP.exe mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi) mode con codepage select=850 keyb br,,C:\WINDOWS\COMMAND\keyboard.sys SET PATH=C:\WINDOWS\SYSTEM\WBEM;%PATH% --------------------- C:\CONFIG.SYS listing: device=C:\WINDOWS\COMMAND\display.sys con=(ega,,1) Country=055,850,C:\WINDOWS\COMMAND\country.sys --------------------- C:\WINDOWS\WINSTART.BAT listing: *File not found* --------------------- C:\WINDOWS\DOSSTART.BAT listing: *File not found* --------------------- Checking for superhidden extensions: .lnk: HIDDEN! (arrow overlay: yes) .pif: HIDDEN! (arrow overlay: yes) .exe: not hidden .com: not hidden .bat: not hidden .hta: not hidden .scr: not hidden .shs: HIDDEN! .shb: HIDDEN! .vbs: not hidden .vbe: not hidden .wsh: not hidden .scf: HIDDEN! (arrow overlay: NO!) .url: HIDDEN! (arrow overlay: yes) .js: not hidden .jse: not hidden --------------------- Verifying REGEDIT.exe integrity: - Regedit.exe found in C:\WINDOWS - .reg open command is normal (regedit.exe %1) - Company name OK: 'Microsoft Corporation' - Original filename OK: 'REGEDIT.EXE' - File description: 'Editor do Registro' Registry check passed --------------------- Enumerating Browser Helper Objects: *No BHO's found* --------------------- Enumerating Task Scheduler jobs: Aplicativo de ajuste.job XoftSpy.job --------------------- Enumerating Download Program Files: [Microsoft XML Parser for Java] CODEBASE = file://C:\WINDOWS\Java\classes\xmldso4.cab OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd [DirectAnimation Java Classes] CODEBASE = file://C:\WINDOWS\SYSTEM\dajava.cab OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd [Internet Explorer Classes for Java] CODEBASE = file://C:\WINDOWS\SYSTEM\iejava.cab OSD = C:\WINDOWS\Downloaded Program Files\Internet Explorer Classes for Java.osd [Update Class] InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38594.8449652778 [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\SYSTEM\FLASH.OCX CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [Windows Genuine Advantage Validation Tool] InProcServer32 = C:\WINDOWS\SYSTEM\LEGITCHECKCONTROL.DLL CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204 [Symantec RuFSI Utility Class] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL CODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab [Symantec AntiVirus scanner] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AVSNIFF.DLL CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab --------------------- Enumerating Winsock LSP files: NameSpace #1: C:\WINDOWS\SYSTEM\rnr20.dll Protocol #1: C:\WINDOWS\SYSTEM\mswsosp.dll Protocol #2: C:\WINDOWS\SYSTEM\msafd.dll Protocol #3: C:\WINDOWS\SYSTEM\msafd.dll Protocol #4: C:\WINDOWS\SYSTEM\msafd.dll Protocol #5: C:\WINDOWS\SYSTEM\rsvpsp.dll Protocol #6: C:\WINDOWS\SYSTEM\rsvpsp.dll --------------------- Enumerating Win9x VxD services: VNETSUP: vnetsup.vxd NDIS: ndis.vxd,ndis2sup.vxd JAVASUP: JAVASUP.VXD CONFIGMG: *CONFIGMG NTKern: *NTKERN VWIN32: *VWIN32 VFBACKUP: *VFBACKUP VCOMM: *VCOMM COMBUFF: *COMBUFF IFSMGR: *IFSMGR IOS: *IOS MTRR: *mtrr SPOOLER: *SPOOLER UDF: *UDF VFAT: *VFAT VCACHE: *VCACHE VCOND: *VCOND VCDFSD: *VCDFSD VXDLDR: *VXDLDR VDEF: *VDEF VPICD: *VPICD VTD: *VTD REBOOT: *REBOOT VDMAD: *VDMAD VSD: *VSD V86MMGR: *V86MMGR PAGESWAP: *PAGESWAP DOSMGR: *DOSMGR VMPOLL: *VMPOLL SHELL: *SHELL PARITY: *PARITY BIOSXLAT: *BIOSXLAT VMCPD: *VMCPD VTDAPI: *VTDAPI PERF: *PERF VRTWD: C:\WINDOWS\SYSTEM\vrtwd.386 VFIXD: C:\WINDOWS\SYSTEM\vfixd.vxd VNETBIOS: vnetbios.vxd VREDIR: vredir.vxd DFS: dfs.vxd NDISWAN: ndiswan.vxd --------------------- Enumerating ShellServiceObjectDelayLoad items: WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL --------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* --------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run *Registry key not found* --------------------- End of report, 20.906 bytes Report generated in 0,786 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only

