zipzappromos.com and others

Question

We have been plagued with this site.  Have followed other threads and have attempted to remove them using instructions therein.  No success so far.    Below is the Hijack-this log for our system.  Any help in resolving this problem would be appreciated.   Logfile of HijackThis v1.99.1 Scan saved at 10:00:44 AM, on 5/3/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32
tvdm.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\PESTPA~1\PPControl.exe C:\PROGRA~1\PESTPA~1\PPMemCheck.exe C:\PROGRA~1\PESTPA~1\CookiePatrol.exe C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLHOS~1.EXE C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\OPLIMIT\ocrawr32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLServiceHost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\PROGRA~1\AOLCOM~1\ACCAgnt.exe C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe C:\Program Files\EarthLink TotalAccess\TaskPanl.exe C:\Program Files\America Online 9.0\waol.exe C:\WINDOWS\system32undll32.exe C:\Program Files\3com\Connection Assistant\bin\mad.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe C:\Program Files\Sprint Virtual Assistant\bin\mpbtn.exe C:\PROGRA~1\3com\CONNEC~1\Common\MOTIVE~1.EXE C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\bin\HPOVDX05.EXE C:\WINDOWS\system32\hpoipm07.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\America Online 9.0\shellmon.exe C:\HJT\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.2 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exe O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWSealtime.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110417709\EE\AOLHostManager.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] 'C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [WorkFlow] D:\installs\BrdJmp\WorkFlow.exe O4 - HKLM\..\Run: [QuickFinder Scheduler] 'C:\Corel\Programs\QFSCHD110.EXE' O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [AOLCC] 'C:\PROGRA~1\AOLCOM~1\ACCAgnt.exe' /startup O4 - HKCU\..\Run: [AOL Fast Start] 'C:\Program Files\America Online 9.0\AOL.EXE' -b O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1058.dll,InstantAccess O4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstart O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exe O4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: Sprint FastConnect virtual assistant.lnk = C:\Program Files\Sprint Virtual Assistant\bin\matcli.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYUS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1058_XP.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\aolserv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

SpotCheckBilly · Answer

CarlMc,Hello! and welcome to the Dell forums. This is a tough infection and we will have to do it in steps. Let's start by doing the following:Go to www.trendmicro.com , and then:1. Click 'Free Online Scan'.2. Click 'Scan now, it's free'.It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:1. Select all available drives.2. Check(tick) 'Auto Clean'.3. Click 'Scan '.When it completes, post back the full filename of any files that cannot be cleaned or deleted. Go to Add/Remove programs and remove(uninstall) the following, if present: MyWebSearch The above could appear anywhere within the entry. Be careful not to remove any personal or system software. Run HiJackThis and click ' Scan', then check(tick) the following, if present: O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1058.dll,InstantAccess O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZUxdm080YYUS O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1058_XP.cab Now, with all windows closed except HiJackThis, click ' Fix checked'. Make sure you're able to view system and hidden files/ folders: 1. Click Start=> Control Panel=> Folder Options=> View tab. 2. Select ' Show hidden files and folders' 3. Clear the check mark in ' Hide protected operating system files'=> Yes to confirm. 4. Click Apply=> OK. 5. Close Control Panel. Then, in ' Safe Mode ', (reboot if necessary) locate and delete the following item(s), if present.Search for...EGDACCESS_1058.dll...using 'Start | Search...'.-Note that some of these file(s) may not be present.Post back a new log, and we can get started with the rest of the fix.:smileyhappy:George a.k.a. SpotCheckBilly

