new hijack this log (with first 4 lines)

Question

I've run spybot s&d, spy blaster, spy sweeper, cw shredder to no avail. Thanks for the help!!   Logfile of HijackThis v1.98.2 Scan saved at 10:26:37 AM, on 12/4/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\WPWWPO.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXE C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXE C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE C:\PROGRAM FILES\PESTPATROL\PPCONTROL.EXE C:\PROGRAM FILES\PESTPATROL\PPMEMCHECK.EXE C:\PROGRAM FILES\PESTPATROL\COOKIEPATROL.EXE C:\WINDOWS\TEMP\FXW.EXE C:\WINDOWS\SYSTEM\KALVMUE32.EXE C:\WINDOWS\SYSTEM\CTFMON.EXE C:\PROGRAM FILES\2WIRE WIRELESS\CLIENT MANAGER\CMTWO.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\YAHOO!\BROWSER\YBROWSER.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\MY DOCUMENTS\HJT\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe' O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXE O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot O4 - HKLM\..\Run: [QuickTime Task] 'C:\WINDOWS\SYSTEM\QTTASK.EXE' -atboottime O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [FXW] C:\WINDOWS\TEMP\FXW.EXE O4 - HKLM\..\Run: [kalvsys] C:\WINDOWS\SYSTEM\KALVMUE32.EXE O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wpwwpo.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup O4 - HKCU\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE' /0 O4 - Startup: 2Wire Wireless Client Manager.lnk = C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXE O4 - Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exe O4 - Startup: hkhhkp.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL O9 - Extra button: Dell Home - {DE9F7D9E-71AE-44E3-8DE5-D741FBFD7B86} - http://www.dellnet.com/ (file missing) (HKCU) O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS
ppdf32.dll O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://ips-inc.webex.com/client/latest/webex/ieatgpc.cab O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=MEDIAGEN

Midnight Star · Answer

okiebub,

Ok, let's try this next and see what it can clean off. Let me know if you have any success with this:

Go to www.trendmicro.com and click "Free Online Scan". This will take a few minutes to download and install, trust me (especially on dialup). When it's down, select all available drives, then click "Scan".

Then post back a new log.

If your not able to get the only scan to run, post back and we'll see if we can get enough of that off to allow AdAware to run.

Mike.

Midnight Star · Answer

okiebub,

There quite a few problems in there. Let's see if AdAware SE can cleanup most of that for us.

When that's done, we'll still need to see a new log afterwards, to make sure all the problems have been 'cleaned' off.

Go ahead and do as James suggested, and download, intall and run AdAware SE Personal, if you don't already have it. then:

Click "Check for updates now"
then "Connect"
then "Ok"
then "Finish"
then click "Start"
check(tick) "perform a full system scan"
then click "Next"

Next, download the VX2 cleaner from this page, and follow the instructions.

Post back a new log.

Mike.

Message Edited by Midnight Star on 12-04-2004 11:09 AM

okiebub · Answer

AdAware will not run. I installed it, but it encounters an error every time I try to launch it (AdAware has caused an error in . Ad-aware  will now close. It's been doing this for months...

okiebub · Answer

Still no luck. I'm also trying to install NIS 2004, but it won't launch.

Midnight Star · Answer

okiebub, Try booting up into 'Safe mode', then installing Norton's. When it asks you to 'scan before installation', select 'Yes'. If your able to download files, download the following and wait until I post back: LSPFix I'll be getting to your log shortly. Mike.

