Log For PC Hill101

Printable View

December 17th, 2005, 02:13 AM
JodyWood

Log For PC Hill101

I have run AdAware, Spybot, Spyware Blaster, Windows Updates, eTrust Online Scan, BitDefender Online Scan, and HijackThis and removed some items there by going through http://hijackthis.de/. It seems that I haven't quite cleaned this PC yet, so could you review and lot me know how it looks.
Thanks,
Jody Wood

Logfile of HijackThis v1.99.1
Scan saved at 12:06:46 AM, on 12/17/2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\PROGRAM FILES\VERIZON ONLINE\CONTROLPAD\Misc\a_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 204.127.202.4,216.148.227.68
December 19th, 2005, 03:54 PM
askey127

Jody,

The log looks clean.
However, for future reference, be aware that http://hijackthis.de/ is regarded in the anti-spyware community as unreliable, to be gracious.
It is NOT in any way related to the original HiJackThis, or its author Merijn.
Just their copping the name might suggest something to you.

askey127
December 22nd, 2005, 02:34 AM
JodyWood

This computer can't be clean. It is still getting pop-ups on a regular basis.

I ran an online scan from Pest Patrol, www.pestpatrol.com. It detected 4 items, but won't remove the problems without purchase. Here is what it found...
1) PeopleOnPage.Apropos
2) Abx Search Toolbar
3) I-Lookup
4) AdKnowledge.com

Here is a new HijackThis log...

Logfile of HijackThis v1.99.1
Scan saved at 12:27:28 AM, on 12/22/2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\PROGRAM FILES\VERIZON ONLINE\CONTROLPAD\Misc\a_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 204.127.202.4,216.148.227.68
December 22nd, 2005, 06:10 AM
askey127
JodyWood,
-----------------------------------------------------------
Download and install CCleaner from here.
Don't run CCleaner yet.
-----------------------------------------------------------
Set Options in CCleaner and run Cleaning Scan. Open the CCleaner program.
( Do not use the Issues block to clean anything with this program. It is for experts only and it is risky).
- Select all Temp Files for Removal.
  Click on the Options block on the left. Select Advanced.
  Uncheck "Only delete files in Windows Temp folders older than 48 hours".
- Set Cookie Retention.
  Click on the Options block on the left, then choose Cookies.
  Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
- Run Cleaning Scan. Click on the Cleaner block on the left. Choose the Windows tab.
  Check everything Except Autocomplete Form History and the Advanced part of the Menu. Click the Run Cleaner button. This process could take a while. When CCleaner shows how much has been removed, cleaning is finished.
-----------------------------------------------------------
Retrieve the Installed Programs List from CCleaner
Click on the Tools block on the left. Choose Uninstall, and it will bring up the list of installed programs.
Click on the button in the lower right labeled Save as Text file, and save the default file install.txt to your desktop.
Paste the contents of that install.txt file into your reply.
-----------------------------------------------------------
Post a New HJT Log
Reboot your computer. Start HijackThis. Click Do System Scan and Save a Log File.
When the Scan is complete, select the whole log (Ctrl-A), copy and paste the log contents in a reply, along with the contents of the CCleaner list install.txt.

askey127
December 22nd, 2005, 10:16 PM
JodyWood

Here is the new Hijack This log...

Logfile of HijackThis v1.99.1
Scan saved at 8:13:13 PM, on 12/22/2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\PROGRAM FILES\VERIZON ONLINE\CONTROLPAD\Misc\a_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 204.127.202.4,216.148.227.68
O20 - AppInit_DLLs: Interceptor.dll

