PCTech Forums

by **brad** » Tue Sep 21, 2004 10:59 am

Doesn't sound legit.
Download / Install / and Update: . Now Run it and post a copy of the Log File here.
**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

brad

by **Daninku** » Tue Sep 21, 2004 12:41 pm

Do you mean, the startup list logfile? If not tell me what should I do, thanks.

by **Geekgirl** » Tue Sep 21, 2004 12:59 pm

Hello Daninku

Brad wants you to download/ install/ scan with then post your entire logfile in here so he can look to see what that startup item is.

**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

by **Daninku** » Tue Sep 21, 2004 1:18 pm

Logfile of HijackThis v1.98.2
Scan saved at 2:15:02 PM, on 9/21/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\My Software\Diskeeper Setup\DkService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mbssysjeavbl.com/1vLA6AL0X_W ... yXAQK.html
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Software\Adobe\Acrobat 6.0 Pro\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\idol owns.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64 heart\Waitstop.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Burn ford.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid= ... lcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

by **Cactus** » Tue Sep 21, 2004 4:24 pm

First let's...
Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

**(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)**

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

wdfmgr.exe
idol owns.exe
Waitstop.exe
Burn ford.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mbssysjeavbl.com/1vLA6AL0X_W ... yXAQK.html

O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - (no file)

O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\idol owns.exe
O4 - HKLM\..\Run: [Proc math] C:\PROGRA~1\64 heart\Waitstop.exe
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Burn ford.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Daniel Fenech" >>>>DUPLICATE ENTRY
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid= ... lcid=0x409

Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

Burn ford
Idol Owns
MyWay Search
Proc math
Acid Find

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\DOWNLO~1\idol owns.exe
C:\PROGRA~1\64 heart\Waitstop.exe
C:\Documents and Settings\All Users\Application Data\store the acid find\Burn ford.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.

Cactus

by **Daninku** » Tue Sep 21, 2004 5:23 pm

Logfile of HijackThis v1.98.2
Scan saved at 6:21:52 PM, on 9/21/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\My Software\Diskeeper Setup\DkService.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\My Software\Hijack This\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zypehnqlgbcplzz.com/1vLA6AL0 ... yXAQK.html
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Software\Adobe\Acrobat 6.0 Pro\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Burn ford.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

by **Cactus** » Wed Sep 22, 2004 6:59 am

Try this uninstaller for LOP:
http://members.rogers.com/rjmac/new_uninstall.exe

Cactus

by **Daninku** » Wed Sep 22, 2004 12:27 pm

Logfile of HijackThis v1.98.2
Scan saved at 1:24:51 PM, on 9/22/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\cisvc.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\My Software\mIRC 6.16\mirc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\cidaemon.exe
C:\My Software\Netscape Navigator\Netscp.exe
C:\My Software\Hijack This\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Software\Adobe\Acrobat 6.0 Pro\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\idol owns.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Mp3Log.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

by **Cactus** » Wed Sep 22, 2004 3:12 pm

Restart your computer in

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\idol owns.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [acid find first mfcd] C:\Documents and Settings\All Users\Application Data\store the acid find\Mp3Log.exe

Go to Control Panel / Add/Remove Programs and remove the
following if they are there:

Messenger Plus! 3

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\DOWNLO~1\idol owns.exe
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\Documents and Settings\All Users\Application Data\store the acid find\Mp3Log.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and Reboot.

Turn on System restore,before opening your browser goto TOOLS>INTERNET OPTIONS and make sure your Homepage is correct,if not ,type the URL you would like in the HomePage box.

Now re-run HJT and post a new logfile back here.

Cactus

by **Daninku** » Wed Sep 22, 2004 3:46 pm

I'm not going to remove Messenger Plus because I need it, But I think i removed the other startup item:

Logfile of HijackThis v1.98.2
Scan saved at 4:43:45 PM, on 9/22/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\My Software\Messenger Plus! 3\MsgPlus.exe
C:\WINDOWS\system32\ctfmon.exe
C:\MYSOFT~1\Fix-It\mxtask.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\My Software\Hijack This\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.com.mt/"); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\Daniel Fenech\Application Data\Mozilla\Profiles\default\urhpthdz.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\My Software\Adobe\Acrobat 6.0 Pro\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {58FA5410-8DD4-BA7E-4541-24DEACC89479} - C:\PROGRA~1\DOWNLO~1\idol owns.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MessengerPlus3] "C:\My Software\Messenger Plus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b30149.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

by **Cactus** » Wed Sep 22, 2004 4:42 pm

It looks like it's gone...

Just a note...this problem came with Messenger Plus 3!!
It is a personal choice,if the problem comes back,you'll know why.. :wink:

Cactus

by **Daninku** » Wed Sep 22, 2004 5:19 pm

Ahhh!!! Interesting. Anyway thanks :mrgreen:

by **PCguy** » Wed Sep 22, 2004 6:51 pm

I know plenty of people who use Messenger Plus and don't have this problem. Make sure you always download things from a trusted site and never let IE install anything you dont know about.

by **lilpinkflower** » Wed Sep 22, 2004 7:09 pm

I've had Messenger Plus for ages.... and it has been totally ok !

... very useful infact....

Did you notice that when you install it you can opt for an ad-free version? They tell you a sob story of how they rely on sponsors etc.... hehehehe but ALWAYS get the ad-free version.... i forgot once when i updated and i had tons of bad stuff on my comp that i then had to get rid of.

MSN plus is brilliant

lilpink x

PCTech Forums

Startup Item

Startup Item

Who is online