0

Run HT again,close all windows and browsers except HT, place a check to the left of the following items and press "fix checked". O4 - HKCU\..\Run: [CU1] C:\Arquivos de programas\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Arquivos de programas\Common Files\VCClient\VCMain.exe Reboot the computer into Safe Mode and set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders">apply>ok. Then navigate to the following folder and delete it: C:\Arquivos de programas\Common Files\VCClient

0

done but popups still here here the ht log Logfile of HijackThis v1.99.1 Scan saved at 15:01:47, on 21/12/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\KB891711\KB891711.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\RUNDLL32.exe C:\WINDOWS\TASKMON.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGCC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGEMC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGAMSVR.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\OSA.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\FINDFAST.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\ARQUIVOS DE PROGRAMAS\INTERNET EXPLORER\IEXPLORE.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\HJT\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGCC.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGEMC.exe O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.exe O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.exe O4 - Startup: Inicialização do Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA.exe O4 - Startup: Localização acelerada da Microsoft.lnk = C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

0

Reboot into safe mode, do a search for and delete: XoftSpy.job Its probable location is C:\Windows\Task\XoftSpy.job This has all the signiture of spyware called lop and is harder to find in 98 but we are about to get it.

0

done and popups still here I run adware Se scan and it found something why shoul I do here the log Ad-Aware SE Build 1.06r1 Logfile Created on:quinta-feira, 22 de dezembro de 2005 13:29:32 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R82 19.12.2005 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch(TAC index:10):13 total references MRU List(TAC index:0):21 total references Tracking Cookie(TAC index:3):10 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Definition File: ========================= Definitions File Loaded: Reference Number : SE1R82 19.12.2005 Internal build : 95 File location : C:\ARQUIVOS DE PROGRAMAS\LAVASOFT\AD-AWARE SE PERSONAL\defs.ref File size : 568938 Bytes Total size : 1707938 Bytes Signature data size : 1673520 Bytes Reference data size : 33906 Bytes Signatures total : 47471 CSI Fingerprints total : 1252 CSI data size : 36173 Bytes Target categories : 15 Target families : 807 Memory + processor status: ========================== Number of processors : 1 Processor architecture : Intel Pentium III Memory available:0 % Total physical memory:114116 kb Available physical memory:3960 kb Total page file size:1983032 kb Available on page file:1888496 kb Total virtual memory:2093056 kb Available virtual memory:2044672 kb OS:Microsoft Windows 98 SE Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 22-12-05 13:29:32 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : .DEFAULT\software\adobe\acrobat reader\6.0\avgeneral\crecentfiles Description : list of recently used files in adobe reader MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\internet explorer Description : last download directory used in microsoft internet explorer MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\internet explorer\main Description : last save directory used in microsoft internet explorer MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\mediaplayer\medialibraryui Description : last selected node in the microsoft windows media player media library MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\mediaplayer\preferences Description : last playlist index loaded in microsoft windows media player MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\mediaplayer\preferences Description : last playlist loaded in microsoft windows media player MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\mediaplayer\preferences