PCTech Forums

Ran Spybot S&D 1.3 with 16381 patterns (updated).. found 53, cleaned 48, on reboot.. 5 more removed.. Ran Ad-aware 6.181 R337 - found a few more.. (26?) cleaned them.. no problem

Tried to install AVG - had a "could not find c:\Doc and settings\daboyz\local settings\temp\wzsf.tmp\setup.exe" or one of its components that right after getting a "Cannot find shell.dll" error message..

bailed on that

and ran Bazooka..

updated..

Nothing Detected

installed and updated Spyware Blaster and Spyware Guard

Launched IE and got about 3 dozen warnings about home page and search page attempted to be changed.. and .. pop-ups are still present

ran HJT 1.98.2 .. and here is the report

(also.. where could i MAIL (yes, old fashioned and antiquated.. but reliable) - a cheque.. / donation.. you folks have been really helpful.. and when things settle down here a bit for me.. i do intend to move up from geek in training.. but that might not happen now til Sept 14-17th window as to when i can take more training on line.. ) ..

any way.. here is the report

Logfile of HijackThis v1.98.2
Scan saved at 4:01:43 PM, on 8/18/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msaq.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\appxx32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\aim\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
C:\Teks2Go Utilities\SpywareGuard\sgbhp.exe
C:\Teks2Go Utilities\HijackThis1982.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R3 - Default URLSearchHook is missing
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\da BoyZ\Application Data\Mozilla\Profiles\default\t436glj2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O4 - HKLM\..\Run: [appxx32.exe] C:\WINDOWS\appxx32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

...i have some suspicions.. ... primarily these lines.. but not sure if i have caught them all.. or not..

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fxbvc.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\fxbvc.dll/sp.html#96676

...also not too comfy with this BIGFIX thing.. hmmmm...

again any help would be greatly appreciated..

Well, PCguy can fill you in on the check................

#1. After you've finished fixing this problem I strongly recommend that you visit the and download the Critical Updates.

Next:
Please download: .
Unzip it to your desktop but don't run it yet.

Do not open internet explorer to come back here until after running the tool.

Double click Aboutbuster.exe, click OK, click Start, then click OK. This will scan your computer for the bad files and delete them.

Once the tool is done scanning, copy the log and paste it into your thread.
with a new Hijack this log.

brad

I followed your instructions ... with use of About Buster

looks like a nifty program..

its instructions said to run it twice.. .. was not sure if that is what you wanted.. but i did..

here is its log file ..


