Help! Problem with mrfindalot

[heatwaves]

Hello,

I can't seem to shake this mrfindalot virus. Every time I open a webpage, it redirects it to mrfindalot search site. I've already run a McAfee virus scan, numerous spybot scans (it was able to get rid of everything except for 'Command Service' -- not sure if they're related), adaware, ewido, qoofix, and brute force uninstaller. So far, nothing has worked.

Also, everytime I search "mrfindalot" on google or yahoo, IE immediately shuts down saying there's a problem with xeymi.dll. Don't know if that helps or not.

Here is my hijack this weblog:

Logfile of HijackThis v1.99.1
Scan saved at 10:38:59 PM, on 7/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
D:\ewido anti-spyware 4.0\guard.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\SYSTEM32\qttask.exe
D:\iTunesHelper.exe
C:\WINDOWS\system32\cvn0.exe
C:\WINDOWS\system32\wfxqhv.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
D:\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Palm\Hotsync.exe
C:\WINDOWS\system32\ghynf.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\common files\aol\1142488254\ee\aolssc.exe
c:\program files\common files\aol\1142488254\ee\services\sscAntiSpywarePlugin\ver1_205_1_1\AOLSP Scheduler.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
D:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R3 - Default URLSearchHook is missing
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [{F1-10-00-01-ZN}] c:\windows\system32\dwdsregt.exe CORN003
O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\system32\cvn0.exe
O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\system32\wfxqhv.exe"
O4 - HKLM\..\Run: [ms06249223285] C:\WINDOWS\ms06249223285.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\SSCRun.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [!ewido] "D:\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [xmlrmo] C:\WINDOWS\SYSTEM32\xmlrmo.exe
O4 - HKCU\..\Run: [krqi] C:\PROGRA~1\COMMON~1\krqi\krqim.exe
O4 - HKCU\..\Run: [PSHope] "C:\Program Files\PSHope\PSHope.exe"
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .dcr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NP32DSW.DLL
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clients/y/at1_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: Domain = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: NameServer = 68.4.16.30,68.6.16.30
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = oc.cox.net
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: FS Templates - C:\WINDOWS\system32\en28l1fu1.dll (file missing)
O20 - Winlogon Notify: logons - C:\WINDOWS\system32\redist.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - America Online - C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe

Many thanks if you can help me out!

[pskelley]

Edited out post not needed.
Phil

[pskelley]

Hello and welcome to the forum. You have a load of junk in this log, if you still need help, let's start like this, and try to cut it down to size.

1) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

2) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

3) Start > Control Panel > Add Remove programs and uninstall PSHope if there. While there, uninstall any program you know does not belong there. If you are unsure, let me know and I will look.

4) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R3 - Default URLSearchHook is missing
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINDOWS\system32\xeymi.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [{F1-10-00-01-ZN}] c:\windows\system32\dwdsregt.exe CORN003
O4 - HKLM\..\Run: [ad8rIU3s] C:\WINDOWS\system32\cvn0.exe
O4 - HKLM\..\Run: [k6mmN5IOU] "C:\WINDOWS\system32\wfxqhv.exe"
O4 - HKLM\..\Run: [ms06249223285] C:\WINDOWS\ms06249223285.exe
O4 - HKCU\..\Run: [xmlrmo] C:\WINDOWS\SYSTEM32\xmlrmo.exe
O4 - HKCU\..\Run: [krqi] C:\PROGRA~1\COMMON~1\krqi\krqim.exe
O4 - HKCU\..\Run: [PSHope] "C:\Program Files\PSHope\PSHope.exe"
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O16 - DPF: {886DDE35-E955-11D0-A707-000000881958} - http://69.56.176.75/webplugin.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: FS Templates - C:\WINDOWS\system32\en28l1fu1.dll (file missing)
O20 - Winlogon Notify: logons - C:\WINDOWS\system32\redist.dll (file missing)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

5) RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\WINDOWS\ms06249223285.exe <<< file

C:\WINDOWS\system32\cvn0.exe <<< file

c:\windows\system32\dwdsregt.exe <<< file

C:\WINDOWS\system32\ghynf.exe <<< file

C:\WINDOWS\SYSTEM32\xmlrmo.exe <<< file

C:\WINDOWS\system32\wfxqhv.exe <<< file

C:\PROGRAM FILES~1\COMMON~1\krqi\ <<< folder

C:\Program Files\PSHope\ <<< folder

Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

Restart the computer and post a new HJT log, along with any comments you think will help.

