pesty popupper.com

Question

Hello,   I have downloaded and installed several anti spyware, anti adware, anti virus and pop-up blocking programs.  I still cannot completely remove what I believe is the Roimoi parasite.  While on the internet, I receive unwanted popups from popupper.com.  I have disabled cookies and popups from popuppers.com; all that appears is a blank page.  I ran HijackThis and removed the obvious problems.  I tried to uninstall Media-Motor using add/remove programs yet it keeps reappearing.  What else can I do?    Please help!  Thanks!

Midnight Star · Answer

Imgardner, Post up a 'HiJackThis' log and we'll look over it and see if anything else might stand out. PS: I tried browsing to 'popupper.com' and it gave an invalid 'removal' link. Mike.

pskelley · Answer

Recently some of the HijackThis responders moved to other sites for various reasons.
There are still some knowledgeable people posting here at Dell, so you may still get help from them.

I suggest you look at this link: http://www.a-sap.org/
To help you choose from that list,
TomCoyotes contains the anti-malware school - Classroom.
SpyWareInfo contains the anti-malware school - BootCamp.
Net-Intergration is the support site of Spybot S&D.
Lavasoft Support is the support site of Ad-aware.
Wilders Security has since stopped hijackthis log support due to the lack of experienced helpers.
Others that I would recommend (with possibly shorter response times)
but generally all those on that list will have experts to help you.

http://www.bleepingcomputer.com/
http://www.subratam.org/
http://www.zerosrealm.com/
http://maddoktor2.com/index.php

I wish you all the best at getting your computer clean.

hanks, pskelley
in training at
TomCoyote and
SpywareInfo

lmgardner30 · Answer

Thanks for the prompt replies. Here is my HijackThis log: Logfile of HijackThis v1.97.7 Scan saved at 6:01:38 PM, on 10/18/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe C:\Program Files\Trend Micro\Internet Security	mproxy.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\Internet Security\PccPfw.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\SM1BG.EXE C:\Program Files\Trend Micro\Internet Security\PCClient.exe C:\Program Files\Trend Micro\Internet Security\pccguide.exe C:\WINDOWS\medload.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\PROGRA~1\Netscape\Netscape\Netscp.exe C:\Documents and Settings\Doug Gardner\My Documents\My Pictures\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmailvip.fuse.net/en_FUSE/logout.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: 411 Ferret Toolbar - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\411Ferret	oolbar.dll O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TM Outbreak Agent] 'C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe' /run O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [Spyware remover] C:\WINDOWS\Remove_spyware.exe O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [PCClient.exe] 'C:\Program Files\Trend Micro\Internet Security\PCClient.exe' O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security\pccguide.exe' O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin
ls.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [loads.exe] C:\WINDOWS\medload.exe O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [DeadAIM] rundll32.exe 'C:\Program Files\AIM\DeadAIM.ocm',ExportedCheckODLs O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Mozilla Quick Launch] 'C:\Program Files\Netscape\Netscape\Netscp.exe' -turbo O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HPAiODevice(hp officejet k series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet k series\Bin\hpoorn07.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm817 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned40.cab O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - http://activex.microsoft.com/activex/controls/WindowsMedia/downloadcontrol.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://media.toontown.com/toontown/sv1.0.7.12.5/ttinst.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes/ContentAuditControl.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Hope someone can make sense of this!

Midnight Star · Answer

Imgardner,

First, let's get the newest version of " HiJackThis"; v1.98.2. This might pick up a few more problems than this version has.

Ok, let's try this for medload.exe:

Bootup your computer into "Safe Mode".
Run "HiJackThis" and click "Scan", make sure no other windows, other than "HiJackThis" are open.
Check (tick) these two entries below:

C:\WINDOWS\medload.exe

O4 - HKLM\..\Run: [loads.exe] C:\WINDOWS\medload.exe

Then click "Fix Checked".
Reboot your computer.
Post a new log.

Let's see if that takes care of the problem. When the new log arrives, we'll see if there are any more 'problems' sneaking around in there.

Mike.

Midnight Star · Answer

Lisa,   Your more than welcome!  Here's the link from CastleCops. I'm really surprised the previous 'spybusting' scanners missed it. There's just a few more processes i'll need to check out for ya'.   Mike.