Description : last search path used in microsoft windows media player MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\office\8.0\excel\recent file list Description : list of recent files used by microsoft excel MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\office\8.0\powerpoint\recent file list Description : list of recent files used by microsoft powerpoint MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\applets\wordpad\recent file list Description : list of recent files opened using wordpad MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\doc find spec mru Description : list of recently used search terms for locating files using the microsoft windows operating system MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\findcomputermru Description : list of recently used search terms for locating computers using the microsoft windows operating system MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run MRU List Object Recognized! Location: : .DEFAULT\software\nico mak computing\winzip\filemenu Description : winzip recently used archives MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general Description : windows media sdk Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [KERNEL32.DLL] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4293857277 Threads : 4 Priority : High FileVersion : 4.10.2222 ProductVersion : 4.10.2222 ProductName : Sistema operacional Microsoft(R) Windows(R) CompanyName : Microsoft Corporation FileDescription : Componente de núcleo do Win32 Kernel InternalName : KERNEL32 LegalCopyright : Copyright (C) Microsoft Corp. 1991-1999 OriginalFilename : KERNEL32.DLL #:2 [MSGSRV32.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4294916973 Threads : 1 Priority : Normal FileVersion : 4.10.2222 ProductVersion : 4.10.2222 ProductName : Sistema operacional Microsoft(R) Windows(R) CompanyName : Microsoft Corporation FileDescription : Servidor de mensagens do dispositivo virtual de 32 bits do Windows InternalName : MSGSRV32 LegalCopyright : Copyright (C) Microsoft Corp. 1992-1998 OriginalFilename : MSGSRV32.exe #:3 [MPREXE.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4294954205 Threads : 1 Priority : Normal FileVersion : 4.10.1998 ProductVersion : 4.10.1998 ProductName : Microsoft(R) Windows(R) Operating System CompanyName : Microsoft Corporation FileDescription : WIN32 Network Interface Service Process InternalName : MPREXE LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998 OriginalFilename : MPREXE.exe #:4 [mmtask.tsk] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4294956281 Threads : 1 Priority : Normal FileVersion : 4.03.1998 ProductVersion : 4.03.1998 ProductName : Microsoft Windows CompanyName : Microsoft Corporation FileDescription : Multimedia background task support module InternalName : mmtask.tsk LegalCopyright : Copyright © Microsoft Corp. 1991-1998 OriginalFilename : mmtask.tsk #:5 [KB891711.EXE] FilePath : C:\WINDOWS\SYSTEM\KB891711\ ProcessID : 4294966269 Threads : 1 Priority : Normal FileVersion : 4.10.2223 ProductVersion : 4.10.2222 ProductName : Microsoft(R) Windows(R) Operating System CompanyName : Microsoft Corporation FileDescription : Windows KB891711 component InternalName : KB891711 LegalCopyright : Copyright (C) Microsoft Corp. 1991-2005 OriginalFilename : KB891711.exe #:6 [MSTASK.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4294964429 Threads : 2 Priority : Normal FileVersion : 4.71.1959.1 ProductVersion : 4.71.1959.1 ProductName : Agendador de tarefas do Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Motor do 'Agendador de tarefas' InternalName : TaskScheduler LegalCopyright : Copyright (C) Microsoft Corp. 1997 OriginalFilename : mstask.exe #:7 [EXPLORER.EXE] FilePath : C:\WINDOWS\ ProcessID : 4294854977 Threads : 26 Priority : Normal FileVersion : 4.72.3110.1 ProductVersion : 4.72.3110.1 ProductName : Sistema operacional Microsoft(R) Windows NT(R) CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : Copyright (C) Microsoft Corp. 1981-1997 OriginalFilename : EXPLORER.exe #:8 [RUNDLL32.EXE] FilePath : C:\WINDOWS\ ProcessID : 4294898257 Threads : 3 Priority : Normal FileVersion : 4.10.1998 ProductVersion : 4.10.1998 ProductName : Sistema operacional Microsoft(R) Windows(R) CompanyName : Microsoft Corporation FileDescription : Executa uma DLL como um aplicativo InternalName : rundll LegalCopyright : Copyright (C) Microsoft Corp. 1991-1998 OriginalFilename : RUNDLL.exe #:9 [TASKMON.EXE] FilePath : C:\WINDOWS\ ProcessID : 4294775445 Threads : 1 Priority : Normal FileVersion : 4.10.1998 ProductVersion : 4.10.1998 ProductName : Microsoft(R) Windows(R) Operating System CompanyName : Microsoft Corporation FileDescription : Task Monitor InternalName : TaskMon LegalCopyright : Copyright (C) Microsoft Corp. 1998 OriginalFilename : TASKMON.exe #:10 [AVGCC.