Zestyfind....

heya i'm new here

could anyone else me with my zesyfind problem?
heres my info

Logfile of HijackThis v1.97.7
Scan saved at 3:32:57 PM, on 5/17/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\Y7I76NAX\HIJACKTHIS[1].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Shaw Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O1 - Hosts: 207.36.196.189 ieautosearch
O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...104.6878356481
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab27571.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab27571.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab

also when i use ad-ware BetterInternet comes up i can't get rid of it
And my computer has been freezing alot, the mouse work can't click on anything, open anything, StartUp Menus opens but says theres nothing in it....

thanx

Try this http://securityresponse.symantec.com...zestyfind.html

Hi Nyeff,

Firstly you nead to move Hijack This to a permenant directory. Then Make sure Adaware is updated with the latest definitions.

Then reboot into safe mode and run Adaware again.

Then re-scan with Hijack This and post the results again

how do i move HiJackThis to a permanent directory? :confused:

C:\WINDOWS\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\Y7I76NAX\HIJACKTHIS[1].EXE

see the temporary internet files folder?its not a permanent directory...make a new folder on C: rename it Hijackthis or porn or anything you want and paste the Hijackthis files there
D'oh:P

okie did it....

Logfile of HijackThis v1.97.7
Scan saved at 3:12:49 PM, on 5/17/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\Y7I76NAX\HIJACKTHIS[1].EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Shaw Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O1 - Hosts: 207.36.196.189 ieautosearch
O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...104.6878356481
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab27571.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab27571.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab

try the link I posted?its 3am and I cant go thru a bunch of stuff on google lol..oh,if you want to do it from the HT log manually,what you do is search for every entry on google and delete anything that looks suspicious

yeah, i'm not using that Virus protector i'm using a different one....

well,its a manual uninstall so I'm guessing it'll work irrespective of your AV..all you have to do is delete the right registry keys...either from the registry or use HT to do it for you and the relevant files

Nyeff.

This is of the link you were given. Although it refers to Norton Antivirus if you can follow the instructions it will still work for you.

Adware.ZestyFind
Last Updated on: February 17, 2004 12:12:33 PM






Type: Adware

Name: ZestyFind

Publisher: Look2me.com
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

Removal: Medium
Damage: Low




Intelligent Updater Definitions*
February 17, 2004


LiveUpdate™ Definitions **
February 18, 2004


*
Intelligent Updater definitions are released daily, but require manual download and installation.
Click here to download manually.

**
LiveUpdate definitions are usually released every Wednesday.
Click here for instructions on using LiveUpdate.





This threat can be detected only by Symantec products that support expanded threats. For more information on expanded threats, please go here.




Behavior
Adware.ZestyFind monitors visited web sites, uploads the information to a server, and then displays pop-up advertisements.

Symptoms

Pop-up ads appear.
You Symantec program detects Adware.ZestyFind.
C:\WINNT\msg117.dll is inaccessible.

Transmission
This adware component can be manually installed or installed as a component of another program.



File names:
msg117.dll

When the Adware.ZestyFind is executed, it performs the following actions:


Drops a file, %System%\msg117.dll.


--------------------------------------------------------------------------------
Note: %System% is a variable. The adware locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
--------------------------------------------------------------------------------


Creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Guardian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Shell Extensions\Approved\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}
HKEY_CLASSES_ROOT\CLSID\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DDFFA75A-E81D-4454-89FC-B9FD0631E726}


URLs visited are logged, uploaded to www.look2me.com, and then pop-up advertisements are shown.


Replaces any of its registry keys, if they are deleted.


