Hijack This log.. what to delete?

Question

When I try to run msconfig, it stays on for about, a second then dissappears. I searched around and discovered Hijack This. I used it, deleted some things and still have the problem.

What should I delete out of this:

Logfile of HijackThis v1.99.1
Scan saved at 3:31:34 PM, on 2/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\GDIEPXOY.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows ServeAd\WinServAd.exe
C:\Program Files\Windows FormatAd\WinForm.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows ServeAd\WinServSuit.exe
C:\Program Files\Windows FormatAd\WinFormKeep.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AIM95\aim.exe
C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AOL Messenger] GDIEPXOY.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe
O4 - HKLM\..\Run: [Windows FormatAd] C:\Program Files\Windows FormatAd\WinForm.exe
O4 - HKLM\..\RunServices: [AOL Messenger] aolmsngr.exe
O4 - HKCU\..\RunOnce: [AOL Messenger] GDIEPXOY.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

Thank you.

Graham.Berndt · Answer

C:\Program Files\Windows ServeAd\WinServAd.exe

C:\Program Files\Windows ServeAd\WinServSuit.exe

O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe

these three should go. also, run Ad-Aware in safe mode

ska is dead · Answer

I can only from   O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll   down, what should I do about the other two?

ska is dead · Answer

delete^*

Midnight Star · Answer

ska is dead,

There one more entry that concerns me, that I didn't include in this solution. We'll check that out, on the next pass.

-

Let's see what we can do...

Go to www.trendmicro.com, and then:

1. Click " Free Online Scan".
2. Click " Scan now, it's free".

It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:

1. Select all available drives.
2. Check(tick) " Auto Clean".
3. Click " Scan".

When it completes, post back the full filename of any files that cannot be cleaned or deleted.

Go to Add/Remove programs and remove(uninstall) the following, if present:

Windows ServAd
Windows FormatAd

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"

-

Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

C:\WINDOWS\system32\GDIEPXOY.EXE
C:\Program Files\Windows ServeAd\WinServAd.exe
C:\Program Files\Windows FormatAd\WinForm.exe
C:\Program Files\Windows ServeAd\WinServSuit.exe
C:\Program Files\Windows FormatAd\WinFormKeep.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Before we begin, let's move HiJackThis to it's own folder; like c:\HJT. When we're done ' cleaning' off your system, we're going to ' flush' the temporary folders which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.

Also move the " Backups" folder, for HiJackThis, if present.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O4 - HKLM\..\Run: [AOL Messenger] GDIEPXOY.EXE
O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe
O4 - HKLM\..\Run: [Windows FormatAd] C:\Program Files\Windows FormatAd\WinForm.exe
O4 - HKCU\..\RunOnce: [AOL Messenger] GDIEPXOY.EXE

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\Windows ServeAd
C:\Program Files\Windows FormatAd

files...

C:\WINDOWS\system32\GDIEPXOY.EXE

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Post back a new log, and let me know how everything goes.

-

Mike.

ska is dead · Answer

That was extremely helpful, msconfig works now, thanks a bunch man. Oh, and if you still want the log:

Logfile of HijackThis v1.99.1
Scan saved at 2:14:22 PM, on 2/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [AOL Messenger] aolmsngr.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

Midnight Star · Answer

ska is dead,

Your welcome!

-

Let's fix this entry, then move on to the next scan...

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O4 - HKLM\..\RunServices: [AOL Messenger] aolmsngr.exe

Now, with all windows closed except HiJackThis, click "Fix checked".

Download mwav.exe from MicroWorld, then:

1. Double-click the mwav.exe icon to run it (it'll self extract).
2. Click "Scan".
3. When it completes, post back the results from the 'Virus log information' pane.

Mike.