lmgardner30 · Answer

Mike,   By George I think you got it!  So far, so good.  I was getting an error message on shut down from medload, now it is gone.  What was that?  Here is my newest HijackThis log.  I think it all looks okay now, what do you think?    Thank you!  Thank you! Lisa :smileyhappy:   Logfile of HijackThis v1.98.2 Scan saved at 7:05:50 PM, on 10/18/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe C:\Program Files\Trend Micro\Internet Security	mproxy.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\Internet Security\PccPfw.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\SM1BG.EXE C:\Program Files\Trend Micro\Internet Security\PCClient.exe C:\Program Files\Trend Micro\Internet Security\pccguide.exe C:\WINDOWS\medload.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\PROGRA~1\Netscape\Netscape\Netscp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\DOCUME~1\DOUGGA~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmailvip.fuse.net/en_FUSE/logout.html R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: 411 Ferret Toolbar - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\411Ferret	oolbar.dll O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TM Outbreak Agent] 'C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe' /run O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [Spyware remover] C:\WINDOWS\Remove_spyware.exe O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [PCClient.exe] 'C:\Program Files\Trend Micro\Internet Security\PCClient.exe' O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security\pccguide.exe' O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin
ls.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [loads.exe] C:\WINDOWS\medload.exe O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [DeadAIM] rundll32.exe 'C:\Program Files\AIM\DeadAIM.ocm',ExportedCheckODLs O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Mozilla Quick Launch] 'C:\Program Files\Netscape\Netscape\Netscp.exe' -turbo O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HPAiODevice(hp officejet k series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet k series\Bin\hpoorn07.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm817 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned40.cab O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - http://activex.microsoft.com/activex/controls/WindowsMedia/downloadcontrol.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://media.toontown.com/toontown/sv1.0.7.12.5/ttinst.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes/ContentAuditControl.cab

Midnight Star · Answer

Lisa,

It's looking good, let's do just a few more things:

First, let's put " HijackThis" in it's own directory. That way, if we need to 'unfix' any entires, we'll be able to do it. If the temporary directory gets cleared, we'll loose this ability.

Check (tick) these these entries, then click " Fix checked".

R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)

(These are just 'dead-link' entries and can be safetly removed.)

O3 - Toolbar: 411 Ferret Toolbar - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\411Ferret\toolbar.dll

O4 - HKLM\..\Run: [Spyware remover] C:\WINDOWS\Remove_spyware.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
(Hostile ActiveX)

When your done, boot into " Safe Mode", making sure you can view hidden and system files, then delete:

[file] C:\WINDOWS\Remove_spyware.exe

[folder] C:\Program Files\411Ferret

Reboot your computer, and post back a new log, just to make sure we've gotten them removed.

In reguards to one of the last entries:

The [Spyware remover] software really isn't the best choice in removal products and is listed a suspect/or rogue; see BPS Spyware & Adware Remover.

Mike.

lmgardner30 · Answer

Thanks so much Mike!   In a weak moment among too many pop-ups, I installed the Spyware Remover.  I had problems with even more ads afterward.  I knew it was suspect.  That's when I installed Spybot.  I guess I never completely removed the Spyware Remover.    I followed your instructions.  I think the problem is resolved.  Here is my HijackThis log.  As you can see in the 04 category, there is file that reads HKLM\..\Run [DeadAIM] rundll32.exe....  Can I zap this one too?  I get a rundll32 DeadAIM error message on startup.  It would be great if I could fix this little annoyance too.   Thanks for going the extra mile! Lisa   Logfile of HijackThis v1.98.2 Scan saved at 10:11:46 PM, on 10/18/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\SM1BG.EXE C:\Program Files\Trend Micro\Internet Security\PCClient.exe C:\Program Files\Trend Micro\Internet Security\pccguide.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Program Files\Hewlett-Packard\AiO\hp officejet k series\Bin\hpoorn07.exe C:\Program Files\Nikon\NkView6\NkvMon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe C:\Program Files\Trend Micro\Internet Security	mproxy.exe C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\WINDOWS\system32\hpoipm07.exe C:\Program Files\Trend Micro\Internet Security\PccPfw.exe C:\Program Files\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS10 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmailvip.fuse.net/en_FUSE/logout.html O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TM Outbreak Agent] 'C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe' /run O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [PCClient.exe] 'C:\Program Files\Trend Micro\Internet Security\PCClient.exe' O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security\pccguide.exe' O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin
ls.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [DeadAIM] rundll32.exe 'C:\Program Files\AIM\DeadAIM.ocm',ExportedCheckODLs O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Mozilla Quick Launch] 'C:\Program Files\Netscape\Netscape\Netscp.exe' -turbo O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HPAiODevice(hp officejet k series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet k series\Bin\hpoorn07.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm817 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dll O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned40.cab O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - http://activex.microsoft.com/activex/controls/WindowsMedia/downloadcontrol.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://media.toontown.com/toontown/sv1.0.7.12.5/ttinst.cab O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://www.contentwatch.com/audit/includes/ContentAuditControl.cab

Midnight Star · Answer

Your welcome Lisa,   You sure can. Since it's an AIM add-on, let's first see if there's an ' Add/Remove programs' entry, or an 'unstall' entry available from ' Start | All programs'. If so, let's try to delete it from there. If not, go ahead and 'fix' that entry.   Mike.

lmgardner30 · Answer

Mike, Everything is running smoothly now. Thank heavens for every hacker out there, there is a knowledgable good guy like yourself to undo the damage. Thanks again, Lisa

Virus & Spyware

pesty popupper.com

Was this post helpful?