Error messages - HJT log included

Question

I keep getting this error message when I start up my computer.  A wild-tangent something seems to be missing.  Beside that, I get some kind of error message as the computer shuts down, but it shuts down faster than I can read it.  It ends with a dll though.  Also...I had to uninstall and reinstall Spybot...and...it just recently said Error during check!: Winpup32 (Ungültiger Datentyp für '')   Logfile of HijackThis v1.97.7 Scan saved at 11:20:52 PM, on 11/15/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)   Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Nhksrv.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Toolbar\TBPSSvc.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Common Files\WinTools\WToolsS.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\DELLMMKB.EXE C:\PROGRA~1\NORTON~1
avapw32.exe C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Messenger Plus! 2\MsgPlus.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\WINDOWS\system32\ltmsg.exe C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe C:\PROGRA~1\Toolbar\TBPS.exe C:\WINDOWS\system32\P2P Networking\P2P Networking.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\WinTools\WSup.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\PROGRA~1\Toolbar\PIB.exe C:\Program Files\Netropa\OSD.exe C:\Program Files\America Online 7.0\waol.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Documents and Settings\Cam\Spybot - Search & Destroy\SpybotSD.exe C:\Program Files\AIM\aim.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\GhostSurf\GhostSurf.exe C:\HJT\hijackthis\HijackThis.exe   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.seekerbar.com/ie.aspx?tb_id=50154 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154 R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Documents and Settings\Cam\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar	oolbar.dll O2 - BHO: (no name) - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\system32\IETie.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_5_0.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar	oolbar.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exe O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe' O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe 'C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll',cdaEngineMain O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet O4 - HKCU\..\Run: [MessengerPlus2] 'C:\Program Files\Messenger Plus! 2\MsgPlus.exe' /WinStart O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [H/PC Connection Agent] 'C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE' O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: Allow personal info to reach this site - file://C:\Program Files\GhostSurf\info.allow.html O8 - Extra context menu item: Allow popups on this site - file://C:\Program Files\GhostSurf\popup.allow.html O8 - Extra context menu item: Allow this advertisement - file://C:\Program Files\GhostSurf\menu.allowimg.html O8 - Extra context menu item: Block personal info from this site - file://C:\Program Files\GhostSurf\info.block.html O8 - Extra context menu item: Block popups on this site - file://C:\Program Files\GhostSurf\popup.block.html O8 - Extra context menu item: Block this advertisement - file://C:\Program Files\GhostSurf\menu.blockimg.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Create Mobile Favorite (HKLM) O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: GhostSurf Privacy Center (HKLM) O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O9 - Extra button: WeatherBug (HKCU) O15 - Trusted Zone: *.musicmatch.com O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38111.1200810185 O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9BDC6DF4-0FB6-4424-A874-2079449DF4E4}: NameServer = 205.188.146.146   I have no idea what half of this s--t is.

jamez kann · Answer

Hi

A) please download the latest hijackthis Download from SpywareInfo or from Majorgeeks (your hijackthis version should be 1.9.82)

B)Do any 2 Online scans TrendMicro Panda RAV Kaspersky McAfee Bit Defender Symantec

eTrust AV web scanner http://virusscan.jotti.dhs.org/ and let us know what they find. use the clean options when you do the scan.

C) UpdateSpybot

D) Download Ad-aware SE Personal 1.05

E). Download CWShredder

F) Start Windows in Safe Mode by pressing F8 as the computer is booting and choosing Safe Mode, then Turn off System Restore for Windows ME and Windows XP.How to Boot to Safe mode How to Disable System Restore

G) Open My Computer and choose Tools, then click on Folder Options, click on the View tab and under Advanced Setting, choose Show Hidden Files and Folders, then click on OK and close My Computer. In Windows XP/2000, you may also want to uncheck the options for "Hide extensions for known file types" and "hide protected operating system files". How to Show Hidden Files and Folders

H) Run spybot,adaware and cwshredder in safe mode

AdAware SE Tutorial by H@ns

Tutorial - How to remove CoolWebSearch with CWShredder

I) Reboot into normal mode and repost your hijackthis log

Other Hijackthis help forums

1) Net-integration.net (Official Spybot help forum) 2) Lavasoftsupport.com (Official Adaware help forum) 3) BleepingComputers 4) Maddoktor2.com 5) Spywarewarrior.com 6)subratam.org 7) tomcoyote.org 8)Besttechie 9) GeekstoGo 10) ComputerCops 11) GladiatorAntivirus 12) Amazingtechs 13) Mickeytheman.com 14) Thatcomputerguy.us 15) windowsforum.org

Maverick001 · Answer

The new HJT doesn't want to work...it keeps malfunctioning.

Texruss · Answer

Hey Maverick! Been a while since I saw you last...you held them at bay for a long time, but the bugs have invaded now for sure. *;-) Well, the log you gave is six weeks old...but if you still have those things you have been limping along pretty badly for a long time.

Fix some of these things and then download the new 1.99 HJT version below for your next log:

http://www.richardthelionhearted.com/~merijn/

First:

Download and run Norton's tool to expunge Huntbar (Wintools):

http://securityresponse.symantec.com/avcenter/FxHuntbr.exe

Reboot.

Next: Run Hijackthis and fix check these items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.seekerbar.com/ie.aspx?tb_id=50154
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
Comments: Morpheus-owned domain

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:7212
Comments: If you don't run a proxy server remove this entry

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
Comments: Morpheus-owned domain

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
Comments: security risk http://www.winpatrol.com/db/freesample/mybar.html

O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
Comments: WT is not my favorite... http://www.dslreports.com/shownews/39958

O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
Comments: KeenValue adware http://computercops.biz/startuplist-4747.html

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
Comments: Optional remove...resource hog
O9 - Extra button: WeatherBug (HKCU)
Comments: if it's the free version it will have adware

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
Comments: SpywareBlaster pegs this one as malware

Reboot to Safe Mode and using Windows Explorer delete these folders:

C:\Program Files\MyWay
C:\Program Files\WildTangent
C:\Program Files\Common files\SearchUpgrader

Empty the Recycle Bin and reboot into regular mode Windows.

Reboot in normal mode Windows and download this freeware cleanup program which works much better than Windows Disk Cleanup:

http://cleanup.stevengould.org/

Run it and clean all temporary files and prefetch files. Don't give up on it when it stalls on a file...it will pick back up after a couple of minutes. Wait until it asks to log off to clean remaining files. I have seen this program run for hours on machines really loaded down with temp files. After the first time, run it daily to keep your machine riunning well.

Next...download and run these two programs (Spybot S&D and Adaware) at the link below. Use Spybot first.

Most of the Internet baddies can be killed by a one-two punch with Spybot and Adaware assuming these three factors are achieved:

1. Latest version
2. Configured correctly for running options
3. New definitions from update feature

Please download the latest Adaware which is called SE edition and Spybot 1.3. Graphic tutorials at:

http://russelltexas.com/malware/spybot13/spybot13.htm

http://russelltexas.com/malware/adawarese/adawarese.htm

Follow the directions for proper use of those excellent products. BTW...the German message you saw after running Spybot was a buggy definition update.

Next, reboot a final time and browse a bit, exit IE 6 and post a new Hijackthis log in this thread.

HTH,

Texruss

Virus & Spyware

Error messages - HJT log included

Was this post helpful?