Hi, I did follow your instructions to fix the problems from hijackthis and there're some problems still existing. when i connected to the internet the IE browser will pop up with advertisment automatically. Then I opened another browser like 2 seconds after another pop up message shown up again. Therefore I tried to run hijackthis again and here's the logfile. Pls help me out again. Any help would be appreciated. Thanks! Logfile of HijackThis v1.97.7 Scan saved at 11:54:06 PM, on 1/19/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\System32\ICO.exe C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe C:\WINDOWS\System32\Pelmiced.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\pgtools\tatss.exe C:\Program Files\Common Files\Dpi\dpi.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\PowerPanel\Program\PcfMgr.exe C:\Program Files\ICQ\ICQ.exe C:\WINDOWS\System32\Wqj2moDV.exe C:\WINDOWS\System32\Demc1bU0.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\AproposClient\Apropos.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\SONY\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sbc.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.sbc.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = , R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = , O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\AproposClient\AproposPlugin.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.exe O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [JOGSERV2.EXE] C:\Program Files\Sony\Jog Dial Navigator\JogServ2.exe O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.exe O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe /IMEName O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [4X@95ME57C5BM8] C:\WINDOWS\System32\Cjo9g.exe O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.exe O4 - HKLM\..\Run: [Tat] C:\WINDOWS\system32\pgtools\tatss.exe O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\RunOnce: [ICQ] C:\Program Files\ICQ\ICQ.exe -trayboot O4 - Global Startup: PowerPanel.lnk = ? O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM) O9 - Extra button: ICQ Pro (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://vaio-online.sony.com/ O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2E841CF8-B6A5-4BD2-A266-128DF2F63DAE}: NameServer = 67.36.13.26 66.73.20.40 O17 - HKLM\System\CS1\Services\Tcpip\..\{2E841CF8-B6A5-4BD2-A266-128DF2F63DAE}: NameServer = 67.36.13.26 66.73.20.40

0

Go here for free trojan scan http://www.trojanscan.com/trojanscan/ Do it first. I'm 99% sure you have the peper trojan which needs special attention, if so... 1. Use the uninstall tool - download from: http://home01.wxs.nl/~kleyn080/uninst.exe. Double click on uninst.exe, let it run and terminate. 2. Delete all the associated files with drpeper - download from http://www.mjc1.com/files/mo/drpeper.html. Double click drpepertobackup, it will self extract to C:. With the text in the box highlighted and the 'overwrite' existing files checked, click start. 3. Go to the file C:\drpeper\Find backup and Delete Peper files.vbs and double click. 4. A box will appear, copy and paste: xxxxxx.exe and hit ok. 5. A second box will appear, copy and paste yyyyyy.exe and hit ok. 6. It will find all the files, delete them and will make backups in the same folder. It'll open a text file (Peper.txt) with the list of all files deleted. Make sure it is saved. Then rescan with HJT, post a new HJT log and the contents of the Peper.txt file - the next stage will be to remove the rest of the bad stuff. In line 4. replace xxxxxx.exe with any unknown running process that does not have an O4 startup. In line 5. replace yyyyyy.exe with the one from the [14-char], which would be MztYif2.exe in the example above. Make sure they show the Peper.txt - it should list a bunch of things deleted. And make sure they keep the drpeper folder with the backups. Once they are all clean and happy they can delete the drpeper folder. I'm getting into untested ( by me ), ground here. Afterwards, messenger and a couple of other thins need to be disabled. Frank

0

After you've done all the other things from earlier answer: You should put HJT in C:\ for back-up. WITH ALL OTHER WINDOWS CLOSED, HAVE HJT FIX: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = , R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = , O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\AproposClient\AproposPlugin.dll O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe FIX: O4 - HKLM\..\Run: [4X@95ME57C5BM8] C:\WINDOWS\System32\Cjo9g.exe O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.exe O4 - HKLM\..\Run: [Tat] C:\WINDOWS\system32\pgtools\tatss.exe O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe O14 - IERESET.INF: START_PAGE_URL=http://vaio-online.sony.com/ Turn this off in services.msc O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background DO you recognize these? if so keep, if not fix. O17 - HKLM\System\CCS\Services\Tcpip\..\{2E841CF8-B6A5-4BD2-A266-128DF2F63DA E}: NameServer = 67.36.13.26 66.73.20.40 O17 - HKLM\System\CS1\Services\Tcpip\..\{2E841CF8-B6A5-4BD2-A266-128DF2F63DA E}: NameServer = 67.36.13.26 66.73.20.40 REBOOT Download CWShreddder http://www.spywareinfo.com/~merijn/cwschronicles.html and check your system. Here's what I found on nerocheck. It's up to you to try. Quote is from answers that work:Nerocheck NeroCheck.exe (Ahead Software) Background Task installed by Nero’s CD Burning software. Straight from Ahead software : "The NeroCheck program looks for known driver conflicts with our Nero software. So that when a Nero Log file is printed, at the very bottom of the Nero log file you will find a list of drivers we have found on your system that could be causing conflicts, if you are running into problems.". Recommendation : If Nero is working on your system then you do not need NeroCheck to run. Disable it with The Ultimate Troubleshooter unless you experience problems with Nero, in which case re-enable NeroCheck to see what the log file reports. O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

0

Hey I am still waiting for you to try the doxdesk website and give me the report.

0

I had the same thing happen with the unwanted toolbar and here is how I fixed it. I went to the windows add/remove menu and found it there listed as a program. Windows removed it just fine. I ran ad-aware which didn't pick it up the first time but the second time I ran ad-aware I did so with an updated list and this time it found it lodged in the registry. Ad aware removed it and I re-booted several times to make sure it wasn't going to reappear and it was gone. I also located two other programs which should have not been there and got rid of them as well. I found the folder for it using Windows Explorer (Folder name was search4u-or similar name). Hope this helps.

0

I just had the same problem with the WhenUSearch toolbar. I could not remove it using Add/Remove programs even though it was listed there. I tried Spybot Search & Distroy and AdAware...found and removed a lot of other bad stuff by not this toolbar. THE SOLUTION: Find the WhenUSearch folder in Program Files. Here you will find the uninstall program. Run it and voila! its gone.

0