# Browser Hijack - Win98



## akasha (Jun 23, 2004)

Hello. I am having the same problem as many other people on here with my home computer. I have downloaded HJT and will run it when I get home. I am running Windows 98. I have had to download and put the HJT and CWShredder on a disk at my work because my computer at home is almost non-functioning because of this. Is there anything else I should do? Once I have run HJT, may I post it here and have someone help me?

Also, how does this happen?  

Thanks!


----------



## etaf (Oct 2, 2003)

yes I would also download LPSFIX just in case you need that as well. http://www.cexx.org/lspfix.htm

see here 
http://forums.techguy.org/t157045.html

TRY not to reboot the PC to many times also make sure you copy HJT to its own folder NOT DESKTOP as it makes backups and you may want to be able to access them.

Currently the Spyware identified by the security experts and especially the morphing and breeding .exe`s in the new variants of CWS, after every re-boot required by Ad-Aware and Spybot etc, just spawns more and more files for the poster to find and delete. This is making the advice the security experts give just too hard to follow.
One of the security experts recently had one log with over a hundred files, they guy had to format c: drive.

How does it happen - have a read here
want to know how you got infected in the first place:
http://forums.techguy.org/t208517


----------



## Couriant (Mar 26, 2002)

Akasha,  ready for your HighJackThis log


----------



## akasha (Jun 23, 2004)

Hello. I ran HijackThis is safe mode and put the log file onto a disk. Brought it to work with me and now the disk won't work. So I am having someone try to send the file to me in a little bit. The computer is pretty much screwed. Can't do anything at all. "Not enough memory to run this program" etc. Not good. As soon as I get the log file I will post it up. Thanks for your help. I hope we can fix it.


----------



## Couriant (Mar 26, 2002)

Alrighty


----------



## akasha (Jun 23, 2004)

Ok, here it is. Wow, this was not easy to get. I hope you can help me.

I had to put it as an attachment because it said I had too many characters.


----------



## ~Candy~ (Jan 27, 2001)

OMG, what a mess 

Let's see if I can't get it posted in 2 parts  I'm going to try to find $teve, I think he thought he saw the worst one a while back


----------



## ~Candy~ (Jan 27, 2001)

Logfile of HijackThis v1.97.7
Scan saved at 6:37:14 PM, on 06/23/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - (no file)
O2 - BHO: (no name) - {569CB91E-B7BA-A53B-FAE6-02AC70957176} - (no file)
O2 - BHO: SÆR§i½kN0LìÉ×@di - Data - (no file)
O2 - BHO: (no name) - {BEFC335B-6797-430E-0DA7-1985DA8D0CA0} - C:\WINDOWS\SYSTEM\APPBB.DLL
O2 - BHO: (no name) - {097FBE5D-0CB9-381B-B07B-EDBEFEEADD4B} - C:\WINDOWS\IPIC.DLL
O2 - BHO: (no name) - {A5F3D9AB-8A4A-FC36-8E59-766BE42625C8} - C:\WINDOWS\JAVADX.DLL (file missing)
O2 - BHO: (no name) - {93172B60-102B-BA72-941B-8BD79EFD02CE} - C:\WINDOWS\SYSTEM\NTKG32.DLL (file missing)
O2 - BHO: (no name) - {68DF5457-27E3-938C-FF3E-963D9B64B087} - C:\WINDOWS\SYSTEM\CRTJ32.DLL (file missing)
O2 - BHO: (no name) - {8F534F76-94D1-789D-5A3D-063BABD3B7B6} - C:\WINDOWS\ATLIF32.DLL
O2 - BHO: (no name) - {B6A3B55E-3E7A-43C2-DABF-0AB1F18BB287} - C:\WINDOWS\SYSTEM\NETZH32.DLL (file missing)
O2 - BHO: (no name) - {792E5EAE-8A79-E368-3772-122B30F2715E} - C:\WINDOWS\JAVAFO.DLL
O2 - BHO: (no name) - {26571DFB-F0E1-4FA0-1226-0FBB11AD977C} - C:\WINDOWS\SYSTEM\IPUR32.DLL
O2 - BHO: (no name) - {3F6D4E24-4321-64A9-0883-66287C5D74EC} - C:\WINDOWS\SYSTEM\SYSRH32.DLL
O2 - BHO: (no name) - {C93674FC-5119-8EBA-A174-F9BA8737F9AD} - C:\WINDOWS\SDKLQ32.DLL (file missing)
O2 - BHO: (no name) - {741B8545-C0CC-A2D8-BC3E-791180D4540D} - C:\WINDOWS\SYSTEM\SYSHP.DLL
O2 - BHO: (no name) - {9A9818E8-9D7D-3C58-402D-00B852B4FD1B} - C:\WINDOWS\SYSTEM\SYSAB.DLL
O2 - BHO: (no name) - {7F3E6667-9F00-4657-EDB2-B4A455182254} - C:\WINDOWS\SYSTEM\SDKZK32.DLL (file missing)
O2 - BHO: (no name) - {63E743F2-961A-BA40-C5DE-2004CB60063A} - C:\WINDOWS\ATLQX32.DLL
O2 - BHO: (no name) - {0D8178AE-7DED-E7A6-AB6D-4D9B04D1AF2A} - C:\WINDOWS\SYSTEM\MFCYT.DLL (file missing)
O2 - BHO: (no name) - {259EE5B9-79F9-788C-1426-7B4E6B1A0211} - C:\WINDOWS\ADDIC32.DLL (file missing)
O2 - BHO: (no name) - {848DC661-460C-1759-2257-AF74EE2D55E8} - C:\WINDOWS\SYSTEM\WINIP32.DLL (file missing)
O2 - BHO: (no name) - {2098979F-5F6C-346E-38A3-33881C4292F1} - C:\WINDOWS\SYSTEM\MFCBY.DLL
O2 - BHO: (no name) - {38A21EDE-A8D7-D4A6-8EB4-FB9CF27E8C65} - C:\WINDOWS\SYSTEM\APPNL.DLL (file missing)
O2 - BHO: (no name) - {086D4C94-8795-3F3E-AD57-B413E97E121E} - C:\WINDOWS\SYSTEM\APPKE32.DLL (file missing)
O2 - BHO: (no name) - {DBF9F02E-3228-CEAC-5B78-70AE0D8E8BEE} - C:\WINDOWS\MFCSA.DLL
O2 - BHO: (no name) - {9E0E94E6-F2FC-52E4-E589-519846F8629C} - C:\WINDOWS\ATLLO32.DLL
O2 - BHO: (no name) - {CE6F21E7-0536-EC5D-F3F8-9D6EDC72FCBB} - C:\WINDOWS\SYSTEM\SDKDQ.DLL
O2 - BHO: (no name) - {43E76A8D-E0B1-618A-CF6F-AD2CFE938EC6} - C:\WINDOWS\IEOD32.DLL
O2 - BHO: (no name) - {7DD85366-D791-988B-E591-E8766F46FA72} - C:\WINDOWS\JAVAVI32.DLL (file missing)
O2 - BHO: (no name) - {4040F8C7-D4A1-FB4E-1176-1DE0DA5EB9E6} - C:\WINDOWS\SYSTEM\ADDBK.DLL (file missing)
O2 - BHO: (no name) - {5843DD82-A389-4A51-4288-89B1D1B9C22B} - C:\WINDOWS\SYSTEM\CRNP.DLL
O2 - BHO: (no name) - {B1318C42-3375-85F2-0B8B-DD594A7686D3} - C:\WINDOWS\D3HB32.DLL
O2 - BHO: (no name) - {646C57CD-B620-5ABD-0600-A30E3EA96595} - C:\WINDOWS\WINEY32.DLL (file missing)
O2 - BHO: (no name) - {EE37178B-E57C-4045-A483-E895595C72A5} - C:\WINDOWS\SDKDY.DLL
O2 - BHO: (no name) - {CAF47898-C983-EDC8-AA16-D3DD2ABB41F8} - C:\WINDOWS\D3WG.DLL
O2 - BHO: (no name) - {B7850B28-A394-BB11-DC89-B0592CEE7C17} - C:\WINDOWS\SYSTEM\WINPD32.DLL
O2 - BHO: (no name) - {70958982-9286-4C4E-3FD3-FEC16A115FBF} - C:\WINDOWS\JAVAHS.DLL (file missing)
O2 - BHO: (no name) - {71F6D625-50AB-41C3-B6EC-563B80E121D0} - C:\WINDOWS\SYSTEM\APIXG.DLL
O2 - BHO: (no name) - {755BA34E-BCAF-6042-9822-36A6D47647C0} - C:\WINDOWS\IPGN.DLL (file missing)
O2 - BHO: (no name) - {1C42788F-CB61-1703-83C3-A5B4CC5D800A} - C:\WINDOWS\SYSTEM\MFCBE.DLL
O2 - BHO: (no name) - {FF3B84BF-172F-490A-EADC-AFDD0366F962} - C:\WINDOWS\APPJU32.DLL (file missing)
O2 - BHO: (no name) - {2CA0B67D-538E-0F30-8CD3-19E8BA8A6ED7} - C:\WINDOWS\D3PD32.DLL (file missing)
O2 - BHO: (no name) - {850AC2CD-883E-D3E9-9CBA-6830CC0DA62F} - C:\WINDOWS\SYSTEM\MSZX.DLL
O2 - BHO: (no name) - {734EC21E-6EA1-B2AD-C406-611E0CE95F47} - C:\WINDOWS\SYSTEM\APPMH32.DLL
O2 - BHO: (no name) - {E0AC72B4-8BA8-C6A8-6319-254FCC5D9916} - C:\WINDOWS\IPNI32.DLL (file missing)
O2 - BHO: (no name) - {61BEDCDC-2914-5A17-085D-42929EE6A5C0} - C:\WINDOWS\SYSTEM\ADDHF32.DLL (file missing)
O2 - BHO: (no name) - {E7E40E04-9CBA-8F0C-C943-6791199E07B6} - C:\WINDOWS\WINGM.DLL (file missing)
O2 - BHO: (no name) - {F262194E-016C-4588-3E87-FB32E14CDB4F} - C:\WINDOWS\D3ZC.DLL (file missing)
O2 - BHO: (no name) - {FEC37FE7-FCAF-0C3B-CBFE-983F52ABE09F} - C:\WINDOWS\WINXY32.DLL (file missing)
O2 - BHO: (no name) - {9EFC589A-2E20-FB8E-64E2-26266C42A5C4} - C:\WINDOWS\APPJE32.DLL (file missing)
O2 - BHO: (no name) - {C452088F-C45A-0FD0-E6B2-351678AE738C} - C:\WINDOWS\NTRF32.DLL (file missing)
O2 - BHO: (no name) - {5FFA6789-7ABE-BCB3-18BC-3EB6BE2C1706} - C:\WINDOWS\MFCUR.DLL (file missing)
O2 - BHO: (no name) - {94F04059-6E7E-66D6-541C-B1B81A2E0CF0} - C:\WINDOWS\SYSTEM\APPMI32.DLL (file missing)
O2 - BHO: (no name) - {A8F65E75-52BF-A3F5-0D7A-13C50B331D7C} - C:\WINDOWS\SYSTEM\APICS.DLL (file missing)
O2 - BHO: (no name) - {AE5AEB55-10EC-BD98-802F-9B4D473083C9} - C:\WINDOWS\SYSTEM\ATLXT32.DLL (file missing)
O2 - BHO: (no name) - {BD83DEE3-0881-986E-6BB1-F3EC3342CFEB} - C:\WINDOWS\SYSTEM\SDKVO.DLL (file missing)
O2 - BHO: (no name) - {4E0B27B5-3F3E-8DF7-94F9-D02FD285D78D} - C:\WINDOWS\APIMJ.DLL (file missing)
O2 - BHO: (no name) - {B10A9A8A-BFE0-3A30-47B5-BF3A196D2B94} - C:\WINDOWS\CRNE.DLL (file missing)
O2 - BHO: (no name) - {0592FD13-8F18-30CF-B6D7-7CF3E26BA5F0} - C:\WINDOWS\SYSTEM\SDKHJ32.DLL (file missing)
O2 - BHO: (no name) - {95AF3145-72CF-F3FC-766B-19712121F763} - C:\WINDOWS\SYSTEM\IPUA.DLL (file missing)
O2 - BHO: (no name) - {A1A78BE6-3485-9621-F44A-C7518D2AA3C5} - C:\WINDOWS\SYSTEM\SYSVN32.DLL (file missing)
O2 - BHO: (no name) - {9649097E-0E71-1683-9C12-2FA824B2B4E3} - C:\WINDOWS\SYSTEM\JAVATV.DLL (file missing)
O2 - BHO: (no name) - {CF520ADE-6CBC-AF6C-09E0-DB1172A8E241} - C:\WINDOWS\SYSTEM\NTRY.DLL (file missing)
O2 - BHO: (no name) - {BFBEE69C-9405-CA32-626D-F9CB61DEDFEE} - C:\WINDOWS\SYSTEM\MFCRO32.DLL
O2 - BHO: (no name) - {6EF0F034-C0DA-6CB6-18F6-2B49B1B81D7A} - C:\WINDOWS\WINNN.DLL (file missing)
O2 - BHO: (no name) - {0B279656-E5DB-EB53-3FEA-19499CF6D302} - C:\WINDOWS\SYSTEM\ATLNH32.DLL (file missing)
O2 - BHO: (no name) - {BB7B5AD0-8481-4F5C-C00C-F6ED8E8BC959} - C:\WINDOWS\MSGA32.DLL (file missing)
O2 - BHO: (no name) - {150C15CE-ECE3-0E88-2657-77F261ADE060} - C:\WINDOWS\MSXG32.DLL (file missing)
O2 - BHO: (no name) - {A9593486-C5F0-338D-36D5-AEC2E367709D} - C:\WINDOWS\NETIL32.DLL (file missing)
O2 - BHO: (no name) - {EC37D9B3-9A1E-E706-8A80-9B7C13DF2373} - C:\WINDOWS\IPSD32.DLL (file missing)
O2 - BHO: (no name) - {A1A50CD0-785E-FFA9-1C5C-C6BFA9DA4408} - C:\WINDOWS\SYSTEM\IPNA32.DLL (file missing)
O2 - BHO: (no name) - {6D256696-FD51-F1E9-DB11-BB4F8AF267C4} - C:\WINDOWS\SYSTEM\MSYO32.DLL
O2 - BHO: (no name) - {984869C4-07B6-6CA1-483C-05C2E18F0B2A} - C:\WINDOWS\SYSTEM\SYSTJ.DLL (file missing)
O2 - BHO: (no name) - {BE12335B-881A-0FCD-A8A0-EB254F8E97FE} - C:\WINDOWS\ADDDW.DLL (file missing)
O2 - BHO: (no name) - {75C2C1CD-BCDC-B99C-0CFB-A40F986D56B6} - C:\WINDOWS\APPLU.DLL (file missing)
O2 - BHO: (no name) - {4BD47B76-6228-8A54-BD88-41CA4875AF2D} - C:\WINDOWS\SYSTEM\CRVJ32.DLL (file missing)
O2 - BHO: (no name) - {FEDBED98-F74E-8D33-0AF8-6770CFE85B4A} - C:\WINDOWS\SYSTEM\IECP.DLL (file missing)
O2 - BHO: (no name) - {9BEB30CF-3417-E3A6-7095-155EAF27942A} - C:\WINDOWS\SYSTEM\NETXI.DLL (file missing)
O2 - BHO: (no name) - {1C66F978-31BD-3C49-46DF-77C25D1EAB9A} - C:\WINDOWS\APPOK32.DLL (file missing)
O2 - BHO: (no name) - {9CAC6CAF-4B28-F4D4-DF8D-838894CDCC14} - C:\WINDOWS\MSOX.DLL (file missing)
O2 - BHO: (no name) - {4CC66EC0-00A1-2571-3E7A-55E7176449FD} - C:\WINDOWS\SYSTEM\MSVX.DLL (file missing)
O2 - BHO: (no name) - {AB6E0FF3-5C24-433E-F0F0-97AEB24D486A} - C:\WINDOWS\SDKOQ32.DLL (file missing)
O2 - BHO: (no name) - {A204EFC7-8DF8-7F8D-FA51-5DA68C729D7D} - C:\WINDOWS\SYSTEM\CRQL.DLL (file missing)
O2 - BHO: (no name) - {55242AEF-4F97-3E4E-B909-1289B58D0126} - C:\WINDOWS\SYSTEM\APIDQ32.DLL (file missing)
O2 - BHO: (no name) - {E0B6E9D3-9E12-0847-BC0F-EE873738C91C} - C:\WINDOWS\SYSTEM\APPJF32.DLL (file missing)
O2 - BHO: (no name) - {228A2B02-D102-7883-2EE4-1741A3AF0C9E} - C:\WINDOWS\SYSTEM\CRWU.DLL (file missing)
O2 - BHO: (no name) - {B8532A5D-D53A-4914-4F85-64FE19CB58F7} - C:\WINDOWS\SYSXU32.DLL
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\MXTARGET.DLL (file missing)
O2 - BHO: (no name) - {12119B62-3DCD-D52D-5D1B-954FBD4E3964} - C:\WINDOWS\JAVAPH32.DLL
O2 - BHO: (no name) - {EC2EFA0C-89CD-150E-8481-A93FC40E0574} - C:\WINDOWS\SYSTEM\WINTE32.DLL (file missing)
O2 - BHO: (no name) - {9291DFCD-3181-094F-72F9-50CD032CB64E} - C:\WINDOWS\SYSTEM\MSZY32.DLL (file missing)
O2 - BHO: (no name) - {05F3F3D2-8BFA-C735-FCDF-D4BD8418D325} - C:\WINDOWS\WINBL32.DLL (file missing)
O2 - BHO: (no name) - {AA8263C2-BEC0-1A3A-53EC-210BF773BE14} - C:\WINDOWS\APILD32.DLL (file missing)
O2 - BHO: (no name) - {92C13A2E-9A7F-21D3-5898-A6A429E0CF01} - C:\WINDOWS\IEXR32.DLL (file missing)
O2 - BHO: (no name) - {4012ED96-802F-7AC9-B75A-1E8A5464D4AC} - C:\WINDOWS\SYSTEM\APING32.DLL
O2 - BHO: (no name) - {4E1F2599-1CA5-D764-D339-534E908B1189} - C:\WINDOWS\SYSTEM\NETGX.DLL (file missing)
O2 - BHO: (no name) - {5B7AB13C-069E-0A96-369B-83180E283DCD} - C:\WINDOWS\ATLNV.DLL (file missing)
O2 - BHO: (no name) - {E3B07E43-4C96-B49C-2BF5-389580278980} - C:\WINDOWS\SYSTEM\NTWP.DLL (file missing)
O2 - BHO: (no name) - {25AEC155-1A3F-6021-34B6-97B5405E8A06} - C:\WINDOWS\SYSTEM\IPPO.DLL
O2 - BHO: (no name) - {400AC210-8A15-E2A5-C53B-EDD257680B40} - C:\WINDOWS\SYSTEM\SDKGL32.DLL
O2 - BHO: (no name) - {A3A23120-7EE4-B1BE-8BCD-755877155DD7} - C:\WINDOWS\APPYI32.DLL
O2 - BHO: (no name) - {C66732A6-EC21-52D4-C47B-D16697AAFF45} - C:\WINDOWS\IPBT32.DLL (file missing)
O2 - BHO: (no name) - {0ABD6FA5-2D80-204C-F97F-AEA25930C091} - C:\WINDOWS\APPCU32.DLL
O2 - BHO: (no name) - {E2E6C0E2-FA3A-8992-181C-3BA9E7ED6D56} - C:\WINDOWS\MFCQI32.DLL (file missing)
O2 - BHO: (no name) - {35B5588D-F5F0-2823-78EF-03676F6C97E2} - C:\WINDOWS\SYSTEM\CRUQ.DLL (file missing)
O2 - BHO: (no name) - {F8241258-7425-E5B8-2794-A607FBD21C67} - C:\WINDOWS\SYSBD.DLL (file missing)
O2 - BHO: (no name) - {F27E4347-4EF1-EFDB-366F-410FB1EAD197} - C:\WINDOWS\APPIS32.DLL
O2 - BHO: (no name) - {C8CDF86E-4E1F-F9B6-47DB-7B0058A0E715} - C:\WINDOWS\CRRT.DLL (file missing)
O2 - BHO: (no name) - {F960E6C0-0930-66A3-4D6F-92DE39605CFF} - C:\WINDOWS\SYSTEM\APPVZ32.DLL (file missing)
O2 - BHO: (no name) - {3F6C5C2D-913F-483D-B92A-0AA1D6F2F5E5} - C:\WINDOWS\SYSTEM\NTLM.DLL
O2 - BHO: (no name) - {03BFA13C-73CA-D4A5-9C3E-AC8F6BB2CFFA} - C:\WINDOWS\SYSTEM\SYSDD32.DLL (file missing)
O2 - BHO: (no name) - {A66B11D1-6292-26F4-404E-061A0C5235AE} - C:\WINDOWS\MSDH32.DLL (file missing)
O2 - BHO: (no name) - {6C924832-BFE0-5FFA-789B-ABE3BCB3F18B} - C:\WINDOWS\ATLZL32.DLL (file missing)
O2 - BHO: (no name) - {649D8F6A-813A-C214-169B-6B02D3E907E3} - C:\WINDOWS\SYSTEM\NETRL.DLL (file missing)
O2 - BHO: (no name) - {119850B9-5F4D-66DF-EB70-933EF3F56ACA} - C:\WINDOWS\SYSTEM\APIXV32.DLL (file missing)
O2 - BHO: (no name) - {1543D985-30C4-833D-0C16-5C0B34868EDC} - C:\WINDOWS\APPJF.DLL (file missing)
O2 - BHO: (no name) - {B9E4D006-7A30-6772-18E7-A2C7B4E14473} - C:\WINDOWS\JAVAFC.DLL (file missing)
O2 - BHO: (no name) - {900686D2-4771-89B3-EB7A-12122627BC3F} - C:\WINDOWS\SYSTEM\SDKKD32.DLL (file missing)
O2 - BHO: (no name) - {6320880C-2831-D537-26D1-85371207E2DC} - C:\WINDOWS\SYSTEM\MSKW.DLL (file missing)
O2 - BHO: (no name) - {18E88317-F0FD-6EDD-AC34-0FB341D28669} - C:\WINDOWS\SYSTEM\IEGH32.DLL
O2 - BHO: (no name) - {38DF3D06-229E-F962-0410-815CF0FA2EE8} - C:\WINDOWS\SYSTEM\APPBH32.DLL (file missing)
O2 - BHO: (no name) - {94FA4010-B3F3-C483-2777-51238C74EE13} - C:\WINDOWS\JAVAYS.DLL (file missing)
O2 - BHO: (no name) - {B122B85D-3708-C0FF-DD1B-6F69A7D6D247} - C:\WINDOWS\CRUD.DLL