okiebub · Answer

Still no luck, but I ran CW Shredder & Spy Sweeper again... Here's a new hjt log   Logfile of HijackThis v1.98.2Scan saved at 6:33:38 PM, on 12/4/2004Platform: Windows ME (Win9x 4.90.3000)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\WINDOWS\SYSTEM\STIMON.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\RESTORE\STMGR.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\WPWWPO.EXEC:\WINDOWS\RUNDLL32.EXEC:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXEC:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXEC:\PROGRAM FILES\2WIRE\2PORTALMON.EXEC:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXEC:\WINDOWS\SYSTEM\QTTASK.EXEC:\PROGRAM FILES\PESTPATROL\PPCONTROL.EXEC:\PROGRAM FILES\PESTPATROL\PPMEMCHECK.EXEC:\PROGRAM FILES\PESTPATROL\COOKIEPATROL.EXEC:\WINDOWS\TEMP\FXW.EXEC:\WINDOWS\SYSTEM\KALVMUE32.EXEC:\WINDOWS\SYSTEM\CTFMON.EXEC:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\PROGRAM FILES\2WIRE WIRELESS\CLIENT MANAGER\CMTWO.EXEC:\WINDOWS\SYSTEM\DDHELP.EXEC:\MY DOCUMENTS\HJT\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1O1 - Hosts: 69.20.16.183 auto.search.msn.comO1 - Hosts: 69.20.16.183 search.netscape.comO1 - Hosts: 69.20.16.183 ieautosearchO4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exeO4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe'O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXEO4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorunO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [QuickTime Task] 'C:\WINDOWS\SYSTEM\QTTASK.EXE' -atboottimeO4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exeO4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exeO4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exeO4 - HKLM\..\Run: [FXW] C:\WINDOWS\TEMP\FXW.EXEO4 - HKLM\..\Run: [kalvsys] C:\WINDOWS\SYSTEM\KALVMUE32.EXEO4 - HKLM\..\Run: [Narrator] C:\WINDOWS\wpwwpo.exeO4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exeO4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXEO4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exeO4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startupO4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startupO4 - HKCU\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE' /0O4 - HKCU\..\RunServices: [ctfmon.exe] ctfmon.exeO4 - HKCU\..\RunServices: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startupO4 - HKCU\..\RunServices: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startupO4 - HKCU\..\RunServices: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE' /0O4 - Startup: 2Wire Wireless Client Manager.lnk = C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXEO4 - Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exeO4 - Startup: hkhhkp.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLLO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLLO9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLLO9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLLO9 - Extra button: Dell Home - {DE9F7D9E-71AE-44E3-8DE5-D741FBFD7B86} - http://www.dellnet.com/ (file missing) (HKCU)O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dllO12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dllO12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS
ppdf32.dllO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://ips-inc.webex.com/client/latest/webex/ieatgpc.cabO16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dllO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cabO16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=MEDIAGENO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

Midnight Star · Answer

okiebub,

Ok, let see what we can do...

First, download and run the Virtumondo removal tool from Symantec, and follow the instructions on that page.

Reboot your computer into "Safe Mode"

Next, run LSPFix, then:

Check(tick) "I know what i'm doing"
Then click on(highlight) each occurance of winlspak.dll. Then click ">>" to move them over to the "Remove" pane.
(Double check and make sure that only winlspak.dll is in the "Remove" pane, and nothing else.)
Click "Finished >>"

Check "Windows Task Manager" and 'stop' or 'end' the following processes if running:

WPWWPO.EXE
FXW.EXE
KALVMUE32.EXE
hkhhkp.exe

Next, run HiJackThis and check(tick) the following entry(s), if present:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

O4 - HKLM\..\Run: [FXW] C:\WINDOWS\TEMP\FXW.EXE
O4 - HKLM\..\Run: [kalvsys] C:\WINDOWS\SYSTEM\KALVMUE32.EXE
O4 - Startup: hkhhkp.exe

O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\winlspak.dll

Now, with all windows closed except HiJackThis, click "Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

files...

c:\windows\system\winlspak.dll
C:\WINDOWS\WPWWPO.EXE
C:\WINDOWS\TEMP\FXW.EXE
C:\WINDOWS\SYSTEM\KALVMUE32.EXE

Run " Disk Cleanup" and allow it to remove anything that it finds.

Reboot your computer.

Post back a new log.

Mike.

Edits: Added " Safe Mode" link.