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\ ProcessID : 4294786097 Threads : 5 Priority : Normal FileVersion : 7,1,0,355 ProductVersion : 7.1.0.355 ProductName : AVG Anti-Virus System CompanyName : GRISOFT, s.r.o. FileDescription : AVG Control Center InternalName : AvgCC LegalCopyright : Copyright © 2005, GRISOFT, s.r.o. OriginalFilename : AvgCC.exe #:11 [AVGEMC.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\ ProcessID : 4294806213 Threads : 6 Priority : Normal FileVersion : 7,1,0,371 ProductVersion : 7.1.0.371 ProductName : AVG Anti-Virus System CompanyName : GRISOFT, s.r.o. FileDescription : AVG E-Mail Scanner InternalName : avgemc LegalCopyright : Copyright © 2005, GRISOFT, s.r.o. OriginalFilename : avgemc.exe #:12 [AVGAMSVR.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\ ProcessID : 4294807857 Threads : 7 Priority : Normal FileVersion : 7,1,0,365 ProductVersion : 7.1.0.365 ProductName : AVG Anti-Virus System CompanyName : GRISOFT, s.r.o. FileDescription : AVG Alert Manager InternalName : avgamsvr LegalCopyright : Copyright © 2005, GRISOFT, s.r.o. OriginalFilename : avgamsvr.exe #:13 [SYSTRAY.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4294812345 Threads : 2 Priority : Normal FileVersion : 4.10.2222 ProductVersion : 4.10.2222 ProductName : Sistema operacional Microsoft(R) Windows(R) CompanyName : Microsoft Corporation FileDescription : Miniaplicativo de bandeja do sistema InternalName : SYSTRAY LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998 OriginalFilename : SYSTRAY.exe #:14 [WZQKPICK.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\WINZIP\ ProcessID : 4294736641 Threads : 1 Priority : Normal FileVersion : 1.0 (32-bit) ProductVersion : 9.0 (6224) ProductName : WinZip CompanyName : WinZip Computing, Inc. FileDescription : WinZip Executable InternalName : WZQKPICK.exe LegalCopyright : Copyright (c) WinZip Computing, Inc. 1991-2004 - All Rights Reserved LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc OriginalFilename : WZQKPICK.exe Comments : StringFileInfo: U.S. English #:15 [OSA.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\ ProcessID : 4294707169 Threads : 1 Priority : Normal #:16 [FINDFAST.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\ ProcessID : 4294720485 Threads : 3 Priority : Normal FileVersion : 8.0 ProductVersion : 8.0 ProductName : Localização acelerada da Microsoft® CompanyName : Microsoft Corporation FileDescription : Localização acelerada do Microsoft Office InternalName : FINDFAST LegalCopyright : Copyright © Microsoft Corp. 1995-1997 OriginalFilename : FINDFAST.exe #:17 [WMIEXE.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4293129993 Threads : 3 Priority : Normal FileVersion : 5.00.1755.1 ProductVersion : 5.00.1755.1 ProductName : Microsoft(R) Windows NT(R) Operating System CompanyName : Microsoft Corporation FileDescription : WMI service exe housing InternalName : wmiexe LegalCopyright : Copyright (C) Microsoft Corp. 1981-1998 OriginalFilename : wmiexe.exe #:18 [DDHELP.EXE] FilePath : C:\WINDOWS\SYSTEM\ ProcessID : 4293055549 Threads : 2 Priority : Realtime FileVersion : 4.09.00.0900 ProductVersion : 4.09.00.0900 ProductName : Microsoft® DirectX for Windows® CompanyName : Microsoft Corporation FileDescription : Microsoft DirectX Helper InternalName : DDHelp.exe LegalCopyright : Copyright © Microsoft Corp. 1994-2002 OriginalFilename : DDHelp.exe #:19 [MSNMSGR.