----------



## ~Candy~ (Jan 27, 2001)

O2 - BHO: (no name) - {0846276E-4539-F77E-477A-1EF23204BFBA} - C:\WINDOWS\NETPN.DLL (file missing)
O2 - BHO: (no name) - {60EFCCA1-458B-A0A8-3708-42761B9E5AF9} - C:\WINDOWS\APPBI.DLL
O2 - BHO: (no name) - {A492B317-DD26-C698-818B-197AC147A872} - C:\WINDOWS\SYSTEM\APISF32.DLL
O2 - BHO: (no name) - {CDD6063D-A2D3-EDA3-4C59-E4BC7D8D1E7B} - C:\WINDOWS\ATLMF32.DLL (file missing)
O2 - BHO: (no name) - {9B86CC76-3686-802D-B036-D25C675E70D8} - C:\WINDOWS\MFCRZ.DLL
O2 - BHO: (no name) - {87424B02-2FF6-09E1-E738-007E72109D83} - C:\WINDOWS\ATLAN.DLL
O2 - BHO: (no name) - {DC8B2B40-3BA9-3774-CC4F-C5FBA5F492D8} - C:\WINDOWS\SYSTEM\MFCCI.DLL
O2 - BHO: (no name) - {8ECF5651-A743-30FE-97AE-0350AAE9366E} - C:\WINDOWS\IPFW32.DLL (file missing)
O2 - BHO: (no name) - {B55DE13F-54EB-742A-E17A-7E8042B880DC} - C:\WINDOWS\SYSTEM\SYSCO.DLL (file missing)
O2 - BHO: (no name) - {486FB334-9056-7058-15E8-1E8523A2C936} - C:\WINDOWS\MSBV32.DLL (file missing)
O2 - BHO: (no name) - {B64D852F-9FE9-83C4-3452-87A31638742A} - C:\WINDOWS\NETDF.DLL (file missing)
O2 - BHO: (no name) - {01E64E20-3427-E394-AB83-7E7E07C2E091} - C:\WINDOWS\SYSTEM\SDKVY.DLL (file missing)
O2 - BHO: (no name) - {D2C16F98-EDD2-9F81-F55D-5F0E2FEFD1B9} - C:\WINDOWS\APPXJ.DLL (file missing)
O2 - BHO: (no name) - {C2E2D6AE-6948-2FD3-6A8F-2314B7F1C88F} - C:\WINDOWS\SYSTEM\JAVARV.DLL (file missing)
O2 - BHO: (no name) - {71430DBA-D535-B29C-9CDC-0D8EC769143D} - C:\WINDOWS\SYSTEM\JAVAVQ.DLL (file missing)
O2 - BHO: (no name) - {EC6769E7-72FF-CFC6-4623-8D56AA16A3B9} - C:\WINDOWS\JAVAOV32.DLL (file missing)
O2 - BHO: (no name) - {B569CE58-BDA6-5970-EB31-74D2633ADBC6} - C:\WINDOWS\SYSTEM\APPTO.DLL (file missing)
O2 - BHO: (no name) - {4EE57E98-2B5C-B792-7B77-6A09FFB2DB5D} - C:\WINDOWS\ATLBM.DLL (file missing)
O2 - BHO: (no name) - {6FA8BC18-483E-EF31-969E-6BCBA8A3EC51} - C:\WINDOWS\SYSTEM\MFCIS32.DLL (file missing)
O2 - BHO: (no name) - {5B7B91DD-E674-53C5-4007-CBAEA8704D54} - C:\WINDOWS\SYSTEM\ATLOF32.DLL (file missing)
O2 - BHO: (no name) - {3C590378-0A5C-B10E-AF30-95DF78FBEABD} - C:\WINDOWS\APISM32.DLL (file missing)
O2 - BHO: (no name) - {801E5653-BF81-FCDF-5733-2D57FAF1EB57} - C:\WINDOWS\ADDKF.DLL (file missing)
O2 - BHO: (no name) - {FCBFF6A4-6C0F-E57F-4DCD-3DECF316CA20} - C:\WINDOWS\NETIS32.DLL (file missing)
O2 - BHO: (no name) - {B57D4547-53A2-CE5F-B929-72FEAA007FF8} - C:\WINDOWS\IEIC32.DLL (file missing)
O2 - BHO: (no name) - {71E94D83-8173-542B-9A66-5DEB602D769D} - C:\WINDOWS\IPON32.DLL (file missing)
O2 - BHO: (no name) - {C0E3C647-E399-C4EF-5619-7DFBC9F73430} - C:\WINDOWS\SYSTEM\NTWN32.DLL (file missing)
O2 - BHO: (no name) - {81B99B40-1BE4-463E-324F-9B7AB83DEDBC} - C:\WINDOWS\SYSTEM\ATLTR32.DLL (file missing)
O2 - BHO: (no name) - {3C7652FC-49D5-AB91-A5E9-C22E6515486A} - C:\WINDOWS\JAVAMZ.DLL (file missing)
O2 - BHO: (no name) - {B9125411-A71F-D810-41C4-83B84756319F} - C:\WINDOWS\SYSTEM\MSCQ.DLL (file missing)
O2 - BHO: (no name) - {764A59F9-99D6-2569-75F4-67BB902C09E0} - C:\WINDOWS\D3UV.DLL (file missing)
O2 - BHO: (no name) - {124D0F11-4118-F197-B2B9-2911BC897B9D} - C:\WINDOWS\IPCE32.DLL (file missing)
O2 - BHO: (no name) - {9FA4197C-8EBB-5DCC-5C24-5898711BC0CB} - C:\WINDOWS\SYSTEM\WINYN32.DLL (file missing)
O2 - BHO: (no name) - {E2EE3398-3679-6B34-51F3-26F80A4F6FA2} - C:\WINDOWS\SYSYT32.DLL (file missing)
O2 - BHO: (no name) - {77C239BA-5AEC-315B-9B35-29C196DF8255} - C:\WINDOWS\SYSTEM\APPVY32.DLL
O2 - BHO: (no name) - {58EDEE37-3961-A0F9-A428-713B6BA5B6BC} - C:\WINDOWS\SYSTEM\D3NH.DLL (file missing)
O2 - BHO: (no name) - {CE4C97F1-3AF4-B347-19CF-19D81E0A8C51} - C:\WINDOWS\SYSTEM\MFCWY.DLL (file missing)
O2 - BHO: (no name) - {F6005AF9-6CAF-0B35-090C-7DB24CB55C33} - C:\WINDOWS\SYSTEM\WINWX32.DLL (file missing)
O2 - BHO: (no name) - {F0FBCC5D-F83F-2011-4825-6319C233D4FD} - C:\WINDOWS\JAVAUB32.DLL (file missing)
O2 - BHO: (no name) - {A12F8C71-8266-116B-4118-FD5124D815E9} - C:\WINDOWS\SDKBY32.DLL (file missing)
O2 - BHO: (no name) - {1BAB07F0-65D7-D061-3959-352E09CDEE13} - C:\WINDOWS\SYSTEM\ADDWH.DLL (file missing)
O2 - BHO: (no name) - {4CCFF5DA-AABA-0F8D-68C1-24CF5592B254} - C:\WINDOWS\SYSTEM\IEEE.DLL (file missing)
O2 - BHO: (no name) - {F99FD3DD-B2A7-2E20-544D-4732FB1F2037} - C:\WINDOWS\NTZB32.DLL (file missing)
O2 - BHO: (no name) - {4CC7119A-4ABC-8D35-FD7C-F27B7C371F4F} - C:\WINDOWS\IPMS32.DLL (file missing)
O2 - BHO: (no name) - {ED99CDD8-995A-30B5-F538-6F6BB05E98A5} - C:\WINDOWS\APPEI32.DLL
O2 - BHO: (no name) - {75C150B8-A73B-789D-4607-9214B7D9B263} - C:\WINDOWS\SYSTEM\SDKYT.DLL (file missing)
O2 - BHO: (no name) - {5E844A68-69DA-12E1-2FE1-7B3FF482E143} - C:\WINDOWS\SYSTEM\IPZB.DLL (file missing)
O2 - BHO: (no name) - {F29ECC18-7D8F-25BA-338C-3D062010B63D} - C:\WINDOWS\SYSTEM\IPNL32.DLL (file missing)
O2 - BHO: (no name) - {54EB7B84-F317-411F-3367-C7DB5659AF53} - C:\WINDOWS\SYSTEM\ADDTS32.DLL (file missing)
O2 - BHO: (no name) - {2402BAD1-2B03-B117-D0E4-9685436E0914} - C:\WINDOWS\APIQE.DLL (file missing)
O2 - BHO: (no name) - {4A35DEC1-AC71-E2CC-AA75-FE86733D32EC} - C:\WINDOWS\ADDEI.DLL (file missing)
O2 - BHO: (no name) - {C5C19DFD-3698-78C8-5F10-B0FD7784786A} - C:\WINDOWS\SYSTEM\IEMF.DLL (file missing)
O2 - BHO: (no name) - {A7344122-BAC9-D5E2-DAA3-6E0B56A76202} - C:\WINDOWS\ATLST32.DLL (file missing)
O2 - BHO: (no name) - {263AA006-FCC9-38D2-F5F0-3B6CBB118EEB} - C:\WINDOWS\SYSTEM\NETEJ.DLL (file missing)
O2 - BHO: (no name) - {516EDE13-B156-B4CC-2062-5342572B2546} - C:\WINDOWS\SYSTEM\SYSIC.DLL (file missing)
O2 - BHO: (no name) - {95C43FF9-1045-B100-7E1E-8C9905C3936A} - C:\WINDOWS\APPIV.DLL (file missing)
O2 - BHO: (no name) - {8A3710A8-856C-474C-EDA9-618FA6820298} - C:\WINDOWS\SYSTEM\D3AJ.DLL (file missing)
O2 - BHO: (no name) - {26D2DCB8-71C1-252A-D759-F55FEC431202} - C:\WINDOWS\SYSTEM\SDKDF.DLL (file missing)
O2 - BHO: (no name) - {ADCDEB91-0598-F6B4-C015-DD1DF78A7639} - C:\WINDOWS\APPYU.DLL (file missing)
O2 - BHO: (no name) - {EB795AAF-E5F0-6EDA-6EE0-C8D5661F84AB} - C:\WINDOWS\SYSTEM\APIEP32.DLL (file missing)
O2 - BHO: (no name) - {6D0072FE-C5C1-38C5-F97B-0AA0E3061FA7} - C:\WINDOWS\SYSTEM\ADDEV32.DLL (file missing)
O2 - BHO: (no name) - {F75DD02C-3BD5-F4D5-EDC9-061DD005621D} - C:\WINDOWS\SYSTEM\ATLCX.DLL (file missing)
O2 - BHO: (no name) - {FCBB7DCA-C7F2-B903-1606-3F52061736A8} - C:\WINDOWS\MFCHN.DLL (file missing)
O2 - BHO: (no name) - {7091E7AC-9792-0B02-E2FF-3EAF307B875C} - C:\WINDOWS\ADDND.DLL (file missing)
O2 - BHO: (no name) - {91EC19B5-6CDF-6761-17FA-77D99E5F4FFA} - C:\WINDOWS\SYSTEM\IEVY.DLL (file missing)
O2 - BHO: (no name) - {51F242CE-3A79-A2F0-3B9D-50A94CC69C30} - C:\WINDOWS\SYSNF32.DLL (file missing)
O2 - BHO: (no name) - {E5DE847E-2095-F990-2879-44A97175C77F} - C:\WINDOWS\SYSTEM\IEVA.DLL (file missing)
O2 - BHO: (no name) - {BF7866D6-BABA-DD76-E154-EDBCBB4EB3C3} - C:\WINDOWS\SYSTEM\APIFS.DLL (file missing)
O2 - BHO: (no name) - {FF52FC75-302C-5DED-C090-F77905337D75} - C:\WINDOWS\WINGJ.DLL (file missing)
O2 - BHO: (no name) - {FEA897C3-D493-788E-BB13-CDFB063D1C36} - C:\WINDOWS\SYSTEM\NTTC.DLL (file missing)
O2 - BHO: (no name) - {FA30FBE1-2D6A-60CB-19A0-CC0872CC2F67} - C:\WINDOWS\SDKGB.DLL (file missing)
O2 - BHO: (no name) - {980CE5B6-E441-9875-FE0B-C9868B9CD977} - C:\WINDOWS\SYSTEM\CRMD.DLL (file missing)
O2 - BHO: (no name) - {7FCAFA9A-BE41-BD99-B325-4EB88233C3F7} - C:\WINDOWS\SYSTEM\D3RU.DLL (file missing)
O2 - BHO: (no name) - {F6FA4846-407B-1704-55C6-49034869A8A2} - C:\WINDOWS\JAVAIA32.DLL (file missing)
O2 - BHO: (no name) - {6EDE5FEB-4B64-81BF-6F46-91C2DA5FF17F} - C:\WINDOWS\SYSTEM\APPBI.DLL (file missing)
O2 - BHO: (no name) - {77B56A9B-5F2E-3199-3215-D7E8E0F1C765} - C:\WINDOWS\NETNN32.DLL (file missing)
O2 - BHO: (no name) - {4D910CC2-32E4-A9B9-5CCF-A97959F766CD} - C:\WINDOWS\APIIW32.DLL (file missing)
O2 - BHO: (no name) - {0DFBD1CD-D3E2-7D8F-E66F-7CC3DEDD603B} - C:\WINDOWS\WINRL32.DLL (file missing)
O2 - BHO: (no name) - {211B99E0-F1C1-1D55-58EC-0AF23546E627} - C:\WINDOWS\SYSTEM\SYSXE32.DLL (file missing)
O2 - BHO: (no name) - {A93FD066-4034-261C-9871-B51199364831} - C:\WINDOWS\SYSTEM\JAVAIL32.DLL (file missing)
O2 - BHO: (no name) - {7FF0C18F-DEC1-F4E3-8B04-146F5F290713} - C:\WINDOWS\MFCJW32.DLL (file missing)
O2 - BHO: (no name) - {24A47C18-4C17-2AC4-710A-F949DD49082D} - C:\WINDOWS\IPNN.DLL (file missing)
O2 - BHO: (no name) - {EC181F69-6F9B-E0B5-49A6-720AC3A3C6BF} - C:\WINDOWS\SYSTEM\WINZG.DLL (file missing)
O2 - BHO: (no name) - {3BDD9FC8-FEC3-D9B3-9A1E-E70628A8039B} - C:\WINDOWS\MSUS.DLL (file missing)
O2 - BHO: (no name) - {4AAFEDF6-1929-789B-05C6-5C1430ADEC3B} - C:\WINDOWS\SDKDG.DLL (file missing)
O2 - BHO: (no name) - {A764757D-5FD4-2312-E88E-5CF1C41EB7E2} - C:\WINDOWS\SYSTEM\NTJI32.DLL (file missing)
O2 - BHO: (no name) - {46EE648F-E92A-73BD-8D04-D598861EAC3C} - C:\WINDOWS\SYSTEM\ADDIC32.DLL (file missing)
O2 - BHO: (no name) - {D26AF2AB-0F2A-822B-1267-109C8769FEDC} - C:\WINDOWS\MSJE.DLL (file missing)
O2 - BHO: (no name) - {4861F239-22C4-39AD-0E05-069E210E1F47} - C:\WINDOWS\JAVANI.DLL (file missing)
O2 - BHO: (no name) - {7571235D-30E2-4293-ABC7-C0BA95A0E67B} - C:\WINDOWS\SYSTEM\CRCH32.DLL (file missing)
O2 - BHO: (no name) - {FC586704-72A8-A1A7-50AB-9D6BCC44CD11} - C:\WINDOWS\SYSTEM\SDKAU32.DLL (file missing)
O2 - BHO: (no name) - {C07A7FBC-4843-E91F-FEB6-8EDBA5E50E6C} - C:\WINDOWS\JAVAVR.DLL (file missing)
O2 - BHO: (no name) - {85F4A366-EF18-EE63-8BCA-9409682EF1F6} - C:\WINDOWS\SYSTEM\ATLAP32.DLL (file missing)
O2 - BHO: (no name) - {713BB4D3-0B7C-1D3D-8240-26C661FA80FC} - C:\WINDOWS\IPNX32.DLL (file missing)
O2 - BHO: (no name) - {D3272FB2-77C2-2E70-D4B6-CF2118AE8CC3} - C:\WINDOWS\SYSTEM\WINGD32.DLL (file missing)
O2 - BHO: (no name) - {9A1D21EE-D57F-16A5-A4F6-B038DE21DD47} - C:\WINDOWS\SYSTEM\SYSNX.DLL (file missing)
O2 - BHO: (no name) - {E8A24F81-F9FE-B428-CFF6-913E5B4C1A5F} - C:\WINDOWS\MFCBL32.DLL (file missing)
O2 - BHO: (no name) - {1EC43146-FE24-6B9D-F9A9-C425872D8430} - C:\WINDOWS\SYSTEM\APPJG32.DLL (file missing)
O2 - BHO: (no name) - {A00AAF77-87FC-E7A7-25AF-EDAA483F0E5F} - C:\WINDOWS\SYSTEM\IPVQ32.DLL (file missing)
O2 - BHO: (no name) - {C5E86805-D845-BC65-9E1F-8A0C0B537E38} - C:\WINDOWS\SYSTEM\D3ET.DLL (file missing)
O2 - BHO: (no name) - {A501755C-E721-100A-5653-4F4325A3E8A5} - C:\WINDOWS\SYSTEM\D3TV32.DLL (file missing)
O2 - BHO: (no name) - {480F3093-85F1-45A2-F3FD-5DC8ECE8C707} - C:\WINDOWS\NETQB.DLL (file missing)
O2 - BHO: (no name) - {BE166C01-C895-7DB1-E1E6-B6BD6196E91F} - C:\WINDOWS\NETYE32.DLL (file missing)
O2 - BHO: (no name) - {A519ABD5-0403-D86B-DED9-9E0905A175C1} - C:\WINDOWS\CREV.DLL
O2 - BHO: (no name) - {0AA6C63C-09D3-E5E7-0A8E-04F7B826233B} - C:\WINDOWS\IEFG32.DLL (file missing)
O2 - BHO: (no name) - {F49CDCAF-423F-0C17-7D9F-0426F77CD991} - C:\WINDOWS\APIBW.DLL (file missing)
O2 - BHO: (no name) - {05C150CD-544C-36B1-CA46-2353C69AE959} - C:\WINDOWS\IEIE32.DLL (file missing)
O2 - BHO: (no name) - {E6A8DF75-9B34-005D-4060-2AB82D18D1F5} - C:\WINDOWS\NTNA32.DLL (file missing)
O2 - BHO: (no name) - {58A3B91E-A75A-8511-4324-2C08241EDB1B} - C:\WINDOWS\SYSQU.DLL (file missing)
O2 - BHO: (no name) - {EC2F8BCE-E72C-6203-F559-D2C39F735203} - C:\WINDOWS\ADDOO.DLL (file missing)
O2 - BHO: (no name) - {5489F1AF-AE33-CAB7-EC5E-E967C178A152} - C:\WINDOWS\SYSTEM\APILA32.DLL (file missing)
O2 - BHO: (no name) - {4CC44A9A-EFC8-A88E-7497-8165E50B60F8} - C:\WINDOWS\ADDNA.DLL (file missing)
O2 - BHO: (no name) - {377FEB56-8C41-2539-026D-47F1BD3C2087} - C:\WINDOWS\CRAZ32.DLL (file missing)
O2 - BHO: (no name) - {28454FAA-A15D-30CD-A952-4CEB53685373} - C:\WINDOWS\SYSTEM\MFCSE32.DLL (file missing)
O2 - BHO: (no name) - {C2FD5428-8E7E-9558-F24F-1C6BD302EF96} - C:\WINDOWS\D3ID.DLL (file missing)
O2 - BHO: (no name) - {9E341BFC-A0E5-ADF4-05C5-F84E4309D3C0} - C:\WINDOWS\ATLUQ.DLL (file missing)
O2 - BHO: (no name) - {55E6CF7B-F013-B32D-B116-5147DD5BB2CC} - C:\WINDOWS\IEBY32.DLL (file missing)
O2 - BHO: (no name) - {5E299E38-4A5E-77A8-49AB-520615EA0FEC} - C:\WINDOWS\SYSTEM\WINTM.DLL (file missing)
O2 - BHO: (no name) - {566A7648-21AD-C5B2-6784-38BED7933A1C} - C:\WINDOWS\ATLKJ.DLL (file missing)
O2 - BHO: (no name) - {8BC3F6F6-AA22-B883-0FF6-991C43FF449C} - C:\WINDOWS\SYSTEM\MFCQF32.DLL (file missing)
O2 - BHO: (no name) - {7E5F19B5-50A6-BD6F-A0D8-E4033D4FBFBE} - C:\WINDOWS\SYSTEM\IEBG32.DLL (file missing)
O2 - BHO: (no name) - {20904407-F1D7-A5E0-D318-ADCADE1537F1} - C:\WINDOWS\SYSTEM\IECM32.DLL (file missing)
O2 - BHO: (no name) - {4CB9FBD7-715E-2372-4851-441F0E8F7435} - C:\WINDOWS\SYSTEM\NETSN.DLL (file missing)
O2 - BHO: (no name) - {DE13E5F5-995A-E41F-BCEA-4BB12255DCB6} - C:\WINDOWS\SYSTEM\IPYR.DLL (file missing)
O2 - BHO: (no name) - {AC23653D-BE50-EAD2-A25B-51705938FCB7} - C:\WINDOWS\JAVAIK.DLL (file missing)
O2 - BHO: (no name) - {DE4658DD-4820-B1DC-4E0C-3F28B04B2CDC} - C:\WINDOWS\SYSTEM\D3CB.DLL (file missing)
O2 - BHO: (no name) - {678CC773-5452-E708-FCA1-D732D6CAB9EC} - C:\WINDOWS\SYSTEM\ADDQP32.DLL (file missing)
O2 - BHO: (no name) - {744E3EAB-BB28-83A0-8BFA-B511A5F4B4E1} - C:\WINDOWS\SYSGK32.DLL (file missing)
O2 - BHO: (no name) - {B6F8DB98-4F82-F737-62AB-FCA0E147B64B} - C:\WINDOWS\ADDHB32.DLL (file missing)
O2 - BHO: (no name) - {AD30BB91-8465-0660-B64A-987681894D93} - C:\WINDOWS\SYSTEM\APISU32.DLL (file missing)
O2 - BHO: (no name) - {5B571395-D542-0087-653F-7C09A44F7F9B} - C:\WINDOWS\APPIO32.DLL (file missing)
O2 - BHO: (no name) - {8CA3D314-75D0-BB31-78BB-7E404B2A966F} - C:\WINDOWS\SYSTEM\APIMN.DLL (file missing)
O2 - BHO: (no name) - {5312339D-0716-6F8E-C7E3-C153C96F9D87} - C:\WINDOWS\SYSTEM\MFCZY32.DLL (file missing)
O2 - BHO: (no name) - {3E589AC4-D875-E18F-230E-C2FBCC1516D6} - C:\WINDOWS\ATLNV32.DLL (file missing)
O2 - BHO: (no name) - {0786A300-8F5F-4A6A-ED10-0B4CC41D2AD1} - C:\WINDOWS\SYSTEM\APIKB32.DLL (file missing)
O2 - BHO: (no name) - {D52D3F17-387E-D195-61D1-ED8EB93A56D9} - C:\WINDOWS\WINQB32.DLL (file missing)