Scanned at: 5:39:52 PM on: 8/18/2004


-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15


Removed Data Streams:
C:\WINDOWS\AIM.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\boqgz.dat:tfxtb
C:\WINDOWS\cznfr.dll:fgfnb
C:\WINDOWS\dqyop.dll:uouvq
C:\WINDOWS\emachines_32.bmp:dmaov
C:\WINDOWS\encarta.ico:spsxe
C:\WINDOWS\explorer.scf:eqxgm
C:\WINDOWS\FaxSetup.log:wmstx
C:\WINDOWS\FeedingFrenzy.scr:xrqlg
C:\WINDOWS\Gone Fishing.bmp:ujwha
C:\WINDOWS\Greenstone.bmp:xycyu
C:\WINDOWS\ICQ.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\ielx.dll:geyil
C:\WINDOWS\jezcc.txt:jfbbi
C:\WINDOWS\msaq.exe:bwwwq
C:\WINDOWS\msaq.exe:zrvtd
C:\WINDOWS\msdfmap.ini:nqqfo
C:\WINDOWS\msdfmap.ini:thfle
C:\WINDOWS\msgsocm.log:bepbw
C:\WINDOWS\N6Uninst.exe:xrasq
C:\WINDOWS\Netscape.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\nsreg.dat:efals
C:\WINDOWS\nsreg.dat:mphge
C:\WINDOWS\nsreg.dat:rkfnr
C:\WINDOWS\ODBCINST.INI:wylzv
C:\WINDOWS\OEWABLog.txt:bhbbo
C:\WINDOWS\orun32.ini:prkza
C:\WINDOWS\orun32.isu:pydep
C:\WINDOWS\pqcaa.dat:hrdec
C:\WINDOWS\pqcaa.dat:tiuhi
C:\WINDOWS\Prairie Wind.bmp:hzwjr
C:\WINDOWS\Q308387.log:iszpo
C:\WINDOWS\Q308387.log:mifuk
C:\WINDOWS\Q311889.log:ejxze
C:\WINDOWS\Q312368.log:rrfov
C:\WINDOWS\Q315403.log:spkox
C:\WINDOWS\qbnxv.dll:lgatr
C:\WINDOWS\qbnxv.dll:rdgoa
C:\WINDOWS\qbnxv.dll:uiiwz
C:\WINDOWS\QTFont.for:ckihr
C:\WINDOWS\QTFont.for:kqubr
C:\WINDOWS\regedit.exe:dqnhu
C:\WINDOWS\REGLOCS.OLD:luvne
C:\WINDOWS\REGLOCS.OLD:vlbml
C:\WINDOWS\regopt.log:cfrhx
C:\WINDOWS\Rhododendron.bmp:vrfmo
C:\WINDOWS\River Sumida.bmp:evfsh
C:\WINDOWS\River Sumida.bmp:nmtzn
C:\WINDOWS\Santa Fe Stucco.bmp:fcuwp
C:\WINDOWS\sessmgr.setup.log:fmmei
C:\WINDOWS\sessmgr.setup.log:wwyxb
C:\WINDOWS\setdebug.exe:llqks
C:\WINDOWS\setuperr.log:deapu
C:\WINDOWS\setuperr.log:pwqcd
C:\WINDOWS\setuplog.txt:qexhm
C:\WINDOWS\smscfg.ini:wetup
C:\WINDOWS\Soap Bubbles.bmp:ixpmg
C:\WINDOWS\Sti_Trace.log:oflir
C:\WINDOWS\syscd32.exe:bxiai
C:\WINDOWS\vbaddin.ini:hcxeb
C:\WINDOWS\vbaddin.ini:kffit
C:\WINDOWS\vminst.log:fjgad
C:\WINDOWS\vminst.log:tboqg
C:\WINDOWS\vmmreg32.dll:kiglo
C:\WINDOWS\wanmpsvc.exe:ycznf
C:\WINDOWS\wanmpsvc.exe:zdhke
C:\WINDOWS\wiadebug.log:bllrl
C:\WINDOWS\win.ini:ryumb
C:\WINDOWS\win.ini:sdapy
C:\WINDOWS\winamp.ini:tmden
C:\WINDOWS\Winamp1.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\Windows Update.log:cetca
C:\WINDOWS\Windows Update.log:jznrd
C:\WINDOWS\Windows Update.log:nhbgr
C:\WINDOWS\winhlp32.exe:filll
C:\WINDOWS\winnt.bmp:engpj
C:\WINDOWS\WMSysPrx.prx:qjeqo


