Hi! I'm a blonde college student who happened to download a toolbar that has plagued my computer with popups as i search with internet explorer. I ran Adware, and cwshredder. It finds new files everyday, but it doesn't get rid of the popups. The websites are bannerfarm and metarewards.com that I have seen today. I looked around for help and I found the hijack software. I followed the instructions to post my running processes found on my computer. I need an expert to tell me what I can and cannot delete, and also for any additional tips to forget about these popups. Thank You! Log from Hijack Logfile of HijackThis v1.97.7 Scan saved at 8:37:23 PM, on 7/3/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\RPCSS.exe C:\WINDOWS\SYSTEM\RESTORE\STMGR.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\MICROSOFT WORKS\WKSSB.exe C:\WINDOWS\SYSTEM\CTHELPER.exe C:\WINDOWS\LOADQM.exe C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\SYSTEM\YFRKSUZ.exe C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.exe C:\PROGRAM FILES\AIM95\AIM.exe C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.exe C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\WINDOWS\SYSTEM\RNAAPP.exe C:\WINDOWS\SYSTEM\TAPISRV.exe C:\WINDOWS\SYSTEM\WBEM\WINMGMT.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\PROGRAM FILES\CASE'S LADDER\CHATCLIENT.exe C:\WINDOWS\TEMP\HIJACKTHIS.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [CTStartup] C:\PROGRAM FILES\CREATIVE\SPLASH SCREEN\CTEaxSpl.exe /run O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.exe O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [dcmndivsm] C:\WINDOWS\SYSTEM\yfrksuz.exe O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.exe O4 - Startup: PowerReg SchedulerV2.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Encarta Encyclopedia (HKLM) O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM) O9 - Extra button: Define (HKLM) O9 - Extra 'Tools' menuitem: Define (HKLM) O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/SU/ocx/12119/CTSUEng.cab O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://play.igl.net/clo/install/CLOActiveXInstallerProj1.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38047.5185648148 O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab O16 - DPF: Yahoo! Pinochle - http://download.games.yahoo.com/games/clients/y/ut2_x.cab O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab Thanks!

Jen, I don't see an antivirus running and I think C:\WINDOWS\SYSTEM\YFRKSUZ.exe may be a virus,don't know for sure but you should run an online scan. A free online virus scan here Housecall Download this free spyware remover Ad-aware 6.0 be sure to update it and set to this: Launch the program, and click on the Gear at the top of the start screen. Click the "Scanning" button. Under Drives & Folders, select "Scan within Archives". Click "Click here to select Drives + folders" and select your installed hard drives. Under Memory & Registry, select all options. Click the "Advanced" button. Under "Log-file detail", select all options. Click the "Tweaks" button. Under "Scanning Engine", select the following: "Include additional Ad-aware settings in logfile" and "Unload recognized processes during scanning." Under "Cleaning Engine", select the following: "Let Windows remove files in use after reboot." Click on 'Proceed' to save these Preferences. Please make sure that you activate IN-DEPTH scanning before you proceed. You can get a free antivirus here avg antivirus After you run the online scan and ad-aware 6.0 post another log.These to two items are probably causing you the problem but may be cleaned up after running an antivirus scan and ad-aware: O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL O4 - HKLM\..\Run: [dcmndivsm] C:\WINDOWS\SYSTEM\yfrksuz.exe

Hello. I ran housecall and it picked up 8 viruses. I rebooted and I am running it again. It was unable to remove one virus. "Troj agent.ea" Also, I updated the settings on adware and I am running it again. After they finish, I will reboot and post another hijack log. Thanks!