O2 - BHO: (no name) - {F492FBA5-5668-CA6F-54F7-6A546017A1BA} - C:\WINDOWS\SYSTEM\IEOO32.DLL (file missing)
O2 - BHO: (no name) - {2C94CAA0-8EC0-18A4-1452-710E2A750145} - C:\WINDOWS\SYSTEM\JAVAON32.DLL (file missing)
O2 - BHO: (no name) - {8705901D-8680-E8CA-FBE0-7D485E343513} - C:\WINDOWS\JAVAHT32.DLL (file missing)
O2 - BHO: (no name) - {7B586A6E-3C23-C954-4A5E-AF74D5213E8A} - C:\WINDOWS\SYSTEM\MSHP.DLL (file missing)
O2 - BHO: (no name) - {368141D4-591D-E735-C971-27E5E649F293} - C:\WINDOWS\D3WJ.DLL (file missing)
O2 - BHO: (no name) - {7A7E10DA-FBEB-BEC0-8B9D-91213C74ECF2} - C:\WINDOWS\APIHR.DLL (file missing)
O2 - BHO: (no name) - {E3713D32-4404-118A-8F1C-4EDBD1BFEE70} - C:\WINDOWS\MSFN32.DLL (file missing)
O2 - BHO: (no name) - {196EDB12-C98B-22AB-88CA-6BCEBAC7061A} - C:\WINDOWS\IPQI32.DLL (file missing)
O2 - BHO: (no name) - {F73396C4-CF26-92B0-F05D-07D7BAA16C5C} - C:\WINDOWS\APPXE32.DLL (file missing)
O2 - BHO: (no name) - {D986D284-5C5E-2E4F-3203-060CADC63C2F} - C:\WINDOWS\SYSTEM\SDKQE.DLL (file missing)
O2 - BHO: (no name) - {3F1D1C11-C6CD-314A-27A6-C5CE2849DB25} - C:\WINDOWS\SYSTEM\MSEQ32.DLL (file missing)
O2 - BHO: (no name) - {86D610E0-3709-5CD8-116B-9DB04FBB11F8} - C:\WINDOWS\D3PC32.DLL (file missing)
O2 - BHO: (no name) - {E147AAF3-2C0B-3A3F-4FC5-5E61B062F9D9} - C:\WINDOWS\IPAA32.DLL (file missing)
O2 - BHO: (no name) - {5AC5C3B9-9CEC-BC17-DFFB-3F33F50B8236} - C:\WINDOWS\WINNR.DLL (file missing)
O2 - BHO: (no name) - {5C175B24-A743-E79E-D278-2045621D5A16} - C:\WINDOWS\JAVAVX32.DLL (file missing)
O2 - BHO: (no name) - {53A09398-B041-2B40-F68F-D765229D49AB} - C:\WINDOWS\SYSTEM\MSLM.DLL (file missing)
O2 - BHO: (no name) - {B36BF8D0-78A6-6627-C70B-89B4CE7916F8} - C:\WINDOWS\IEKR.DLL (file missing)
O2 - BHO: (no name) - {E1E8AEA2-38F4-646F-14A8-EFBE2B53710F} - C:\WINDOWS\SYSTEM\ATLTT.DLL (file missing)
O2 - BHO: (no name) - {26286E09-CF52-4BFA-ACBF-184990967DFA} - C:\WINDOWS\APINT.DLL
O2 - BHO: (no name) - {C67A31CB-FB08-10EF-0404-A97DC623736F} - C:\WINDOWS\SYSTEM\APPBK.DLL
O2 - BHO: (no name) - {391EBDD6-3870-2010-1956-24C67B4A9911} - C:\WINDOWS\SYSTEM\MSSU.DLL
O2 - BHO: (no name) - {1C47DCAF-2F99-78C6-852D-BBC5A17E2D17} - C:\WINDOWS\SYSTEM\CRDN32.DLL (file missing)
O2 - BHO: (no name) - {115E5C08-B81B-0D79-CD2A-7B758D540646} - C:\WINDOWS\IPNR.DLL
O2 - BHO: (no name) - {118F5147-E64E-88D2-3AAE-AC78BB33A170} - C:\WINDOWS\SYSTEM\SYSDW32.DLL (file missing)
O2 - BHO: (no name) - {831A236D-FCB7-2D82-618C-3F6E9115FBCB} - C:\WINDOWS\SYSTEM\APIBC32.DLL
O2 - BHO: (no name) - {E396FA77-7E2C-9C15-D4BE-4A5B3C15B7E8} - C:\WINDOWS\MFCVV.DLL
O2 - BHO: (no name) - {C3A39351-DEB8-8E15-2A5F-CAD2770B4E07} - C:\WINDOWS\SYSTEM\APIGG.DLL (file missing)
O2 - BHO: (no name) - {E71F1BB2-A9C1-EE52-1D96-41C2CDD6BE05} - C:\WINDOWS\SYSTEM\SDKYZ32.DLL (file missing)
O2 - BHO: (no name) - {C69B7B71-B2CE-83F6-61B9-D762F6B1BE40} - C:\WINDOWS\SYSTEM\JAVATW.DLL (file missing)
O2 - BHO: (no name) - {699338DE-1BB0-EC2C-30C1-289B67EA1745} - C:\WINDOWS\SYSTEM\SDKPX32.DLL (file missing)
O2 - BHO: (no name) - {4EDA8FB3-2068-2CC0-E8D6-4CC5E70AA182} - C:\WINDOWS\SYSTEM\JAVALQ32.DLL (file missing)
O2 - BHO: (no name) - {D1FABFA3-12FE-6B59-88D3-1CA0B4FC7374} - C:\WINDOWS\SYSTEM\ADDPN.DLL (file missing)
O2 - BHO: (no name) - {2586916A-B55B-DFA2-4026-728627964AA0} - C:\WINDOWS\SDKCG.DLL (file missing)
O2 - BHO: (no name) - {9E44A5C3-1CA2-7EE3-1D57-992CB30F2AC7} - C:\WINDOWS\SYSTEM\ATLDG32.DLL (file missing)
O2 - BHO: (no name) - {E22E3773-8826-65FC-BCDE-BE460F9AD004} - C:\WINDOWS\SYSTEM\MFCZD32.DLL (file missing)
O2 - BHO: (no name) - {24FC655B-81EC-FEB9-56AA-B6D3DD9EFE0F} - C:\WINDOWS\NTUB32.DLL (file missing)
O2 - BHO: (no name) - {AA53D1EB-71C5-5171-BF05-BCB9E3BCD005} - C:\WINDOWS\SDKFQ.DLL (file missing)
O2 - BHO: (no name) - {64B7CF25-A72D-D62B-C29E-603B124EB935} - C:\WINDOWS\SYSTEM\MFCGP.DLL (file missing)
O2 - BHO: (no name) - {3B9B5DF7-2AB9-16A6-4505-78AF14014B28} - C:\WINDOWS\CRSJ.DLL (file missing)
O2 - BHO: (no name) - {96238F7D-6165-13E6-0307-788481765169} - C:\WINDOWS\ATLKN.DLL (file missing)
O2 - BHO: (no name) - {A9AED059-8955-CDD5-9BD2-A74CB9D61DD3} - C:\WINDOWS\MSGN32.DLL (file missing)
O2 - BHO: (no name) - {0F1C73A3-D00A-5B50-277B-29E122FC2D80} - C:\WINDOWS\NETNY32.DLL (file missing)
O2 - BHO: (no name) - {849DE21F-010C-FE22-30A7-D575B854F78A} - C:\WINDOWS\SYSTEM\IEZR.DLL (file missing)
O2 - BHO: (no name) - {FA6A38A1-544A-BE45-6CC4-C0B31B07E071} - C:\WINDOWS\JAVAPC32.DLL (file missing)
O2 - BHO: (no name) - {F6987897-569B-4F86-9817-ECB4A9AED059} - C:\WINDOWS\SYSTEM\IPEU.DLL (file missing)
O2 - BHO: (no name) - {FA5E2DB2-55C3-E875-0683-1F6FA5FF6A23} - C:\WINDOWS\SYSTEM\ADDIQ.DLL (file missing)
O2 - BHO: (no name) - {6D27E351-258A-9BB7-20B9-5C5AEDD3E72A} - C:\WINDOWS\SYSTEM\MSBP32.DLL (file missing)
O2 - BHO: (no name) - {B4FB0365-675A-5E62-B49B-D990566002AC} - C:\WINDOWS\ADDJA.DLL (file missing)
O2 - BHO: (no name) - {4D48529B-74F6-988B-1896-ABE0AA392AA1} - C:\WINDOWS\SYSTEM\CRQW.DLL (file missing)
O2 - BHO: (no name) - {72C48455-7D90-8EC6-72E4-E8D58D4A6A6D} - C:\WINDOWS\SYSTEM\SYSBP.DLL (file missing)
O2 - BHO: (no name) - {7DF8C2D5-CF4D-E64B-77B3-1EF4A5B30CDF} - C:\WINDOWS\SYSTEM\APPKS32.DLL (file missing)
O2 - BHO: (no name) - {29FC66BD-3EA4-3F16-0ABF-93515F25ED12} - C:\WINDOWS\WINHH32.DLL (file missing)
O2 - BHO: (no name) - {BD573771-8543-CBD7-3010-D318D283263D} - C:\WINDOWS\SYSTEM\D3TG.DLL (file missing)
O2 - BHO: (no name) - {6FAA77FE-F83E-4CC6-7BAD-CBD84B1D066C} - C:\WINDOWS\SYSTEM\MSLN.DLL (file missing)
O2 - BHO: (no name) - {FF56B561-EE03-788D-F628-1F9CD8262ABA} - C:\WINDOWS\IPUF32.DLL (file missing)
O2 - BHO: (no name) - {E2CC3C05-2DC0-602B-C0D5-4D6FA3DC9AAE} - C:\WINDOWS\SYSTEM\CRRP.DLL (file missing)
O2 - BHO: (no name) - {A647B4A2-3D1B-ED77-B290-2C86827F0089} - C:\WINDOWS\SYSTEM\NETTF.DLL
O2 - BHO: (no name) - {1ADC7397-51FF-4FCA-2D49-8E0E4130D831} - C:\WINDOWS\SYSTEM\CRXG.DLL
O2 - BHO: (no name) - {BA5A91EC-2B2A-2B49-C41E-E07C3952DB06} - C:\WINDOWS\WINMX32.DLL (file missing)
O2 - BHO: (no name) - {F2D31668-0E17-1202-40F9-389B234B48E9} - C:\WINDOWS\SYSTEM\IPEN.DLL
O2 - BHO: (no name) - {03FD1E63-CC0A-B875-49EE-8252C15AA0FA} - C:\WINDOWS\ATLFW32.DLL (file missing)
O2 - BHO: (no name) - {DCAC4288-4597-CC9C-88ED-6AFF6D21C6A6} - C:\WINDOWS\NTGC.DLL
O2 - BHO: (no name) - {357A8D57-F3CF-8C5F-5649-47A18C3A78B1} - C:\WINDOWS\SYSTEM\JAVAIF32.DLL
O2 - BHO: (no name) - {017A0FF7-26F5-7344-C985-64575DDA97DD} - C:\WINDOWS\APPLD32.DLL
O2 - BHO: (no name) - {1D29E35C-2CEB-1C5D-F790-A48A9C394EF2} - C:\WINDOWS\SYSTEM\IEUZ.DLL
O2 - BHO: (no name) - {067B880F-DB35-0DD5-B856-B7C07C2E8FB5} - C:\WINDOWS\SYSTEM\WINOE32.DLL
O2 - BHO: (no name) - {0CF3B610-277F-D80D-2D60-E2E75E58BD58} - C:\WINDOWS\SYSTEM\WINZE.DLL (file missing)
O2 - BHO: (no name) - {0D986CF8-2CE9-4F81-C868-236758D1D348} - C:\WINDOWS\SYSTEM\CRYU32.DLL (file missing)
O2 - BHO: (no name) - {74FCBCF2-483C-D6F3-DABD-BB36D6036740} - C:\WINDOWS\SYSTEM\ADDIB32.DLL
O2 - BHO: (no name) - {213C3374-2B1F-7A96-5E35-570933B9E400} - C:\WINDOWS\CRWQ.DLL
O2 - BHO: (no name) - {9ADF5FEC-10AD-9935-70A8-9DD47AD25683} - C:\WINDOWS\SYSTEM\CRJS.DLL
O2 - BHO: (no name) - {D8F15E7B-9A97-CCE6-52A9-BC9615F22B63} - C:\WINDOWS\ADDZZ.DLL
O2 - BHO: (no name) - {0315E8BF-CB9F-4795-F013-258F5F05C8F7} - C:\WINDOWS\ADDAK32.DLL (file missing)
O2 - BHO: (no name) - {927C0C93-B6C9-2E0A-236A-282EE3A26535} - C:\WINDOWS\WINWT.DLL (file missing)
O2 - BHO: (no name) - {01E9ECB4-091B-FBA9-07B7-64920B906A95} - C:\WINDOWS\NETRA.DLL
O2 - BHO: (no name) - {64830A97-02DE-7E21-600B-1232F97CB535} - C:\WINDOWS\SYSTEM\NTIH.DLL (file missing)
O2 - BHO: (no name) - {821F0A9B-325C-CAF4-6704-DC8BD318C5DF} - C:\WINDOWS\SYSTEM\D3PY.DLL (file missing)
O2 - BHO: (no name) - {7AF9B025-A80E-75C2-AC93-2B24CF7C4231} - C:\WINDOWS\SDKUG.DLL (file missing)
O2 - BHO: (no name) - {9A5C3A3F-8512-4B05-8DD1-E190DD541F17} - C:\WINDOWS\SYSTEM\APPQY32.DLL
O2 - BHO: (no name) - {149E0B62-F53C-DC8F-8A0A-C09F8001C3BE} - C:\WINDOWS\SYSTEM\WINBC32.DLL (file missing)
O2 - BHO: (no name) - {F7283C59-38AE-4267-0320-D017AE595DEF} - C:\WINDOWS\ADDCA.DLL (file missing)
O2 - BHO: (no name) - {535F4D50-1204-8BDF-6CCF-739AAC2FC7EE} - C:\WINDOWS\SYSTEM\WINHR32.DLL
O2 - BHO: (no name) - {427DC0FE-1732-761D-24CD-41DBCD4FA0C4} - C:\WINDOWS\ATLMV32.DLL (file missing)
O2 - BHO: (no name) - {8AE894CC-C521-8B5D-5E04-DD2258BE2E9B} - C:\WINDOWS\SYSTEM\ATLZP32.DLL
O2 - BHO: (no name) - {52B4A5E3-EF00-655D-F1EC-72FC938EB5C9} - C:\WINDOWS\SYSTEM\SYSLJ32.DLL (file missing)
O2 - BHO: (no name) - {C0209690-DBDA-0E71-33D1-D3B9F9A012CA} - C:\WINDOWS\SYSTEM\MFCDV.DLL
O2 - BHO: (no name) - {82878982-61A2-6166-EC08-369D9A893FF5} - C:\WINDOWS\NTCV32.DLL
O2 - BHO: (no name) - {95BB3438-0B60-B4FB-A68F-174D498229E8} - C:\WINDOWS\ADDKT.DLL (file missing)
O2 - BHO: (no name) - {1D628BF7-9593-0367-E97B-9B283E344A43} - C:\WINDOWS\SYSTEM\D3HF.DLL (file missing)
O2 - BHO: (no name) - {6CDF4542-5DEC-7905-A0CD-BC9330E10B5B} - C:\WINDOWS\SYSTEM\NTIU.DLL (file missing)
O2 - BHO: (no name) - {88BB4F74-795B-7383-C229-042B27D847E6} - C:\WINDOWS\SYSTEM\ADDSJ32.DLL (file missing)
O2 - BHO: (no name) - {E4261D11-21C5-6EB4-9A02-01397B59886F} - C:\WINDOWS\SYSTEM\WINFU32.DLL (file missing)
O2 - BHO: (no name) - {E7B5B80E-5488-9B50-227D-41B9A402E405} - C:\WINDOWS\SYSTEM\MFCRH32.DLL (file missing)
O2 - BHO: (no name) - {4A41D55C-3C3E-AF30-1F46-CB52DD793120} - C:\WINDOWS\ATLVQ.DLL (file missing)
O2 - BHO: (no name) - {4F9A4F6D-CA0E-3F49-D4C7-79FE3EB7E433} - C:\WINDOWS\APPCB32.DLL (file missing)
O2 - BHO: (no name) - {A7130089-69D9-78BB-940B-E38E64B08BFA} - C:\WINDOWS\SYSIO32.DLL (file missing)
O2 - BHO: (no name) - {16C96F47-AF1D-2784-4317-6327E1F138D2} - C:\WINDOWS\SYSTEM\WINOT.DLL (file missing)
O2 - BHO: (no name) - {F264CBC2-6A6B-CAFF-A88C-74D64BFD3120} - C:\WINDOWS\SDKAM.DLL (file missing)
O2 - BHO: (no name) - {0DD86029-4FA2-2C88-6830-BEA6482EB30A} - C:\WINDOWS\SYSTEM\IPBZ32.DLL (file missing)
O2 - BHO: (no name) - {FCB9041E-2D86-4562-7DE2-6ECFD4FFCDEC} - C:\WINDOWS\SYSTEM\CRCV.DLL (file missing)
O2 - BHO: (no name) - {06479FBD-B7F4-E4BF-7FBF-CDD5E2D81431} - C:\WINDOWS\MSIX.DLL (file missing)
O2 - BHO: (no name) - {46627ADD-649A-091B-8A47-C872CCE5F33E} - C:\WINDOWS\SYSTEM\IEPV.DLL (file missing)
O2 - BHO: (no name) - {87BB8735-D059-E026-8627-CD8DC71E9026} - C:\WINDOWS\IEES.DLL (file missing)
O2 - BHO: (no name) - {7E36A3E9-29C2-EA71-7A8A-E460FBF9A871} - C:\WINDOWS\SYSTEM\APPXP32.DLL (file missing)
O2 - BHO: (no name) - {8EA0B64A-75D0-8453-9B31-AF50B903FDDF} - C:\WINDOWS\SYSTEM\CREZ32.DLL (file missing)
O2 - BHO: (no name) - {A22FC59F-1205-057F-57E5-C9625673826F} - C:\WINDOWS\SYSTEM\IPZF32.DLL (file missing)
O2 - BHO: (no name) - {46F83DE2-4037-83D3-C38B-C0E3BBEF1FAA} - C:\WINDOWS\ATLZG.DLL (file missing)
O2 - BHO: (no name) - {95597FE1-0A74-EFF8-B334-ECFE88EB83DF} - C:\WINDOWS\SYSTEM\NTAB32.DLL (file missing)
O2 - BHO: (no name) - {E600A1CC-7940-009E-9B83-E94CDEE2CB62} - C:\WINDOWS\SYSTEM\SDKZP32.DLL (file missing)
O2 - BHO: (no name) - {3D027C22-8D2B-4A94-D0FD-46C7FE851825} - C:\WINDOWS\NETHK32.DLL (file missing)
O2 - BHO: (no name) - {3429CDC6-3484-6774-8A09-FF9D77DCDBED} - C:\WINDOWS\SYSOV32.DLL (file missing)
O2 - BHO: (no name) - {EB83084A-24FF-C393-E570-D9A67713C46F} - C:\WINDOWS\CRBD.DLL (file missing)
O2 - BHO: (no name) - {1A734543-A487-C1B1-4762-33E9376507AA} - C:\WINDOWS\SYSTEM\APPVK32.DLL (file missing)
O2 - BHO: (no name) - {F1A15EA1-4EFF-02B2-CC10-A00AC68DD4BD} - C:\WINDOWS\SYSTEM\APPFU.DLL (file missing)
O2 - BHO: (no name) - {7B6232B1-932F-D979-81D6-8BCF1AF291F8} - C:\WINDOWS\SYSTEM\MFCLW.DLL (file missing)
O2 - BHO: (no name) - {0F8C2FF8-B84B-1234-32EF-FBA2FFCC592C} - C:\WINDOWS\APIID.DLL (file missing)
O2 - BHO: (no name) - {9B8491E6-04E2-DF53-B789-DFCB84CE91D1} - C:\WINDOWS\SYSTEM\NTPL.DLL (file missing)
O2 - BHO: (no name) - {57A97B91-BC0A-46EA-143F-D2AC5E32BFB4} - C:\WINDOWS\NETCE.DLL (file missing)
O2 - BHO: (no name) - {C0146C97-9E45-541E-2BF9-8DEC38F21C73} - C:\WINDOWS\JAVAKV.DLL (file missing)
O2 - BHO: (no name) - {BCE9FBFC-B2C0-9F1D-47BA-B7B5678960D8} - C:\WINDOWS\SYSTEM\SDKQO32.DLL (file missing)
O2 - BHO: (no name) - {3500DC94-C0FD-7A59-32CD-06861C388D23} - C:\WINDOWS\CRGA.DLL (file missing)
O2 - BHO: (no name) - {E79FD511-CE10-89B9-D9B1-B80BF43B7AB9} - C:\WINDOWS\SYSTEM\MSEK.DLL (file missing)
O2 - BHO: (no name) - {EDEE8712-E461-F4B4-D11B-5B7D849A7FC7} - C:\WINDOWS\SYSTEM\CRJK.DLL (file missing)
O2 - BHO: (no name) - {80D3DFA3-37F2-47BA-15DF-7EA3197E6CDC} - C:\WINDOWS\JAVARU32.DLL (file missing)
O2 - BHO: (no name) - {621C5F14-0928-7C3B-745B-DA8F9C0CDA43} - C:\WINDOWS\JAVAYX32.DLL (file missing)
O2 - BHO: (no name) - {6BD4ABBD-3523-C873-457D-313BA77F97C0} - C:\WINDOWS\APPFR.DLL (file missing)
O2 - BHO: (no name) - {A8022F1F-3F6C-3EEC-407E-F52D3DE155EA} - C:\WINDOWS\ADDHX.DLL (file missing)
O2 - BHO: (no name) - {D0ED69AF-D1D6-86F9-BD6B-33C486EE20B9} - C:\WINDOWS\SYSTEM\SYSHC.DLL (file missing)
O2 - BHO: (no name) - {94B0ADA2-7054-3996-E7C3-6D7DE0D9CDF7} - C:\WINDOWS\SYSTEM\MSWZ32.DLL (file missing)
O2 - BHO: (no name) - {1BA9C0B2-7943-49BF-324C-FCAC5D057D6B} - C:\WINDOWS\NETVJ.DLL (file missing)
O2 - BHO: (no name) - {425A0FE9-3A0E-9E1F-C04A-B2DBFCF6EB7E} - C:\WINDOWS\SYSTEM\APIHR32.DLL (file missing)
O2 - BHO: (no name) - {EE11AF32-0603-9096-830F-FD18EBB7A964} - C:\WINDOWS\SYSTEM\SDKMY.DLL (file missing)
O2 - BHO: (no name) - {DA2E1456-592A-59FB-D2A9-711A767623D9} - C:\WINDOWS\IPWX.DLL (file missing)
O2 - BHO: (no name) - {4ABF050C-DD0D-52FF-DD7A-B315E8F9B10E} - C:\WINDOWS\D3QF.DLL (file missing)
O2 - BHO: (no name) - {4D2401C4-3963-5399-544B-E35CFE7B28CC} - C:\WINDOWS\SYSTEM\CRTP.DLL (file missing)
O2 - BHO: (no name) - {7432FB40-2792-013E-0818-99CBAC8DFA5F} - C:\WINDOWS\ADDJE.DLL (file missing)
O2 - BHO: (no name) - {CF0279FD-6CD0-71C3-707F-1BA66FBF7592} - C:\WINDOWS\SYSTEM\MSIY.DLL (file missing)


