[SOLVED] AIM problem and other problems

[Jok3r5458]

I am having the same problem here is my log.

Logfile of HijackThis v1.98.2
Scan saved at 3:13:43 PM, on 9/2/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\CMMPU.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\UPDATEV01.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iwantsearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\TEMP\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\WINDOWS\TEMP\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\PROGRAM FILES\INTBAR\RUNDLG32.DLL
F1 - win.ini: run=C:\WINDOWS\SYSTEM\cmmpu.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\PROGRAM FILES\INTBAR\RUNDLG32.DLL
O2 - BHO: (no name) - {EC9248C0-FB8D-11D8-BCE5-00D086298B40} - C:\WINDOWS\SYSTEM\FLP.DLL
O2 - BHO: AIM Helper - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} - C:\PROGRAM FILES\AIM TOOLBAR\AIMHELPER.DLL
O2 - BHO: Core Library - {E9C1FD9A-46B0-4185-84ED-E2F8ACD4A262} - C:\WINDOWS\SYSTEM\KDP1775.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_5_5_0.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\PROGRAM FILES\INTBAR\RUNDLG32.DLL
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [updatev01] C:\WINDOWS\SYSTEM\updatev01.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [Kazaa Download Accelerator Updater] regsvr32 /s C:\WINDOWS\SYSTEM\KDPUPD.DLL
O4 - HKLM\..\Run: [Kazaa Download Accelerator Updater (required)] regsvr32 /s C:\WINDOWS\SYSTEM\KDP1775.DLL
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 206.141.192.60,206.141.193.55
O18 - Filter: text/html - {EC9248C1-FB8D-11D8-BCE5-00D0E9652EDB} - C:\WINDOWS\SYSTEM\FLP.DLL
O18 - Filter: text/plain - {EC9248C1-FB8D-11D8-BCE5-00D0E9652EDB} - C:\WINDOWS\SYSTEM\FLP.DLL

 

[Flrman1]

Hi Jok3r5458

Welcome to TSG!

I have split your post off into your own thread. In the future if you have a Question/Problem please start a "New Thread". It get's too confusing trying to address two different people's problem in the same thread and you may get overlooked.

Please continue in this thread.

 

[Flrman1]

Click here to download StartDreck.

UnZip the startdreck.zip file first. DoubleClick: 'StartDreck.exe'
First click on the config button.
Now click the Unmark all button
Put a check by these boxes only:
*Registry->run keys
*Registry->Browser helper objects
*System/drivers> Running processes
hit >ok.

Now click the Save button to save that log.

Copy and Paste the contents of that log back here and await further instructions.

 

[Jok3r5458]

Ok, I fixed it by going to this site, http://www.softwarepatch.com/tips/about-blank-adware.html | it gives u details on wat to do. (this site is VERY helpful)

 

[Flrman1]

OK, but I still say you should follow through by posting the startdreck log. Although the information on the page you posted is true, it is incomplete. Many times this hijacker installs a hidden file that must be identified and removed. None of the tools on that page will identify or remove that hidden file if you have it. If indeed you do have that variant of CWS, it may appear for now that the hijack is gone, but it will return if the file is not removed. The startdreck log will show if it is there or not. If it is it can be removed by using a reg file to force the file to show and strip it's attributes so it can be deleted.

It can't hurt anything to post the Startdreck log to be sure.

 

[Jok3r5458]

I can get on to it fine, but when I try to IM somebody it says:
This program has performed an illegal operation and will be shut down.


Other Problem:
Stuff has gotten installed on my computer by itself.
Home Search Assistant
Internet Optimizer
SB Soft
Search Extender
Search Assistant Uninstaller (Doesn't work to uninstall)
Shopping Wizzard
SideFind
SlotchBar

All of those programs got onto my computer without me putting them there. Please help with my AIM problem and my other problems. thanks

 

[Byteman]

Hi,
Go into Add/Remove or Change/Remove Programs, and run the uninstaller for any programs listed in your post, and also:::: Look carefully for NewDotNet domains, or similar

WebHancer

Next::: straight up> if you have used Kazaa, even if you have uninstalled it, you should get this Kazaa bundled spyware removal tool, and run it.

http://www.majorgeeks.com/download3446.html

NEXT:

Go to this site and read the AIM info and use the fixer.

http://www.res.kent.edu/connect/default.asp?path=&dest=111

Make sure you edit out your present profile, you can create a new one later.

Next> If you can download these two programs it would greatly help you.

AdAware SE personal edition (free)

SpyBot Search and Destroy

from here:

http://www.majorgeeks.com/downloads31.html

Now, here are the directions to install and use both programs: Make sure you try for updates in each program, before you scan with them. Run AdAware first, then SpyBot. Both programs are free, and they both require updating much like an antivirus program.

Spybot:
Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode tick Perform full system scan.

Next deselect Search for negligible risk entries.

Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Before restart, Empty Recycle Bin.