ska is dead · Answer

This is almost embarassing to post.. freakin' 34 infected files:   File C:\WINDOWS\system32\GDIEPXOY.EXE infected by 'Backdoor.Win32.Spyboter.gen' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\GDIEPXOY.EXE infected by 'Backdoor.Win32.Spyboter.gen' Virus. Action Taken: No Action Taken. File C:\WINDOWS\zeta.exe infected by 'not-a-virus:AdWare.BargainBuddy.n' Virus. Action Taken: No Action Taken. File C:\WINDOWS\2_0_1browserhelper2.dll.tcf infected by 'Trojan-Clicker.Win32.Delf.r' Virus. Action Taken: No Action Taken. File C:\WINDOWS\ahadp.exe infected by 'not-a-virus:AdWare.BargainBuddy.n' Virus. Action Taken: No Action Taken. File C:\WINDOWS\dlmax.dll infected by 'not-a-virus:AdWare.BiSpy.t' Virus. Action Taken: No Action Taken. File C:\WINDOWS\farmmext.exe infected by 'Trojan-Downloader.Win32.Stubby.c' Virus. Action Taken: No Action Taken. File C:\WINDOWS\mxTarget.dll infected by 'not-a-virus:AdWare.BiSpy.o' Virus. Action Taken: No Action Taken. File C:\WINDOWS\preInsTT.exe infected by 'not-a-virus:AdWare.BiSpy.f' Virus. Action Taken: No Action Taken. File C:\WINDOWS\systb.exe infected by 'not-a-virus:AdWare.ToolBar.ImiBar.d' Virus. Action Taken: No Action Taken. File C:\WINDOWS\winlogon.exe.tcf infected by 'Trojan-Clicker.Win32.XMedia.g' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\angelex.exe infected by 'not-a-virus:AdWare.BargainBuddy.n' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\apuc.dll infected by 'not-a-virus:AdWare.BargainBuddy.j' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ctwshau.exe infected by 'Trojan-Downloader.Win32.Agent.ae' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe infected by 'not-a-virus:AdWare.BargainBuddy.q' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul1.exe infected by 'not-a-virus:AdWare.BargainBuddy.q' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken. File C:\WINDOWS\system32\javexulm.vxd infected by 'not-a-virus:AdWare.BargainBuddy.q' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32
etut80ex.vxd infected by 'not-a-virus:AdWare.BargainBuddy.q' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32andreco.exe infected by 'not-a-virus:AdWare.BetterInternet' Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32	rkgif.exe infected by 'Trojan-Clicker.Win32.VB.ex' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\BHO001.DLL.dat infected by 'not-a-virus:AdWare.IGetNet.b' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\cd_clint.dll infected by 'not-a-virus:AdWare.Cydoor' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\DelD.tmp infected by 'not-a-virus:AdWare.180Solutions' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\DrTemp\wupdsnff.exe infected by 'not-a-virus:AdWare.BetterInternet' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\DSORLTS1\stats[1].htm infected by 'Exploit.HTML.Mht' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SD6FG1YJ\ar3[1].jar infected by 'Trojan.Java.ClassLoader.k' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI1181.tmp\dlmax.dll infected by 'not-a-virus:AdWare.BiSpy.t' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI2EC3.tmp	waintec.dll infected by 'not-a-virus:AdWare.BiSpy.f' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI2F8E.tmp	waintec.dll infected by 'not-a-virus:AdWare.BiSpy.f' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI3555.tmp	waintec.dll infected by 'not-a-virus:AdWare.BiSpy.f' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI65EE.tmp\mxTarget.dll infected by 'not-a-virus:AdWare.BiSpy.o' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI65EE.tmp\preInsMt.exe infected by 'not-a-virus:AdWare.BiSpy.q' Virus. Action Taken: No Action Taken. File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI6900.tmp\farmmext.exe infected by 'Trojan-Downloader.Win32.Stubby.c' Virus. Action Taken: No Action Taken.

Midnight Star · Answer

ska is dead, That not too bad ... :) - Let's delete these files, then post back a new HiJackThis log, and if we're still in the green, we'll just need to do the final cleanup and you should be good to go. The other files, not included in this post, should be permanently delete when we do the final cleanup. Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders: files... C:\WINDOWS\system32\GDIEPXOY.EXE C:\WINDOWS\zeta.exe C:\WINDOWS\2_0_1browserhelper2.dll.tcf C:\WINDOWS\ahadp.exe C:\WINDOWS\dlmax.dll C:\WINDOWS\farmmext.exe C:\WINDOWS\mxTarget.dll C:\WINDOWS\preInsTT.exe C:\WINDOWS\systb.exe C:\WINDOWS\winlogon.exe.tcf C:\WINDOWS\system32\angelex.exe C:\WINDOWS\system32\apuc.dll C:\WINDOWS\system32\ctwshau.exe C:\WINDOWS\system32\exul.exe C:\WINDOWS\system32\exul1.exe C:\WINDOWS\system32\javexulm.vxd C:\WINDOWS\system32
etut80ex.vxd C:\WINDOWS\system32andreco.exe C:\WINDOWS\system32	rkgif.exe - Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from ' Safe Mode'. Mike. Message Edited by Midnight Star on 02-28-2005 07:37 PM

ska is dead · Answer

Enjoy.

