Originally Posted by charlie_c

Got a virus - everything slow. Security alerts galore. Ran AVG scan - fixed 1 virus. Here is a current HJT log file:

Logfile of HijackThis v1.99.0
Scan saved at 7:22:47 PM, on 2/23/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\PROGRAM FILES\JUNO\EXEC.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\MSAGENT\AGENTSVR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.juno.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.netzero.net/s/sp?r=al&cf=s...00000&N=PL&O=A
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\PROGRAM FILES\JUSEARCH\SEARCHENH1.DLL
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O2 - BHO: Name - {0F0513C0-81F2-11D9-8879-000E5C9B44B9} - C:\WINDOWS\SYSTEM\MSMKD.DLL
O2 - BHO: (no name) - {13714781-81F2-11D9-8879-000EAB9230F1} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL (file missing)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\PROGRAM FILES\JUNO\TOOLBAR.DLL
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - HKCU\..\Run: [Juno_uoltray] C:\PROGRAM FILES\JUNO\EXEC.EXE regrun
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-sp.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-sp.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm
O9 - Extra button: ComcastHSI - {FEB0B8A0-720F-11D8-8879-0030BD0023D9} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {FEB0B8A1-720F-11D8-8879-0030BD0023D9} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {FEB0B8A2-720F-11D8-8879-0030BD0023D9} - http://www.comcastsupport.com (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minib...ansporter.cab?
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download...basetup152.cab
O16 - DPF: {768D513A-C75B-4FAA-8452-E906CDAB6545} (FVLiteLoad Class) - http://digitalflip.net/fvlite/fvliteY.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by5fd.bay5.hotmail.msn.com/re...s/MsnPUpld.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.188.180,195.225.176.31

Thanks,
Charlie

Originally Posted by Lonny Jones

Hello

If you dont get all the critical updates its almost not worth cleaning the PC. Please do then post a new log.

Originally Posted by Lonny Jones

Hello

Run Hijackthis place a check next to these items
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
O2 - BHO: Name - {0F0513C0-81F2-11D9-8879-000E5C9B44B9} - C:\WINDOWS\SYSTEM\MSMKD.DLL
O2 - BHO: (no name) - {13714781-81F2-11D9-8879-000EAB9230F1} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL (file missing)

all of these if more than one >O17 - HKLM\System\CCS\Services\Tcpip\..\{CF0255E9-3626-4D5A-9D6D-71ED267AFCBA}: NameServer = 69.50.188.180,195.225.176.31
===========================
Hit fix checked and close hijackthis.
Go into NETWORK CONNECTIONS in control panel. Then right click on your default connection there and choose properties.

Originally Posted by Lonny Jones

Hello

Run Hijackthis place a check next to these items
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\SYSTEM\SFCMAN32.DLL/sp.html (obfuscated)
O2 - BHO: Name - {0F0513C0-81F2-11D9-8879-000E5C9B44B9} - C:\WINDOWS\SYSTEM\MSMKD.DLL
O2 - BHO: (no name) - {13714781-81F2-11D9-8879-000EAB9230F1} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL (file missing)

all of these if more than one >O17 - HKLM\System\CCS\Services\Tcpip\..\{CF0255E9-3626-4D5A-9D6D-71ED267AFCBA}: NameServer = 69.50.188.180,195.225.176.31
===========================
Hit fix checked and close hijackthis.
Go into NETWORK CONNECTIONS in control panel. Then right click on your default connection there and choose properties.
Then click on NETWORKING tab. Then click on INTERNET PROTOCOL. IN the window that comes up, click on the obtain DNS SERVER ADDRESS automatically radio button.
Tat may not be avaiable on some systems ^
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit hit enter

Download/Save this zipped file to your desktop
http://skads.org/special/rkfiles.zip
It will Just make a report of suspect files
Unzip the files inside to a folder of its own.
Open the folder and run the RKFILES.BAT, sit back and wait untill its finished, when it is finaly finished a text will open, post it along with a fresh hiajckthis log

Originally Posted by Lonny Jones

Hi

Download the rem3 tool rem3.zip to your desktop
http://forums.skads.org/index.php?showtopic=80
It must be unziped in order to work correctly > extract/unzip the files inside.
Open the rem3 folder, add this file to the bottom of the ver3.txt
DXCONF.EXE
Then when the tool is ran it will delete that file

You Will need to Boot into Safe Mode.
http://support.microsoft.com/default...b;EN-US;180902

Now run remv3.bat , answer no to the pompts about registry files.
when it is finished a text will open save it (Log.txt) to the desktop or somewhere handy.



Restart back to a normal windows session, Post that log txt make and post a fresh hijackthis log.

Originally Posted by Lonny Jones

Looks good

Run Hijackthis and have it fix just these items.
O2 - BHO: Name - {0F0513C0-81F2-11D9-8879-000E5C9B44B9} - C:\WINDOWS\SYSTEM\MSMKD.DLL (file missing)
O2 - BHO: (no name) - {13714781-81F2-11D9-8879-000EAB9230F1} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL (file missing)


Let us know if there are any problems