Also go here:
http://tools.radiosplace.com/HijackThis.exe



and download Hijackthis.exe. YOU MUST make a separate new folder, rename it HJT, the desktop will do OK>>>if you make the separate folder!!!!!

The directions for using HJT and to copy and paste the saved log it creates are here:

Please do NOT TRY to use Hijackthis for anything but making and saving the log- a lot of what it shows is needed and mistakes with it can cause problems...

http://mjc1.com/mirror/hjt/

Look at the Quick Start Guide, and the Copy and Paste guide. When you run hijackthis.exe from the HJT folder> hit the SCAN button, when it finishes, the scan button will be Save Log> save it and change the filename to hijackthis.txt, which will open with Notepad, save that Notepad file....come back to this thread, open a reply below my post, copy and paste the entire logfile into the blank area, and submit your reply. Simple as that!

 

[Jok3r5458]

I have installed that AdAware SE personal edition, and I scanned and after it got done it it started to delete them and it froze, I have tryed scanning 3 times b4 i decided to quit, n e suggestions on fixing that?? also I have left it deleting for over 30 min.

 

[Byteman]

Hi,
Your thread will probably be moved to the Security forum shortly> due to the problems showing in the log.
Look for it there, you will be emailed by a moderator, you did nothing wrong, just a better place to help you....

i just noticed I forgot to include the link to fix AIM!! I'm such a nerd....

http://www.res.kent.edu/connect/default.asp?path=&dest=111

EDITED{{Do not worry about the AIM problem for now.}}

Please post the Hijackthis log, don't worry about AdAware now. We can probably remove some things that are keeping it from completing.

EDIT::: I see you have posted a hijackthis log as a new thread, post it here as a reply!! and delete your other post.

You will need to run Hijackthis.exe again...save the log as before, name the file hijackthis2.txt....copy and paste into a blank Reply, here in THIS thread, please. Your original post and all the replies will go with the move, so check the Security forum for your thread after you are notified...thanks.

 

[Jok3r5458]

I dont feel to be stupid but how do I put my computer into safe mode??
I am running Windows 98.

 

[Byteman]

hi, Please do not do a thing right now, you have a CWS infection that need special treatment!!!!!

Do not try to use AdAware anymore. Go back a post or two and read my edited reply about moving the thread to Security forum...

Please follow the directions given to you by flrman1...if you like that computer!

 

[~Candy~]

Hi guys, will move this one and merge the other one.....in the future, please request a move instead of a new post

 

[Jok3r5458]

Logfile of HijackThis v1.98.2
Scan saved at 10:09:42 PM, on 9/10/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\CMMPU.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\UPDATEV01.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\gbvmh.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\gbvmh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\gbvmh.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R3 - Default URLSearchHook is missing
F1 - win.ini: run=C:\WINDOWS\SYSTEM\cmmpu.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\g06reggj.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\g06reggj.slt\prefs.js)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {B36A4008-5663-2ECF-9E70-FA3F4CC8F486} - C:\WINDOWS\MFCST.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_5_5_0.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [updatev01] C:\WINDOWS\SYSTEM\updatev01.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [Kazaa Download Accelerator Updater] regsvr32 /s C:\WINDOWS\SYSTEM\KDPUPD.DLL
O4 - HKLM\..\Run: [Kazaa Download Accelerator Updater (required)] regsvr32 /s C:\WINDOWS\SYSTEM\KDP1775.DLL
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Winad Client] C:\PROGRAM FILES\WINAD CLIENT\WINAD.EXE
O4 - HKLM\..\Run: [swgcybusqwc] C:\WINDOWS\SYSTEM\wodsiqhv.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [JAVAAL32.EXE] C:\WINDOWS\SYSTEM\JAVAAL32.EXE
O4 - HKLM\..\RunServices: [ADDHC.EXE] C:\WINDOWS\SYSTEM\ADDHC.EXE
O4 - HKLM\..\RunServices: [IETK.EXE] C:\WINDOWS\SYSTEM\IETK.EXE
O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\PROGRAM FILES\ACESOFT\TRACKS ERASER PRO\TE.exe min
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\RunServices: [Tracks Eraser Pro] C:\PROGRAM FILES\ACESOFT\TRACKS ERASER PRO\TE.exe min
O4 - HKCU\..\RunServices: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - HKCU\..\RunServices: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Viewpoint Search - res://C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT TOOLBAR\VIEWBAR.DLL/CXTSEARCH.HTML
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MT...lexpressions.aol.com/testdrive.adp?clientId=2
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 206.141.192.60,206.141.193.55

 

[~Candy~]

Also, a note to the poster..............I think you've been asked this prior......PLEASE keep with the same thread instead of opening new ones for the same problem. All you are doing is confusing the issue and making it more difficult to help you.

 

[~Candy~]

You're fine BM.

I would recommend to the poster to first dump Kazaa.........