Blue Zipper Adware or Spyware. Tried everything can't remove

Question

For a few weeks now I have noticed a program called blue zipper that has taken over my computer.  It is fairly harmeless because it just routes me through it's advertisers from time to time, but that is all I know for sure.  I suspect it is monitoring me as well as occasionally sending me pop ups.  I have searched my hard drive and this blue zipper is no where to be found.  I have run all sorts of Programs including Spybot, Adaware, and even McAfee's new virus scan which also seeks out spyware.  No luck from anything.  There is a bluezipper.com which appears to promote advertising, but no links of any kind that can help me.  Please if anyone can help me remove this I would be very grateful.  Thanks

Tuxedo Jack · Answer

Please get HijackThis from this location, then save it to C:\HJT. If the directory does not exist, please create it.

http://majorgeeks.com/download.php?det=3155

Run it, then click Scan, then click Save Log.

Copy and paste the text of the log into a reply to this thread.

gstriker · Answer

Thanks so much Tuxedo Jack.  Worked like a champ, at least so far.  Guess I am still not convinced it's gone for good, but it is gone for now.  Your help is very appreciated

gstriker · Answer

It was defeated, but only temporarily.  Any other thoughts?

Tuxedo Jack · Answer

Please post the log here so's we can take a look at it and see what it's loading into startup.

What happens on startup isn't always evident; some programs mask themselves. If you post the log, we can tell you what's good and what's bad.

gstriker · Answer

This is the printout after running the HijackThis program.  Hope that is what you are looking for.  There are possibly several programs here that I don't want.  I am in the process of trying to eliminate all the garbage.  Thanks for your help on this. Logfile of HijackThis v1.97.7Scan saved at 12:42:16 PM, on 2/18/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\pctspk.exeC:\Program Files\ScanSoft\OmniPageSE\opware32.exeC:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\Program Files\Precpop2\precpop2.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Apoint\Apoint.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Apoint\Apntex.exeC:\PROGRA~1\AWS\WEATHE~1\Weather.exeC:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exeC:\PROGRA~1\INCRED~1\bin\IncMail.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\Program Files\SmartDisk\FlashPath\sdstat.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\WINDOWS\explorer.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Documents and Settings\George Shields\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluezipper.com/hphelper.php?home=http://start.earthlink.net/&marker=3765260995&siteid=DIAGNOSTIC_FREESLIDE_2&ip=192.168.1.2&zip=unknown&cty=unknown&gender=unknown&month=unknown&date=unknown&year=unknown&income=unknown&city=unknown&state=unknown&firstname=unknown&lastname=unknownR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.excite.com/microsoft/ie50R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htmR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://start.earthlink.net/channel/STARTR1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://start.earthlink.com/R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O1 - Hosts: 217.116.231.7 aimtoday.aol.comO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbarealbar.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {5BF858BE-3C82-8DFE-F188-F02207D7C275} - C:\WINDOWS\system32\xmnkdtzg.dll (file missing)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbarealbar.dllO3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [precpop2] 'C:\Program Files\Precpop2\starter.exe'O4 - HKLM\..\Run: [PCTVOICE] pctspk.exeO4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exeO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [McAfee Guardian] 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe' /SUO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe'O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanupO4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] 'C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe' /STARTMONITORO4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /cO4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O9 - Extra button: WeatherBug (HKCU)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: ADVFN 4v4 - http://www.advfn.com/p.php?pid=loadercabO16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cabO16 - DPF: {00000EF1-0000-0000-0000-000000000000} - http://mx253.sb03.com/apps/softsearch/ppstub.cabO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cabO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.5.cabO16 - DPF: {1FC215B7-F71D-4137-8D67-455A2D5CA8C5} - http://www.fileeliminator.com/get/BEL/Bug%20Eliminator.cabO16 - DPF: {2ABE804B-4D3A-41BF-A172-304627874B45} - http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_US.cabO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cabO16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/25743f7d2ef79c1c8005/netzip/RdxIE601.cabO16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://directv.direcway.com/dwayready/dpcsysinfo.cabO16 - DPF: {79B96C72-C0D0-4DC8-BC7E-9F314A918228} - http://ak.imgfarm.com/images/nocache/myspeedbar/myinitialsetup1.0.0.7.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37634.3849537037O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/earthlink/overball/install.cabO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cabO16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack_XP.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