Here is installed program list from CCleaner...
ABBYY FineReader 4.0 Sprint
Ad-Aware SE Personal
Adobe Acrobat 5.0
AiOSoftware
AiO_Scan
AOL Instant Messenger
aspi
AVG Free Edition
BufferChm
CCHelp
CCleaner (remove only)
CCScore
Control Pad
Copy
CreativeProjectsTemplates
CreativeProjects
CueTour
Destinations
Director
DocProc
DocumentViewer
EPSON Status Monitor 2
ESSAdpt
ESSANUP
ESSCAM
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSvpaht
ESSvpot
Fax
Find... On the Internet
Greetings Workshop
HijackThis 1.99.1
HP Diagnostic Assistant
HP Image Zone 4.2
HP PSC & OfficeJet 4.2
HP Software Update
HPODiscovery
HPSystemDiagnostics
InstantShare
Internet Explorer Q903235
Internet Explorer Q905915
Kodak EasyShare software
KSU
LeadTool
LiveReg (Symantec Corporation)
LiveUpdate 2.6 (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft Data Access Components KB870669
Microsoft Encarta 98 Encyclopedia
Microsoft Entertainment Pack: The Puzzle Collection
Microsoft Internet Explorer 6 SP1 and Internet Tools
Microsoft Money 98
Microsoft Outlook Express 6
Microsoft VGX Q833989
Microsoft Windows Critical Update Notification
Microsoft Word 97
Microsoft Works 4.5
Microsoft XML Parser and SDK
Microtek ScanWizard 5
Notifier
OLYMPUS CAMEDIA Master 2.5
OTtBP
Outlook Express Q823353
Panda ActiveScan
PCDADDIN
PCDHELP
PCDLNCH
PCDrdsho
PhoneTools
PhotoGallery
PrintScreen
QFolder
QuickProjects
QuickTime
Readme
RealPlayer 4.0
RealPlayer Basic
Scan
SFR2
SFR
SkinsHP1
Software CineMaster 99
Spybot - Search & Destroy 1.4
SpywareBlaster v3.4
TrayApp
Ulead Photo Explorer 7.0 SE
Unload
USB MassStorage CardReader
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Visual IP InSight(Verizon Online)
WebReg
Webshots Desktop
Windows 98 KB891711 Update
Windows 98 KB896358 Update
Windows 98 Q823559 Update
Windows 98 Q840315 Update
Windows 98 Q888113 Update
Windows 98 Q890175 Update
Windows Media Player 7.1
WinZip
ZoneAlarm
Zork Grand Inquisitor
December 23rd, 2005, 08:11 AM
askey127

Jody,

That O20 entry looks like a new Trojan infection that has just appeared on the net.
McAfee just recorded its existence Dec 15. See here: http://vil.nai.com/vil/content/v_137572.htm
Let's see if we can make it go.
-----------------------------------------------------------
Remove log item with HighjackThis. Start HijackThis. If the opening screen shows, choose None of the above, just start the program.
Click Scan. When the Scan is complete, Check the following entry:
O20 - AppInit_DLLs: Interceptor.dll
Make sure all other windows except HJT are closed, and Click Fix Checked.
-----------------------------------------------------------
Unregister dlls for removal.
Go to Start, Run OR Start, Programs, Accessories, Command Prompt. Enter this line, followed by 'Enter'.

regsvr32 /u Interceptor.dll

It may show 'not found', or 'error' out.
-----------------------------------------------------------
File Deletion.
In Windows Explorer, navigate to this file. Use Find (F3) or Start, Search; then Delete this file, if present:
It will likely be located in C:\Windows\ or C:\Windows\System\
Interceptor.dll
If you have any problem deleting a file, right click the file and check Properties to see if it's read-only. Uncheck the read-only box, click Apply and OK. Then retry Delete.
If a message pops up saying "File in use", or something like that, hit Ctrl-Alt-Delete and look under the Processes tab. If the filename is in there, click End Process, then retry Delete.
Please make note of the location if you cannot delete.
-----------------------------------------------------------
Post a New HJT Log
Reboot your computer. Start HijackThis. Click Do System Scan and Save a Log File.
When the Scan is complete, select the whole log (Ctrl-A), copy and paste the log contents in a reply.

askey127
December 23rd, 2005, 08:56 AM
Tufenuf

askey127, Found this info on Interceptor.dll at the link below.

interceptor.dll file information
The process API Interceptor belongs to the software Interceptor DLL by Tenebril Inc.

Description: File interceptor.dll is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 163840 bytes (25% of all occurrence), 172032 bytes, 155648 bytes, 176128 bytes.
A .dll file (Dynamic Link Library) is a special type of Windows program containing functions that other programs can call. This .dll file can be injected to all running processes and can change or manipulate their behavior. Program starts upon Windows startup (see Registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs). The file is not a Windows system file. The program has no visible window. The process can be removed using the control panel Add\Remove programs applet. The service has no detailed description. It can change the behavior of other programs or manipulate other programs. interceptor.dll is able to record inputs, monitor applications, manipulate other programs. Therefore the technical security rating is 5% dangerous.