CarlMc · Answer

Thanks for your help.  I have followed your instructions.  No virus found.  Hijack-this found two of the items you indicated and they were deleted.  Following is the new Hijack-this log:   Logfile of HijackThis v1.99.1Scan saved at 8:35:23 AM, on 5/6/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32
tvdm.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\PESTPA~1\PPControl.exeC:\PROGRA~1\PESTPA~1\PPMemCheck.exeC:\PROGRA~1\PESTPA~1\CookiePatrol.exeC:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\OPLIMIT\ocrawr32.exeC:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLHOS~1.EXEC:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLServiceHost.exeC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\AOLCOM~1\ACCAgnt.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\3com\Connection Assistant\bin\mad.exeC:\Program Files\3com\Connection Assistant\bin\mpbtn.exeC:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exeC:\PROGRA~1\3com\CONNEC~1\Common\MOTIVE~1.EXEC:\Program Files\WinZip\WZQKPICK.EXEC:\Program Files\Sprint Virtual Assistant\bin\mpbtn.exeC:\Program Files\Hewlett-Packard\HP OfficeJet T Series\bin\HPOVDX05.EXEC:\WINDOWS\system32\hpoipm07.exeC:\Program Files\America Online 9.0\waol.exeC:\Program Files\America Online 9.0\shellmon.exeC:\Program Files\Messenger\msmsgs.exeC:\HJT\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.2R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exeO2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dllO3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWSealtime.exeO4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exeO4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exeO4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exeO4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110417709\EE\AOLHostManager.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [AOL Spyware Protection] 'C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [WorkFlow] D:\installs\BrdJmp\WorkFlow.exeO4 - HKLM\..\Run: [QuickFinder Scheduler] 'C:\Corel\Programs\QFSCHD110.EXE'O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScanO4 - HKCU\..\Run: [AOLCC] 'C:\PROGRA~1\AOLCOM~1\ACCAgnt.exe' /startupO4 - HKCU\..\Run: [AOL Fast Start] 'C:\Program Files\America Online 9.0\AOL.EXE' -bO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exeO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exeO4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exeO4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Sprint FastConnect virtual assistant.lnk = C:\Program Files\Sprint Virtual Assistant\bin\matcli.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeO23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeO23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\aolserv.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exeO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe Please advise of any next steps needed.  Thanks again

SpotCheckBilly · Answer

Hello CarlMc,,Your log file looks clean, so let's go on to the next step:Please download and install this disk cleanup utility called Cleanup! Here It will get rid of any malware which may be hiding in your temp folders ( a common hiding place). You may also regain some space. A tutorial which describes its usage can be found Here :Run the disk cleanup utility and check the custom settings under options to your liking. Be sure to delete temporary files and temporary internet files for all user profiles. Also, clean out the prefetch folder and the recycle bin.Next, reboot and download the 'List Installed Programs script' from Here Note: Scroll about halfway down the list to find it.Run it and post the log as a reply to this thread please. We will use the results to determine the course of action in the steps that follow.George a.k.a. SpotCheckBilly:smileyhappy: Message Edited by SpotCheckBilly on 05-07-2005 12:49 AM

CarlMc · Answer

Again thanks for your help. Have run the programs indicated and here is the log from the installed programs script:

INSTALLED SOFTWARE (129) - D1KZ5Q11 - 5/7/2005 8:48:09 AM

3Com Connection Assistant Ver: 4.03.02.10
ActiveUpdate
Ad-Aware SE Personal
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Reader 6.0.1 Ver: 006.000.001 Installed: 3/29/2004
America Online (Choose which version to remove)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Computer Check-Up
AOL Connectivity Services
AOL Deskbar
AOL Spyware Protection Ver: 1.0.76
AOL Toolbar
AOL You've Got Pictures Screensaver
BroadJump Client Foundation
CC_ccProxyExt Ver: 103.0.2.10 Installed: 4/25/2005
ccCommon Ver: 103.0.2.10 Installed: 4/25/2005
ccPxyCore Ver: 103.0.2.10 Installed: 4/25/2005
CheckIt Diagnostics Ver: 7.0
CleanUp!
Conexant HSF V92 56K Data Fax PCI Modem
Corel WordPerfect Suite 8
DAO 3.5
Deal Info Ver: 2004.0.129.0 Installed: 6/22/2004
Dell Picture Studio - Dell Image Expert Ver: 3.4.1 Installed: 7/30/2002
Dell ResourceCD
EarthLink Accelerator Ver: 3.1.1.141 Installed: 12/20/2004
EarthLink Common Ver: 2004.1.42.0 Installed: 6/30/2004
EarthLink FastLane Ver: 5.5.100 Installed: 6/22/2004
EarthLink IM Ver: 2004.1.42.0 Installed: 6/30/2004
EarthLink MailBox Ver: 2004.1.88.0 Installed: 6/30/2004
EarthLink MDAC Ver: 2004.0.129.0 Installed: 6/22/2004
EarthLink Redistributed Ver: 2004.0.129.0 Installed: 6/22/2004
EarthLink Setup Ver: 2004.1.42.0 Installed: 6/30/2004
EarthLink TaskPanel Ver: 2004.1.88.0 Installed: 6/30/2004
EarthLink Toolbar
EarthLink Toolbar Ver: 2004.2.80.0 Installed: 6/30/2004
EarthLink TotalAccess 2004 Ver: 2004.1.88.0
EarthLink Update Manager Ver: 2004.1.42.0 Installed: 6/30/2004
EarthLink Webspace Ver: 2004.1.42.0 Installed: 6/30/2004
Easy CD Creator 5 Basic Ver: 5.2.0.56 Installed: 7/30/2002
ELNBonus Ver: 2004.1.42.0 Installed: 6/30/2004
Fatman Adventures 1.02 Ver: 1.02
Help and Support Customization Ver: 1.00.0000 Installed: 7/30/2002
HijackThis 1.99.1 Ver: 1.99.1
HP OfficeJet T Series (Remove Only)
Intel(R) 845G Chipset Graphics Driver Software
Intellisync® for AOL
Lernout & Hauspie TruVoice for Microsoft Agent
LiveReg (Symantec Corporation) Ver: 3.0.0
LiveUpdate 2.6 (Symantec Corporation) Ver: 2.6.14.0
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2002 Ver: 2002 Installed: 11/15/2001
Microsoft Money 2002 Ver: 10.0.50 Installed: 11/15/2001
Microsoft Money 2002 System Pack Ver: 10.0.80 Installed: 11/15/2001
Microsoft Office XP Professional with FrontPage Ver: 10.0.2627.01 Installed: 3/19/2004
Microsoft Picture It! Photo 2002 Ver: 6.0.0.0000 Installed: 11/15/2001
Microsoft Plus! for Windows XP Ver: 1.00.00.0554 Installed: 7/19/2003
Microsoft Word 2002 Ver: 10.0.2627.01 Installed: 11/15/2001
Microsoft Works 2002 Setup Launcher
Microsoft Works 6.0 Ver: 06.00.0000 Installed: 11/15/2001
Microsoft Works Suite Add-in for Microsoft Word Ver: 2.0.0.0000 Installed: 11/15/2001
Microsoft XML Parser Ver: 8.20.8730.4 Installed: 6/22/2004
Modem Helper
Moraff's 3D-Jongg Freeware 1.1
MSRedist Ver: 1.0.0.0 Installed: 4/25/2005
MSSoap Ver: 2003.2.1.0 Installed: 6/22/2004
MUSICMATCH Jukebox
Nancy Drew: The Final Scene
Norton AntiSpam Ver: 2005.1.0.163 Installed: 4/25/2005
Norton AntiSpam Ver: 2005.1.0.163 Installed: 4/25/2005
Norton AntiVirus 2005 Ver: 11.0.2 Installed: 4/25/2005
Norton Internet Security Ver: 1.0.0 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security Ver: 8.0.0.64 Installed: 4/25/2005
Norton Internet Security 2005 (Symantec Corporation) Ver: 8.0.0.64
Norton WMI Update Ver: 2005.1.0.111 Installed: 4/25/2005
Norton WMI Update Ver: 2005.1.0.111 Installed: 4/25/2005
NoteCard
Paint Shop Pro 7 Ver: 7.05.0000 Installed: 7/30/2002
PhotoParade Player
Punch! Super Home Suite
Quicken 2005 Ver: 14.00.0000 Installed: 12/9/2004
Quicken 2005 Ver: 14.00.0000 Installed: 12/9/2004
QuickTime
RealPlayer
sdnjzi
Sean's Magic Slate
SPBBC Ver: 1.00.0000 Installed: 4/25/2005
Sprint FastConnect virtual assistant
Spybot - Search & Destroy 1.3 Ver: 1.3
Symantec Network Drivers Update Ver: 5.5.1.6 Installed: 5/3/2005
Symantec Script Blocking Installer Ver: 11.0.2 Installed: 4/25/2005
SymNet Ver: 5.4.2.17 Installed: 4/25/2005
Viewpoint Media Player
WebFldrs XP Ver: 9.50.5318 Installed: 11/15/2001
Windows Installer 3.1 (KB893803) Ver: 3.1
Windows Installer Clean Up Ver: 2.05.00.0000 Installed: 4/25/2005
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB834707 Ver: 20040929.110854
Windows XP Hotfix - KB867282 Ver: 20050127.090417
Windows XP Hotfix - KB873333 Ver: 20050114.005213
Windows XP Hotfix - KB873339 Ver: 20041117.092459
Windows XP Hotfix - KB885250 Ver: 20050118.202711
Windows XP Hotfix - KB885835 Ver: 20041027.181713
Windows XP Hotfix - KB885836 Ver: 20041028.173203
Windows XP Hotfix - KB885884 Ver: 20040924.025457
Windows XP Hotfix - KB886185 Ver: 20041021.090540
Windows XP Hotfix - KB887472 Ver: 20041014.162858
Windows XP Hotfix - KB887742 Ver: 20041103.095002
Windows XP Hotfix - KB888113 Ver: 20041116.131036
Windows XP Hotfix - KB888302 Ver: 20041207.111426
Windows XP Hotfix - KB890047 Ver: 20041221.124506
Windows XP Hotfix - KB890175 Ver: 20041201.233338
Windows XP Hotfix - KB890859 Ver: 1
Windows XP Hotfix - KB890923 Ver: 1
Windows XP Hotfix - KB891781 Ver: 20050110.165439
Windows XP Hotfix - KB893066 Ver: 1
Windows XP Hotfix - KB893086 Ver: 1
Windows XP Service Pack 2 Ver: 20040803.231319
WinZip Ver: 8.1 SR-1 (5266)
WordPerfect Office 11 Ver: 11.0.0.233 Installed: 3/19/2004
Works Suite OS Pack Ver: 1.0.0.0000 Installed: 11/15/2001
Works Synchronization Ver: 1.0.0.0000 Installed: 11/15/2001