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Messenger] GDIEPXOY.EXE
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKCU\..\RunOnce: [AOL Messenger] GDIEPXOY.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

Midnight Star · Answer

ska is dead,

Let's fix these item(s), then verify that they're no longer present on your harddrive, and if everything is running ok, we should be ready for the final cleanup.

-

The header for HiJackThis is very important: It helps to determine what steps might need to be taken to better secure your system, and provide more efficient cleanup procedures. For example, some files, which on standard on one platform, may indicate a virus or trojan on another. So, be sure to include this information with any future posts.

If you haven't ran HouseCall lately, let's go back to www.trendmicro.com, download the latest definitions, and run it.

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [AOL Messenger] GDIEPXOY.EXE
O4 - HKCU\..\RunOnce: [AOL Messenger] GDIEPXOY.EXE

Now, with all windows closed except HiJackThis, click " Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

Search for...

GDIEPXOY.EXE

...using " Start | Search...".

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Post back a new log, and let me know how everything goes.

-

Mike.

ska is dead · Answer

Here you are:

Logfile of HijackThis v1.99.1
Scan saved at 2:59:04 PM, on 3/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (file missing)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

Midnight Star · Answer

ska is dead,

Let's fix this one entry, and we should be ready for the final cleanup...

Run HiJackThis and click " Scan", then check(tick) the following, if present:

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Now, with all windows closed except HiJackThis, click " Fix checked".

Reboot your computer, and try using different programs and make sure everything is running ok. If your still experiencing problems, post back any concerns or problems you may be having and wait for any advice before continuing with the cleanup.

Download, install and run Cleanup! from Steven Gould, then:

1. Click " Cleanup!"

( wait for the program to finish scanning your system, and selecting files to be removed.)

2. Exit the program and reboot the computer, if necessary.

-

For more information about using Cleanup! see here.

If everything is running ok, let's do the final cleanup...

1. Run " Disk Cleanup" and allow it to remove everything it finds.

2. If you've downloaded MicroWorld AV ( MWAV), run it again - but don't scan, just click " Clear Log" and exit the program.

3. Go to www.trendmicro.com and click " Free Online Scan", then " Scan now, it's free!". When it's downloaded, select all available drives, then check(tick) " Auto clean", then click " Scan".

4. Run AdAware SE Personal and " perform a full system scan", then Spybot S&D, and " Check for Problems". Let them both remove the residual 'problems' left that HiJackThis couldn't fix.

5. Disable, then re-enable system restore; with a reboot in-between. Then immediately create a new system point manually.

If your having any more problems, post back.

-

Happy surfing,

Mike.

ska is dead · Answer

I did another WMAV scan and this is what I got (not as bad as last time):

File C:\WINDOWS\glazgp.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

File C:\WINDOWS\system32\gdiepxoy.exe infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\BHO001.DLL.dat infected by "not-a-virus:AdWare.IGetNet.b" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\cd_clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Del2.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\DelD.tmp infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\DrTemp\wupdsnff.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\DSORLTS1\stats[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SD6FG1YJ\ar3[1].jar infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI1181.tmp\dlmax.dll infected by "not-a-virus:AdWare.BiSpy.t" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI2EC3.tmp\twaintec.dll infected by "not-a-virus:AdWare.BiSpy.f" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI2F8E.tmp\twaintec.dll infected by "not-a-virus:AdWare.BiSpy.f" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI3555.tmp\twaintec.dll infected by "not-a-virus:AdWare.BiSpy.f" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI65EE.tmp\mxTarget.dll infected by "not-a-virus:AdWare.BiSpy.o" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI65EE.tmp\preInsMt.exe infected by "not-a-virus:AdWare.BiSpy.q" Virus. Action Taken: No Action Taken.

File C:\DOCUME~1\KEVIN\LOCALS~1\Temp\THI6900.tmp\farmmext.exe infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.

How do I delete them, just locate them?

Midnight Star · Answer

Ska,

Let's start off by manually deleting these two files, then see if Cleanup! and/or "Disk Cleanup" can remove the others location in a 'temp' folder. You might want to try running both from safe mode.

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

files...

C:\WINDOWS\glazgp.exe
C:\WINDOWS\system32\gdiepxoy.exe

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".

Mike.

ska is dead · Answer

Ok, now the only thing that appears in WMAV is

File C:\WINDOWS\system32\GDIEPXOY.EXE infected by "Backdoor.Win32.Spyboter.gen" Virus. Action Taken: No Action Taken.

Why won't this GDIEPXOY go away?

Virus & Spyware

Hijack This log.. what to delete?

Was this post helpful?