Message Edited by Midnight Star on 12-04-2004 08:37 PM

okiebub · Answer

Despite  following all of these directions, some of the files continue to return. When I try to use HJT to delete ...search.netscape.com I get a Visual C++ error that closes HJT. Also, there are several files in Windows Explorer that look suspicious (KALVEW32.EXE, KALVOLE.EXE, KRNL382.EXE). btw, thanks SOOOO much for your help.   Logfile of HijackThis v1.98.2Scan saved at 4:31:56 PM, on 12/5/2004Platform: Windows ME (Win9x 4.90.3000)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\MPREXE.EXEC:\WINDOWS\SYSTEM\STIMON.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\RUNDLL32.EXEC:\WINDOWS\SYSTEM\RESTORE\STMGR.EXEC:\PROGRAM FILES\YAHOO!\BROWSER\YBRWICON.EXEC:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMON32.EXEC:\PROGRAM FILES\2WIRE\2PORTALMON.EXEC:\PROGRAM FILES\YAHOO!\BROWSER\YCOMMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXEC:\WINDOWS\SYSTEM\QTTASK.EXEC:\PROGRAM FILES\PESTPATROL\PPCONTROL.EXEC:\PROGRAM FILES\PESTPATROL\PPMEMCHECK.EXEC:\PROGRAM FILES\PESTPATROL\COOKIEPATROL.EXEC:\WINDOWS\SYSTEM\CTFMON.EXEC:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXEC:\WINDOWS\SYSTEM\DDHELP.EXEC:\PROGRAM FILES\2WIRE WIRELESS\CLIENT MANAGER\CMTWO.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\PROGRAM FILES\YAHOO!\BROWSER\YBROWSER.EXEC:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXEC:\MY DOCUMENTS\HJT\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dslR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1O1 - Hosts: 69.20.16.183 auto.search.msn.comO1 - Hosts: 69.20.16.183 search.netscape.comO1 - Hosts: 69.20.16.183 ieautosearchO4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exeO4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\PROGRAM FILES\SBC YAHOO!\CONNECTION MANAGER\IP INSIGHT\IPMon32.exe'O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\2PORTALMON.EXEO4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorunO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [QuickTime Task] 'C:\WINDOWS\SYSTEM\QTTASK.EXE' -atboottimeO4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exeO4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exeO4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exeO4 - HKLM\..\Run: [kalvsys] C:\WINDOWS\SYSTEM\KALVMUE32.EXEO4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exeO4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXEO4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exeO4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startupO4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startupO4 - HKCU\..\Run: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE' /0O4 - HKCU\..\RunServices: [ctfmon.exe] ctfmon.exeO4 - HKCU\..\RunServices: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startupO4 - HKCU\..\RunServices: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startupO4 - HKCU\..\RunServices: [SpySweeper] 'C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE' /0O4 - Startup: 2Wire Wireless Client Manager.lnk = C:\Program Files\2Wire Wireless\Client Manager\CMTWO.EXEO4 - Startup: hp instant support.lnk = C:\Program Files\Hewlett-Packard\hpis\bin\matcli.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLLO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLLO9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLLO9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLLO9 - Extra button: Dell Home - {DE9F7D9E-71AE-44E3-8DE5-D741FBFD7B86} - http://www.dellnet.com/ (file missing) (HKCU)O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dllO12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS
ppdf32.dllO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://ips-inc.webex.com/client/latest/webex/ieatgpc.cabO16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dllO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cabO16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab?affiliate=MEDIAGENO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

okiebub · Answer

I have not been able to recreate the c++ error nor can I run adaware. When I run adaware, I get 'Ad-aware has caused an erro in . Ad-aware will now close. Then, I get an erro rmessage that appears to be in German (I have several messages that are in German, including some associated with spybot).

Midnight Star · Answer

okiebub,

Can you post back the C++ error that your getting? I'm curious about it's contents.

The following files that are in IE:

KALVEW32.EXE
KALVOLE.EXE
KRNL382.EXE

What did you use to associate them with IE?

Your pc has a VX2 infection, that AdAware can remove. Have you tried to run it again, after you we're able to remove some other problems that we're present?

Mike.

okiebub · Answer

No, I can't post the C++ error because my entire system locks up. There's always another error message that asks me to email merijn@spywareinfo.com with what I was doing when HJT encountered errors. The info at the top of this message says something about "FIxother1item(sItem 01...hosts 09.20.16.183 ...search.netscape.com

It also includes the windows 9x 4.90.3000

MSIE 6.0.2800.1106

HJT 1.98.2

As for the other files in WIndows Explorer, I have not associated them with anything. I just noticed them when I was deleting c:/windows/system/kalvmue32.exe

I can try to recreate teh C++ error and write down the info and post it.

Midnight Star · Answer

okiebub,

That's some good information to have, just trying to lock it down for future use. I was thinking that they we're showing us as an Internet object. Check the file creation date(s) for those files and see if they corrospond the one that I posted you 'fix': KALVMUE32.EXE

Mike.

Edits: Add the program reference.

Message Edited by Midnight Star on 12-05-2004 05:45 PM

Midnight Star · Answer

okiebub,   Ok. When you ran the Virtumundo removal tool from symantec the second time, did it pick up anything additonal? or did your system come up clean?   Mike.

okiebub · Answer

It came back clean. Just to verify, the Virtumondo is "fixVundo," correct? That's the link that you gave me.

the other strange exe files have the same creation date, but I don't know what the date of the Kalvmue32.exe file was.

Everything I have done has been to no avail--the extra desktop icons that I had succeeded in removing are now back on my desktop. I run Spybot and I still have numerous files. It fixes some, but leaves a number of CoolWWWxxx files. I run CW Shredder, and it removes the same 2 files, but does nothing about the remaining ones listed in spybot. Spy Sweeper continues to notify me of changes trying to be made to my system. It tries to remove ieautosearch, but cannot do it.

What would happen if I simply reinstall Windows? Would that fix the problems?

Message Edited by okiebub on 12-05-2004 07:10 PM

Midnight Star · Answer

okiebub,   Perhaps, one of the responders at www.bleepingcomputer.com, with more experience than myselft, might be able help.   Mike.

Virus & Spyware

new hijack this log (with first 4 lines)

Was this post helpful?