Can't Remove Look2Me

[bithead]

I've run AdAware, Spybot, Look2Me Destroyer, and ewido (in safe mode) -- none of them are 100% successful. I'll post my hijackthis log in this message and my ewido in a reply to it. Thanks in advance!

Logfile of HijackThis v1.99.1
Scan saved at 2:51:18 PM, on 3/30/2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINNT\System32\smss.exe
F:\WINNT\system32\winlogon.exe
F:\WINNT\system32\services.exe
F:\WINNT\system32\lsass.exe
F:\WINNT\system32\svchost.exe
F:\WINNT\system32\spoolsv.exe
F:\Program Files\ComputerAssociates\ARCserve\msgeng.exe
D:\Program Files\Symantec\pcAnywhere\awhost32.exe
F:\Program Files\ComputerAssociates\NTAgent\Ntagent.exe
F:\WINNT\System32\cusrvc.exe
d:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
F:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
F:\WINNT\System32\svchost.exe
d:\Program Files\ewido anti-malware\ewidoctrl.exe
d:\Program Files\ewido anti-malware\ewidoguard.exe
D:\Program Files\GFI\LANguard Network Security Scanner 3\sscansvc.exe
F:\WINNT\LogWatNT.exe
F:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
F:\WINNT\system32\regsvc.exe
D:\Program Files\Remote Task Manager\RTMService.exe
F:\WINNT\system32\MSTask.exe
D:\Program Files\TapeWare\TWWINSDR.EXE
D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
F:\WINNT\system32\vmnat.exe
F:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\UltraVNC\WinVNC.exe
F:\Program Files\ComputerAssociates\ARCserveITDS\asdscsvc.exe
F:\Program Files\ComputerAssociates\ARCserveITDS\Liccheck.exe
F:\WINNT\Explorer.EXE
F:\WINNT\system32\cmd.exe
F:\WINNT\system32\net.exe
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\WINNT\System32\NWTRAY.EXE
F:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
D:\Program Files\MWSnap\MWSnap.exe
F:\PROGRA~1\INSTAN~1\aim.exe
F:\Program Files\Longshot Productions\LastQUIT v1.2\LASTQUIT.EXE
D:\Program Files\Novell\iFolder\trayapp.exe
C:\Program Files\OpenOffice.org1.0.1\program\soffice.exe
F:\WINNT\system32\rundll32.exe
F:\WINNT\system32\cmd.exe
D:\Ad-Spy-Ware killers\HijackThis.exe
F:\WINNT\System32\brsags.exe
F:\WINNT\System32\brsags.exe
F:\WINNT\System32\brsags.exe
F:\WINNT\System32\brsags.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.99.1.12:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.0;<local>
F2 - REG:system.ini: Shell=Explorer.exe, F:\WINNT\System32\rbjef.exe
F2 - REG:system.ini: UserInit=F:\WINNT\system32\userinit.exe,dvqiqyw.exe
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\winnt\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroCheck] F:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [Client Access Service] "D:\Program Files\IBM\Client Access\CwbSvStr.Exe"
O4 - HKLM\..\Run: [Client Access Help Update] "D:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "D:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [vptray] F:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [WinVNC] "D:\Program Files\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [shellbn] F:\WINNT\System32\shellbn.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] F:\Program Files\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [biwrfq] F:\WINNT\System32\brsags.exe reg_run
O4 - HKLM\..\RunServices: [shellbn] F:\WINNT\System32\shellbn.exe
O4 - HKCU\..\Run: [MWSnap] "D:\Program Files\MWSnap\MWSnap.exe"
O4 - HKCU\..\Run: [shellbn] F:\WINNT\System32\shellbn.exe
O4 - HKCU\..\Run: [wfesh] F:\WINNT\System32\brsags.exe reg_run
O4 - HKCU\..\Run: [ScreenTaker] F:\Program Files\ScreenTaker\STaker.exe
O4 - HKCU\..\Run: [Ramd] "F:\Program Files\rmda\haci.exe" -vt yazr
O4 - HKCU\..\Run: [Key] F:\DOCUME~1\bithead.001\LOCALS~1\Temp\1F.tmp
O4 - HKCU\..\Run: [CU2] F:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [AIM] F:\PROGRA~1\INSTAN~1\aim.exe -cnetwait.odl
O4 - Startup: OpenOffice.org 1.0.1.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = D:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: LastQUIT v1.2.lnk = F:\Program Files\Longshot Productions\LastQUIT v1.2\LASTQUIT.EXE
O4 - Global Startup: Novell iFolder.lnk = D:\Program Files\Novell\iFolder\trayapp.exe
O4 - Global Startup: tyebm.exe
O8 - Extra context menu item: &Google Search - res://f:\winnt\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://f:\winnt\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://f:\winnt\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://f:\winnt\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Similar Pages - res://f:\winnt\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://f:\winnt\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - F:\WINNT\System32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - F:\WINNT\System32\dmonwv.dll (file missing)
O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = insightnetsolutions.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = insightnetsolutions.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = insightnetsolutions.net
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = insightnetsolutions.net
O20 - Winlogon Notify: NavLogon - F:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: SensSrv - senssrv.dll (file missing)
O20 - Winlogon Notify: Setup - F:\WINNT\system32\en04l1dq1.dll
O20 - Winlogon Notify: winm32 - F:\WINNT\SYSTEM32\winm32.dll
O23 - Service: ARCserve Discovery Service (ASDiscoverySvc) - Unknown owner - F:\Program Files\ComputerAssociates\ARCserveITDS\asdscsvc.exe
O23 - Service: ARCserve Message Engine (ASMsgEngine) - Unknown owner - F:\Program Files\ComputerAssociates\ARCserve\msgeng.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - D:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Cheyenne Alert Notification Server - Cheyenne Division Of Computer Associates International, Inc. - F:\Program Files\ComputerAssociates\ARCserve\Alert\Alert.exe
O23 - Service: Client Agent for ARCserve - Computer Associates - F:\Program Files\ComputerAssociates\NTAgent\Ntagent.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - F:\WINNT\System32\cusrvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - d:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Client Access Express Remote Command (Cwbrxd) - IBM Corporation - F:\WINNT\CWBRXD.EXE
O23 - Service: DefWatch - Symantec Corporation - F:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - F:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - d:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: GFI LANguard N.S.S. Scheduled Scans Service (lnss_sscans) - GFI Software Ltd. - D:\Program Files\GFI\LANguard Network Security Scanner 3\sscansvc.exe
O23 - Service: Event Log Watch (LogWatch) - Unknown owner - F:\WINNT\LogWatNT.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - F:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Task Manager service (RTM) - Unknown owner - D:\Program Files\Remote Task Manager\RTMService.exe
O23 - Service: TapeWare - Unknown owner - D:\Program Files\TapeWare\TWWINSDR.EXE
O23 - Service: VMware Authorization Service (VMAuthdService) - Unknown owner - D:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
O23 - Service: VMware NAT Service - Unknown owner - F:\WINNT\system32\vmnat.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - D:\Program Files\UltraVNC\WinVNC.exe" -service (file missing)
O23 - Service: ZipToA - Unknown owner - F:\WINNT\System32\ZipToA.exe (file missing)
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - F:\Program Files\Iomega\AutoDisk\ADService.exe

