adware/spyware

Question

I have unistalled 1 of these programs(WebRebates) but it keeps getting reinstalled.  Another one(Web Savings from Ebates) will not allow me to uninstall.  How did I get these and what do I do about them.  I am using Trend Micro's Pc-cillin for anit virus.  Should I use another program to combat this problem in addtion to regular anti-virus software? My computer is running sooooo slow.  I have defragmented the hard drive, run a virus scan, and keep uninstallin the same adware programs.  I get a message.'Could not execute main:the system cannot find the file specified. Do I need to format my hard drive??? PLEASE HELP!!! Thanks!!

cghost · Answer

Check out texruss' pinned topic at the top of the page. Download and run hijackthis and post a log for review. Regards.

gregandtammy · Answer

My Hijack log....Please help!!! ile of HijackThis v1.98.0Scan saved at 9:57:38 AM, on 7/17/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Trend Micro\Internet Security\Tmntsrv.exeC:\Program Files\Trend Micro\Internet Security	mproxy.exeC:\Program Files\Trend Micro\Internet Security\PccPfw.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Logitech\iTouch\iTouch.exeC:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Internet Optimizer\optimize.exeC:\Program Files\MSN Apps\Updater\01.02.0001.1004\en-us\msnappau.exeC:\Program Files\Trend Micro\Internet Security\pccguide.exeC:\Program Files\Trend Micro\Internet Security\PCClient.exeC:\Program Files\Trend Micro\Internet Security\TMOAgent.exeC:\Program Files\Save\Save.exeC:\Program Files\Web_Rebates\WebRebates0.exeC:\WINDOWS\system32	bctray.exeC:\Program Files\VVSN\VVSN.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\AIM\aim.exeC:\Documents and Settings\Alexandria\Application Data	tuh.exeC:\WINDOWS\System32\otxvgpj.exeC:\Program Files\Linksys\WUSB11 v25 Config Utility\WUSB11Cfg.exeC:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exeC:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeC:\Program Files\Internet Optimizer\actalert.exeC:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exeC:\WINDOWS\System32\hpoipm07.exeC:\Program Files\Web_Rebates\WebRebates1.exeC:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exeC:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\Alexandria\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS
em219.dll (file missing)O2 - BHO: TwaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS	waintec.dllO2 - BHO: (no name) - {5ED6467A-DB77-4AA6-8727-625508D57D6D} - C:\WINDOWS\System32\jmnkz.dllO2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem300.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0001.1004\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0001.1004\en-us\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0001.1004\en-us\msntb.dllO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [DeadAIM] rundll32.exe 'C:\PROGRA~1\AIM\DeadAIM.ocm',ExportedCheckODLsO4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [rzybzqz] C:\WINDOWS\System32\evxuznr.exeO4 - HKLM\..\Run: [Internet Optimizer] 'C:\Program Files\Internet Optimizer\optimize.exe'O4 - HKLM\..\Run: [msnappau] 'C:\Program Files\MSN Apps\Updater\01.02.0001.1004\en-us\msnappau.exe'O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exeO4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security\pccguide.exe'O4 - HKLM\..\Run: [PCClient.exe] 'C:\Program Files\Trend Micro\Internet Security\PCClient.exe'O4 - HKLM\..\Run: [TM Outbreak Agent] 'C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe' /runO4 - HKLM\..\Run: [WhenUSave] 'C:\Program Files\Save\Save.exe'O4 - HKLM\..\Run: [WebRebates0] 'C:\Program Files\Web_Rebates\WebRebates0.exe'O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exeO4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32	bctray.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Alexandria\Application Data	tuh.exeO4 - HKCU\..\Run: [Dcd] C:\WINDOWS\System32\otxvgpj.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Instant Wireless Configuration Utility.lnk = ?O4 - Global Startup: HPAiODevice(hp psc 900 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exeO4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htmO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} (F1 Organizer Class) - http://www.addictivetechnologies.net/DM0/cab/fpmat78.cabO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cabO16 - DPF: {59D04288-805E-4D43-BE09-83B1083E9E1E} (IUpdateAutoLaunch Control) - http://idenphones.motorola.com/idenupdate/nextel/iUpdateAutoLaunch.ocxO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cabO16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.roings.com/cabs/budicon.cabO16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

cghost · Answer

Hi,   I was just looking through my account stuff and saw you posted a reply which I missed. The log you posted has a lot of issues in it and I would have to do a lot of research. If you are still in need of help to fix your computer if you go to this site and post a log:   http://forum.malwareremoval.com/viewforum.php?f=11&sid=d358435f2869570d94b3bfeba275a855   You will get quicker and better help than I can offer you.   Regards. cg

Virus & Spyware

Was this post helpful?