Removed 7 Random Key Entries
Deleted 2 Service Keys Successfully!
Removed! : C:\WINDOWS\addah.exe
Removed! : C:\WINDOWS\appxx32.exe
Removed! : C:\WINDOWS\boqgz.dat
Removed! : C:\WINDOWS\cqlis.dat
Removed! : C:\WINDOWS\cznfr.dll
Removed! : C:\WINDOWS\d3du32.exe
Removed! : C:\WINDOWS\d3mq.exe
Removed! : C:\WINDOWS\d3mv32.exe
Removed! : C:\WINDOWS\dbdwf.dat
Removed! : C:\WINDOWS\dqyop.dll
Removed! : C:\WINDOWS\drjdu.dat
Removed! : C:\WINDOWS\ejoxw.dll
Removed! : C:\WINDOWS\jwhaa.dll
Removed! : C:\WINDOWS\kcwwh.dat
Removed! : C:\WINDOWS\lnbyj.dat
Removed! : C:\WINDOWS\pqcaa.dat
Removed! : C:\WINDOWS\qbnxv.dll
Removed! : C:\WINDOWS\rasqp.dll
Removed! : C:\WINDOWS\rrdim.dat
Removed! : C:\WINDOWS\sfioo.dat
Removed! : C:\WINDOWS\syscd32.exe
Removed! : C:\WINDOWS\uiiwz.dat
Removed! : C:\WINDOWS\urozp.dat
Removed! : C:\WINDOWS\vuecd.dat
Removed! : C:\WINDOWS\wnmpm.dll
Removed! : C:\WINDOWS\xrasq.dat
Removed! : C:\WINDOWS\System32\addht.exe
Removed! : C:\WINDOWS\System32\atldm.exe
Removed! : C:\WINDOWS\System32\d3km32.exe
Removed! : C:\WINDOWS\System32\emjyp.dat
Removed! : C:\WINDOWS\System32\fjgad.dat
Removed! : C:\WINDOWS\System32\frhxv.dll
Removed! : C:\WINDOWS\System32\gatrw.dll
Removed! : C:\WINDOWS\System32\ibcty.dll
Removed! : C:\WINDOWS\System32\jgfed.dat
Removed! : C:\WINDOWS\System32\njzpg.dll
Removed! : C:\WINDOWS\System32\ofxyx.dat
Removed! : C:\WINDOWS\System32\sgecc.dat
Removed! : C:\WINDOWS\System32\ucttz.dat
Removed! : C:\WINDOWS\System32\yfmvu.dat
Removed! : C:\WINDOWS\System32\zyrqe.dll
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15


Removed Data Streams:
C:\WINDOWS\AIM.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\boqgz.dat:tfxtb
C:\WINDOWS\cznfr.dll:fgfnb
C:\WINDOWS\dqyop.dll:uouvq
C:\WINDOWS\emachines_32.bmp:dmaov
C:\WINDOWS\encarta.ico:spsxe
C:\WINDOWS\explorer.scf:eqxgm
C:\WINDOWS\FaxSetup.log:wmstx
C:\WINDOWS\FeedingFrenzy.scr:xrqlg
C:\WINDOWS\Gone Fishing.bmp:ujwha
C:\WINDOWS\Greenstone.bmp:xycyu
C:\WINDOWS\ICQ.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\ielx.dll:geyil
C:\WINDOWS\jezcc.txt:jfbbi
C:\WINDOWS\msaq.exe:bwwwq
C:\WINDOWS\msaq.exe:zrvtd
C:\WINDOWS\msdfmap.ini:nqqfo
C:\WINDOWS\msdfmap.ini:thfle
C:\WINDOWS\msgsocm.log:bepbw
C:\WINDOWS\N6Uninst.exe:xrasq
C:\WINDOWS\Netscape.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\nsreg.dat:efals
C:\WINDOWS\nsreg.dat:mphge
C:\WINDOWS\nsreg.dat:rkfnr
C:\WINDOWS\ODBCINST.INI:wylzv
C:\WINDOWS\OEWABLog.txt:bhbbo
C:\WINDOWS\orun32.ini:prkza
C:\WINDOWS\orun32.isu:pydep
C:\WINDOWS\pqcaa.dat:hrdec
C:\WINDOWS\pqcaa.dat:tiuhi
C:\WINDOWS\Prairie Wind.bmp:hzwjr
C:\WINDOWS\Q308387.log:iszpo
C:\WINDOWS\Q308387.log:mifuk
C:\WINDOWS\Q311889.log:ejxze
C:\WINDOWS\Q312368.log:rrfov
C:\WINDOWS\Q315403.log:spkox
C:\WINDOWS\qbnxv.dll:lgatr
C:\WINDOWS\qbnxv.dll:rdgoa
C:\WINDOWS\qbnxv.dll:uiiwz
C:\WINDOWS\QTFont.for:ckihr
C:\WINDOWS\QTFont.for:kqubr
C:\WINDOWS\regedit.exe:dqnhu
C:\WINDOWS\REGLOCS.OLD:luvne
C:\WINDOWS\REGLOCS.OLD:vlbml
C:\WINDOWS\regopt.log:cfrhx
C:\WINDOWS\Rhododendron.bmp:vrfmo
C:\WINDOWS\River Sumida.bmp:evfsh
C:\WINDOWS\River Sumida.bmp:nmtzn
C:\WINDOWS\Santa Fe Stucco.bmp:fcuwp
C:\WINDOWS\sessmgr.setup.log:fmmei
C:\WINDOWS\sessmgr.setup.log:wwyxb
C:\WINDOWS\setdebug.exe:llqks
C:\WINDOWS\setuperr.log:deapu
C:\WINDOWS\setuperr.log:pwqcd
C:\WINDOWS\setuplog.txt:qexhm
C:\WINDOWS\smscfg.ini:wetup
C:\WINDOWS\Soap Bubbles.bmp:ixpmg
C:\WINDOWS\Sti_Trace.log:oflir
C:\WINDOWS\syscd32.exe:bxiai
C:\WINDOWS\vbaddin.ini:hcxeb
C:\WINDOWS\vbaddin.ini:kffit
C:\WINDOWS\vminst.log:fjgad
C:\WINDOWS\vminst.log:tboqg
C:\WINDOWS\vmmreg32.dll:kiglo
C:\WINDOWS\wanmpsvc.exe:ycznf
C:\WINDOWS\wanmpsvc.exe:zdhke
C:\WINDOWS\wiadebug.log:bllrl
C:\WINDOWS\win.ini:ryumb
C:\WINDOWS\win.ini:sdapy
C:\WINDOWS\winamp.ini:tmden
C:\WINDOWS\Winamp1.ico:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\WINDOWS\Windows Update.log:cetca
C:\WINDOWS\Windows Update.log:jznrd
C:\WINDOWS\Windows Update.log:nhbgr
C:\WINDOWS\winhlp32.exe:filll
C:\WINDOWS\winnt.bmp:engpj
C:\WINDOWS\WMSysPrx.prx:qjeqo