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\MSN MESSENGER\ ProcessID : 4293045085 Threads : 15 Priority : Normal FileVersion : 7.0.0816 ProductVersion : 7.0.0816 ProductName : MSN Messenger CompanyName : Microsoft Corporation FileDescription : MSN Messenger InternalName : msnmsgr LegalCopyright : Copyright (c) Microsoft Corporation 1997-2005 LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries. OriginalFilename : msnmsgr.exe #:20 [AD-AWARE.EXE] FilePath : C:\ARQUIVOS DE PROGRAMAS\LAVASOFT\AD-AWARE SE PERSONAL\ ProcessID : 4293022941 Threads : 2 Priority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 21 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@realmedia[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:10 Value : Cookie:usuario@realmedia.com/ Expires : 31-12-20 21:59:58 LastSync : Hits:10 UseCount : 0 Hits : 10 Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@maxserving[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:3 Value : Cookie:usuario@maxserving.com/ Expires : 18-12-15 12:09:22 LastSync : Hits:3 UseCount : 0 Hits : 3 Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@tribalfusion[1].txt TAC Rating : 3 Category : Data Miner Comment : Hits:7 Value : Cookie:usuario@tribalfusion.com/ Expires : 31-12-37 22:00:00 LastSync : Hits:7 UseCount : 0 Hits : 7 Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@as-us.falkag[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:549 Value : Cookie:usuario@as-us.falkag.net/ Expires : 21-12-06 21:30:04 LastSync : Hits:549 UseCount : 0 Hits : 549 Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@2o7[2].txt TAC Rating : 3 Category : Data Miner Comment : Hits:2 Value : Cookie:usuario@2o7.net/ Expires : 21-12-10 13:25:06 LastSync : Hits:2 UseCount : 0 Hits : 2 Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 5 Objects found so far: 26 Deep scanning and examining files (c:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : File Data : VZAJET32.DLL TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : PHD.DLL TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : PFD.DLL TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : mvyuv.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : CDFG95.DLL TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : wvdmps.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : dkdmo.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : wsasf.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : cortc.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ CoolWebSearch Object Recognized! Type : File Data : moscp.dll TAC Rating : 10 Category : Malware Comment : Object : c:\WINDOWS\SYSTEM\ Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@realmedia[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : c:\WINDOWS\Cookies\usuario@realmedia[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@tribalfusion[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : c:\WINDOWS\Cookies\usuario@tribalfusion[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@maxserving[1].txt TAC Rating : 3 Category : Data Miner Comment : Value : c:\WINDOWS\Cookies\usuario@maxserving[1].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@as-us.falkag[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : c:\WINDOWS\Cookies\usuario@as-us.falkag[2].txt Tracking Cookie Object Recognized! Type : IECache Entry Data : usuario@2o7[2].txt TAC Rating : 3 Category : Data Miner Comment : Value : c:\WINDOWS\Cookies\usuario@2o7[2].txt Disk Scan Result for c:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 41 Scanning Hosts file...... Hosts file location:"C:\WINDOWS\hosts". »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 31 entries scanned. New critical objects:0 Objects found so far: 41 Performing conditional scans... »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» CoolWebSearch Object Recognized! Type : Regkey Data : TAC Rating : 10 Category : Malware Comment : Rootkey : HKEY_LOCAL_MACHINE Object : software\microsoft\downloadmanager CoolWebSearch Object Recognized! Type : File Data : hosts TAC Rating : 10 Category : Malware Comment : Object : C:\WINDOWS\ CoolWebSearch Object Recognized! Type : File Data : wbemess.log TAC Rating : 10 Category : Malware Comment : Object : C:\WINDOWS\SYSTEM\wbem\logs\ Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 3 Objects found so far: 44 13:53:31 Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:23:59.100 Objects scanned:54624 Objects identified:23 Objects ignored:0 New critical objects:23