----------



## ~Candy~ (Jan 27, 2001)

O2 - BHO: (no name) - {68229CE8-5399-DD1A-1BE0-0E44EFD2DB03} - C:\WINDOWS\SYSTEM\IPGJ32.DLL (file missing)
O2 - BHO: (no name) - {98A9B656-1029-E870-F0CD-CA151569B86D} - C:\WINDOWS\IELW.DLL (file missing)
O2 - BHO: (no name) - {C5873BC9-A0EE-12D4-2B7C-D9AAC38D4055} - C:\WINDOWS\SYSTEM\MSRV.DLL (file missing)
O2 - BHO: (no name) - {D4C865F2-EF3F-A44E-8D54-A989848F235F} - C:\WINDOWS\ADDJO.DLL (file missing)
O2 - BHO: (no name) - {993506F8-9F04-9B9E-697C-9857340397E5} - C:\WINDOWS\CROK.DLL (file missing)
O2 - BHO: (no name) - {21258EF1-13DE-0334-9DB4-2B3E344FFB37} - C:\WINDOWS\ADDKU.DLL (file missing)
O2 - BHO: (no name) - {318CB07C-457D-C2FD-D558-1DC5AF0F27FB} - C:\WINDOWS\SYSTEM\JAVATE.DLL (file missing)
O2 - BHO: (no name) - {236A52A4-0D6B-4284-F174-EB78C9872A68} - C:\WINDOWS\APPPB.DLL (file missing)
O2 - BHO: (no name) - {81A2631B-5BDA-D851-21DF-25C2E10A72BF} - C:\WINDOWS\SYSTEM\IECL.DLL (file missing)
O2 - BHO: (no name) - {C60B4EDC-4EF3-233E-44E2-00346BCDBEDE} - C:\WINDOWS\SYSTEM\CRKZ32.DLL (file missing)
O2 - BHO: (no name) - {7DD6BF95-EB84-0559-D846-FF6A7418A53A} - C:\WINDOWS\ADDIB.DLL (file missing)
O2 - BHO: (no name) - {003482D3-A1D3-5890-2FB0-DBB032CAE989} - C:\WINDOWS\SYSTEM\ADDAN.DLL (file missing)
O2 - BHO: (no name) - {EE7118D1-F99F-AAF0-2F73-A1C63E7FE7B3} - C:\WINDOWS\MFCMJ32.DLL (file missing)
O2 - BHO: (no name) - {D347A63E-D453-8011-9CE5-A8289CC2E209} - C:\WINDOWS\APPXV32.DLL (file missing)
O2 - BHO: (no name) - {C088C334-B86C-344C-0F4B-E6396812E3BB} - C:\WINDOWS\ADDKE32.DLL (file missing)
O2 - BHO: (no name) - {67675AE7-E657-5A48-9AA3-A09FC8BFCAF5} - C:\WINDOWS\SYSTEM\MFCWD.DLL (file missing)
O2 - BHO: (no name) - {5E66D566-79F9-86D7-97BB-4FC8CBB27631} - C:\WINDOWS\D3WL.DLL (file missing)
O2 - BHO: (no name) - {74EDB343-0CEA-2557-78E0-56CC2C95DD49} - C:\WINDOWS\SYSTEM\CRNK.DLL (file missing)
O2 - BHO: (no name) - {1270AA6C-EE66-FDEB-E0CE-C19876F44A68} - C:\WINDOWS\SYSTEM\SYSOP32.DLL (file missing)
O2 - BHO: (no name) - {2341B6B9-E486-B1AF-52DC-D05B8550CE4F} - C:\WINDOWS\IPHW32.DLL (file missing)
O2 - BHO: (no name) - {95646EC5-0567-79CA-37E5-0B429083BDAA} - C:\WINDOWS\SYSTEM\D3UE.DLL (file missing)
O2 - BHO: (no name) - {7FEE627F-064F-4EF5-DF76-A75B7E64D510} - C:\WINDOWS\SYSTEM\MFCQR.DLL (file missing)
O2 - BHO: (no name) - {27083D1E-4CF3-6A15-63DE-48F53D2C3EC4} - C:\WINDOWS\SYSTEM\ADDFG.DLL (file missing)
O2 - BHO: (no name) - {DA961EB4-D503-2B8A-69AB-C4905735F48D} - C:\WINDOWS\ATLRZ32.DLL (file missing)
O2 - BHO: (no name) - {BAA30FC7-144C-D511-86B0-B4821F6A694B} - C:\WINDOWS\IPOJ32.DLL (file missing)
O2 - BHO: (no name) - {B346C41C-D83E-EA3C-45FE-1A22D8F51425} - C:\WINDOWS\SYSTEM\MFCXU32.DLL (file missing)
O2 - BHO: (no name) - {F8013DEE-3728-F550-E3A1-227F0FCDD006} - C:\WINDOWS\MSXW32.DLL (file missing)
O2 - BHO: (no name) - {99D566D6-BEF0-42AD-21F4-4089B5C6DAD2} - C:\WINDOWS\SYSTEM\NTZZ32.DLL (file missing)
O2 - BHO: (no name) - {6A992CAC-EAB9-A2BE-D846-226F805F48E9} - C:\WINDOWS\IPSG32.DLL (file missing)
O2 - BHO: (no name) - {A1A15520-4D75-D2B3-991B-0E236756853A} - C:\WINDOWS\SYSTEM\D3BJ32.DLL (file missing)
O2 - BHO: (no name) - {63F55AAB-207A-4070-C941-3AF6DF73213B} - C:\WINDOWS\SDKXN32.DLL (file missing)
O2 - BHO: (no name) - {771317EF-0B4F-CF0A-0367-88AF1EDB349F} - C:\WINDOWS\SDKRJ32.DLL (file missing)
O2 - BHO: (no name) - {35A01210-A8E7-5949-8F4B-D83F54410DD6} - C:\WINDOWS\SYSTEM\MFCDF32.DLL (file missing)
O2 - BHO: (no name) - {A897A95C-5C75-A6CD-A8C2-258DF4528231} - C:\WINDOWS\SYSJN.DLL (file missing)
O2 - BHO: (no name) - {BAAE8C40-3872-4C97-1E70-BCDA3B7B9152} - C:\WINDOWS\SYSTEM\CRIA.DLL (file missing)
O2 - BHO: (no name) - {7A1D7B3D-9E0A-8D1C-848C-C93372C7CB57} - C:\WINDOWS\SYSTEM\NTME32.DLL (file missing)
O2 - BHO: (no name) - {77FBD659-0434-791E-97FD-4C8D0FEE0558} - C:\WINDOWS\APIWL.DLL (file missing)
O2 - BHO: (no name) - {07C0B5BB-649E-8853-BC0D-D77DA5430D5F} - C:\WINDOWS\IEBJ32.DLL (file missing)
O2 - BHO: (no name) - {2AAD032F-C2DB-6300-2B79-91AEA3EAF236} - C:\WINDOWS\SYSTEM\SDKMI.DLL (file missing)
O2 - BHO: (no name) - {C5AD1A0E-1F4A-2916-4D9B-93585168EDD3} - C:\WINDOWS\CRID.DLL (file missing)
O2 - BHO: (no name) - {EE427AA2-C3A0-EEBC-C139-0A744C94E673} - C:\WINDOWS\ATLAS.DLL (file missing)
O2 - BHO: (no name) - {453BE369-8D1D-69D7-A6CB-D4BE3C9AC738} - C:\WINDOWS\SDKVA32.DLL (file missing)
O2 - BHO: (no name) - {A5FF8485-7410-8006-3E97-05C369AB07B3} - C:\WINDOWS\JAVAFQ32.DLL (file missing)
O2 - BHO: (no name) - {4822E4EB-9815-46D6-4820-A8C7F30AEABB} - C:\WINDOWS\SYSTEM\IPIM32.DLL (file missing)
O2 - BHO: (no name) - {F75F0D6E-B293-75B7-CEB9-9C175F169FEC} - C:\WINDOWS\SYSTEM\MFCTY32.DLL (file missing)
O2 - BHO: (no name) - {5436B57C-1E64-AF31-E968-FEE7E08B380E} - C:\WINDOWS\APIEL.DLL (file missing)
O2 - BHO: (no name) - {B58A180E-647C-CB87-48E6-A2D792D907B8} - C:\WINDOWS\SYSTEM\JAVAEK.DLL (file missing)
O2 - BHO: (no name) - {656A50AB-3263-97C2-AF7A-288EB28A9DA2} - C:\WINDOWS\SYSTEM\ADDPE.DLL (file missing)
O2 - BHO: (no name) - {C9927A71-926F-63DD-BAF8-F1DFAA3A18E5} - C:\WINDOWS\IEKK32.DLL (file missing)
O2 - BHO: (no name) - {1B0690C2-D68C-8EBD-7D78-D5657204C867} - C:\WINDOWS\SYSTEM\ADDVD32.DLL (file missing)
O2 - BHO: (no name) - {F235DBBF-0F03-E705-4344-63EAF4E2FEE2} - C:\WINDOWS\SYSTEM\JAVAMN.DLL (file missing)
O2 - BHO: (no name) - {180B5AEC-B0F9-5CF0-938E-E2B4CE64A122} - C:\WINDOWS\SYSTEM\ATLPC32.DLL (file missing)
O2 - BHO: (no name) - {95738BD8-A173-33D1-8A23-543455CDCEAC} - C:\WINDOWS\SYSTEM\ADDMR32.DLL (file missing)
O2 - BHO: (no name) - {8424F96C-274A-E21F-2290-BAE0CDBB14A7} - C:\WINDOWS\NTVY.DLL (file missing)
O2 - BHO: (no name) - {A1A2F8F0-3992-55E5-A766-063F5284DA73} - C:\WINDOWS\SYSTEM\NTNI32.DLL (file missing)
O2 - BHO: (no name) - {6235CB4A-32D8-6210-E971-19318E79D781} - C:\WINDOWS\SDKUI32.DLL (file missing)
O2 - BHO: (no name) - {7DB27A26-99E5-D3F2-DE5E-69D6A77FC596} - C:\WINDOWS\NTGP.DLL (file missing)
O2 - BHO: (no name) - {79676F53-BCB6-F5E5-A706-83C66BCDD5E4} - C:\WINDOWS\SYSTEM\IPGS32.DLL (file missing)
O2 - BHO: (no name) - {288490AB-B9EF-D3C0-464C-36A4F2E0FE93} - C:\WINDOWS\JAVALW.DLL (file missing)
O2 - BHO: (no name) - {F491568F-994F-64FF-02BF-6D4779D6ED11} - C:\WINDOWS\SDKXM.DLL (file missing)
O2 - BHO: (no name) - {BFB5D2CE-194B-C74E-63C1-C2F668F52093} - C:\WINDOWS\MSZU.DLL (file missing)
O2 - BHO: (no name) - {B0E0AE62-532D-DA82-E646-815CCD8C430A} - C:\WINDOWS\SYSTEM\MFCGR32.DLL (file missing)
O2 - BHO: (no name) - {601F227A-986D-DCC7-E70A-C96D006696ED} - C:\WINDOWS\SYSTEM\IPAQ32.DLL (file missing)
O2 - BHO: (no name) - {1C38F764-5211-C094-13C0-3AE414DC1B2A} - C:\WINDOWS\MSCW.DLL (file missing)
O2 - BHO: (no name) - {E61B04D3-5684-9F05-B849-0B1AC13A3F3F} - C:\WINDOWS\WINEZ32.DLL (file missing)
O2 - BHO: (no name) - {95744E08-BCA9-7DC5-8D02-05BAA6A2035F} - C:\WINDOWS\APPWM.DLL (file missing)
O2 - BHO: (no name) - {E2DE458D-7398-0644-6C68-DBEF0B1ED102} - C:\WINDOWS\SYSTEM\JAVANS.DLL (file missing)
O2 - BHO: (no name) - {63F1A1BF-6292-25D0-A3BA-12D30D817406} - C:\WINDOWS\JAVAQI32.DLL (file missing)
O2 - BHO: (no name) - {3ADCA3DF-24F9-8DEA-B64E-7E70AF3ACFC4} - C:\WINDOWS\ATLVV32.DLL
O2 - BHO: (no name) - {EB7AE7CF-EE35-DBE6-E874-7DE0B4037362} - C:\WINDOWS\SYSTEM\SYSVF32.DLL (file missing)
O2 - BHO: (no name) - {AA0A9B7C-1E92-535C-0904-539590028603} - C:\WINDOWS\D3IB.DLL
O2 - BHO: (no name) - {9131A68E-E236-1D25-EC50-DCDB09286B27} - C:\WINDOWS\SYSTEM\ADDPB.DLL (file missing)


----------



## ~Candy~ (Jan 27, 2001)

O2 - BHO: (no name) - {70573871-9AF4-AA4B-A3E9-0408CBA9C49F} - C:\WINDOWS\ADDZT.DLL
O2 - BHO: (no name) - {E0C6D820-8362-D0D4-A3D2-7D77A7FCA0D9} - C:\WINDOWS\CRCW.DLL
O2 - BHO: (no name) - {449DE079-4D9D-40A0-79F7-C81D24C85B56} - C:\WINDOWS\SYSTEM\SYSYY32.DLL (file missing)
O2 - BHO: (no name) - {714A75BA-793A-AD03-032C-D32FE3D02CDF} - C:\WINDOWS\SYSTEM\SYSHA.DLL
O2 - BHO: (no name) - {6557D814-89DB-DA16-9B4C-C38A0E1F23F2} - C:\WINDOWS\SYSTEM\MFCNY32.DLL
O2 - BHO: (no name) - {25C74278-2B06-35A9-1466-C9685FB9B474} - C:\WINDOWS\SYSTEM\MFCML32.DLL (file missing)
O2 - BHO: (no name) - {594E2F72-FE93-92E3-61EE-B8A6B35055AD} - C:\WINDOWS\SYSTEM\APPGW.DLL (file missing)
O2 - BHO: (no name) - {33A91ECF-F829-DFA8-9851-A9542E8C427A} - C:\WINDOWS\CRCO.DLL (file missing)
O2 - BHO: (no name) - {5D02935D-E94F-74E3-32D6-84B010E8BBFE} - C:\WINDOWS\SYSTEM\NTMU32.DLL
O2 - BHO: (no name) - {54882F76-55FF-BB31-38C8-936815FEEBA7} - C:\WINDOWS\SYSTEM\NTFE.DLL (file missing)
O2 - BHO: (no name) - {C0F1AE33-153C-4E19-A0B9-7155E429A4F5} - C:\WINDOWS\SYSTEM\WINQU32.DLL
O2 - BHO: (no name) - {94EDA710-BB36-72A8-38B1-FBB4D78789FE} - C:\WINDOWS\NETJM.DLL
O2 - BHO: (no name) - {EE65FB9C-280C-02E2-8454-DC71DD55F204} - C:\WINDOWS\SYSLL.DLL (file missing)
O2 - BHO: (no name) - {07FEE7E2-7D04-D24C-DEDC-3DC5C389B77B} - C:\WINDOWS\APPFI.DLL
O2 - BHO: (no name) - {D0254563-9A8D-007E-CA48-DB55957F02FE} - C:\WINDOWS\SYSTEM\WINSL.DLL (file missing)
O2 - BHO: (no name) - {FC631A47-C8B3-02D6-1DC8-8D4C0F24DA94} - C:\WINDOWS\SYSTEM\ATLHZ.DLL (file missing)
O2 - BHO: (no name) - {456B0350-C35D-AF9C-C437-EF1B9E35850D} - C:\WINDOWS\SYSSQ.DLL (file missing)
O2 - BHO: (no name) - {18F0E66F-02A9-EB4B-21DB-BCE4D00ADEE4} - C:\WINDOWS\SYSTEM\SYSXP.DLL (file missing)
O2 - BHO: (no name) - {BB1C7E31-AB2A-B10E-AD1C-F84A89B87AC1} - C:\WINDOWS\CRRJ.DLL (file missing)
O2 - BHO: (no name) - {233AEA30-0862-61E9-C897-4D9FEE9A0093} - C:\WINDOWS\WINFX32.DLL (file missing)
O2 - BHO: (no name) - {8BCAECE1-BD48-E057-0435-F351137FC682} - C:\WINDOWS\SYSTEM\SDKRO32.DLL (file missing)
O2 - BHO: (no name) - {36602E34-564B-4F82-3460-40E15FF68B74} - C:\WINDOWS\SYSYF32.DLL (file missing)
O2 - BHO: (no name) - {2E651794-347D-9882-B60F-CF52A9AA5182} - C:\WINDOWS\JAVACV32.DLL (file missing)
O2 - BHO: (no name) - {172BF5DA-BFE0-84B4-A970-868C5009C873} - C:\WINDOWS\MFCOU.DLL (file missing)
O2 - BHO: (no name) - {7F1BAB09-C8F9-5BCE-C0DC-0394A6AA3ADD} - C:\WINDOWS\SYSTEM\WINMK32.DLL (file missing)
O2 - BHO: (no name) - {C0D9B279-68DF-C2FA-677D-4626D01E85E4} - C:\WINDOWS\SYSBG.DLL (file missing)
O2 - BHO: (no name) - {ABA73A0B-C663-3DC9-DC8D-DEC226D2602B} - C:\WINDOWS\SYSTEM\IPAJ.DLL (file missing)
O2 - BHO: (no name) - {ADF83008-D033-75CF-F558-8F5FD25A0CAC} - C:\WINDOWS\SYSTEM\SYSZF32.DLL (file missing)
O2 - BHO: (no name) - {22E2AB09-0048-1FF5-A3E7-70536A1077C5} - C:\WINDOWS\SYSMY.DLL (file missing)
O2 - BHO: (no name) - {CBBEC243-B125-F6CB-20B6-4A6446E07C07} - C:\WINDOWS\MSAY32.DLL (file missing)
O2 - BHO: (no name) - {AB7897DF-B84C-91D1-F3BA-557F270913BC} - C:\WINDOWS\SYSTEM\MSUJ.DLL (file missing)
O2 - BHO: (no name) - {8DFCC67B-8710-3829-914B-ECF21F7964E0} - C:\WINDOWS\SYSTEM\ATLPX32.DLL (file missing)
O2 - BHO: (no name) - {CBCC2124-1931-5492-EAAF-C5C2E7437596} - C:\WINDOWS\SYSTEM\ADDTA.DLL
O2 - BHO: (no name) - {FFCF604D-210A-9317-A8C5-80208D4AD348} - C:\WINDOWS\ATLKD.DLL
O4 - HKLM\..\Run: [xepjxuta] C:\WINDOWS\SYSTEM\MKQYAKG.EXE
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [APIOQ.EXE] C:\WINDOWS\SYSTEM\APIOQ.EXE
O4 - HKLM\..\Run: [SpyBlocs] C:\PROGRAM FILES\SPYBLOCS\SpyBlocs.exe
O4 - HKLM\..\RunServices: [SYSRJ32.EXE] C:\WINDOWS\SYSRJ32.EXE
O4 - HKLM\..\RunServices: [SYSHZ32.EXE] C:\WINDOWS\SYSTEM\SYSHZ32.EXE
O4 - HKLM\..\RunServices: [MFCYB.EXE] C:\WINDOWS\SYSTEM\MFCYB.EXE
O4 - HKLM\..\RunServices: [ADDLH.EXE] C:\WINDOWS\ADDLH.EXE
O4 - HKLM\..\RunServices: [SDKMS.EXE] C:\WINDOWS\SDKMS.EXE
O4 - HKLM\..\RunServices: [WINFD.EXE] C:\WINDOWS\SYSTEM\WINFD.EXE
O4 - HKLM\..\RunServices: [NTFD32.EXE] C:\WINDOWS\SYSTEM\NTFD32.EXE
O4 - HKLM\..\RunServices: [NETJM.EXE] C:\WINDOWS\NETJM.EXE
O4 - HKLM\..\RunServices: [APIXB32.EXE] C:\WINDOWS\APIXB32.EXE
O4 - HKLM\..\RunServices: [IEGF32.EXE] C:\WINDOWS\SYSTEM\IEGF32.EXE
O4 - HKLM\..\RunServices: [WINBA.EXE] C:\WINDOWS\SYSTEM\WINBA.EXE
O4 - HKLM\..\RunServices: [MFCXG32.EXE] C:\WINDOWS\SYSTEM\MFCXG32.EXE
O4 - HKLM\..\RunServices: [WINZE32.EXE] C:\WINDOWS\WINZE32.EXE
O4 - HKLM\..\RunServices: [APIJX32.EXE] C:\WINDOWS\SYSTEM\APIJX32.EXE
O4 - HKLM\..\RunServices: [CREC.EXE] C:\WINDOWS\CREC.EXE
O4 - HKLM\..\RunServices: [NETQF32.EXE] C:\WINDOWS\NETQF32.EXE
O4 - HKLM\..\RunServices: [CRFI.EXE] C:\WINDOWS\SYSTEM\CRFI.EXE


----------



## ~Candy~ (Jan 27, 2001)

O4 - HKLM\..\RunServices: [ATLBD.EXE] C:\WINDOWS\ATLBD.EXE
O4 - HKLM\..\RunServices: [SYSQH32.EXE] C:\WINDOWS\SYSTEM\SYSQH32.EXE
O4 - HKLM\..\RunServices: [MSYJ.EXE] C:\WINDOWS\SYSTEM\MSYJ.EXE
O4 - HKLM\..\RunServices: [IPRV.EXE] C:\WINDOWS\IPRV.EXE
O4 - HKLM\..\RunServices: [ADDUF.EXE] C:\WINDOWS\SYSTEM\ADDUF.EXE
O4 - HKLM\..\RunServices: [MFCCQ.EXE] C:\WINDOWS\SYSTEM\MFCCQ.EXE
O4 - HKLM\..\RunServices: [NETZC.EXE] C:\WINDOWS\SYSTEM\NETZC.EXE
O4 - HKLM\..\RunServices: [APPRX32.EXE] C:\WINDOWS\APPRX32.EXE
O4 - HKLM\..\RunServices: [CROG32.EXE] C:\WINDOWS\CROG32.EXE
O4 - HKLM\..\RunServices: [IEOX32.EXE] C:\WINDOWS\SYSTEM\IEOX32.EXE
O4 - HKLM\..\RunServices: [JAVAPE32.EXE] C:\WINDOWS\SYSTEM\JAVAPE32.EXE
O4 - HKLM\..\RunServices: [APIAX.EXE] C:\WINDOWS\APIAX.EXE
O4 - HKLM\..\RunServices: [APPPG.EXE] C:\WINDOWS\APPPG.EXE
O4 - HKLM\..\RunServices: [ATLWO32.EXE] C:\WINDOWS\SYSTEM\ATLWO32.EXE
O4 - HKLM\..\RunServices: [MSAZ32.EXE] C:\WINDOWS\MSAZ32.EXE
O4 - HKLM\..\RunServices: [CRCZ.EXE] C:\WINDOWS\CRCZ.EXE
O4 - HKLM\..\RunServices: [WINLI.EXE] C:\WINDOWS\SYSTEM\WINLI.EXE
O4 - HKLM\..\RunServices: [MSMV32.EXE] C:\WINDOWS\MSMV32.EXE
O4 - HKLM\..\RunServices: [APIUE32.EXE] C:\WINDOWS\APIUE32.EXE
O4 - HKLM\..\RunServices: [SDKAK.EXE] C:\WINDOWS\SDKAK.EXE
O4 - HKLM\..\RunServices: [D3ZY32.EXE] C:\WINDOWS\SYSTEM\D3ZY32.EXE
O4 - HKLM\..\RunServices: [SYSRO.EXE] C:\WINDOWS\SYSTEM\SYSRO.EXE
O4 - HKLM\..\RunServices: [IECQ32.EXE] C:\WINDOWS\SYSTEM\IECQ32.EXE
O4 - HKLM\..\RunServices: [SYSXK.EXE] C:\WINDOWS\SYSXK.EXE
O4 - HKLM\..\RunServices: [SYSXX32.EXE] C:\WINDOWS\SYSXX32.EXE
O4 - HKLM\..\RunServices: [IEGH.EXE] C:\WINDOWS\SYSTEM\IEGH.EXE
O4 - HKLM\..\RunServices: [CRMA.EXE] C:\WINDOWS\SYSTEM\CRMA.EXE
O4 - HKLM\..\RunServices: [ADDDV.EXE] C:\WINDOWS\SYSTEM\ADDDV.EXE
O4 - HKLM\..\RunServices: [IEWY32.EXE] C:\WINDOWS\SYSTEM\IEWY32.EXE
O4 - HKLM\..\RunServices: [ATLGW32.EXE] C:\WINDOWS\ATLGW32.EXE
O4 - HKLM\..\RunServices: [WINTC.EXE] C:\WINDOWS\SYSTEM\WINTC.EXE
O4 - HKLM\..\RunServices: [IEGR32.EXE] C:\WINDOWS\IEGR32.EXE
O4 - HKLM\..\RunServices: [NETFM32.EXE] C:\WINDOWS\NETFM32.EXE
O4 - HKLM\..\RunServices: [WINAI32.EXE] C:\WINDOWS\SYSTEM\WINAI32.EXE
O4 - HKLM\..\RunServices: [SYSMO.EXE] C:\WINDOWS\SYSTEM\SYSMO.EXE
O4 - HKLM\..\RunServices: [APIDN.EXE] C:\WINDOWS\SYSTEM\APIDN.EXE
O4 - HKLM\..\RunServices: [ATLML.EXE] C:\WINDOWS\SYSTEM\ATLML.EXE
O4 - HKLM\..\RunServices: [IESF32.EXE] C:\WINDOWS\IESF32.EXE
O4 - HKLM\..\RunServices: [D3MN32.EXE] C:\WINDOWS\D3MN32.EXE
O4 - HKLM\..\RunServices: [APIGE.EXE] C:\WINDOWS\SYSTEM\APIGE.EXE
O4 - HKLM\..\RunServices: [WINPW32.EXE] C:\WINDOWS\SYSTEM\WINPW32.EXE
O4 - HKLM\..\RunServices: [JAVASG.EXE] C:\WINDOWS\SYSTEM\JAVASG.EXE
O4 - HKLM\..\RunServices: [MSAS32.EXE] C:\WINDOWS\MSAS32.EXE
O4 - HKLM\..\RunServices: [D3LZ32.EXE] C:\WINDOWS\SYSTEM\D3LZ32.EXE
O4 - HKLM\..\RunServices: [WINBP32.EXE] C:\WINDOWS\SYSTEM\WINBP32.EXE
O4 - HKLM\..\RunServices: [APPVG.EXE] C:\WINDOWS\APPVG.EXE
O4 - HKLM\..\RunServices: [WINDD.EXE] C:\WINDOWS\WINDD.EXE
O4 - HKLM\..\RunServices: [MFCWZ32.EXE] C:\WINDOWS\MFCWZ32.EXE
O4 - HKLM\..\RunServices: [D3HZ.EXE] C:\WINDOWS\SYSTEM\D3HZ.EXE
O4 - HKLM\..\RunServices: [NTEJ32.EXE] C:\WINDOWS\SYSTEM\NTEJ32.EXE
O4 - HKLM\..\RunServices: [MFCHE.EXE] C:\WINDOWS\SYSTEM\MFCHE.EXE
O4 - HKLM\..\RunServices: [NETCY32.EXE] C:\WINDOWS\SYSTEM\NETCY32.EXE
O4 - HKLM\..\RunServices: [IEDE32.EXE] C:\WINDOWS\SYSTEM\IEDE32.EXE
O4 - HKLM\..\RunServices: [IEZT32.EXE] C:\WINDOWS\IEZT32.EXE
O4 - HKLM\..\RunServices: [APPZN32.EXE] C:\WINDOWS\APPZN32.EXE
O4 - HKLM\..\RunServices: [NETFN.EXE] C:\WINDOWS\SYSTEM\NETFN.EXE
O4 - HKLM\..\RunServices: [D3SL.EXE] C:\WINDOWS\SYSTEM\D3SL.EXE
O4 - HKLM\..\RunServices: [IEWE.EXE] C:\WINDOWS\SYSTEM\IEWE.EXE
O4 - HKLM\..\RunServices: [CRED32.EXE] C:\WINDOWS\SYSTEM\CRED32.EXE
O4 - HKLM\..\RunServices: [ADDQQ32.EXE] C:\WINDOWS\ADDQQ32.EXE
O4 - HKLM\..\RunServices: [JAVAMF.EXE] C:\WINDOWS\JAVAMF.EXE
O4 - HKLM\..\RunServices: [MSDO32.EXE] C:\WINDOWS\SYSTEM\MSDO32.EXE
O4 - HKLM\..\RunServices: [APPHQ32.EXE] C:\WINDOWS\SYSTEM\APPHQ32.EXE
O4 - HKLM\..\RunServices: [MFCNS32.EXE] C:\WINDOWS\MFCNS32.EXE
O4 - HKLM\..\RunServices: [ADDOV32.EXE] C:\WINDOWS\SYSTEM\ADDOV32.EXE
O4 - HKLM\..\RunServices: [SDKLY32.EXE] C:\WINDOWS\SYSTEM\SDKLY32.EXE
O4 - HKLM\..\RunServices: [ADDUC32.EXE] C:\WINDOWS\ADDUC32.EXE
O4 - HKLM\..\RunServices: [IPPK.EXE] C:\WINDOWS\IPPK.EXE
O4 - HKLM\..\RunServices: [MFCLW.EXE] C:\WINDOWS\SYSTEM\MFCLW.EXE
O4 - HKLM\..\RunServices: [IEOD.EXE] C:\WINDOWS\SYSTEM\IEOD.EXE
O4 - HKLM\..\RunServices: [APPMQ32.EXE] C:\WINDOWS\SYSTEM\APPMQ32.EXE
O4 - HKLM\..\RunServices: [D3LY32.EXE] C:\WINDOWS\SYSTEM\D3LY32.EXE
O4 - HKLM\..\RunServices: [CRHF32.EXE] C:\WINDOWS\CRHF32.EXE
O4 - HKLM\..\RunServices: [APIYN32.EXE] C:\WINDOWS\APIYN32.EXE
O4 - HKLM\..\RunServices: [APPMS32.EXE] C:\WINDOWS\SYSTEM\APPMS32.EXE
O4 - HKLM\..\RunServices: [ATLWK.EXE] C:\WINDOWS\ATLWK.EXE
O4 - HKLM\..\RunServices: [MFCWS.EXE] C:\WINDOWS\SYSTEM\MFCWS.EXE
O4 - HKLM\..\RunServices: [SYSPR32.EXE] C:\WINDOWS\SYSPR32.EXE
O4 - HKLM\..\RunServices: [IEOF.EXE] C:\WINDOWS\IEOF.EXE
O4 - HKLM\..\RunServices: [MSKU.EXE] C:\WINDOWS\SYSTEM\MSKU.EXE
O4 - HKLM\..\RunServices: [IPYF.EXE] C:\WINDOWS\IPYF.EXE
O4 - HKLM\..\RunServices: [D3CX32.EXE] C:\WINDOWS\SYSTEM\D3CX32.EXE
O4 - HKLM\..\RunServices: [ADDAK32.EXE] C:\WINDOWS\ADDAK32.EXE
O4 - HKLM\..\RunServices: [ATLPI.EXE] C:\WINDOWS\ATLPI.EXE
O4 - HKLM\..\RunServices: [D3QW32.EXE] C:\WINDOWS\D3QW32.EXE
O4 - HKLM\..\RunServices: [CRDJ32.EXE] C:\WINDOWS\CRDJ32.EXE
O4 - HKLM\..\RunServices: [IERH.EXE] C:\WINDOWS\IERH.EXE
O4 - HKLM\..\RunServices: [NETWQ.EXE] C:\WINDOWS\NETWQ.EXE
O4 - HKLM\..\RunServices: [ATLBT32.EXE] C:\WINDOWS\ATLBT32.EXE
O4 - HKLM\..\RunServices: [CRGL.EXE] C:\WINDOWS\SYSTEM\CRGL.EXE
O4 - HKLM\..\RunServices: [MFCNI.EXE] C:\WINDOWS\MFCNI.EXE
O4 - HKLM\..\RunServices: [MFCLZ.EXE] C:\WINDOWS\SYSTEM\MFCLZ.EXE
O4 - HKLM\..\RunServices: [APICG.EXE] C:\WINDOWS\SYSTEM\APICG.EXE
O4 - HKLM\..\RunServices: [MFCBQ32.EXE] C:\WINDOWS\MFCBQ32.EXE
O4 - HKLM\..\RunServices: [ATLZB32.EXE] C:\WINDOWS\ATLZB32.EXE
O4 - HKLM\..\RunServices: [MSKC32.EXE] C:\WINDOWS\MSKC32.EXE
O4 - HKLM\..\RunServices: [MSXO32.EXE] C:\WINDOWS\MSXO32.EXE
O4 - HKLM\..\RunServices: [MFCBE32.EXE] C:\WINDOWS\MFCBE32.EXE
O4 - HKLM\..\RunServices: [JAVALO.EXE] C:\WINDOWS\JAVALO.EXE
O4 - HKLM\..\RunServices: [APPZT.EXE] C:\WINDOWS\APPZT.EXE
O4 - HKLM\..\RunServices: [CRDI.EXE] C:\WINDOWS\CRDI.EXE
O4 - HKLM\..\RunServices: [MSSM.EXE] C:\WINDOWS\MSSM.EXE
O4 - HKLM\..\RunServices: [JAVANH32.EXE] C:\WINDOWS\SYSTEM\JAVANH32.EXE
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll


----------



## Couriant (Mar 26, 2002)

I can see why! WOW, that's a lot of BHOs!  OK, lets see now. First download and run SPYWAREBLASTER from www.javacoolsoftware.com This will prevent any more attacks. When you have enabled the protection for IE and others, run HJT again and check these for fixing:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
ALL OF THE O2: BHOs
O4 - HKLM\..\Run: [xepjxuta] C:\WINDOWS\SYSTEM\MKQYAKG.EXE
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [APIOQ.EXE] C:\WINDOWS\SYSTEM\APIOQ.EXE
O4 - HKLM\..\RunServices: [SYSRJ32.EXE] C:\WINDOWS\SYSRJ32.EXE
O4 - HKLM\..\RunServices: [SYSHZ32.EXE] C:\WINDOWS\SYSTEM\SYSHZ32.EXE
O4 - HKLM\..\RunServices: [MFCYB.EXE] C:\WINDOWS\SYSTEM\MFCYB.EXE
O4 - HKLM\..\RunServices: [ADDLH.EXE] C:\WINDOWS\ADDLH.EXE
O4 - HKLM\..\RunServices: [SDKMS.EXE] C:\WINDOWS\SDKMS.EXE
O4 - HKLM\..\RunServices: [WINFD.EXE] C:\WINDOWS\SYSTEM\WINFD.EXE
O4 - HKLM\..\RunServices: [NTFD32.EXE] C:\WINDOWS\SYSTEM\NTFD32.EXE
O4 - HKLM\..\RunServices: [NETJM.EXE] C:\WINDOWS\NETJM.EXE
O4 - HKLM\..\RunServices: [APIXB32.EXE] C:\WINDOWS\APIXB32.EXE
O4 - HKLM\..\RunServices: [IEGF32.EXE] C:\WINDOWS\SYSTEM\IEGF32.EXE
O4 - HKLM\..\RunServices: [WINBA.EXE] C:\WINDOWS\SYSTEM\WINBA.EXE
O4 - HKLM\..\RunServices: [MFCXG32.EXE] C:\WINDOWS\SYSTEM\MFCXG32.EXE
O4 - HKLM\..\RunServices: [WINZE32.EXE] C:\WINDOWS\WINZE32.EXE
O4 - HKLM\..\RunServices: [APIJX32.EXE] C:\WINDOWS\SYSTEM\APIJX32.EXE
O4 - HKLM\..\RunServices: [CREC.EXE] C:\WINDOWS\CREC.EXE
O4 - HKLM\..\RunServices: [NETQF32.EXE] C:\WINDOWS\NETQF32.EXE
O4 - HKLM\..\RunServices: [CRFI.EXE] C:\WINDOWS\SYSTEM\CRFI.EXE
O4 - HKLM\..\RunServices: [ATLBD.EXE] C:\WINDOWS\ATLBD.EXE
O4 - HKLM\..\RunServices: [SYSQH32.EXE] C:\WINDOWS\SYSTEM\SYSQH32.EXE
O4 - HKLM\..\RunServices: [MSYJ.EXE] C:\WINDOWS\SYSTEM\MSYJ.EXE
O4 - HKLM\..\RunServices: [IPRV.EXE] C:\WINDOWS\IPRV.EXE
O4 - HKLM\..\RunServices: [ADDUF.EXE] C:\WINDOWS\SYSTEM\ADDUF.EXE
O4 - HKLM\..\RunServices: [MFCCQ.EXE] C:\WINDOWS\SYSTEM\MFCCQ.EXE
O4 - HKLM\..\RunServices: [NETZC.EXE] C:\WINDOWS\SYSTEM\NETZC.EXE
O4 - HKLM\..\RunServices: [APPRX32.EXE] C:\WINDOWS\APPRX32.EXE
O4 - HKLM\..\RunServices: [CROG32.EXE] C:\WINDOWS\CROG32.EXE
O4 - HKLM\..\RunServices: [IEOX32.EXE] C:\WINDOWS\SYSTEM\IEOX32.EXE
O4 - HKLM\..\RunServices: [JAVAPE32.EXE] C:\WINDOWS\SYSTEM\JAVAPE32.EXE
O4 - HKLM\..\RunServices: [APIAX.EXE] C:\WINDOWS\APIAX.EXE
O4 - HKLM\..\RunServices: [APPPG.EXE] C:\WINDOWS\APPPG.EXE
O4 - HKLM\..\RunServices: [ATLWO32.EXE] C:\WINDOWS\SYSTEM\ATLWO32.EXE
O4 - HKLM\..\RunServices: [MSAZ32.EXE] C:\WINDOWS\MSAZ32.EXE
O4 - HKLM\..\RunServices: [CRCZ.EXE] C:\WINDOWS\CRCZ.EXE
O4 - HKLM\..\RunServices: [WINLI.EXE] C:\WINDOWS\SYSTEM\WINLI.EXE
O4 - HKLM\..\RunServices: [MSMV32.EXE] C:\WINDOWS\MSMV32.EXE
O4 - HKLM\..\RunServices: [APIUE32.EXE] C:\WINDOWS\APIUE32.EXE
O4 - HKLM\..\RunServices: [SDKAK.EXE] C:\WINDOWS\SDKAK.EXE
O4 - HKLM\..\RunServices: [D3ZY32.EXE] C:\WINDOWS\SYSTEM\D3ZY32.EXE
O4 - HKLM\..\RunServices: [SYSRO.EXE] C:\WINDOWS\SYSTEM\SYSRO.EXE
O4 - HKLM\..\RunServices: [IECQ32.EXE] C:\WINDOWS\SYSTEM\IECQ32.EXE
O4 - HKLM\..\RunServices: [SYSXK.EXE] C:\WINDOWS\SYSXK.EXE
O4 - HKLM\..\RunServices: [SYSXX32.EXE] C:\WINDOWS\SYSXX32.EXE
O4 - HKLM\..\RunServices: [IEGH.EXE] C:\WINDOWS\SYSTEM\IEGH.EXE
O4 - HKLM\..\RunServices: [CRMA.EXE] C:\WINDOWS\SYSTEM\CRMA.EXE
O4 - HKLM\..\RunServices: [ADDDV.EXE] C:\WINDOWS\SYSTEM\ADDDV.EXE
O4 - HKLM\..\RunServices: [IEWY32.EXE] C:\WINDOWS\SYSTEM\IEWY32.EXE
O4 - HKLM\..\RunServices: [ATLGW32.EXE] C:\WINDOWS\ATLGW32.EXE
O4 - HKLM\..\RunServices: [WINTC.EXE] C:\WINDOWS\SYSTEM\WINTC.EXE
O4 - HKLM\..\RunServices: [IEGR32.EXE] C:\WINDOWS\IEGR32.EXE
O4 - HKLM\..\RunServices: [NETFM32.EXE] C:\WINDOWS\NETFM32.EXE
O4 - HKLM\..\RunServices: [WINAI32.EXE] C:\WINDOWS\SYSTEM\WINAI32.EXE
O4 - HKLM\..\RunServices: [SYSMO.EXE] C:\WINDOWS\SYSTEM\SYSMO.EXE
O4 - HKLM\..\RunServices: [APIDN.EXE] C:\WINDOWS\SYSTEM\APIDN.EXE
O4 - HKLM\..\RunServices: [ATLML.EXE] C:\WINDOWS\SYSTEM\ATLML.EXE
O4 - HKLM\..\RunServices: [IESF32.EXE] C:\WINDOWS\IESF32.EXE
O4 - HKLM\..\RunServices: [D3MN32.EXE] C:\WINDOWS\D3MN32.EXE
O4 - HKLM\..\RunServices: [APIGE.EXE] C:\WINDOWS\SYSTEM\APIGE.EXE
O4 - HKLM\..\RunServices: [WINPW32.EXE] C:\WINDOWS\SYSTEM\WINPW32.EXE
O4 - HKLM\..\RunServices: [JAVASG.EXE] C:\WINDOWS\SYSTEM\JAVASG.EXE
O4 - HKLM\..\RunServices: [MSAS32.EXE] C:\WINDOWS\MSAS32.EXE
O4 - HKLM\..\RunServices: [D3LZ32.EXE] C:\WINDOWS\SYSTEM\D3LZ32.EXE
O4 - HKLM\..\RunServices: [WINBP32.EXE] C:\WINDOWS\SYSTEM\WINBP32.EXE
O4 - HKLM\..\RunServices: [APPVG.EXE] C:\WINDOWS\APPVG.EXE
O4 - HKLM\..\RunServices: [WINDD.EXE] C:\WINDOWS\WINDD.EXE
O4 - HKLM\..\RunServices: [MFCWZ32.EXE] C:\WINDOWS\MFCWZ32.EXE
O4 - HKLM\..\RunServices: [D3HZ.EXE] C:\WINDOWS\SYSTEM\D3HZ.EXE
O4 - HKLM\..\RunServices: [NTEJ32.EXE] C:\WINDOWS\SYSTEM\NTEJ32.EXE
O4 - HKLM\..\RunServices: [MFCHE.EXE] C:\WINDOWS\SYSTEM\MFCHE.EXE
O4 - HKLM\..\RunServices: [NETCY32.EXE] C:\WINDOWS\SYSTEM\NETCY32.EXE
O4 - HKLM\..\RunServices: [IEDE32.EXE] C:\WINDOWS\SYSTEM\IEDE32.EXE
O4 - HKLM\..\RunServices: [IEZT32.EXE] C:\WINDOWS\IEZT32.EXE
O4 - HKLM\..\RunServices: [APPZN32.EXE] C:\WINDOWS\APPZN32.EXE
O4 - HKLM\..\RunServices: [NETFN.EXE] C:\WINDOWS\SYSTEM\NETFN.EXE
O4 - HKLM\..\RunServices: [D3SL.EXE] C:\WINDOWS\SYSTEM\D3SL.EXE
O4 - HKLM\..\RunServices: [IEWE.EXE] C:\WINDOWS\SYSTEM\IEWE.EXE
O4 - HKLM\..\RunServices: [CRED32.EXE] C:\WINDOWS\SYSTEM\CRED32.EXE
O4 - HKLM\..\RunServices: [ADDQQ32.EXE] C:\WINDOWS\ADDQQ32.EXE
O4 - HKLM\..\RunServices: [JAVAMF.EXE] C:\WINDOWS\JAVAMF.EXE
O4 - HKLM\..\RunServices: [MSDO32.EXE] C:\WINDOWS\SYSTEM\MSDO32.EXE
O4 - HKLM\..\RunServices: [APPHQ32.EXE] C:\WINDOWS\SYSTEM\APPHQ32.EXE
O4 - HKLM\..\RunServices: [MFCNS32.EXE] C:\WINDOWS\MFCNS32.EXE
O4 - HKLM\..\RunServices: [ADDOV32.EXE] C:\WINDOWS\SYSTEM\ADDOV32.EXE
O4 - HKLM\..\RunServices: [SDKLY32.EXE] C:\WINDOWS\SYSTEM\SDKLY32.EXE
O4 - HKLM\..\RunServices: [ADDUC32.EXE] C:\WINDOWS\ADDUC32.EXE
O4 - HKLM\..\RunServices: [IPPK.EXE] C:\WINDOWS\IPPK.EXE
O4 - HKLM\..\RunServices: [MFCLW.EXE] C:\WINDOWS\SYSTEM\MFCLW.EXE
O4 - HKLM\..\RunServices: [IEOD.EXE] C:\WINDOWS\SYSTEM\IEOD.EXE
O4 - HKLM\..\RunServices: [APPMQ32.EXE] C:\WINDOWS\SYSTEM\APPMQ32.EXE
O4 - HKLM\..\RunServices: [D3LY32.EXE] C:\WINDOWS\SYSTEM\D3LY32.EXE
O4 - HKLM\..\RunServices: [CRHF32.EXE] C:\WINDOWS\CRHF32.EXE
O4 - HKLM\..\RunServices: [APIYN32.EXE] C:\WINDOWS\APIYN32.EXE
O4 - HKLM\..\RunServices: [APPMS32.EXE] C:\WINDOWS\SYSTEM\APPMS32.EXE
O4 - HKLM\..\RunServices: [ATLWK.EXE] C:\WINDOWS\ATLWK.EXE
O4 - HKLM\..\RunServices: [MFCWS.EXE] C:\WINDOWS\SYSTEM\MFCWS.EXE
O4 - HKLM\..\RunServices: [SYSPR32.EXE] C:\WINDOWS\SYSPR32.EXE
O4 - HKLM\..\RunServices: [IEOF.EXE] C:\WINDOWS\IEOF.EXE
O4 - HKLM\..\RunServices: [MSKU.EXE] C:\WINDOWS\SYSTEM\MSKU.EXE
O4 - HKLM\..\RunServices: [IPYF.EXE] C:\WINDOWS\IPYF.EXE
O4 - HKLM\..\RunServices: [D3CX32.EXE] C:\WINDOWS\SYSTEM\D3CX32.EXE
O4 - HKLM\..\RunServices: [ADDAK32.EXE] C:\WINDOWS\ADDAK32.EXE
O4 - HKLM\..\RunServices: [ATLPI.EXE] C:\WINDOWS\ATLPI.EXE
O4 - HKLM\..\RunServices: [D3QW32.EXE] C:\WINDOWS\D3QW32.EXE
O4 - HKLM\..\RunServices: [CRDJ32.EXE] C:\WINDOWS\CRDJ32.EXE
O4 - HKLM\..\RunServices: [IERH.EXE] C:\WINDOWS\IERH.EXE
O4 - HKLM\..\RunServices: [NETWQ.EXE] C:\WINDOWS\NETWQ.EXE
O4 - HKLM\..\RunServices: [ATLBT32.EXE] C:\WINDOWS\ATLBT32.EXE
O4 - HKLM\..\RunServices: [CRGL.EXE] C:\WINDOWS\SYSTEM\CRGL.EXE
O4 - HKLM\..\RunServices: [MFCNI.EXE] C:\WINDOWS\MFCNI.EXE
O4 - HKLM\..\RunServices: [MFCLZ.EXE] C:\WINDOWS\SYSTEM\MFCLZ.EXE
O4 - HKLM\..\RunServices: [APICG.EXE] C:\WINDOWS\SYSTEM\APICG.EXE
O4 - HKLM\..\RunServices: [MFCBQ32.EXE] C:\WINDOWS\MFCBQ32.EXE
O4 - HKLM\..\RunServices: [ATLZB32.EXE] C:\WINDOWS\ATLZB32.EXE
O4 - HKLM\..\RunServices: [MSKC32.EXE] C:\WINDOWS\MSKC32.EXE
O4 - HKLM\..\RunServices: [MSXO32.EXE] C:\WINDOWS\MSXO32.EXE
O4 - HKLM\..\RunServices: [MFCBE32.EXE] C:\WINDOWS\MFCBE32.EXE
O4 - HKLM\..\RunServices: [JAVALO.EXE] C:\WINDOWS\JAVALO.EXE
O4 - HKLM\..\RunServices: [APPZT.EXE] C:\WINDOWS\APPZT.EXE
O4 - HKLM\..\RunServices: [CRDI.EXE] C:\WINDOWS\CRDI.EXE
O4 - HKLM\..\RunServices: [MSSM.EXE] C:\WINDOWS\MSSM.EXE
O4 - HKLM\..\RunServices: [JAVANH32.EXE] C:\WINDOWS\SYSTEM\JAVANH32.EXE
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm

Then go into safe mode and delete:
hnoob.dll
sp.html
bekaiqw.dll
the P2P NETWORKING folder in C:\WINDOWS\SYSTEM
All of the EXE files you see listed above. You might want to print it out 

You seem to missing something else from the log, but when you have done all that, run another HJT log.


----------



## Infidel_Kastro (Nov 21, 2003)

Lets hold off on this. $teve and I talked about this and he said that a that system restore would probably be the easiest thing to do becasue you have to remove all the 02's and any associtaed files that correspond, if not, you'll get the same problem.
how long have you had this problem?


----------



## ~Candy~ (Jan 27, 2001)

Tidus4Yuna said:


> You seem to missing something else from the log, but when you have done all that, run another HJT log.


You mean like a virus program 

And systray and scanregistry are missing too.

Looks like another P2P player finding out what really happens


----------



## Couriant (Mar 26, 2002)

Well that's not what I was looking for, but good eye! 

'Looks like another P2P player finding out what really happens'

Yep!


----------



## akasha (Jun 23, 2004)

It started earlier this week with just popups and then the browser got hijacked and the rest is history.


----------



## $teve (Oct 9, 2001)

Dont do anything yet!....and especially *DONT* re-boot your machine.
Im looking in another forum at a similar log,not as bad,but very similar.


----------



## akasha (Jun 23, 2004)

Ok, Will do. I haven't restarted the machine since Wednesday. After I ran the log file I just left it in Safe Mode. Man, this thing got me good.


----------



## $teve (Oct 9, 2001)

While your waiting go here:
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.pandasoftware.com/activescan/
Do a full system scan and allow them to clean anything found.


----------



## akasha (Jun 23, 2004)

Problem is I am at work. I can't download anything on that computer at home. (I can't even open a browser window). In safe mode it doesn't allow me to access the internet. Should I download those things here to a disk and load them tonight?


----------



## ~Candy~ (Jan 27, 2001)

Unfortunately, those are online scans.


----------



## akasha (Jun 23, 2004)

I can't win...


----------



## ~Candy~ (Jan 27, 2001)

I have a question for you. Is there anything important on the machine? If not, you'll have more hair left at the end, at least in my opinion, if you just do a format and reinstall Windows.


----------



## akasha (Jun 23, 2004)

Well, of course I have some files on there I would rather not lose. Can I get those off?


----------



## akasha (Jun 23, 2004)

Am I being given up on LOL?


----------



## ~Candy~ (Jan 27, 2001)

Give up? Us? Never.

Some folks are on different time zones here. 

Let me see if I can reach CyberTech right now, I alerted her to this problem and she had some ideas


----------



## cybertech (Apr 16, 2002)

akasha, Hi ya Candy has requested I assist  Ok just confirm you have not rebooted and the log I see is the latest and greatest.


----------



## akasha (Jun 23, 2004)

Yes, latest and greatest..have not rebooted. It is sitting in safe mode right now.


----------



## cybertech (Apr 16, 2002)

Oh, bummer  Just kidding, I'll post something for you ...


----------



## cybertech (Apr 16, 2002)

akasha, I see you list yourself as "intermediate" ... do you know how to search and sort a directory when you are in Windows Explorer?


----------



## akasha (Jun 23, 2004)

I think I know how to search.."right clicking on the directory (or drive) that I want to search" right?


----------



## TheRealDuckY (Jun 26, 2004)

Hey, Thats quite a messy log. Luckily i specialize in thise hehe .

My name is RubbeR DuckY on SWI. Somebody mentioned your thread and i just had to see this. Please download About:Buster by RubbeR DuckY (thats me go DuckyY! lol) from

http://www.atribune.org/downloads/AboutBuster.zip

Unzip it to your desktop. Reboot into safe mode and run the program. On the first prompt hit Ok. Then hit start and then Ok again. The program should start scanning and removing a hell of a lot of files from your infected computer. After its done scanning Save the report it generates and post it back here. Then in Hijack this tick the boxes next to all 02's that have (Missing File) as the files have been removed. Post the report and a new Hjt log.