[bithead]

Immediately after posting the hijackthis log in the previous message, I rebooted to Safe Mode and ran the ewido scanner. Here is its report:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 4:13:54 PM, 3/30/2006
+ Report-Checksum: D79156C3

+ Scan result:

[420] F:\WINNT\system32\skrobj.dll -> Adware.Look2Me : Error during cleaning
[464] F:\WINNT\System32\hysawbh.dll -> Downloader.Qoologic.bj : Error during cleaning
[696] F:\WINNT\System32\hysawbh.dll -> Downloader.Qoologic.bj : Error during cleaning
:mozilla.10:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.17:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.19:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.21:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.25:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned with backup
:mozilla.28:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.30:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.31:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.32:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.33:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.34:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.35:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.36:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.37:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.38:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.39:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.40:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.41:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.42:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.43:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.44:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.45:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.46:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.47:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.48:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.49:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.50:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned with backup
:mozilla.52:F:\Documents and Settings\bithead.001\Application Data\Mozilla\Firefox\Profiles\06dppvae.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@ads.addynamix[2].txt -> TrackingCookie.Addynamix : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@as-eu.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@as-us.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@paypopup[1].txt -> TrackingCookie.Paypopup : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@reduxads.valuead[1].txt -> TrackingCookie.Valuead : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@z1.adserver[1].txt -> TrackingCookie.Adserver : Cleaned with backup
F:\Documents and Settings\bithead.001\Cookies\bithead@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
F:\WINNT\icont.exe -> Adware.AdURL : Cleaned with backup
F:\WINNT\iconu.exe -> Adware.Zestyfind : Cleaned with backup
F:\WINNT\system32\hohdr.dat -> Downloader.Qoologic.bj : Cleaned with backup
F:\WINNT\system32\__delete_on_reboot__hysawbh.dll -> Downloader.Qoologic.bj : Cleaned with backup
F:\WINNT\system32\__delete_on_reboot__skrobj.dll -> Adware.Look2Me : Cleaned with backup
F:\WINNT\Temp\bw2.com -> Adware.Zestyfind : Cleaned with backup


::Report End

[Rawe]

Hello and welcome aboard.. Lets get started then, shall we?

You have few infections there, please stick to it and we'll get them.

==

Please print these instructions out, or write them down, as you can't read them during the fix.

Please download Look2Me-Destroyer to your desktop.

Before continuing with the fix there is something you must do:

• Click Start -> Run and type in: services.msc
• Check that the following services are running and that their startup is set to automatic:
• Seclogon, or Secondary logon service
• Next your machine needs to be offline, manually disconnect the network cable if necessary.
• Your antivirus, and every other security software MUST be disabled.

Now continue:

• Double-click Look2Me-Destroyer.exe to run it.
• Put a check next to Run this program as a task.
• You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
• When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
• Once it's done scanning, click the Remove L2M button.
• You will receive a Done Scanning message, click OK.
• When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
• Your computer will then shutdown.
• Turn your computer back on.
• Re-launch your Anti-virus/Firewall protection.
• Re-connect back to the internet.
• Please post the contents of C:\Look2Me-Destroyer.txt and a fresh HiJackThis log.

If Look2Me-Destroyer does not reopen automatically, reboot and try again.

[bithead]

Hoo boy! This is a tad embarassing... First, I found that there is no Seclogon or Secondary logon service listed. In looking further into it, I found that this PC is running W2K Pro SP2! I'm not sure if SP2 is the reason for the missing service, but it does beg the question... should I try to install SP4 and subsequent updates before we proceed, or should we try to clean up the malware, then install the updates?

Browsing on this machine cannot be trusted... trying to go to AV web sites usually gets me redirected to someplace else. I tried running Trend's Housecall, only to have it close down shortly after starting to scan. I installed a fresh copy of Firefox the other day and it was hijacked on first launch. I haven't tried going to the Windows Update site yet.

What should be the next step?

[Rawe]

Hmm. That was my fault.

The service you should be looking for is named Runas

Sorry.

[bithead]

No problem. I didn't see your message until after I got into work, so I was doing what I could remotely. Since the machine in question is at home, I won't be able to proceed until this evening, so I'll post back as soon as I can. Thanks for your help!