SpotCheckBilly · Answer

Hello CarlMc,,OK, the offending file has been located. Now we go on to the next step, which will find the file location and tell us which registry entries we need to delete.Please download 'Registry Search Tool' (RegSrch.vbs) from Here Start it and paste in sdnjzi (this is the troublemaker), wait, hit ok. When Wordpad opens, copy contents and post as a reply to this thread  please .George a.k.a. SpotCheckBilly:smileyhappy: Message Edited by SpotCheckBilly on 05-09-2005 05:11 PM Message Edited by SpotCheckBilly on 05-09-2005 05:12 PM

CarlMc · Answer

I downloaded and ran the registry search script but got an error as follows:

Script: c:\unzipped\Reg Srch.vbs

Line : 76

Char: 1

Error: The system cannot find the file specified

Code: 80070002

Source: (null)

Question, can I use the find function in Regedit to locate and remove the entries for sdnjzi or is there more to do?

2nd question, there is another piece of software indicated in the installed software list labeled

'Deal Info', this can't be found using the normal system "find" function. Is it harmful?

SpotCheckBilly · Answer

Hello CarlMc,Yes, you can manually search the registry. However, before you do that, you might try disabling Symantec Script Blocking Service, then running the search tool again. Otherwise you will have to run regedit, paste in sdnjzi, and click 'Find' (F3 after the first is located). Then copy/paste the entry into a Notepad file. (The ENTIRE entry must be listed). Repeat until entire registry is searched then paste contents of the Notepad file back here into this thread.You should have entries that looks similar to:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'xxxxxx'='c:\windows\system32\xxxxxx.exe -start'[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xxxxxx][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xxxxxx]'UninstallString'='c:\windows\system32\xxxxxx.exe -uninstall'[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xxxxxx]'DisplayName'='xxxxxx'[HKEY_USERS\S-1-5-21-3505981011-3453487918-3439042112-1006\Software\Microsoft\Search Assistant\ACMru\5603]'002'='xxxxxx'[HKEY_USERS\S-1-5-21-3505981011-3453487918-3439042112-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]'C:\windows\system32\xxxxxx.exe'='xxxxxx'I wasn't able to find any information about Deal Indo. It may be a program that was once installed and then removed. It does not show up in the HijackThis log and maybe just an orphan Registry entry.George a.k.a. SpotCheckBilly:smileyhappy:

CarlMc · Answer

Hello George,

I disabled script blocking but got the same error, so used regedit and the copy values function to paste the following into wordpad. Not sure that this got all the data you need however as the info on the right side of the regedit screen split bar doesn't copy. If you need further info please let me know and how to do it. Once again thanks for all your help.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\sdnjzi

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\sdnjzi

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sdnjzi

HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Search Assistant\ACMru\5604

HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache

SpotCheckBilly · Answer

Hello CarlMc,

Unfortunately, the information that I need for the next step isn't there. I will check with some other people
to see if there is another way to retrieve the information that we need.