Causes errors when users or antivirus scanners attempt to access it. For example Norton AntiVirus will show the following error message:

Unable to open the file C:\WINNT\System32\msg117.dll. The file is in use by another application or you don't have permission to open the file


--------------------------------------------------------------------------------
Note: Reports indicate this adware can cause severe system instability on Windows 95/98/Me. It may also cause instability on other operating systems.
--------------------------------------------------------------------------------





The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


Rename msg117.dll.
Disable System Restore (Windows Me/XP).
Update the virus definitions.
Delete the subkeys from the registry.
Run a full system scan and delete all the files detected as Adware.ZestyFind.

For specific details on each of these steps, read the following instructions.


1. Rename msg117.dll.

Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer.

Press the F8 key while rebooting, then select "Safe mode command prompt only" in Windows 95/98/Me or "Safe Mode with Command Prompt" in Windows NT/2000/XP.

At the command prompt, type:

ren %system%\msg117.dll zesty.nav


Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer.


By the way you are still running Hijack this from a temp file. You need to run it from the directory you copied it to .

thanx alot, i'm not understanding this, i'll just taker in to the pro's haha

I can understand that my friend, the trouble is you will not learn anything doing that. I no it can be a bit dounting for a newb. But there is nothing like screwing up a few comps to learn how to do things.

yeah but you see i don't have the money to pay 65$ everytime the computer breaks.....might as well do it once and getter over with

Whoa there Nyeff !!!!!!
Follow the instructions from Jinxy, do it slowly AND carefully, then you SAVE the $65, and can do it again, for your mates even.........

It is ALWAYS hard the first time, but in the land of PC's it DOES get easier, we don't ALWAYS break 'em, just sometimes. That includes the Pro's that you alluded to previously.

Failing that, then try this thread by Soda Popinsky

http://www.antionline.com/showthread...ht=hijack+this

But don't whatever you do, come to a site like this and say that you are NOT GOING TO TRY !!!
Trust us.......... this is the FUN bit of computers.

Dont spend the money. This is realy quite easy. Download and install spybot search and destroy. You can get it here:
http://download.com.com/redir?pid=10...-10289035.html

When this is installed reboot your computer as your computer starts up press F8. You will get a list of options use the up and down arrows to highlight safe mode. Then press enter. When your pc has started in safe mode run spybot. Let it do its thing, then reboot normaly.

Hmmm.. well this one can be a real pain to remove.. spybot/adaware.. they can't find all the components of it.. depending on which variant of it is on the box.. zestyfind/Look2Me/spotresults all of these are connected... it's better known as VX2.BetterInternet or VX2/Transponder.. If you google up on those terms you'll see a bit more info about it.. here's a good info link about it at pestpatrol. perhaps you should try running pestpatrol on it..

It would all be rather easy (that's a relative term) if you were running an NT based OS.. as there is a great tool and procedure from a guru called Option^Explicit.. (you'll find him at the lavasoft forums.. go there if things get a bit too hairy for you).. I'll post the procedure written by Option^Explicit for the sake of other users.. as this method won't work for a win98 box due to the fact that the tool called VX2Finder will only run on an NT based OS..

here it is..

Quote:

---

Please do the following:

Download the VX2Finder, version 1.0.0.13 from
http://download.broadbandmedic.com/V.../VX2Finder.exe

1) Delete all files found(VX2Finder will "End Task" on up to 2 instances of Rundll32.exe automatically)
You will get a message about "cannot delete this one" matching the same name in the Guardian Key.

2) Click "Open regedit" which will take you right to the Guardian Key(no need to search for it)

3) Hilite "Guardian", RightClick and choose
Security/permissions, you'll get another
window with 'advanced'..
DE-select (uncheck) the lower box with
"inheritable permissions"
hit 'ok' and 'remove' on the following security prompts.

Restart computer.

4) On restart use VX2Finder again, select + delete the last file, click "User Agent$" will remove that entry from the registry.

5) Click "Open regedit" again, this time restoring the checkmark in "inheritable permissions"

6) Click "Guardian.reg" Deletes the Guardian Key.

7) Use Find again should produce a clean log of blank values.