----------



## TheRealDuckY (Jun 26, 2004)

Also Information on this program and its updates and fixes*

http://forums.subratam.org/index.php?showtopic=957


----------



## $teve (Oct 9, 2001)

Ducky,thanx for joining us here,ive read some of your threads over at SWI....very informative,also used your Buster a few times with success.Feel free to take a run at this one.It seams to attack 98 in a more vigorous manner.

Just noticed yesterdays update:up:


----------



## ~Candy~ (Jan 27, 2001)

Hey DuckY, welcome aboard, hopefully you'll stay awhile


----------



## Flrman1 (Jul 26, 2002)

Thanks for letting us know about the updates Ducky and welcome to TSG!


----------



## akasha (Jun 23, 2004)

Ok, I will give this a try. I download the file and will unzip it on the infected computer once I get home. I already have the computer in safe mode, can I avoid rebooting it once I have unzipped the file? From what I understand everytime I reboot the computer the problem gets worse and the files change names.

Let me know. Again I appreciate all you guys' help.


----------



## TheRealDuckY (Jun 26, 2004)

Hey, Well thats the problem on every reboot the damn thing mutates. And Ad-Awares removal just agravates it to continue attacking. To clean up the log a little fix the (file missing) entries. You can use any of these methods in safe mode to obtain About:Buster on your computer.

* Download it off of another computer and put it on a floppy then transfer

- I would not suggest surfing the net when you are in safe mode. Doing so can get you a virus without an av so fast...

* Also if you are away from that computer and would like the file e-mail me at TBoY14 at Msn.com. at = @



Also. Before you run About:Buster. Tick the entries next to all those RunServices in Hijack this that are random. And all the bhos that are filemissing or random. That will clean the log up and let About:Buster run. Then you can reboot normally and post a new log and the report from a:b.


----------



## ~Candy~ (Jan 27, 2001)

With 98, can you surf the net in safe mode? I don't think I can


----------



## $teve (Oct 9, 2001)

Popcorn anyone?


----------



## ~Candy~ (Jan 27, 2001)

None here, low carb diet


----------



## TheRealDuckY (Jun 26, 2004)

Ill take some.


Dang i have to optimize this scan a little


----------



## ~Candy~ (Jan 27, 2001)

Well, we all have a front row seat, quivering with anticipation, all we are lacking is the original poster to report back 

By the way, who is the Not So Real DuckY


----------



## $teve (Oct 9, 2001)

I have three more of these on the go,all waiting for the poster.

Tum-tee-tum!


----------



## akasha (Jun 23, 2004)

Hey Guys,
Sorry to keep you guys waiting. I am currently out at a racetrack working. I will be home hopefully about 4ish PST and will try these things. I hope they work 
I will let you know the results ASAP.

BTW - no I can't surf the net in safe mode.


----------



## cybertech (Apr 16, 2002)

This is good news, I didn't think this tool was supposed to be used on W98


----------



## buckaroo (Mar 25, 2001)

cybertech said:


> This is good news, I didn't think this tool was supposed to be used on W98


That was my understanding, or, errr, ummm, misunderstanding, too.


----------



## Flrman1 (Jul 26, 2002)

My question is, how do you stop the service in 9x machines?


----------



## ~Candy~ (Jan 27, 2001)

What service? Does 98 have services? I don't think so


----------



## $teve (Oct 9, 2001)

Ill bump this so it dosent get lost.


----------



## cybertech (Apr 16, 2002)

akasha must still be at the racetrack


----------



## akasha (Jun 23, 2004)

Well guys,

No luck. I ran the About:Blaster and everytime I did, it would give a fatal exception error. Tried again to no avail. Ended up having to reboot the computer, so I am sure it is worse now. Any other ideas? I am at the point that I may just reformat and start over.


----------



## $teve (Oct 9, 2001)

akasha.............dont re-format just yet,i just PM`ed Ducky....he`s the best person for this and we need to see how it works for future reference.
So sit tight if you can please.

Thanx:up:


----------



## akasha (Jun 23, 2004)

Okie Dokie


----------



## Flrman1 (Jul 26, 2002)

Well let's get the ball rolling here by seeing what you're Hjiack This log looks like now. Please post a current HJT log.


----------



## akasha (Jun 23, 2004)

Will have to wait till tomorrow  No way to do that from work.


----------



## ~Candy~ (Jan 27, 2001)

I just noticed you are from Lost Wages, I'm here too


----------



## $teve (Oct 9, 2001)

Have you tried it in safe mode?


----------



## akasha (Jun 23, 2004)

Yep Lost Wages...in all its hell hot glory 

I ran everything in Safe Mode. Can't do anything in Normal Mode.


----------



## akasha (Jun 23, 2004)

Any word from Ducky yet? I will get another HJT log tonight....


----------



## TheRealDuckY (Jun 26, 2004)

Adding an update now. Please wait till tonight. 4:00 pm here. Be done around 6. Update will also re- remove the 04's for a fuller cleanup. Also try a few times in safe mode again. Dunno what this error could be caused by. hmm


----------



## akasha (Jun 23, 2004)

Ok. I ran it a couple times on Saturday and that is when it would give me the "fatal exception error"(s). After the third try I stopped because I didn't want to have to reboot the machine again. Just let me know what you want me to do next. As of right now the computer is sitting in safe mode.

Thanks!


----------



## cybertech (Apr 16, 2002)

I had the error on a W2K device but rebooted and ran it twice more and it was, to date, a success. My error was 5 or 50 ... don't remember


----------



## ~Candy~ (Jan 27, 2001)

cybertech said:


> I had the error on a W2K device but rebooted and ran it twice more and it was, to date, a success. My error was 5 or 50 ... don't remember


What  We don't practice what we preach  Write the error messages down


----------



## Flrman1 (Jul 26, 2002)

AcaCandy said:


> What  We don't practice what we preach  Write the error messages down


*smack*


----------



## ~Candy~ (Jan 27, 2001)

You've been waiting for that, haven't you Mark


----------



## Flrman1 (Jul 26, 2002)

Hehe!


----------



## TheRealDuckY (Jun 26, 2004)

Ok About:Buster has been updated. I hope the errors will go away.


----------



## akasha (Jun 23, 2004)

Hello There.

Ok, last night I was going through the print out of this topic and I must not have seen in Ducky's post to clean up the HJT log before using the about:Buster. So, I removed the BHO's and Runservices that Ducky said to, and then tried the about:Buster again...no luck...fatal exception error. I downloaded the about:Buster file about 5:00pm PST yesterday...did I get the newest version or do you have one better?

I also made a new HJT log after everything yesterday...here it is..again this is after I cleaned up the BHO's and what not..I did not reboot after the fatal exception error, so not sure if this HJT log is even right. Also this is all being done in Safe Mode.

Logfile of HijackThis v1.97.7
Scan saved at 10:33:16 PM, on 06/28/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - (no file)
O2 - BHO: (no name) - {569CB91E-B7BA-A53B-FAE6-02AC70957176} - (no file)
O2 - BHO: SÆR§i½kN0LìÉ×@di - Data - (no file)
O2 - BHO: (no name) - {BEFC335B-6797-430E-0DA7-1985DA8D0CA0} - C:\WINDOWS\SYSTEM\APPBB.DLL
O2 - BHO: (no name) - {8F534F76-94D1-789D-5A3D-063BABD3B7B6} - C:\WINDOWS\ATLIF32.DLL
O2 - BHO: (no name) - {26571DFB-F0E1-4FA0-1226-0FBB11AD977C} - C:\WINDOWS\SYSTEM\IPUR32.DLL
O2 - BHO: (no name) - {3F6D4E24-4321-64A9-0883-66287C5D74EC} - C:\WINDOWS\SYSTEM\SYSRH32.DLL
O2 - BHO: (no name) - {741B8545-C0CC-A2D8-BC3E-791180D4540D} - C:\WINDOWS\SYSTEM\SYSHP.DLL
O2 - BHO: (no name) - {9A9818E8-9D7D-3C58-402D-00B852B4FD1B} - C:\WINDOWS\SYSTEM\SYSAB.DLL
O2 - BHO: (no name) - {2098979F-5F6C-346E-38A3-33881C4292F1} - C:\WINDOWS\SYSTEM\MFCBY.DLL
O2 - BHO: (no name) - {CE6F21E7-0536-EC5D-F3F8-9D6EDC72FCBB} - C:\WINDOWS\SYSTEM\SDKDQ.DLL
O2 - BHO: (no name) - {5843DD82-A389-4A51-4288-89B1D1B9C22B} - C:\WINDOWS\SYSTEM\CRNP.DLL
O2 - BHO: (no name) - {B7850B28-A394-BB11-DC89-B0592CEE7C17} - C:\WINDOWS\SYSTEM\WINPD32.DLL
O2 - BHO: (no name) - {71F6D625-50AB-41C3-B6EC-563B80E121D0} - C:\WINDOWS\SYSTEM\APIXG.DLL
O2 - BHO: (no name) - {1C42788F-CB61-1703-83C3-A5B4CC5D800A} - C:\WINDOWS\SYSTEM\MFCBE.DLL
O2 - BHO: (no name) - {850AC2CD-883E-D3E9-9CBA-6830CC0DA62F} - C:\WINDOWS\SYSTEM\MSZX.DLL
O2 - BHO: (no name) - {734EC21E-6EA1-B2AD-C406-611E0CE95F47} - C:\WINDOWS\SYSTEM\APPMH32.DLL
O2 - BHO: (no name) - {BFBEE69C-9405-CA32-626D-F9CB61DEDFEE} - C:\WINDOWS\SYSTEM\MFCRO32.DLL
O2 - BHO: (no name) - {6D256696-FD51-F1E9-DB11-BB4F8AF267C4} - C:\WINDOWS\SYSTEM\MSYO32.DLL
O2 - BHO: (no name) - {4012ED96-802F-7AC9-B75A-1E8A5464D4AC} - C:\WINDOWS\SYSTEM\APING32.DLL
O2 - BHO: (no name) - {25AEC155-1A3F-6021-34B6-97B5405E8A06} - C:\WINDOWS\SYSTEM\IPPO.DLL
O2 - BHO: (no name) - {400AC210-8A15-E2A5-C53B-EDD257680B40} - C:\WINDOWS\SYSTEM\SDKGL32.DLL
O2 - BHO: (no name) - {3F6C5C2D-913F-483D-B92A-0AA1D6F2F5E5} - C:\WINDOWS\SYSTEM\NTLM.DLL
O2 - BHO: (no name) - {18E88317-F0FD-6EDD-AC34-0FB341D28669} - C:\WINDOWS\SYSTEM\IEGH32.DLL
O2 - BHO: (no name) - {A492B317-DD26-C698-818B-197AC147A872} - C:\WINDOWS\SYSTEM\APISF32.DLL
O2 - BHO: (no name) - {DC8B2B40-3BA9-3774-CC4F-C5FBA5F492D8} - C:\WINDOWS\SYSTEM\MFCCI.DLL
O2 - BHO: (no name) - {77C239BA-5AEC-315B-9B35-29C196DF8255} - C:\WINDOWS\SYSTEM\APPVY32.DLL
O2 - BHO: (no name) - {C67A31CB-FB08-10EF-0404-A97DC623736F} - C:\WINDOWS\SYSTEM\APPBK.DLL
O2 - BHO: (no name) - {391EBDD6-3870-2010-1956-24C67B4A9911} - C:\WINDOWS\SYSTEM\MSSU.DLL
O2 - BHO: (no name) - {831A236D-FCB7-2D82-618C-3F6E9115FBCB} - C:\WINDOWS\SYSTEM\APIBC32.DLL
O2 - BHO: (no name) - {A647B4A2-3D1B-ED77-B290-2C86827F0089} - C:\WINDOWS\SYSTEM\NETTF.DLL
O2 - BHO: (no name) - {1ADC7397-51FF-4FCA-2D49-8E0E4130D831} - C:\WINDOWS\SYSTEM\CRXG.DLL
O2 - BHO: (no name) - {F2D31668-0E17-1202-40F9-389B234B48E9} - C:\WINDOWS\SYSTEM\IPEN.DLL
O2 - BHO: (no name) - {357A8D57-F3CF-8C5F-5649-47A18C3A78B1} - C:\WINDOWS\SYSTEM\JAVAIF32.DLL
O2 - BHO: (no name) - {1D29E35C-2CEB-1C5D-F790-A48A9C394EF2} - C:\WINDOWS\SYSTEM\IEUZ.DLL
O2 - BHO: (no name) - {067B880F-DB35-0DD5-B856-B7C07C2E8FB5} - C:\WINDOWS\SYSTEM\WINOE32.DLL
O2 - BHO: (no name) - {74FCBCF2-483C-D6F3-DABD-BB36D6036740} - C:\WINDOWS\SYSTEM\ADDIB32.DLL
O2 - BHO: (no name) - {9ADF5FEC-10AD-9935-70A8-9DD47AD25683} - C:\WINDOWS\SYSTEM\CRJS.DLL
O2 - BHO: (no name) - {9A5C3A3F-8512-4B05-8DD1-E190DD541F17} - C:\WINDOWS\SYSTEM\APPQY32.DLL
O2 - BHO: (no name) - {535F4D50-1204-8BDF-6CCF-739AAC2FC7EE} - C:\WINDOWS\SYSTEM\WINHR32.DLL
O2 - BHO: (no name) - {8AE894CC-C521-8B5D-5E04-DD2258BE2E9B} - C:\WINDOWS\SYSTEM\ATLZP32.DLL
O2 - BHO: (no name) - {C0209690-DBDA-0E71-33D1-D3B9F9A012CA} - C:\WINDOWS\SYSTEM\MFCDV.DLL
O2 - BHO: (no name) - {714A75BA-793A-AD03-032C-D32FE3D02CDF} - C:\WINDOWS\SYSTEM\SYSHA.DLL
O2 - BHO: (no name) - {6557D814-89DB-DA16-9B4C-C38A0E1F23F2} - C:\WINDOWS\SYSTEM\MFCNY32.DLL
O2 - BHO: (no name) - {5D02935D-E94F-74E3-32D6-84B010E8BBFE} - C:\WINDOWS\SYSTEM\NTMU32.DLL
O2 - BHO: (no name) - {C0F1AE33-153C-4E19-A0B9-7155E429A4F5} - C:\WINDOWS\SYSTEM\WINQU32.DLL
O2 - BHO: (no name) - {07FEE7E2-7D04-D24C-DEDC-3DC5C389B77B} - C:\WINDOWS\APPFI.DLL
O2 - BHO: (no name) - {CBCC2124-1931-5492-EAAF-C5C2E7437596} - C:\WINDOWS\SYSTEM\ADDTA.DLL
O2 - BHO: (no name) - {FFCF604D-210A-9317-A8C5-80208D4AD348} - C:\WINDOWS\ATLKD.DLL
O4 - HKLM\..\Run: [xepjxuta] C:\WINDOWS\SYSTEM\MKQYAKG.EXE
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [APIOQ.EXE] C:\WINDOWS\SYSTEM\APIOQ.EXE
O4 - HKLM\..\Run: [SpyBlocs] C:\PROGRAM FILES\SPYBLOCS\SpyBlocs.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll


----------



## Couriant (Mar 26, 2002)

looks better from the last time I saw...

have you got a spyware preventor program in place like SpywareBlaster? I would recommend S/B to be installed and updated first before tackling the entries I'm putting down.

You also have WebRebates, which is or has been installed by spyware so you will need to get rid of that. Delete the folder C:\Program Files\*WebRebates*

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://hnoob.dll/index.html#26980
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\hnoob.dll/sp.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - (no file)
O2 - BHO: (no name) - {569CB91E-B7BA-A53B-FAE6-02AC70957176} - (no file)
O2 - BHO: SÆR§i½kN0LìÉ×@di - Data - (no file)
O2 - BHO: (no name) - {BEFC335B-6797-430E-0DA7-1985DA8D0CA0} - C:\WINDOWS\SYSTEM\APPBB.DLL
O2 - BHO: (no name) - {8F534F76-94D1-789D-5A3D-063BABD3B7B6} - C:\WINDOWS\ATLIF32.DLL
O2 - BHO: (no name) - {26571DFB-F0E1-4FA0-1226-0FBB11AD977C} - C:\WINDOWS\SYSTEM\IPUR32.DLL
O2 - BHO: (no name) - {3F6D4E24-4321-64A9-0883-66287C5D74EC} - C:\WINDOWS\SYSTEM\SYSRH32.DLL
O2 - BHO: (no name) - {741B8545-C0CC-A2D8-BC3E-791180D4540D} - C:\WINDOWS\SYSTEM\SYSHP.DLL
O2 - BHO: (no name) - {9A9818E8-9D7D-3C58-402D-00B852B4FD1B} - C:\WINDOWS\SYSTEM\SYSAB.DLL
O2 - BHO: (no name) - {2098979F-5F6C-346E-38A3-33881C4292F1} - C:\WINDOWS\SYSTEM\MFCBY.DLL
O2 - BHO: (no name) - {CE6F21E7-0536-EC5D-F3F8-9D6EDC72FCBB} - C:\WINDOWS\SYSTEM\SDKDQ.DLL
O2 - BHO: (no name) - {5843DD82-A389-4A51-4288-89B1D1B9C22B} - C:\WINDOWS\SYSTEM\CRNP.DLL
O2 - BHO: (no name) - {B7850B28-A394-BB11-DC89-B0592CEE7C17} - C:\WINDOWS\SYSTEM\WINPD32.DLL
O2 - BHO: (no name) - {71F6D625-50AB-41C3-B6EC-563B80E121D0} - C:\WINDOWS\SYSTEM\APIXG.DLL
O2 - BHO: (no name) - {1C42788F-CB61-1703-83C3-A5B4CC5D800A} - C:\WINDOWS\SYSTEM\MFCBE.DLL
O2 - BHO: (no name) - {850AC2CD-883E-D3E9-9CBA-6830CC0DA62F} - C:\WINDOWS\SYSTEM\MSZX.DLL
O2 - BHO: (no name) - {734EC21E-6EA1-B2AD-C406-611E0CE95F47} - C:\WINDOWS\SYSTEM\APPMH32.DLL
O2 - BHO: (no name) - {BFBEE69C-9405-CA32-626D-F9CB61DEDFEE} - C:\WINDOWS\SYSTEM\MFCRO32.DLL
O2 - BHO: (no name) - {6D256696-FD51-F1E9-DB11-BB4F8AF267C4} - C:\WINDOWS\SYSTEM\MSYO32.DLL
O2 - BHO: (no name) - {4012ED96-802F-7AC9-B75A-1E8A5464D4AC} - C:\WINDOWS\SYSTEM\APING32.DLL
O2 - BHO: (no name) - {25AEC155-1A3F-6021-34B6-97B5405E8A06} - C:\WINDOWS\SYSTEM\IPPO.DLL
O2 - BHO: (no name) - {400AC210-8A15-E2A5-C53B-EDD257680B40} - C:\WINDOWS\SYSTEM\SDKGL32.DLL
O2 - BHO: (no name) - {3F6C5C2D-913F-483D-B92A-0AA1D6F2F5E5} - C:\WINDOWS\SYSTEM\NTLM.DLL
O2 - BHO: (no name) - {18E88317-F0FD-6EDD-AC34-0FB341D28669} - C:\WINDOWS\SYSTEM\IEGH32.DLL
O2 - BHO: (no name) - {A492B317-DD26-C698-818B-197AC147A872} - C:\WINDOWS\SYSTEM\APISF32.DLL
O2 - BHO: (no name) - {DC8B2B40-3BA9-3774-CC4F-C5FBA5F492D8} - C:\WINDOWS\SYSTEM\MFCCI.DLL
O2 - BHO: (no name) - {77C239BA-5AEC-315B-9B35-29C196DF8255} - C:\WINDOWS\SYSTEM\APPVY32.DLL
O2 - BHO: (no name) - {C67A31CB-FB08-10EF-0404-A97DC623736F} - C:\WINDOWS\SYSTEM\APPBK.DLL
O2 - BHO: (no name) - {391EBDD6-3870-2010-1956-24C67B4A9911} - C:\WINDOWS\SYSTEM\MSSU.DLL
O2 - BHO: (no name) - {831A236D-FCB7-2D82-618C-3F6E9115FBCB} - C:\WINDOWS\SYSTEM\APIBC32.DLL
O2 - BHO: (no name) - {A647B4A2-3D1B-ED77-B290-2C86827F0089} - C:\WINDOWS\SYSTEM\NETTF.DLL
O2 - BHO: (no name) - {1ADC7397-51FF-4FCA-2D49-8E0E4130D831} - C:\WINDOWS\SYSTEM\CRXG.DLL
O2 - BHO: (no name) - {F2D31668-0E17-1202-40F9-389B234B48E9} - C:\WINDOWS\SYSTEM\IPEN.DLL
O2 - BHO: (no name) - {357A8D57-F3CF-8C5F-5649-47A18C3A78B1} - C:\WINDOWS\SYSTEM\JAVAIF32.DLL
O2 - BHO: (no name) - {1D29E35C-2CEB-1C5D-F790-A48A9C394EF2} - C:\WINDOWS\SYSTEM\IEUZ.DLL
O2 - BHO: (no name) - {067B880F-DB35-0DD5-B856-B7C07C2E8FB5} - C:\WINDOWS\SYSTEM\WINOE32.DLL
O2 - BHO: (no name) - {74FCBCF2-483C-D6F3-DABD-BB36D6036740} - C:\WINDOWS\SYSTEM\ADDIB32.DLL
O2 - BHO: (no name) - {9ADF5FEC-10AD-9935-70A8-9DD47AD25683} - C:\WINDOWS\SYSTEM\CRJS.DLL
O2 - BHO: (no name) - {9A5C3A3F-8512-4B05-8DD1-E190DD541F17} - C:\WINDOWS\SYSTEM\APPQY32.DLL
O2 - BHO: (no name) - {535F4D50-1204-8BDF-6CCF-739AAC2FC7EE} - C:\WINDOWS\SYSTEM\WINHR32.DLL
O2 - BHO: (no name) - {8AE894CC-C521-8B5D-5E04-DD2258BE2E9B} - C:\WINDOWS\SYSTEM\ATLZP32.DLL
O2 - BHO: (no name) - {C0209690-DBDA-0E71-33D1-D3B9F9A012CA} - C:\WINDOWS\SYSTEM\MFCDV.DLL
O2 - BHO: (no name) - {714A75BA-793A-AD03-032C-D32FE3D02CDF} - C:\WINDOWS\SYSTEM\SYSHA.DLL
O2 - BHO: (no name) - {6557D814-89DB-DA16-9B4C-C38A0E1F23F2} - C:\WINDOWS\SYSTEM\MFCNY32.DLL
O2 - BHO: (no name) - {5D02935D-E94F-74E3-32D6-84B010E8BBFE} - C:\WINDOWS\SYSTEM\NTMU32.DLL
O2 - BHO: (no name) - {C0F1AE33-153C-4E19-A0B9-7155E429A4F5} - C:\WINDOWS\SYSTEM\WINQU32.DLL
O2 - BHO: (no name) - {07FEE7E2-7D04-D24C-DEDC-3DC5C389B77B} - C:\WINDOWS\APPFI.DLL
O2 - BHO: (no name) - {CBCC2124-1931-5492-EAAF-C5C2E7437596} - C:\WINDOWS\SYSTEM\ADDTA.DLL
O2 - BHO: (no name) - {FFCF604D-210A-9317-A8C5-80208D4AD348} - C:\WINDOWS\ATLKD.DLL
O4 - HKLM\..\Run: [xepjxuta] C:\WINDOWS\SYSTEM\MKQYAKG.EXE
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
O4 - HKLM\..\Run: [APIOQ.EXE] C:\WINDOWS\SYSTEM\APIOQ.EXE
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm

Then delete the DLLs I have listed and also:
hnoob.dll file
sp.html file
kaiqw.dll file
*MKQYAKG.EXE *file
*APIOQ.EXE *file
*P2P Networking* folder


----------



## cybertech (Apr 16, 2002)

I would let TheRealDuckY make the next suggestion since it's his fix that is being used here.


----------



## Couriant (Mar 26, 2002)

point taken:


----------



## TheRealDuckY (Jun 26, 2004)

Hey guys. Great to hear it is getting better. Your log has moved from 3 posts to 1 .

Boot into safe mode by tapping F8 several times when the computer is first booting up. In Hijack This tick the boxes next to all those 02's that are random. 

Then Run the new version of the program a few times until you are clean. Report a new log and the Log of About:Buster.


How you know you have the newest version. The newest version has a close button to help you identify.


----------



## akasha (Jun 23, 2004)

Ok. I will download it again just to be sure. However..last night when I tried to run the buster it gave me the fatal exception error. Should I ignore and try again tonight?

PS. Also, how do I know which 02's are random?