I'll get back to you as soon as I can:smileyhappy:

George a.k.a. SpotCheckBilly

SpotCheckBilly · Answer

HelloCarlMC, I have sent you a Private Message with instructions on modifying theRegistry Search Tool so that it should run on your computer.George a.k.a. SpotCheckBilly:smileyhappy:

CarlMc · Answer

Hello George,

Modified the script as suggested (wordpad was where it was supposed to be) but still got the same error. But did a search on the temp file the script created and it was still in the temp folder so here is the results of the last time the script was run including the header info in case it might help debug the script. Thanks again for all your help.

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "sdnjzi" 5/12/2005 9:32:22 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\sdnjzi]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\sdnjzi]
"item"="sdnjzi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\sdnjzi]
"command"="c:\\windows\\system32\\sdnjzi.exe -start"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\sdnjzi]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sdnjzi]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sdnjzi]
"UninstallString"="c:\\windows\\system32\\sdnjzi.exe -uninstall"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sdnjzi]
"DisplayName"="sdnjzi"

[HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Search Assistant\ACMru\5604]
"002"="sdnjzi"

[HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"c"="C:\\installed programs script\\sdnjzireg.txt"

[HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\txt]
"c"="C:\\installed programs script\\sdnjzireg.txt"

[HKEY_USERS\S-1-5-21-1180395095-163748893-4247568029-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\windows\\system32\\sdnjzi.exe"="sdnjzi"

SpotCheckBilly · Answer

Hello CarlMc, I'm confirming the registry entries that need to be fixed.  I'll get back as soon as I canGeorge a.k.a. SpotCheckBilly:smileyhappy:

SpotCheckBilly · Answer

Hello CarlMc,

Great work! We now have the information that we need.

We need to delete the file and kill the registry entries...

Step 1
Download and install Reglite. (This is an easy to use Registry editor and we will use it later on in the fix..)

Please back up your registry, instructions Here It is important to back up your registry before making any changes to it.

Step 2
Download Pocket Killbox from Here:

Unzip the files to a folder. (Usually on your desktop.), then open and double-click on Killbox.exe to run it. In the "Paste Full Path of File to Delete" box, copy and paste the following:

c:\windows\system32\sdnjzi.exe

Check the box to delete on reboot and click the red X to the right. Click OK, then Yes to reboot now.

Allow it to reboot.

While the computer is booting up, tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter'.

Step 3
Open RegLite and copy/paste the following string in the address window at the top then click go.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\sdnjzi]
"command"="c:\\windows\\system32\\sdnjzi.exe -start"

Right click the "sdnjzi.exe"="c:\\windows\\system32sdnjzi.exe.exe -start" value in the right pane and delete.

Then copy/paste the following into the address window and click go.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\sdnjzi.exe

Right click the sdnjzi.exe key in the left pane and delete.

Exit Reglite.

Step 4
Open C:\Windows\Prefetch, select all and delete. (This will cause your computer to boot-up slower for the first few boots. Please do not be alarmed.)

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself), for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\ Every username\Local Settings\Temp\
Also delete your Temporary Internet Files ( Start=> Control Panel=> Internet Options=> Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.

Step 5
Reboot normally and run at least two of the following online virus scans making sure to reboot in between each one. Allow them to fix anything they find.

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Bitdefender
Command on Demand

Write down the full psth and filename of anything that can not be fixed.

Scan with HijackThis and post the new log as a reply to this thread. Include anything that can not be fixed by the online scans. Let us know if the popups stop.

Please let us know of any complications and how the computer is behaving.