Removed 6 Random Key Entries
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset... Done!



and here is the NEW HJT log you requested i run AFTER AB


Logfile of HijackThis v1.98.2
Scan saved at 7:33:19 PM, on 8/18/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\msaq.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\aim\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
C:\Teks2Go Utilities\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Teks2Go Utilities\HijackThis1982.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R3 - Default URLSearchHook is missing
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\da BoyZ\Application Data\Mozilla\Profiles\default\t436glj2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {86CC8D04-6990-3461-CA24-AF770BA94E40} - C:\WINDOWS\mfcof32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com


Now.. one of the pops-ups they are getting is from

patchworks.org or patch..<something> .org.. saying..

To Microsoft User... there may be spies in your system..
blah blah blah... down load your patches for microsoft from us..
blah blah blah..
...yeah.. like i would trust any other site outside of microsoft?? doubt it

anyway.. just thought i would up date you on that.. if it helps

thanx..

:S hate to be a pest..

i did post the new HJT and the ABOUT BUSTER logs..

is there anyone who could follow up with me on this system, i have kept it off now .. for 3 days.. so as to not mess up or undo what has already been rightfully undone..

input / assistance would be greatly appreciated..

Hey CanadianTek...
I can have a look at your logfile,give me 10 minutes to move to another comp...that's where my tools are...

Cactus

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

services.exe
msaq.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\gfnbs.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {86CC8D04-6990-3461-CA24-AF770BA94E40} - C:\WINDOWS\mfcof32.dll

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime ---This is optional,not needed at start-up---

Go to Control Panel / Add/Remove Programs and remove the following if they are there:

msaq

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\mfcof32.dll
C:\WINDOWS\msaq.exe

Empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

Re-run HJT and post a new logfile.