ChrisRLG · Answer

Important: Create a folder on the C: drive called C:\HJT. You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Unzip HijackThis into this folder. When you run HijackThis from this folder and have it 'Fixed checked' it will create a backup file of modifications to use if restore is necessary. Please delete the old copy so it can't be used. --------------------------------------------- Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked. Any R0/R1 lines that you don't wish to keep as home/search pages O2 - BHO: (no name) - {5BF858BE-3C82-8DFE-F188-F02207D7C275} - C:\WINDOWS\system32\xmnkdtzg.dll (file missing)O4 - HKLM\..\Run: [precpop2] 'C:\Program Files\Precpop2\starter.exe'O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exeO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.5.cabO16 - DPF: {2ABE804B-4D3A-41BF-A172-304627874B45} - http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_US.cabO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/25743f7d2ef79c1c8005/netzip/RdxIE601.cabO16 - DPF: {79B96C72-C0D0-4DC8-BC7E-9F314A918228} - http://ak.imgfarm.com/images/nocache/myspeedbar/myinitialsetup1.0.0.7.cabO16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} (EGP2ECOM Class) - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_pack_XP.cabThe following activeX controls will reinstall when(and if) you revisit that website, UNLESS you know they are from a safe source, check to remove.O16 - DPF: {00000EF1-0000-0000-0000-000000000000} - http://mx253.sb03.com/apps/softsearch/ppstub.cabO16 - DPF: {1FC215B7-F71D-4137-8D67-455A2D5CA8C5} - http://www.fileeliminator.com/get/BEL/Bug%20Eliminator.cabO16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cabO16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/earthlink/overball/install.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cabThen Reboot to safe mode (F8 on boot) and delete the following files/folders:-Folder > C:\Program Files\Precpop2\Folder > C:\PROGRAM FILES\MYWEBS~1\Then Reboot and post a fresh log for me to check.

gstriker · Answer

As you instructed, hope this helps.  Thanks for your help   Logfile of HijackThis v1.97.7Scan saved at 7:11:01 PM, on 2/18/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\McAfee\McAfee Internet Security\GUARDDOG.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\McAfee\McAfee Internet Security\GUARDDOG.EXEC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\pctspk.exeC:\Program Files\ScanSoft\OmniPageSE\opware32.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeC:\WINDOWS\System32\DSentry.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\Program Files\Apoint\Apoint.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exeC:\PROGRA~1\AWS\WEATHE~1\Weather.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exeC:\PROGRA~1\INCRED~1\bin\IncMail.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\SmartDisk\FlashPath\sdstat.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\McAfee\McAfee Firewall\CPD.EXEC:\Program Files\McAfee\McAfee Firewall\CPD.EXEc:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\Documents and Settings\George Shields\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://start.earthlink.net/channel/STARTR1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://start.earthlink.com/R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O1 - Hosts: 217.116.231.7 aimtoday.aol.comO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbarealbar.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbarealbar.dllO3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osbootO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCTVOICE] pctspk.exeO4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exeO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe files\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [McAfee Guardian] 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe' /SUO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe'O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] 'C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe' /STARTMONITORO4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /cO4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exeO4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\binesources\WebMenuImg.htmO9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O9 - Extra button: WeatherBug (HKCU)O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO16 - DPF: ADVFN 4v4 - http://www.advfn.com/p.php?pid=loadercabO16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cabO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cabO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cabO16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) - http://directv.direcway.com/dwayready/dpcsysinfo.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37634.3849537037O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

gstriker · Answer

After your last task you had me complete I have not seen the return of the bluezipper.  The last time it appeared almost right away.  I will update you if it should return.  Thanks for all of your help.  This forum is awesome and I hope some day to be able to help others.  One other thing, should I delete this once I know my problem is solved or leave it for others to view in the future?  thx

ChrisRLG · Answer

Your log is now clean.Follow the link below to my site, malware section, and install spywareblaster and spywareguard from the links.Also ie-spyad from hereWith all those active you will be safer, do update them periodically.Please advise if you are still having any problems. BTW hijackthis is still running from a temp folder C:\Documents and Settings\George Shields\Local Settings\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe If all works ok please delete the hijackthis file, new versions come out regularly.

Virus & Spyware

Was this post helpful?