To get rid of the trojan you have to disable your system restore: This is my clean-up Me schpiel: ARE YOU UPDATED ON WIN ME, OUTLOOK, AND IE? If not, do that first. I run Adaware, Spybot and I update and run them every three days or less, plus Script Sentry, MRU Blaster, Spyware Blaster in the background, and A Squared once a week or so just to double check; update it also every three days. If you have, or think you have trojans, virus, etc., do this: Dump system restore: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239?Open&src=sec_doc_nam&docid=2001111912274039&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl That is not an option, bugs hide in the system restore files. Do not re-enable them until you are sure you are clean. General clean-up: Expose Hidden Files: http://www.xtra.co.nz/help/0,,4155-1916458,00.html Go into safe mode and run Adaware, Spybot, your updated AV, and then do this: Use these in order: Trojan Hunter trial version: http://www.misec.net/ Trojan Scan: http://www.windowsecurity.com/trojanscan/ SWATIT: http://swatit.org/download.html reboot, back into safe mode: Tools > Intenet Options> General Tab > Delte files > check the box to delete off line content > click ok > delete cookies > click ok. %TEMP% files: Dble click My Computer icon on desk top > type %TEMP in the address bar > click enter > delete all you can delete. Empty recycle bin. Go to start > Programs > Accessories > System Tools > Run disk clean up, then scan disk, if scan disk tells you there are programs running in the background--ctrl+alt+delete and end-task on everything except sytray and explorer, the run scan disk > then defragmenter. Read this yet?: Me set up page, Trev: http://www.burzurq.com/forum/trevtweak.html If you do not have a firewall or want a great free service, i use: Free Sygate firewall: http://smb.sygate.com/products/spf_standard.htm Diagnostics: Jason’s Browser Security Test: http://www.jasons-toolbox.com/BrowserSecurity/ Gibson tests: http://www.grc.com/default.htm I use LeakTest, DCOMbobulator, ShieldUp, and UnplugNpray Thresher

Hello. Ok, so I keep running adware, spybot and cwsshredder and the virus. THe trojan ea virus is still on my computer, I will try and fix that today. I just wanted to post a new hijack log and see if there is anything else bad. Thanks!! Logfile of HijackThis v1.97.7 Scan saved at 2:29:40 PM, on 7/5/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\RPCSS.exe C:\WINDOWS\SYSTEM\RESTORE\STMGR.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\MICROSOFT WORKS\WKSSB.exe C:\WINDOWS\SYSTEM\CTHELPER.exe C:\WINDOWS\LOADQM.exe C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.exe C:\WINDOWS\SYSTEM\YFRKSUZ.exe C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\PROGRAM FILES\AIM95\AIM.exe C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\MONEY EXPRESS.exe C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.exe C:\WINDOWS\SYSTEM\DDHELP.exe C:\WINDOWS\SYSTEM\SPOOL32.exe C:\WINDOWS\SYSTEM\PSTORES.exe C:\WINDOWS\SYSTEM\RNAAPP.exe C:\WINDOWS\SYSTEM\TAPISRV.exe C:\PROGRAM FILES\WINZIP\WINZIP32.exe C:\WINDOWS\TEMP\HIJACKTHIS.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\MXTARGET.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.exe O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [ALCHEM] C:\WINDOWS\ALCHEM.exe O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.exe" +c O4 - HKLM\..\Run: [xwczqrv] C:\WINDOWS\SYSTEM\YFRKSUZ.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.exe O4 - Startup: PowerReg SchedulerV2.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Encarta Encyclopedia (HKLM) O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM) O9 - Extra button: Define (HKLM) O9 - Extra 'Tools' menuitem: Define (HKLM) O9 - Extra button: AIM (HKLM) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.att.net O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab O16 - DPF: Yahoo! Pinochle - http://download.games.yahoo.com/games/clients/y/ut2_x.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

This is the source of your pop-ups. O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\MXTARGET.DLL Read this. Adware Alert - TWAINTEC.DLL - MXTarget This is bulls--- too. O4 - HKLM\..\Run: [xwczqrv] C:\WINDOWS\SYSTEM\YFRKSUZ.exe You'll probably have to go into safe mode and delete that file. Then I suggest you go into msconfig and start unchecking the unneccessary start up items. This should help for that. Sysinfo -- Startup Applications List

Unable to clean trojan file C:\WINDOWS\Temporary Internet Files\Content.IE5\9B7FXP4A\clo[1].zip/clo.exe because it is contained in an archive Unable to clean trojan file C:\WINDOWS\Temporary Internet Files\Content.IE5\ADRWXGR6\BlackAndRed[1].zip/BlackAndRed.exe because it is contained in an archive Renamed file C:\WINDOWS\Temporary Internet Files\Content.IE5\K5AVGTMJ\leaktest[1].exe to C:\WINDOWS\Temporary Internet Files\Content.IE5\K5AVGTMJ\leaktest[1].exe.tcf Unable to clean trojan file C:\WINDOWS\Temporary Internet Files\Content.IE5\KXAF6J8P\BlackAndRed[1].zip/BlackAndRed.exe because it is contained in an archive