Once you have that HJT log posted, update ewido and run a complete system scan, save the scan report and post it as soon as you have it.

Thanks...pskelley
Safer Networking Forums

[heatwaves]

Thank you, PSKelley, your solution seemed to work!

I went through the list that you provided and everything went off without a hitch except for #5. For your "find and delete" suggestion, I was only able to find and delete the final two folders under 'Program Files'. The other .exe files in 'Windows' and 'Windows/System32' weren't there. Unless I'm mistaken, I'm attributing it to HijackThis's fixes.

In any event here is the new HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 6:47:01 PM, on 7/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
D:\ewido anti-spyware 4.0\guard.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\SYSTEM32\qttask.exe
D:\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Palm\Hotsync.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\common files\aol\1142488254\ee\services\sscAntiSpywarePlugin\ver1_205_1_1\AOLSP Scheduler.exe
C:\Program Files\mcafee.com\personal firewall\MpfTray.exe
C:\WINDOWS\explorer.exe
D:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\SSCRun.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [!ewido] "D:\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .dcr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NP32DSW.DLL
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clients/y/at1_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: Domain = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: NameServer = 68.4.16.30,68.6.16.30
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = oc.cox.net
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - America Online - C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe

[heatwaves]

And here's the ewido scan report... (I removed 17 objects after this scan report)

+ Created at: 7:56:36 PM 7/30/2006

+ Scan result:

C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009455.dll -> Adware.Agent : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009456.dll -> Adware.Agent : No action taken.
C:\WINDOWS\SYSTEM32\nodeipproc.dll -> Adware.BHO : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009463.dll -> Adware.Look2Me : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009464.dll -> Adware.Look2Me : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009597.exe -> Adware.SearchAssistant : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009598.exe -> Adware.SearchAssistant : No action taken.
C:\WINDOWS\system32ghynf.exe -> Adware.SearchAssistant : No action taken.
HKU\S-1-5-19\Software\2nd -> Adware.SecondThought : No action taken.
HKU\S-1-5-19\Software\2nd\Client -> Adware.SecondThought : No action taken.
HKU\S-1-5-21-854245398-1580818891-842925246-1004\Software\2nd -> Adware.SecondThought : No action taken.
HKU\S-1-5-21-854245398-1580818891-842925246-1004\Software\2nd\Client -> Adware.SecondThought : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009460.exe -> Adware.Suggestor : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009461.exe -> Adware.Suggestor : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009462.exe -> Adware.Suggestor : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009606.DLL -> Adware.Suggestor : No action taken.
C:\WINDOWS\SYSTEM32\iqqr.exe -> Adware.Suggestor : No action taken.
C:\WINDOWS\system32n9nyb.exe -> Adware.Suggestor : No action taken.
D:\Hijackthis\backups\backup-20060730-180441-450.dll -> Adware.Suggestor : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009457.exe -> Adware.ZenoSearch : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009458.exe -> Adware.ZenoSearch : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009459.exe -> Adware.ZenoSearch : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009454.exe -> Downloader.Agent.aaf : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009452.exe -> Downloader.Small.ajc : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009453.exe -> Downloader.TSUpdate.f : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009611.exe -> Downloader.TSUpdate.l : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009610.exe -> Downloader.TSUpdate.r : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009466.exe -> Downloader.VB.air : No action taken.
C:\Documents and Settings\bumpus_diva\Local Settings\Temp\Temporary Internet Files\Content.IE5\OB07EH83\drsmartload45a[1].exe -> Downloader.VB.aiw : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009465.exe -> Downloader.VB.aiy : No action taken.
C:\Documents and Settings\bumpus_diva\Local Settings\Temp\Temporary Internet Files\Content.IE5\PAOH7TWU\xp-cydoor-728[1].swf -> Not-A-Virus.Hoax.SWF.Alerter.a : No action taken.
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP84\A0009451.exe -> Trojan.VB.tg : No action taken.