----------



## TheRealDuckY (Jun 26, 2004)

Every 02 Tidus4Yuna listed.

Thanks Tidus4Yuna


----------



## akasha (Jun 23, 2004)

Ok, what about the other files Tidus4Yuna recommended that I get rid of?


----------



## TheRealDuckY (Jun 26, 2004)

Lets just fix the 02 entries for now. Later we'll do the rest.


----------



## akasha (Jun 23, 2004)

Okie Dokie 

Thanks again for your help


----------



## TheRealDuckY (Jun 26, 2004)

Update to version 1.23. Should remove more files. Please download from here.

http://www.atribune.org/downloads/AboutBuster.zip


----------



## akasha (Jun 23, 2004)

Ok. I will give it a try tonight


----------



## akasha (Jun 23, 2004)

Ok. Here is the latest. I tried removing the 02's and running about:Blaster again, no luck. Fatal Exception error 0028:00078CO in VXD VMM (O1).

So I tried what Tidus4Yuna said. Worked to some degree. I am able to boot the computer back up. Ran Norton..found a virus there..removed it. Downloaded Ad Aware. For some reason it locks up when I try to run Ad Aware in Normal mode, so I ran it in Safe Mode. Removed the files. Restarted. When I restart in the MSDos it says somthing to the effect of 
C: (a bunch of jumbled letters and numbers)
Bad Command or File Name.

The it brings up a dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

I think the computer still has something on it. Some files are running in the Startup.

Any other ideas?


----------



## TheRealDuckY (Jun 26, 2004)

Is this happening in buster or Hijack this??? keep running and trying buster.


----------



## ~Candy~ (Jan 27, 2001)

For the VNET error, check your computer name and workgroup name.


----------



## akasha (Jun 23, 2004)

The fatal exception error is happening in about:Buster.

As far as the Vnet error. How would I go about doing that? Would the problem that I had/have screw with the computer name?

Any idea why Ad aware would be locking up, or where the error is coming from in the MSDos prompt when I boot up?


----------



## Couriant (Mar 26, 2002)

removed: didn't see the 6th page of messages...


----------



## ~Candy~ (Jan 27, 2001)

akasha said:


> As far as the Vnet error. How would I go about doing that? Would the problem that I had/have screw with the computer name?


Yes, messing with the computer name would do that. Go to control panel, networking, and try fixing it there.


----------



## akasha (Jun 23, 2004)

Hmm...wierd. I didn't know Spyware could mess with the computer name. I will try what you said to fix it


----------



## Couriant (Mar 26, 2002)

The only thing that is going on is that if you leave the O4 Startup entries it will keep rebooting and reloading the spyware/whatever this pain in the rear is until you delete it. By the sounds of it, this buster program may not be good at all (no offense ducky) for your computer.


----------



## TheRealDuckY (Jun 26, 2004)

Hey Tidus4Yuna none taken. But id like to explain what About:Buster does.

*Not Run in safe mode*

Runs.. When it finds a file it deletes it and its 04.. Or Runservices, Run, and Runonce keys. But this is what happens. If the infection is heavy. The files will notice that other files are missing and reinstall quickly. Thats why.. in normal mode about:buster must be run a few times to make the infection more mild. Then finally removing it.

*Run in safe mode*

Does the same, but, the files do not communicate with each other so the infection is removed completely.

*Also can you please post a new Hijack This log. Thank you.*


----------



## akasha (Jun 23, 2004)

Logfile of HijackThis v1.97.7
Scan saved at 10:23:35 PM, on 06/29/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll


----------



## TheRealDuckY (Jun 26, 2004)

Ok looks like we may nail this thing today. Run About:Buster one more time in safe mode (i think your in safe mode now.) Then restart normally. Open Internet explorer a few times. Post a new Hijack this log.

!!!!!! Looks VERY clean in the log.


----------



## akasha (Jun 23, 2004)

I will try to run it. Everytime I have tried to run it in safe mode I get the fatal exception error and it closes the program. (Right now I am in Normal Mode)

Something is still not right with it though..see below.

For some reason it locks up when I try to run Ad Aware in Normal mode, so I ran it in Safe Mode. Removed the files. Restarted. When I restart in the MSDos it says somthing to the effect of 
C: (a bunch of jumbled letters and numbers)
Bad Command or File Name.

Then it brings up a dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

and one other thing, I installed Norton Anit-virus. I cannot run "LiveUpdate" though. It says I am not connected to the internet, but I am. Any ideas?


----------



## akasha (Jun 23, 2004)

Bueller? Bueller? Anyone?


----------



## ~Candy~ (Jan 27, 2001)

Did you go to the control panel, networking?

If so, you might try to change your sign on to Windows.


----------



## akasha (Jun 23, 2004)

No, I haven't yet. I am at work 

I don't have a sign on for Windows.


----------



## ~Candy~ (Jan 27, 2001)

Do you have a sign on for networking at all


----------



## akasha (Jun 23, 2004)

Nope. That is the wierd thing. I have a box that comes up for a username and password, but I don't enter anything in it.


----------



## akasha (Jun 23, 2004)

Ok. Here is my latest HJT

Logfile of HijackThis v1.97.7
Scan saved at 7:22:57 PM, on 06/30/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SPYBLOCS\SPYBLOCS.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980 ----(This one keeps coming back)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll

When I restart I am still getting these errors

When I restart in the MSDos it says somthing to the effect of 
C:/> (a bunch of jumbled letters and numbers)
Bad Command or File Name.

Then it brings up a Windows Networking dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

Also Ad Aware still won't run in Normal Mode. It locks up after it starts the scan (it works fine in Safe Mode, so I know it is not the program)

and one other thing, I installed Norton Anit-virus. I cannot run "LiveUpdate" though. It says I am not connected to the internet, but I am.

These files are running in the startup
ccapp and qttask

I am also not able to log into hotmail through hotmail.com, when I try to log in it goes to a "page cannot be displayed error".

This website res://kaiqw.dll/index.html#26980 keeps popping up as my home page, even when I remove it. It doesn't go to a page though it goes to a "page cannot be displayed" as well.

Seems something is still not right. Help!!

Any ideas....


----------



## ~Candy~ (Jan 27, 2001)

Start, run, type sysedit and press ok, go to the autoexec.bat and config.sys files and post the contents of each.


----------



## akasha (Jun 23, 2004)

Ok. I will try that.


----------



## akasha (Jun 23, 2004)

Here it is.

autoexec=
SET BLASTER=A220 I7 D1 H7 P330 T6
SET SBPCI=C:\SBPCI
üWÁîjà;zü"àß"íÜK¨
îÅ_ÚðÊ°.ß./ð_¨;Su?âÔ[r_Ñ;ÿþÿÏvmÔ

}LêiH?ÑEPù º¿lÓï¾õÿ"à[âÿ¨×!|°Dþ]+ÿ[email protected]èëæ5ë-!¼7ø°ã§s$yM|»ÛðoµôU
Sýîyûÿÿw¥g?{¡ÛQ¹½áìó%bîf*ÿÿÿÿ+Uü¡qm*»ûøIZ;Ê¦vóÊAûv[èÏ@>;úÿÿÿÿvú¿tk.dÀnÁøÔ;Q½ºE.ydêÒ!T%äÃ½øÿÿo	m[¬LR¿I¾JZ¢µ²ÖìÌF¡_ú7êü93Ü÷	²ù)æÿ%~ÊÖ\/$Jûîß~c[email protected]ïþ_JFN¶ûw» ê.þv	*Øÿïàbß±C$OàìÜ³%Yÿÿÿ·Äex¯Tr³°±TÎHúN ØÕÿ_½§ß¦/}_¢Å·!K»¦¹S]×ÿàÿ2?Øì 	P9tv7{êÿÿÛlW}HC
H±[.yCæþEnÑÿÿÿßTylST-"¶Õ×ðqôò[(´ìËßÁÿÈ(+^êL+àûkrôNÿ

and config.sys=
rem
rem *** DO NOT EDIT THIS FILE! ***
rem
rem This file was created by the System Configuration Utility as
rem a placeholder for your CONFIG.SYS. Your actual CONFIG.SYS
rem file has been saved under the name CONFIG.TSH.
rem

Thanks.


----------



## ~Candy~ (Jan 27, 2001)

Well, that probably explains the first startup garbage error 

Go to start, run, type msconfig, and uncheck the box to process those two files.


----------



## TheRealDuckY (Jun 26, 2004)

Ok it looks like

*Most of the files have been removed by About:Buster
*Most of the entries in Hijack this have also been cleared.
*The hijack is now only using one page (good)


Soon the Hijack probably will die. Follow the directions one post above. Then restart in safe mode and try running about:Buster. Then try in normal mode.

Good job AcaCandy


----------



## akasha (Jun 23, 2004)

Okay, did that. The About Buster program in safe mode got the blue screen of death (fatal exception error) when I ran it. 
Ran it in Normal Mode...this is what I got..
About:Buster Version 1.23
Attempted Clean Of Temp folder.
Pages Reset... Done!

Here is the latest Hijack This file:

Logfile of HijackThis v1.97.7
Scan saved at 1:08:48 PM, on 07/01/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980 (again this keeps coming back)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll
*
Also, unchecked those files in msconfig...problem is still there during restart. 
This time is has REM TSHOOT in front of the jumbled letters.
C:/> rem TShoot (a bunch of jumbled letters and numbers)
Bad Command or File Name.

Then it brings up a Windows Networking dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

Also Ad Aware still won't run in Normal Mode. It locks up after it starts the scan (it works fine in Safe Mode, so I know it is not the program)

another thing, I installed Norton Anit-virus. I cannot run "LiveUpdate" though. It says I am not connected to the internet, but I am.*

*I am also not able to log into hotmail through hotmail.com, when I try to log in it goes to a "page cannot be displayed error". I cannot log onto MSN Messenger...says I have an invalid username and password (which I don't). However, I am able to in Netscape...

I can't download Windows updates because "Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting." The time is fine.*

*This website res://kaiqw.dll/index.html#26980 keeps popping up as my home page, even when I remove it. It doesn't go to a page though it goes to a "page cannot be displayed" as well.*

Frustrated


----------



## akasha (Jun 23, 2004)

Anyone...please???

Is there any other program I can try to remove the remaining problem?


----------



## akasha (Jun 23, 2004)

ttt


----------



## ~Candy~ (Jan 27, 2001)

Patience my dear. DuckY doesn't hang out all day like some of us do. It's best to wait for him, ok?


----------



## Couriant (Mar 26, 2002)

akaska, can you run either Spybot S&D or CWShredder? These are spyware removal tools.


----------



## akasha (Jun 23, 2004)

Tidus4Yuna,

Yes, I can and did..neither of them found anything. Whatever is going is definetly affecting mainly Microsoft things..Like I said I can't access hotmail.com or MSN Messenger through IE, but it works fine in Netscape.


----------



## Couriant (Mar 26, 2002)

there has to be a process running that is blocking you... I will ponder more on that..


----------



## akasha (Jun 23, 2004)

Cool! Thank you very much!!!


----------



## ~Candy~ (Jan 27, 2001)

*Also, unchecked those files in msconfig...problem is still there during restart. 
This time is has REM TSHOOT in front of the jumbled letters.
C:/> rem TShoot (a bunch of jumbled letters and numbers)
Bad Command or File Name.*

You either didn't uncheck BOTH the config.sys and autoexec.bat or you didn't save the changes. Double check......doesn't account for the hotmail problem, but definitely seeing the REM stuff.


----------



## akasha (Jun 23, 2004)

Ok. I will check on that.


----------



## TheRealDuckY (Jun 26, 2004)

The new version of about:buster is out. Errors fixed and scan takes under 10 seconds . After you try the directions above try the new version in safe mode and normal mode.

Good luck, and thanks for being patient.


----------



## $teve (Oct 9, 2001)

Been using it all day Ducky.............good job man:up:


----------



## TheRealDuckY (Jun 26, 2004)

Is it fast enough


----------



## $teve (Oct 9, 2001)

As fast as the poster can post

Its a *BIG* help!
Respect:up:


----------



## akasha (Jun 23, 2004)

Ok. Ran the new About:Buster..here are the results..ran in normal mode. I am going to restart now and see what happens.