8) Click "Restore Policy" to restore the Debug policy altered in the look2Me installation.(requires reboot to apply, but not immediatley neccessary)

---

Also, here is a good thread to read.. look at the post(s) done by computerguy (the admin)

then take a look at this thread. Note what Option^Explicit says in that thread.. read all of it carefully..

now here's a part of the thread that might give you something to go on.. all the files for the randomly named dll's are 309kb.. so perhaps you can indentify the "bad files" by the size and digital signature .. here's a quote.. but read all the other things he has to say in that post and the others he made in that thread.

Quote:

---

(from Option^Explicit )

*Make sure you set Folder Options to "Show All Files and Folders" as these have hidden attributes by default.
Also be careful of the file names, these are very close to actual Windows names, so don't delete the wrong files.
These will be hidden, read only, and 309kb in size. They have no properties but do have a Digital Signature for "Ni Tech Networking" under that tab.

---

all else fails.. like I said.. go to lavasoft and beg for help from Option^Explicit..

and while you're there.. ask him if he'll release a version of VX2finder for win98/me

good luck.. keep us posted.. and see that page at pestpatrol.. in fact, search the pestpatrol site for VX2.. there's a number of pages about it there.. and maybe.. just maybe.. depending on which variant of VX2 you have.. pestpatrol "might" clean it up for you.

i gave into my computer...ima sad sad man yup, anyway i've had friends, family and other forums hell my buddie even posted on some forums to help but still a no go!!!
I'm taking the piece of crapbox into the pro's...............

Thanx to anyone and everyone whom tried to help!

PEace

Quote:

---

yeah but you see i don't have the money to pay 65$ everytime the computer breaks.....might as well do it once and getter over with

---

I think the point people are trying to make is that it isn't that hard to remove nasties. And just because you spend the money to get it fixed, doesn't mean it's not going to happen again. If you do not understand the instructions being given, then ask for clarification. It's not unusual to feel like you are in over your head (I feel that way all the time)

The absolute worst thing that can happen is that you'll have to do a fresh install of your OS. Best case, you will learn a little about your system, a little about how things work, and a lot about how to prevent the same thing from happening again.

You service tech isn't going to be giving you any advice on how to protect yourself..that would cut into his bread and butter.

Quote:

---

i've had friends, family and other forums hell my buddie even posted on some forums to help but still a no go!!!

---

I would also suggest that is the wrong approach....(at least IMHO), you only end up with a dozen different opinions going 2 dozen different directions, and all you end up doing is stepping on each other's schlongs and making things worse.

:)
I remember that helpless feeling....but also the resolve to get to know
what is going on inside of that box. It is a year later and I'm glad I didn't give in!

Rome wasn't built in a day...shame, Nyeff already managed to post a HT log.
Many don't even get that far.

i've been off and on computers for years and still know not a thing!
and No i don't understand what yous are trying to tell me what i should do!
alot of personal **** is going on right now so i'd much rather giver to the pro's, one less then to help me sleep at night, yaknow?

Follow the instructions in the posts,either do a manual uninstall,or download something like adaware to get rid of it for you

i have ad-ware that didn't work for zestyfind, betterinternet, sportsresults i've tried posting my thingy from HiJackThis but everytime i do it i guess i'm doing it wrong for ppl on here , then someone else tells me i'm doing it right........i've tried the instructions and it don't work!

thanx anyway

Have you done all the instructions in safe mode?which OS are you on?

Win98. and yes i have...but i do not know how to manually remove it...

this is all the problems, freezing all the programs except the mouse,,,,i can open up start menu but says theres nothing in it, zestyfind pops up adds don't show "it shows an error page" sometimes when i surf the net it takes me to sportsresults, i donno what the hell a betterinternet does.....and just today my kazaa won't open cause it says, Error library failed.....i donno what to do anymore

Do a search for msg117.dll make sure you've got hidden files enabled tho..have it?