Cactus

Thank you.. i will get on that in about 4 hours.. when im due to awaken.. im exhausted from having to move.. (4th residence now in 2004 - beyond my control) - and wiped - with the passing of my mother.. this friday past..

to help fill the void i had try to log on .. to pctechforums from her place and it would not let me log in.. even after getting a new pwd issued.. so i had to wait til i got in tonight.. to see if i could get in. here.. and i could..

never heard of that.. both systems were on win 98.. :S

will up date you as soon as i try these suggestions..

again.. thank you cactus..

Hey CanadianTek..really sorry to here about your mom...
Hope things work out for you...

Let us know how the fix works.

Cactus

apologies for lateness.. still sorting out some "mom" issues.. lots of loose ends..

thank you for your condolences and well wishes..


I ran this report on Aug 22/2k4 and amidst all the mess.. i call life..

ROGERS disconnected me at midnight on the 21st.. of AUG.. even though they were explicitely instructed NOT to disconnect me til Sept. 22

back up and running now..

followed your advice.. and re-ran the HJT.. here is the results..

Thx


Logfile of HijackThis v1.98.2
Scan saved at 1:55:03 PM, on 8/22/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\aim\aim.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
C:\Teks2Go Utilities\SpywareGuard\sgbhp.exe
C:\Teks2Go Utilities\HijackThis1982.exe

N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\da BoyZ\Application Data\Mozilla\Profiles\default\t436glj2.slt\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Teks2Go Utilities\SpywareGuard\sgmain.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

Thank You Cactus..

one lesssssssssss thing to worry and stress out about this week..

hope to be back to normality.. in 3 or 4 days

..you are a saint.. or an angel.. or both.. (gender and or religious affiliations taken into account)

Hello Again Brad and Cactus and .. gang..

Have UPDATED all the service packs..

BUT still cannot install.. AVG on this xp

Get Shell.dll errors,

close that..

get.. Cannot find file c:\Document and Settings\<username>\local settings\temp\wzs6a.tmp\setup.exe

(now this occurs of course.. after.. i had deleted all temp files and temporary internet files.. in all profiles..)

So even if i boot into safe mode as administrator.. i still get the error message.. .. or c:\d&s\....\temp\wzs6d.temp\setup.exe

(yes.. it seems to change between wzs6a and wzs6d.tmp )

we also downloaded the latest version from the net.. just in case the saved down version was corrupt..

to no avail..

YOUR assistance would be greatly appreciated

thanx

Normally when you can't install an anti-virus program on a computer it means you either have a virus or your having conflicts from left-over files from another anti-virus. Or your system has been infected with a virus which has corrupted the dll, and your AntiVirus program has removed it.
It's a system file, and there should be a copy of it in your WINDOWS folder, and another in your WINDOWS\SYSTEM32 folder.
Look in the two folders I mentioned, and see if you find copies of the file there
(You might need to change, in 'Folder Options', these settings:
Open up 'My Computer', go to 'Tools -> Folder Options -> View' enable 'Show hidden files and folders'. and deselect 'Hide extensions for known file types' and 'Hide protected operating system files')

You'll need to delete the files because they may be altered, infected copies, and then copy the file into both directories.
Get the file [url=http://www.dll-files.com/dllindex/dll-files.shtml?shell]Here
[/url] and drop it into both the folders I mentioned.

Hope this helps

What is the exact error your getting?
Spyware removal programs sometimes delete or quarantine
this file.
Click Start
Click Search
Click All files and folders
In the All or part of the file name box, type in
shell.dll
In the Look in list, click My Computer
Click Search
When or if you find it copy and paste it into C:\WINNT\System32 directory.

If not then goto the link Geekgirl posted a download
a copy from there.

Cactus

That link to Shell.zip ... WORKED..

once i copied the extracted shell.dll to c:\windows..

ALL loooked great...

was then able to install avg

then ran it.. found 7 viruses..

cleaned them..

THANK YOU.. ALL for your support. .. and condolences.

you can close this ;) thanx