0

The bad guy appears to be coolwebsearch.Download this coolwebsearch removal tool called aboutbuster http://www.malwarebytes.org/AboutBuster.zip to the desktop and update it. Reboot into safe mode.Double click "About:Buster". Click "Start" to begin the scan. If prompted to end the Explorer.exe process, click "Yes".Your desktop may disappear --- this is normal. Allow the program to scan twice, and when complete click "Save Log" This will create a text file called "AB Logfile.txt" in the folder where About:Buster is saved. Post the log file after running cleanup. Exit About:Buster then open it and run it again to make sure it comes up clean. To reboot into safe mode turn the computer off.Wait 30 seconds,restart and press F8 intermittingly as it is booting. This may take a few tries to get the timimg right.

0

doesn't work here the log AboutBuster 5.1, reference file 33 Scan started on [22/12/05] at [15:33:53] ------------------- Streams(ADS) not scanned: System not NTFS ------------------- No Files Found! ------------------- Scan was COMPLETED SUCCESSFULLY at 15:35:09 AboutBuster 5.1, reference file 33 Scan started on [22/12/05] at [15:35:59] ------------------- Streams(ADS) not scanned: System not NTFS ------------------- No Files Found! ------------------- Scan was COMPLETED SUCCESSFULLY at 15:37:11 AboutBuster 5.1, reference file 33 Scan started on [22/12/05] at [15:41:04] ------------------- Streams(ADS) not scanned: System not NTFS ------------------- No Files Found! ------------------- Scan was COMPLETED SUCCESSFULLY at 15:42:36

0

Ok, I recognize one of the files as look2me. Download the look2me9xfix at this link http://www.noidea.us/easyfile/file.php?show=20050804120705301 to the desktop and run it. Extract the files, and then open the l2m9xfix folder you just created and run RunThis.bat. A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed. Then please restart your computer, and post a new HijackThis log as well as the entire text of the log.txt file which should be in the same folder as RunThis.bat. Then we can manually cleanup the coolwebsearch files.

0

Logfile of HijackThis v1.99.1 Scan saved at 22:04:21, on 22/12/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\KB891711\KB891711.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\TASKMON.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGCC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGEMC.exe C:\ARQUIVOS DE PROGRAMAS\GRISOFT\AVG FREE\AVGAMSVR.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\ARQUIVOS DE PROGRAMAS\WINZIP\WZQKPICK.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\OSA.exe C:\ARQUIVOS DE PROGRAMAS\MICROSOFT OFFICE\OFFICE\FINDFAST.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\HJT\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGCC.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGEMC.exe O4 - HKLM\..\Run: [AVG7_AMSVR] C:\ARQUIV~1\GRISOFT\AVGFRE~1\AVGAMSVR.exe O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.exe O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe O4 - Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.exe O4 - Startup: Inicialização do Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA.exe O4 - Startup: Localização acelerada da Microsoft.lnk = C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab Log of L2M9XFix v1.01a ************ Running from directory: C:\l2m9xfix ************ Files found: C:\WINDOWS\system\LKAETK32.DLL C:\WINDOWS\system\MCC40LOC.DLL C:\WINDOWS\system\MCTCP.DLL C:\WINDOWS\system\mipatcha.dll ************ Registry entries found: [HKEY_CLASSES_ROOT\CLSID\{55BCFEA0-6B61-11DA-B6AC-0007952373B1}\InprocServer32] @="C:\\WINDOWS\\SYSTEM\\MCTCP.DLL" ************ Killing Explorer Done! Killing Rundll32 Done! Removing malicious CLSID(s) Done! Restarting Explorer Done! Deleting malicious files Done! Finished!

0

Are you still having popups. If so run the look2me9xfix from safe mode and post the results. Run the adaware scan again and post it's log file.

0

Also,delete everything that adaware se finds.When the scan completes click next>put a check in the boxes in the window MRU's, Files,Folders, Everything,click next,click ok to remove all items.

0

after doing everything the popups were still there but now popups finished everytime i started the pc the hoster program shows 12700 entryes i deleted them and restore original hosts and when i restart the computer they were there i deleted them a few times and after this the popups were gone but the 12700 entries still there actually i don't know what happenned thank you a lot for the help

0

1. Turn off system restore 2. boot to safe mode 3. run adaware se - delete everything it finds 4. run virus scan - delete everything it finds 5. restart in regular mode 6. turn on system restore also try spybot s&d and spywareblaster Alert me after you respond otherwise I'll forget to come back.

0