[pskelley]

Thanks for the feedback, the HJT log looks clean of malware:bigthumb: but you said this:

And here's the ewido scan report... (I removed 17 objects after this scan report)
I assume you are talking about the items where it says "no action taken". I would appreciate it if you would do this:

Your HJT log is stretching for some reason, look under format in the NOTEPAD and make sure "Word Wrap" is NOT checks, then run one more ewido scan so I can make sure all of the junk is gone. Choose delete or quarantine if anything is located and post the ewido scan report and a last HJT log. If all is well I will have valuable closing information and you will be on your way.

Thanks...Phil

[heatwaves]

Thanks again for all your help, Phil. I went into NOTEPAD and unchecked "Word Wrap" as you requested.

Here are the very latest ewido scan repot and HJT logs:

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 7:04:19 PM 7/31/2006

+ Scan result:

C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP85\A0009625.dll -> Adware.BHO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP85\A0009626.exe -> Adware.SearchAssistant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP85\A0009622.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP85\A0009623.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
D:\System Volume Information\_restore{E27BD981-1282-47B7-BFE7-1F63DA3E23D2}\RP85\A0009624.dll -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\Documents and Settings\bumpus_diva\Local Settings\Temp\Temporary Internet Files\Content.IE5\PAOH7TWU\xp-cydoor-728[1].swf -> Not-A-Virus.Hoax.SWF.Alerter.a : Ignored.


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 7:06:30 PM, on 7/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
D:\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\SYSTEM32\qttask.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
D:\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Palm\Hotsync.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\common files\aol\1142488254\ee\services\sscAntiSpywarePlugin\ver1_205_1_1\AOLSP Scheduler.exe
D:\Program Files\America Online 9.0\waol.exe
D:\Program Files\America Online 9.0\shellmon.exe
D:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.yahoo.com/
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1142488254\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunesHelper.exe"
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\SSCRun.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [!ewido] "D:\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AOL Fast Start] "D:\Program Files\America Online 9.0\AOL.EXE" -b
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .dcr: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NP32DSW.DLL
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clients/y/at1_x.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: Domain = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{83E21324-56A9-4923-AD62-4420FF41D835}: NameServer = 68.4.16.30,68.6.16.30
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = oc.cox.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = oc.cox.net
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - America Online - C:\Program Files\Common Files\AOL\1142488254\ee\services\sscFirewallPlugin\ver1_205_1_1\aolavupd.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - D:\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe

[pskelley]

Thanks for returning that information. You HJT log looks to be clean of malware, but I need to question the item you ignored in ewido:
C:\Documents and Settings\bumpus_diva\Local Settings\Temp\Temporary Internet Files\Content.IE5\PAOH7TWU\xp-cydoor-728[1].swf -> Not-A-Virus.Hoax.SWF.Alerter.a : Ignored.
That is a Temp/TIF item anyway, but here is what Cydoor is:
http://www.symantec.com/security_response/writeup.jsp?docid=2003-080115-1112-99 (piece of junk)

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

ewido is a great program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.
If you keep the ewido scanner (I suggest you do) clean out the quarantine and stop it from running and using resources after the trial.

(make sure you do this, ewido is picking up nasty stuff in C:\System Volume Information\_restore and to my knowledge this is the only way to clean it)
System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?Open&src=sec_doc_nam

Safe surfing...tashi:) will close your topic in a day or so.

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

[tashi]

As the problem appears to be resolved this topic has been archived.

If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.

Glad we could help. :)