Quote:

---

this is all the problems, freezing all the programs except the mouse,,,,i can open up start menu but says theres nothing in it, zestyfind pops up adds don't show "it shows an error page" sometimes when i surf the net it takes me to sportsresults, i donno what the hell a betterinternet does.....and just today my kazaa won't open cause it says, Error library failed.....i donno what to do anymore

---

:wow: And I say again... :wow:


With those kind of issues, I have to believe there is more than one piece of malware.. it kind of sounds like they are fighting each other for resources.

I also have to believe that your "service tech" will probably just reinstall your OS... I would presume the rate you quoted was per hour? Go to a clean machine, download an AV, download a firewall (for a line of defense while you get all your updates), and burn them to a disk. Then do a clean install. BEFORE you plug your net connection back in, install the AV and firewall (Sygate, ZoneAlarm, whatever)get your updates.

Then read through the spyware forum..check out some of the tools recommended. It will only take an hour or two to reinstall...You've spent longer here tryingto fix it ;)

I've had some nasty infections before, but never to the point of the symptoms you described. Offhand though, Kazzaa is probably where you are getting all this crap.

On another note, your tech will probably try to talk you into installing XP. if you are willing to spend the money for a tech, and you have the system to handle it, buy it. Wal-Mart sells it for around $125...

I did a google on this O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
It's the closest I got to another possible infection

Just a small addition... the tool sumdumguy linked to above (VX2Finder.exe) doesn't work anymore. Go here and click on the link..

Quote:

---

and just today my kazaa won't open cause it says, Error library failed

---

<rant>Sorry people, I just couldn't hold this back. Kazaa has been the cause of most of these kinds of tech support stuff. I know a lot of people use it. IMHO if you use Kazaa you are asking for problems and deserve what you get. Most of us can fix the problems it brings with it, but to those who can't (or won't) learn how. You made your bed, now lay in it.</rant>

/me dons his asbestos under-roos getting ready for the onslaught...

don't you dare give up.. not after I (and others) went to all that trouble posting info for you.

it's not gonna fix itself.. you do have to do a bit of work.. at least read all the info carefully that's been presented.. if you really want someone to hold your hand thru it all.. there are folks that could do just that. send me a pm and I'll see what we can work out.

and if you really just want to bite the bullet and reinstall your win98 OS and have a cdrom for it.. well then we "could" take that route.. but you'd be a much happier and knowledgeable person if you stuck to it and got rid of this yourself..

this is what yous keep telling me to do, i got HiJackThis in a solid folder i scanned with ad-ware then HiJackThis in safe mode and heres the log....

Logfile of HijackThis v1.97.7
Scan saved at 4:52:02 PM, on 5/19/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\MY DOCUMENTS\MY RECEIVED FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Shaw Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Downloads (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...104.6878356481
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - http://us.dl1.yimg.com/download.yaho...ymmapi_416.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab27571.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab27571.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialer...ecomendada.cab

This isn't really my area, but here's what I see:

O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/diale...Recomendada.cab The page no longer exists, that's why your pop-up is getting page not found. Deleting that should take care of your pop-up.

Actually, that's all I see. sumdumguy might see more (hint, hint)

EDIT: AACK...missed these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cus...://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com...

O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

See this link for more information. I would uninstall it ASAP.

hmm yes I thought that looked suspicious too,but since it was installed in the program files folder I assumed that it was some kind of trojan killer he had,I also googled for it,there IS a program called spykiller,sure you arent removing a legit program here?

therenegade, in that searching, did you run across all the complaints? Spykiller has been purported to give false positives in order to entice people into buying it. I'm not saying it is true, just the accusation.

Also, there are hijacked links that when people go to download Spybot, they are directed to SpyKiller and mistakenly download it, instead of Spybot. http://www.safer-networking.org/inde...ail=2004-02-05

Most of the time, people don't know they have it. :D

I did actually,it was just the fact that the program started from the program files folder rather than system which made me hesitate lol,my bad