George a.k.a. SpotCheckBilly:smileyhappy:

CarlMc · Answer

Hello George, thanks for all the help have completed the steps you have outlined and have had no problems with zipzappromos.com appearing for the last few days.  Have run the virus checks, no virus found.  Below is the hijack-this log after the final clean up.  Again thank you for all your help.  We rest easier knowing that our grandchildren can use the internet again without unwanted smut appearing.  Logfile of HijackThis v1.99.1Scan saved at 9:56:59 PM, on 5/17/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32
tvdm.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\PESTPA~1\PPControl.exeC:\PROGRA~1\PESTPA~1\PPMemCheck.exeC:\PROGRA~1\PESTPA~1\CookiePatrol.exeC:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exeC:\WINDOWS\System32\hkcmd.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\OPLIMIT\ocrawr32.exeC:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLHOS~1.EXEC:\Program Files\BroadJump\Client Foundation\CFD.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\COMMON~1\AOL\111041~1\EE\AOLServiceHost.exeC:\Program Files\EarthLink TotalAccess\TaskPanl.exeC:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exeC:\Program Files\Sprint Virtual Assistant\bin\mpbtn.exeC:\Program Files\Hewlett-Packard\HP OfficeJet T Series\bin\HPOVDX05.EXEC:\WINDOWS\system32\hpoipm07.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\America Online 9.0\waol.exeC:\Program Files\America Online 9.0\shellmon.exeC:\Program Files\Messenger\msmsgs.exeC:\HJT\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.2R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exeO2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink\Toolbar\EScamBlk.dllO2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPuB.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dllO2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dllO3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - (no file)O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dllO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWSealtime.exeO4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exeO4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exeO4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exeO4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SPRINT~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1110417709\EE\AOLHostManager.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [AOL Spyware Protection] 'C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [WorkFlow] D:\installs\BrdJmp\WorkFlow.exeO4 - HKLM\..\Run: [QuickFinder Scheduler] 'C:\Corel\Programs\QFSCHD110.EXE'O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScanO4 - HKCU\..\Run: [AOL Fast Start] 'C:\Program Files\America Online 9.0\AOL.EXE' -bO4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstartO4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exeO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exeO4 - Global Startup: HP OfficeJet Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Series 600\Bin\HPOstr05.exeO4 - Global Startup: HP OfficeJet T Series Startup.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Sprint FastConnect virtual assistant.lnk = C:\Program Files\Sprint Virtual Assistant\bin\matcli.exeO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar	oolbar.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cabO16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeO23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeO23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\aolserv.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exeO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

SpotCheckBilly · Answer

Hello CarlMc,Congratulations! Your log looks clean - good work! That was a tough infection to remove, but everything looks good. Reboot your computer, and try using different programs and make sure everything is running ok. If your still experiencing problems, post back any concerns or problems you may be having and wait for any advice before continuing with the cleanup. Download, install and run Cleanup! from Steven Gould, then:1. Click 'Cleanup!'(wait for the program to finish scanning your system, and selecting files to be removed.)2. Exit the program and reboot the computer, if necessary.-For more information about using Cleanup! see here . If everything is running ok, let's do the final cleanup... 1. Run ' Disk Cleanup' and allow it to remove everything it finds. 2. If you've downloaded MicroWorld AV (MWAV), run it again - but don't scan, just click 'Clear Log' and exit the program.3. Go to www.trendmicro.com and click 'Free Online Scan ', then 'Scan now, it's free! '. When it's downloaded, select all available drives, then check(tick) 'Auto clean ', then click 'Scan '.4. Run AdAware SE Personal and 'perform a full system scan ', then Spybot S&D, and 'Check for Problems'. Let them both remove the residual 'problems' left that HiJackThis couldn't fix.5. Disable, then re-enable system restore ; with a reboot in-between. Then immediately create a new system point manually. To help keep your machine free of malware, run Ad-Aware and Spybot S&D on a regular basis and keep them updated. Additionally, in my signature below you'll find links for three free programs that will actually help prevent malware from getting into your computer in the first place. They are: Spywareblaster, SpywareGuard and IE-SPYAD. They are very small and use little or no system resources. There are also links to two free personal firewalls: Zone Alarm and Sygate. A note about personal firewalls. If you install a third-party firewall, disable the firewall in Windows XP. If you have any additional problems or concerns post back. - Happy surfing,:smileyhappy: George a.k.a. SpotCheckBilly

Virus & Spyware

zipzappromos.com and others

Was this post helpful?