About:Buster Version 1.24
Removed! : C:\WINDOWS\System\jehjb.dat
Removed! : C:\WINDOWS\System\wints32.dll
Removed! : C:\WINDOWS\System\lurju.dat
Removed! : C:\WINDOWS\System\gzkww.dat
Removed! : C:\WINDOWS\System\gbkwm.dat
Removed! : C:\WINDOWS\System\hwllv.dat
Removed! : C:\WINDOWS\System\ggecl.dat
Removed! : C:\WINDOWS\System\txysd.dat
Removed! : C:\WINDOWS\System\wmppc.dat
Removed! : C:\WINDOWS\System\vtkva.dat
Removed! : C:\WINDOWS\System\okuro.dat
Removed! : C:\WINDOWS\System\bodek.dat
Removed! : C:\WINDOWS\System\sktis.dat
Removed! : C:\WINDOWS\System\imqcq.dat
Removed! : C:\WINDOWS\System\tctfe.dat
Removed! : C:\WINDOWS\System\wwqxi.dat
Removed! : C:\WINDOWS\System\esnju.dat
Removed! : C:\WINDOWS\System\yabtv.dat
Removed! : C:\WINDOWS\System\hxbmn.dat
Removed! : C:\WINDOWS\System\rzdaz.dat
Removed! : C:\WINDOWS\System\aaxkb.dat
Removed! : C:\WINDOWS\System\cbppg.dat
Removed! : C:\WINDOWS\System\ktzgp.dat
Removed! : C:\WINDOWS\System\cbdtx.dat
Removed! : C:\WINDOWS\System\bqlxc.dat
Removed! : C:\WINDOWS\System\lqntq.dat
Removed! : C:\WINDOWS\System\pbqbu.dat
Removed! : C:\WINDOWS\System\siwak.dat
Removed! : C:\WINDOWS\System\bueam.dat
Removed! : C:\WINDOWS\System\enobv.dat
Removed! : C:\WINDOWS\System\fkrtk.dat
Removed! : C:\WINDOWS\System\otonl.dat
Removed! : C:\WINDOWS\System\mwwus.dat
Removed! : C:\WINDOWS\System\znewb.dat
Removed! : C:\WINDOWS\System\cikrd.dat
Removed! : C:\WINDOWS\System\fhdys.dat
Removed! : C:\WINDOWS\System\bxsui.dat
Removed! : C:\WINDOWS\System\zwwgg.dat
Removed! : C:\WINDOWS\System\aipdt.dat
Removed! : C:\WINDOWS\System\hnuey.dat
Removed! : C:\WINDOWS\System\zzirm.dat
Removed! : C:\WINDOWS\System\gsult.dat
Removed! : C:\WINDOWS\System\josjq.dat
Removed! : C:\WINDOWS\System\uchhm.dat
Removed! : C:\WINDOWS\System\xrpjz.dat
Removed! : C:\WINDOWS\System\pfjtj.dat
Removed! : C:\WINDOWS\System\bcbrd.dat
Removed! : C:\WINDOWS\System\awpvz.dat
Removed! : C:\WINDOWS\System\qskqt.dat
Removed! : C:\WINDOWS\System\pzeoq.dat
Removed! : C:\WINDOWS\System\ztwzi.dat
Removed! : C:\WINDOWS\System\sapon.dat
Removed! : C:\WINDOWS\System\ndblm.dat
Removed! : C:\WINDOWS\System\yihng.dat
Removed! : C:\WINDOWS\System\rbnpr.dat
Removed! : C:\WINDOWS\System\yrkii.dat
Removed! : C:\WINDOWS\System\sflbn.dat
Removed! : C:\WINDOWS\System\primd.dat
Removed! : C:\WINDOWS\System\yfmkb.dat
Removed! : C:\WINDOWS\System\rmfhd.dat
Removed! : C:\WINDOWS\System\kvaze.dat
Removed! : C:\WINDOWS\System\fvyqq.dat
Removed! : C:\WINDOWS\System\mlune.dat
Removed! : C:\WINDOWS\System\lvmun.dat
Removed! : C:\WINDOWS\System\jmnwu.dat
Removed! : C:\WINDOWS\System\ntlgw.dat
Removed! : C:\WINDOWS\System\mgxqa.dat
Removed! : C:\WINDOWS\System\rawsr.dat
Removed! : C:\WINDOWS\System\utefg.dat
Removed! : C:\WINDOWS\System\imcbl.dat
Removed! : C:\WINDOWS\System\osuld.dat
Removed! : C:\WINDOWS\System\yxmww.dat
Removed! : C:\WINDOWS\System\wpeks.dat
Removed! : C:\WINDOWS\System\oxgrd.dat
Removed! : C:\WINDOWS\System\qirny.dat
Removed! : C:\WINDOWS\System\tvnxj.dat
Removed! : C:\WINDOWS\System\tgazr.dat
Removed! : C:\WINDOWS\System\uzgtu.dat
Removed! : C:\WINDOWS\System\yimdc.dat
Removed! : C:\WINDOWS\System\qrtir.dat
Removed! : C:\WINDOWS\System\ezrpa.dat
Removed! : C:\WINDOWS\System\gpudt.dat
Removed! : C:\WINDOWS\System\gvxnu.dat
Removed! : C:\WINDOWS\System\kxtue.dat
Removed! : C:\WINDOWS\System\ohblx.dat
Removed! : C:\WINDOWS\System\nbfjb.dat
Removed! : C:\WINDOWS\System\ricms.dat
Removed! : C:\WINDOWS\System\ozggi.dat
Removed! : C:\WINDOWS\System\ndsah.dat
Removed! : C:\WINDOWS\System\jmauv.dat
Removed! : C:\WINDOWS\System\napuy.dat
Removed! : C:\WINDOWS\System\swkjt.dat
Removed! : C:\WINDOWS\System\mszay.dat
Removed! : C:\WINDOWS\System\vlhxz.dat
Removed! : C:\WINDOWS\System\mzzxx.dat
Removed! : C:\WINDOWS\System\wbkla.dat
Removed! : C:\WINDOWS\System\sfljj.dat
Removed! : C:\WINDOWS\System\cahwa.dat
Removed! : C:\WINDOWS\System\fejln.dat
Removed! : C:\WINDOWS\System\dbrpt.dat
Removed! : C:\WINDOWS\System\gdwkt.dat
Removed! : C:\WINDOWS\System\ahwli.dat
Removed! : C:\WINDOWS\System\aorjy.dat
Removed! : C:\WINDOWS\System\kndub.dat
Removed! : C:\WINDOWS\System\yxtxj.dat
Removed! : C:\WINDOWS\System\cmssb.dat
Removed! : C:\WINDOWS\System\wbibg.dat
Removed! : C:\WINDOWS\System\xupgf.dat
Removed! : C:\WINDOWS\System\spbzi.dat
Removed! : C:\WINDOWS\System\mstvd.dat
Removed! : C:\WINDOWS\System\puqjf.dat
Removed! : C:\WINDOWS\System\pkclo.dat
Removed! : C:\WINDOWS\System\zmlfm.dat
Removed! : C:\WINDOWS\System\hsjqb.dat
Removed! : C:\WINDOWS\System\lvkgd.dat
Removed! : C:\WINDOWS\System\klfmt.dat
Removed! : C:\WINDOWS\System\xtyqc.dat
Removed! : C:\WINDOWS\System\biqwv.dat
Removed! : C:\WINDOWS\System\ktfpp.dat
Removed! : C:\WINDOWS\System\ipezf.dat
Removed! : C:\WINDOWS\System\pelea.dat
Removed! : C:\WINDOWS\System\pxqyk.dat
Removed! : C:\WINDOWS\System\kbytw.dat
Removed! : C:\WINDOWS\System\fqrbk.dat
Removed! : C:\WINDOWS\System\fjwvn.dat
Removed! : C:\WINDOWS\System\avqge.dat
Removed! : C:\WINDOWS\System\gbjua.dat
Removed! : C:\WINDOWS\System\bbumf.dat
Removed! : C:\WINDOWS\System\fousc.dat
Removed! : C:\WINDOWS\System\zbzzv.dat
Removed! : C:\WINDOWS\System\fuldn.dat
Removed! : C:\WINDOWS\System\wcgut.dat
Removed! : C:\WINDOWS\System\aletf.dat
Removed! : C:\WINDOWS\System\nhgbo.dat
Removed! : C:\WINDOWS\System\rrdqr.dat
Removed! : C:\WINDOWS\System\yhznf.dat
Removed! : C:\WINDOWS\System\jcgzh.dat
Removed! : C:\WINDOWS\System\cxcyc.dat
Removed! : C:\WINDOWS\System\nqjtw.dat
Removed! : C:\WINDOWS\System\sinxr.dat
Removed! : C:\WINDOWS\System\xiyjm.dat
Removed! : C:\WINDOWS\System\yrzyi.dat
Removed! : C:\WINDOWS\System\hvsqf.dat
Removed! : C:\WINDOWS\System\ebloa.dat
Removed! : C:\WINDOWS\System\siwek.dat
Removed! : C:\WINDOWS\System\bjebk.dat
Removed! : C:\WINDOWS\System\ttgbe.dat
Removed! : C:\WINDOWS\System\gnzbx.dat
Removed! : C:\WINDOWS\System\bmply.dat
Removed! : C:\WINDOWS\System\atcjo.dat
Removed! : C:\WINDOWS\System\mwtok.dat
Removed! : C:\WINDOWS\System\xzwkr.dat
Removed! : C:\WINDOWS\System\hacip.dat
Removed! : C:\WINDOWS\System\siuux.dat
Removed! : C:\WINDOWS\System\bontc.dat
Removed! : C:\WINDOWS\System\fawcb.dat
Removed! : C:\WINDOWS\System\gegzo.dat
Removed! : C:\WINDOWS\System\uxlzt.dat
Removed! : C:\WINDOWS\System\isetm.dat
Removed! : C:\WINDOWS\System\rthkp.dat
Removed! : C:\WINDOWS\System\tjqwp.dat
Removed! : C:\WINDOWS\System\zguet.dat
Removed! : C:\WINDOWS\System\gxgcp.dat
Removed! : C:\WINDOWS\System\tbzpl.dat
Removed! : C:\WINDOWS\System\kyazn.dat
Removed! : C:\WINDOWS\System\icjya.dat
Removed! : C:\WINDOWS\System\nyxju.dat
Removed! : C:\WINDOWS\System\inqda.dat
Removed! : C:\WINDOWS\System\iclii.dat
Removed! : C:\WINDOWS\System\tbntc.dat
Removed! : C:\WINDOWS\System\wzmvg.dat
Removed! : C:\WINDOWS\System\nfzxq.dat
Removed! : C:\WINDOWS\System\ogjxr.dat
Removed! : C:\WINDOWS\System\ncmdq.dat
Removed! : C:\WINDOWS\System\tpdfx.dat
Removed! : C:\WINDOWS\System\uqnfi.dat
Removed! : C:\WINDOWS\System\subku.dat
Removed! : C:\WINDOWS\System\uxuyp.dat
Removed! : C:\WINDOWS\System\mklzt.dat
Removed! : C:\WINDOWS\System\wcpgw.dat
Removed! : C:\WINDOWS\System\anpsv.dat
Removed! : C:\WINDOWS\System\jmpwk.dat
Removed! : C:\WINDOWS\System\czmnc.dat
Removed! : C:\WINDOWS\System\dcwjp.dat
Removed! : C:\WINDOWS\System\wvfsp.dat
Removed! : C:\WINDOWS\System\tkpth.dat
Removed! : C:\WINDOWS\System\ueeqw.dat
Removed! : C:\WINDOWS\System\qtmey.dat
Removed! : C:\WINDOWS\System\dhuhc.dat
Removed! : C:\WINDOWS\System\rmrgi.dat
Removed! : C:\WINDOWS\System\sckjq.dat
Removed! : C:\WINDOWS\System\hoosg.dat
Removed! : C:\WINDOWS\System\qrrnd.dat
Removed! : C:\WINDOWS\System\jxmxy.dat
Removed! : C:\WINDOWS\System\gjuaa.dat
Removed! : C:\WINDOWS\System\dqnud.dat
Removed! : C:\WINDOWS\System\fmzqr.dat
Removed! : C:\WINDOWS\System\kawul.dat
Removed! : C:\WINDOWS\System\uecgk.dat
Removed! : C:\WINDOWS\System\xgtwt.dat
Removed! : C:\WINDOWS\System\gcqrj.dat
Removed! : C:\WINDOWS\System\bintj.dat
Removed! : C:\WINDOWS\System\qaqkc.dat
Removed! : C:\WINDOWS\System\ehpfd.dat
Removed! : C:\WINDOWS\System\knptv.dat
Removed! : C:\WINDOWS\System\mmdgi.dat
Removed! : C:\WINDOWS\System\rhtbz.dat
Removed! : C:\WINDOWS\System\jxmfu.dat
Removed! : C:\WINDOWS\System\odcwb.dat
Removed! : C:\WINDOWS\System\yqxkn.dat
Removed! : C:\WINDOWS\System\dkrlm.dat
Removed! : C:\WINDOWS\System\tziog.dat
Removed! : C:\WINDOWS\System\nnjig.dat
Removed! : C:\WINDOWS\System\yefza.dat
Removed! : C:\WINDOWS\System\dyiwa.dat
Removed! : C:\WINDOWS\System\yxnls.dat
Removed! : C:\WINDOWS\System\mubwo.dat
Removed! : C:\WINDOWS\System\vahyu.dat
Removed! : C:\WINDOWS\System\bpwbm.dat
Removed! : C:\WINDOWS\System\itmtt.dat
Removed! : C:\WINDOWS\System\zqemx.dat
Removed! : C:\WINDOWS\System\mzlof.dat
Removed! : C:\WINDOWS\System\dsoyz.dat
Removed! : C:\WINDOWS\System\fuedo.dat
Removed! : C:\WINDOWS\System\btdkn.dat
Removed! : C:\WINDOWS\System\ertht.dat
Removed! : C:\WINDOWS\System\txujq.dat
Removed! : C:\WINDOWS\System\rbwtt.dat
Removed! : C:\WINDOWS\System\dgpuj.dat
Removed! : C:\WINDOWS\System\bucym.dat
Removed! : C:\WINDOWS\System\vqaxj.dat
Removed! : C:\WINDOWS\System\sxvth.dat
Removed! : C:\WINDOWS\System\fnuwt.dat
Removed! : C:\WINDOWS\System\hflfk.dat
Removed! : C:\WINDOWS\System\oefkm.dat
Removed! : C:\WINDOWS\System\zdlmb.dat
Removed! : C:\WINDOWS\System\yllxm.dat
Removed! : C:\WINDOWS\System\gdjmy.dat
Removed! : C:\WINDOWS\System\pmohu.dat
Removed! : C:\WINDOWS\System\ggyor.dat
Removed! : C:\WINDOWS\System\rblyk.dat
Removed! : C:\WINDOWS\System\pzols.dat
Removed! : C:\WINDOWS\System\agejn.dat
Removed! : C:\WINDOWS\System\ynupy.dat
Removed! : C:\WINDOWS\System\lqnny.dat
Removed! : C:\WINDOWS\System\pufwa.dat
Removed! : C:\WINDOWS\System\mlblv.dat
Removed! : C:\WINDOWS\System\ohzcs.dat
Removed! : C:\WINDOWS\System\nhfop.dat
Removed! : C:\WINDOWS\System\lgdrk.dat
Removed! : C:\WINDOWS\System\bemgb.dat
Removed! : C:\WINDOWS\System\vftpx.dat
Removed! : C:\WINDOWS\System\sfpwd.dat
Removed! : C:\WINDOWS\System\qmfth.dat
Removed! : C:\WINDOWS\System\gtinp.dat
Removed! : C:\WINDOWS\System\havpf.dat
Removed! : C:\WINDOWS\System\zrdee.dat
Removed! : C:\WINDOWS\System\xobyx.dat
Removed! : C:\WINDOWS\System\ligxv.dat
Removed! : C:\WINDOWS\System\tnjkh.dat
Removed! : C:\WINDOWS\System\bndnn.dat
Removed! : C:\WINDOWS\System\csffu.dat
Removed! : C:\WINDOWS\System\zaxsf.dat
Removed! : C:\WINDOWS\System\uzlkx.dat
Removed! : C:\WINDOWS\System\fplss.dat
Removed! : C:\WINDOWS\System\gdjrb.dat
Removed! : C:\WINDOWS\System\gdgvp.dat
Removed! : C:\WINDOWS\System\vqyjz.dat
Removed! : C:\WINDOWS\System\noatj.dat
Removed! : C:\WINDOWS\System\kqdra.dat
Removed! : C:\WINDOWS\System\joqwx.dat
Removed! : C:\WINDOWS\System\zhqkq.dat
Removed! : C:\WINDOWS\System\twtok.dat
Removed! : C:\WINDOWS\System\sdnqs.dat
Removed! : C:\WINDOWS\System\gltxp.dat
Removed! : C:\WINDOWS\System\ekuob.dat
Removed! : C:\WINDOWS\System\kaipr.dat
Removed! : C:\WINDOWS\System\dhrtt.dat
Removed! : C:\WINDOWS\System\oohkq.dat
Removed! : C:\WINDOWS\System\kcftc.dat
Removed! : C:\WINDOWS\System\bxfbn.dat
Removed! : C:\WINDOWS\System\ohqnn.dat
Removed! : C:\WINDOWS\System\fnnln.dat
Removed! : C:\WINDOWS\System\tcvuz.dat
Removed! : C:\WINDOWS\System\xjehr.dat
Removed! : C:\WINDOWS\System\dzimb.dat
Removed! : C:\WINDOWS\System\cbitn.dat
Removed! : C:\WINDOWS\System\vlrqf.dat
Removed! : C:\WINDOWS\System\qlplg.dat
Removed! : C:\WINDOWS\System\nvquh.dat
Removed! : C:\WINDOWS\System\zzvpu.dat
Removed! : C:\WINDOWS\System\rtizl.dat
Removed! : C:\WINDOWS\System\rtiao.dat
Removed! : C:\WINDOWS\System\jzysy.dat
Removed! : C:\WINDOWS\System\qsikk.dat
Removed! : C:\WINDOWS\System\ktmfa.dat
Removed! : C:\WINDOWS\System\vpwou.dat
Removed! : C:\WINDOWS\System\kyyla.dat
Removed! : C:\WINDOWS\System\fmcei.dat
Removed! : C:\WINDOWS\System\ihhde.dat
Removed! : C:\WINDOWS\System\ghowr.dat
Removed! : C:\WINDOWS\System\fwezf.dat
Removed! : C:\WINDOWS\System\wamwq.dat
Removed! : C:\WINDOWS\System\qtpsy.dat
Removed! : C:\WINDOWS\System\dtzij.dat
Removed! : C:\WINDOWS\System\ifkvw.dat
Removed! : C:\WINDOWS\System\eufna.dat
Removed! : C:\WINDOWS\System\qipwj.dat
Removed! : C:\WINDOWS\System\miaqq.dat
Removed! : C:\WINDOWS\System\kailu.dat
Removed! : C:\WINDOWS\System\rfmuz.dat
Removed! : C:\WINDOWS\System\pjkbh.dat
Removed! : C:\WINDOWS\System\rmvyu.dat
Removed! : C:\WINDOWS\System\drkab.dat
Removed! : C:\WINDOWS\System\jgiao.dat
Removed! : C:\WINDOWS\System\pgewz.dat
Removed! : C:\WINDOWS\System\jhdfn.dat
Removed! : C:\WINDOWS\System\mwldf.dat
Removed! : C:\WINDOWS\System\orjuc.dat
Removed! : C:\WINDOWS\System\arexy.dat
Removed! : C:\WINDOWS\System\osozb.dat
Removed! : C:\WINDOWS\System\ybglc.dat
Removed! : C:\WINDOWS\System\arhlp.dat
Removed! : C:\WINDOWS\System\ccput.dat
Removed! : C:\WINDOWS\System\zyidc.dat
Removed! : C:\WINDOWS\System\qxiom.dat
Removed! : C:\WINDOWS\System\yzlte.dat
Removed! : C:\WINDOWS\System\sozwt.dat
Removed! : C:\WINDOWS\System\uvrai.dat
Removed! : C:\WINDOWS\System\zeoxd.dat
Removed! : C:\WINDOWS\System\zdrww.dat
Removed! : C:\WINDOWS\System\igyey.dat
Removed! : C:\WINDOWS\System\lfpyg.dat
Removed! : C:\WINDOWS\System\zvucj.dat
Removed! : C:\WINDOWS\System\aztkk.dat
Removed! : C:\WINDOWS\System\qjkyk.dat
Removed! : C:\WINDOWS\System\cvpqv.dat
Removed! : C:\WINDOWS\System\wmggr.dat
Removed! : C:\WINDOWS\System\fnkig.dat
Removed! : C:\WINDOWS\System\lkatt.dat
Removed! : C:\WINDOWS\System\xmsfx.dat
Removed! : C:\WINDOWS\System\mittc.dat
Removed! : C:\WINDOWS\System\wibxy.dat
Removed! : C:\WINDOWS\System\oecea.dat
Removed! : C:\WINDOWS\System\lqqfl.dat
Removed! : C:\WINDOWS\System\ntbby.dat
Removed! : C:\WINDOWS\System\camni.dat
Removed! : C:\WINDOWS\System\yawiw.dat
Removed! : C:\WINDOWS\System\cjfcr.dat
Removed! : C:\WINDOWS\System\qezdk.dat
Removed! : C:\WINDOWS\System\sflge.dat
Removed! : C:\WINDOWS\System\kzpxy.dat
Removed! : C:\WINDOWS\System\voiqe.dat
Removed! : C:\WINDOWS\System\shssx.dat
Removed! : C:\WINDOWS\System\kxihg.dat
Removed! : C:\WINDOWS\System\tjnut.dat
Removed! : C:\WINDOWS\System\swuyu.dat
Removed! : C:\WINDOWS\System\vqdsc.dat
Removed! : C:\WINDOWS\System\lpvgl.dat
Removed! : C:\WINDOWS\System\adyiz.dat
Removed! : C:\WINDOWS\System\ungvq.dat
Removed! : C:\WINDOWS\System\fktfj.dat
Removed! : C:\WINDOWS\System\qyigh.dat
Removed! : C:\WINDOWS\System\bzjhx.dat
Removed! : C:\WINDOWS\System\vqgvp.dat
Removed! : C:\WINDOWS\System\cnnjk.dat
Removed! : C:\WINDOWS\System\lxeoh.dat
Removed! : C:\WINDOWS\System\lrqxo.dat
Removed! : C:\WINDOWS\System\czhuj.dat
Removed! : C:\WINDOWS\System\knbpv.dat
Removed! : C:\WINDOWS\System\fsbee.dat
Removed! : C:\WINDOWS\System\vvbqh.dat
Removed! : C:\WINDOWS\System\zhoum.dat
Removed! : C:\WINDOWS\System\jykss.dat
Removed! : C:\WINDOWS\System\rnlcv.dat
Removed! : C:\WINDOWS\System\hamfx.dat
Removed! : C:\WINDOWS\System\ossfx.dat
Removed! : C:\WINDOWS\System\rziah.dat
Removed! : C:\WINDOWS\System\bdfbj.dat
Removed! : C:\WINDOWS\System\cbldj.dat
Removed! : C:\WINDOWS\System\opjqk.dat
Removed! : C:\WINDOWS\System\kcmcu.dat
Removed! : C:\WINDOWS\System\amyag.dat
Removed! : C:\WINDOWS\System\vsyjx.dat
Removed! : C:\WINDOWS\System\tpqxt.dat
Removed! : C:\WINDOWS\System\tjjat.dat
Removed! : C:\WINDOWS\System\zfrme.dat
Removed! : C:\WINDOWS\System\fncxf.dat
Removed! : C:\WINDOWS\System\bdjxd.dat
Removed! : C:\WINDOWS\System\scktg.dat
Removed! : C:\WINDOWS\System\wjvxt.dat
Removed! : C:\WINDOWS\System\dgqce.dat
Removed! : C:\WINDOWS\System\cnvwj.dat
Removed! : C:\WINDOWS\System\qatzj.dat
Removed! : C:\WINDOWS\System\ilwuy.dat
Removed! : C:\WINDOWS\System\myjut.dat
Removed! : C:\WINDOWS\System\yqeqc.dat
Removed! : C:\WINDOWS\System\ybiad.dat
Removed! : C:\WINDOWS\System\zoipm.dat
Removed! : C:\WINDOWS\System\pezeg.dat
Removed! : C:\WINDOWS\System\tliqq.dat
Removed! : C:\WINDOWS\System\nyagd.dat
Removed! : C:\WINDOWS\System\xwvxe.dat
Removed! : C:\WINDOWS\System\ocluf.dat
Removed! : C:\WINDOWS\System\csepx.dat
Removed! : C:\WINDOWS\System\oxjkk.dat
Removed! : C:\WINDOWS\System\kvzxc.dat
Removed! : C:\WINDOWS\System\sqynh.dat
Removed! : C:\WINDOWS\System\kmkec.dat
Removed! : C:\WINDOWS\System\qqmge.dat
Removed! : C:\WINDOWS\System\frufi.dat
Removed! : C:\WINDOWS\System\jvlkn.dat
Removed! : C:\WINDOWS\System\fwrcm.dat
Removed! : C:\WINDOWS\System\jyced.dat
Attempted Clean Of Temp folder.
Pages Reset... Done!


----------



## akasha (Jun 23, 2004)

Ok. Restarted. Here is the latest HJT log..

Logfile of HijackThis v1.97.7
Scan saved at 2:38:49 PM, on 07/03/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\LOADQM.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll

I am still having these problems..

Then it brings up a Windows Networking dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

Ad Aware still won't run in Normal Mode. It locks up after it starts the scan (it works fine in Safe Mode, so I know it is not the program) - It always locks up when scanning C:\Windows\System\DDHELP.EXE

Norton Anit-virus - I cannot run "LiveUpdate" though. It says I am not connected to the internet, but I am.

I am also not able to log into hotmail through hotmail.com, when I try to log in it goes to a "page cannot be displayed error". Seems any websites that I have to login to I cannot log onto MSN Messenger...says I have an invalid username and password (which I don't). However, I am able to in Netscape...

I can't download Windows updates because "Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting." The time is fine.


----------



## TheRealDuckY (Jun 26, 2004)

Ok looks like the Cws is gone .

Try reinstalling Internet Explorer 6.


----------



## ~Candy~ (Jan 27, 2001)

akasha said:


> I can't download Windows updates because "Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting." The time is fine.


Check the year, I had that happen to me once


----------



## akasha (Jun 23, 2004)

The year on the date is fine. I will try reinstalling IE6


----------



## akasha (Jun 23, 2004)

Ok reinstalled IE6..no luck..

Still having these problems...

Then it brings up a Windows Networking dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

Ad Aware still won't run in Normal Mode. It locks up after it starts the scan (it works fine in Safe Mode, so I know it is not the program) - It always locks up when scanning C:\Windows\System\DDHELP.EXE

Norton Anit-virus - I cannot run "LiveUpdate" though. It says I am not connected to the internet, but I am.

I am also not able to log into hotmail through hotmail.com, when I try to log in it goes to a "page cannot be displayed error". Seems any websites that I have to login to I cannot log onto MSN Messenger...says I have an invalid username and password (which I don't). However, I am able to in Netscape...

I can't download Windows updates because "Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting." The time is fine.


----------



## ~Candy~ (Jan 27, 2001)

What part of Vegas are you in?


----------



## Flrman1 (Jul 26, 2002)

AcaCandy said:


> What part of Vegas are you in?


The dry sandy part!


----------



## ~Candy~ (Jan 27, 2001)

Lol, I think that would be on the way to California  Where hopefully all these idiots who are tying up traffice will be headed tomorrow


----------



## akasha (Jun 23, 2004)

North Las Vegas


----------



## ~Candy~ (Jan 27, 2001)

Was just out that way this a.m. to the swap meet


----------



## $teve (Oct 9, 2001)

A chat room are we in now?


----------



## akasha (Jun 23, 2004)

Making a little headway..I installed AVG Virus Scanner and it found quite a few infected files. I took care of them so here is the latest and greatest problems. I am finally able to run Ad Aware in Normal Mode.

Then it brings up a Windows Networking dialog box that says
"The following error occured while loading the device VNETSUP
Error 6101: The string specified by the COMPUTERNAME keyword in the registry was not found"

This one is driving me crazy!! I don't understand it...
I am also not able to log into hotmail through hotmail.com, when I try to log in it goes to a "page cannot be displayed error". Seems any websites that I have to login to I cannot log onto MSN Messenger...says I have an invalid username and password (which I don't). However, I am able to in Netscape...

I can't download Windows updates because "Windows Update has encountered an error. This may be due to a discrepancy in your computer's time setting." The time is fine. Checked many times...

Help?


----------



## ~Candy~ (Jan 27, 2001)

Click the Start button, point to Settings, then click Control Panel. 
Double-click the Network icon, then click the Identification tab. 
Make sure the Computer Name and Workgroup entries are present and valid.


----------



## akasha (Jun 23, 2004)

Ok, that helpled 900%!!

Able to do everything that I wasn't before...

However..it's back!! 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980

Newest HJT Log.

Logfile of HijackThis v1.97.7
Scan saved at 5:05:26 PM, on 07/04/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SpyBlocs] C:\PROGRAM FILES\SPYBLOCS\SpyBlocs.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o
O4 - HKLM\..\RunOnce: [RegTLib] c:\windows\RegTLib.exe c:\windows\SYSTEM\StdOle2.Tlb
O4 - HKLM\..\RunOnce: [Registering xenroll.dll..] c:\windows\SYSTEM\regsvr32 /s xenroll.dll
O4 - HKLM\..\RunOnce: [Registering hhctrl.ocx..] c:\windows\SYSTEM\regsvr32 /s hhctrl.ocx
O4 - HKLM\..\RunOnce: [Registering itircl.dll..] c:\windows\SYSTEM\regsvr32 /s itircl.dll
O4 - HKLM\..\RunOnce: [Registering itss.dll..] c:\windows\SYSTEM\regsvr32 /s itss.dll
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll

I ran Ad Aware before running HJT and posting this..


----------



## ~Candy~ (Jan 27, 2001)

Ok, well my work here is finished  *whew* I knew we could kill those two errors  Thought I was going to have to drive out to your neck of the woods yet tonight 

Back to either DuckY or the other log gurus


----------



## ~Candy~ (Jan 27, 2001)

Oops, one thing I notice here, you aren't running scanregistry. That is a lifesaver. Go to start, run, type msconfig and hit ok, go to the startup tab and check scanregistry and systray. If you see any load power profiles, you should probably check those too.

You might wait until the end though to do that


----------



## akasha (Jun 23, 2004)

Thank you so much for your help!!

It's the wierdest thing. I haven't done anything..and I ran HJT, and now it's gone..

Logfile of HijackThis v1.97.7
Scan saved at 5:14:32 PM, on 07/04/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\PROGRAM FILES\GRISOFT\AVG6\AVGW.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [SpyBlocs] C:\PROGRAM FILES\SPYBLOCS\SpyBlocs.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunOnce: [GrpConv] grpconv.exe -o
O4 - HKLM\..\RunOnce: [RegTLib] c:\windows\RegTLib.exe c:\windows\SYSTEM\StdOle2.Tlb
O4 - HKLM\..\RunOnce: [Registering xenroll.dll..] c:\windows\SYSTEM\regsvr32 /s xenroll.dll
O4 - HKLM\..\RunOnce: [Registering hhctrl.ocx..] c:\windows\SYSTEM\regsvr32 /s hhctrl.ocx
O4 - HKLM\..\RunOnce: [Registering itircl.dll..] c:\windows\SYSTEM\regsvr32 /s itircl.dll
O4 - HKLM\..\RunOnce: [Registering itss.dll..] c:\windows\SYSTEM\regsvr32 /s itss.dll
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll

Don't get it.


----------



## ~Candy~ (Jan 27, 2001)

Don't reboot yet. Wait for the log gurus. Rebooting may bring it back.


----------



## akasha (Jun 23, 2004)

Ok. I won't. I noticed a PGate Basic in my add/remove programs. I looked it up on google and found a way to remove it out of the registry. I did that and now it is gone out of my add/remove programs...just an FYI.


----------



## akasha (Jun 23, 2004)

ttt


----------



## Couriant (Mar 26, 2002)

I'm curious to find out where these came from:

O4 - HKLM\..\RunOnce: [Registering xenroll.dll..] c:\windows\SYSTEM\regsvr32 /s xenroll.dll
O4 - HKLM\..\RunOnce: [Registering hhctrl.ocx..] c:\windows\SYSTEM\regsvr32 /s hhctrl.ocx
O4 - HKLM\..\RunOnce: [Registering itircl.dll..] c:\windows\SYSTEM\regsvr32 /s itircl.dll
O4 - HKLM\..\RunOnce: [Registering itss.dll..] c:\windows\SYSTEM\regsvr32 /s itss.dll


----------



## akasha (Jun 23, 2004)

Not sure. I downloaded and installed Windows Update, but haven't restarted the computer since then. Could that be it?


----------



## Couriant (Mar 26, 2002)

I can't say, I never seen that in the startup before. 

AcaCandy, do you know what this is: WINOA386.MOD


----------



## ~Candy~ (Jan 27, 2001)

http://www.liutilities.com/products/wintaskspro/processlibrary/winoa386/


----------



## Flrman1 (Jul 26, 2002)

These are all there because you haven't restarted since doing the updates:

O4 - HKLM\..\RunOnce: [Registering xenroll.dll..] c:\windows\SYSTEM\regsvr32 /s xenroll.dll
O4 - HKLM\..\RunOnce: [Registering hhctrl.ocx..] c:\windows\SYSTEM\regsvr32 /s hhctrl.ocx
O4 - HKLM\..\RunOnce: [Registering itircl.dll..] c:\windows\SYSTEM\regsvr32 /s itircl.dll
O4 - HKLM\..\RunOnce: [Registering itss.dll..] c:\windows\SYSTEM\regsvr32 /s itss.dll

Those dlls are waiting to be regitered once you restart.


----------



## ~Candy~ (Jan 27, 2001)

Thanks Mark, I told her not to restart until someone said to


----------



## Flrman1 (Jul 26, 2002)

:up:


----------



## akasha (Jun 23, 2004)

Ok, so am I all clean now, or do I have this WINOA386.MOD?


----------



## buckaroo (Mar 25, 2001)

I've been following this thread from page 1.

I would reboot and post a new HJT log.


----------



## Couriant (Mar 26, 2002)

Something DuckY said that has got me thinking... If we did this in safe mode, that will stop the files from starting right, so if we remove them in safe mode it will no longer mutate?


----------



## akasha (Jun 23, 2004)

"If you see any load power profiles, you should probably check those too."

I saw two of them and checked them...that is ok right? Going to restart and see what happens.


----------



## akasha (Jun 23, 2004)

Ok restarted...here is the latest HJT file...looks like something is back.
This is now my homepage again.
res://kaiqw.dll/index.html#26980

Logfile of HijackThis v1.97.7
Scan saved at 5:46:34 PM, on 07/06/2004
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://kaiqw.dll/index.html#26980
N3 - Netscape 7: user_pref("browser.startup.homepage","www.google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\qxys6g8x.slt\prefs.js)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .asp: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npdsplay.dll
O12 - Plugin for .WAV: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npaudio.dll


----------



## akasha (Jun 23, 2004)

ttt


----------



## TheRealDuckY (Jun 26, 2004)

Yello,

Your almost there  only 11 pages :-/ ... lol
Ok reboot into safe mode.. But first download the new version of About:Buster. (1.25)

www.downloads.subratam.org/AboutBuster.zip

Same directions as always.

Start it, hit Ok, Start, And Ok again to start the scan. It will generate a log. Post that log here.

Then reboot into normal mode. Lets see if that wraps it up.


----------



## akasha (Jun 23, 2004)

Ok. Did all of that...didn't find anything. However, my homepage is back to normal. It seems to do this alot. Changes then changes back without anything being fixed.

About:Buster Version 1.25
Attempted Clean Of Temp folder.
Pages Reset... Done!


----------



## akasha (Jun 23, 2004)

ttt


----------



## Couriant (Mar 26, 2002)

Take a look at this:

http://forums.techguy.org/t246140.html

I wish I had time to figure something out for this smeggy problem, but I don't have that nor the knowledge of these beasts.  But I will try to help as much as I can


----------



## akasha (Jun 23, 2004)

Should I try this?
http://forums.techguy.org/t246140.html


----------



## Couriant (Mar 26, 2002)

if anyone I would trust, it's Flrman1.


----------



## akasha (Jun 23, 2004)

So, is that what I have? That is the thing, I still have no idea what my computer has, so I am just going off what people on here tell me to do. Some direction?

Thanks!


----------



## Couriant (Mar 26, 2002)

this is a bad variant of CWS that we've seen and it's morphing everytime we fix it. We are trying to figure out how to fix it. The link I gave you may be long, but it may fix your issue. I will try to look at it soon.


----------