Important: Some malware camouflage themselves as interceptor.dll, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the interceptor.dll process on your pc whether it is pest.

http://www.file.net/process/interceptor.dll.html

Tufenuf
December 24th, 2005, 02:29 AM
JodyWood

Here is what I ran into when running the last set of instructions...
1) When fixing the "020 - AppInit_DLLs: Interceptor.dll" through Hijack This, I received the following error message:

An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O20 - AppInit_DLLs: Interceptor.dll)
Error #5 - Invalid procedure call or argument

Please email me at [email protected], reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows 9x 4.10.1998
MSIE version: 6.0.2800.1106
HijackThis version: 1.99.1

This message has been copied to your clipboard.
Click OK to continue the rest of the scan.

2) When unregistering the dll, it was unable to find anything to unregister.

3) When deleting the file, I was unable to find the file to delete. I did a file search without success. I then looked directly in C:\Windows\ and C:\Windows\System\ and C:\Windows\System32\ where I found nothing.

Issues having at this time...
1) Still receiving random pop-ups. Fewer than before, but still getting them. Here is an example URL from one of the pop-ups:

http://www.mediapurchases.com/normal/yyy65.html

2) If opting to shutdown the computer, it goes through the shutdown process and then reboots, which is not the desired affect.

So far, this seems to be a stumper to get fixed. Something is persistent in keeping the pop-ups around, but for some reason it does not appear obvious in the channels that I have gone down in past removal experiences - AdAware, Spybot, AntiVirus scans, Hijack This, etc. Though, I am positive we can get it resolved because this is an awesome forum! All help thus far and going forward is greatly appreciated!

Here is the latest Hijack This log...
Logfile of HijackThis v1.99.1
Scan saved at 12:07:08 AM, on 12/24/2005
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\PROGRAM FILES\VERIZON ONLINE\CONTROLPAD\Misc\a_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 204.127.202.4,216.148.227.68
December 24th, 2005, 07:30 AM
askey127
Jody,
It's very odd that Appinit_dll entry showed up in one log. Appinit entries aren't even supposed to show on W98 systems. That's probably why the error notice.

Download and run this:
http://www.pchell.com/downloads/VX2Finder9x.exe
Write down any files it finds.
-----------------------------------------------------------
Please download WebRoot SpySweeper from HERE (At the bottom of the page - Says 'SpySweeper 4.5 Free Trial' - It's a 2 week trial):
- Install it.
- Once the program is installed, it will open.
- It will prompt you to update to the latest definitions, click Yes.
- Once the definitions are installed, click Sweep Now on the left side.
- Click the Start button.
- When it's done scanning, click the Next button.
- Make sure everything has a check next to it, then click the Next button.
- It will remove all of the items found.
- Click Session Log in the upper right corner, copy everything in that window.
- Click the Summary tab and click Finish.
- Paste the contents of the session log you copied into your next reply.
If Spysweeper asks to reboot, it should be allowed.
If it doesn't ask for a reboot, do it anyway.
Otherwise, the bad files have an opportunity to make a comeback.

Please post results from VX2Finder and the log from Spysweeper.

askey127
January 4th, 2006, 05:49 AM
JodyWood

VX2Finder9x.exe log:
Files Found---

User Agent String---
{D180EDD7-318C-C0EA-9DA1-9815F9253A6A}
January 4th, 2006, 05:51 AM
JodyWood

Looks like log did not contain most recent information from scan I completed today, but here it is anyway...
Spy Sweeper Log, Part 1:
********
8:46 AM: | Start of Session, Saturday, December 24, 2005 |
8:46 AM: Spy Sweeper started
8:46 AM: Sweep initiated using definitions version 589
8:46 AM: Starting Memory Sweep
8:51 AM: Found Adware: look2me
8:51 AM: Detected running threat: C:\WINDOWS\SYSTEM\DULOADER.DLL (ID = 163642)
8:52 AM: Detected running threat: C:\WINDOWS\SYSTEM\PCFMGR.DLL (ID = 163642)
8:59 AM: Memory Sweep Complete, Elapsed Time: 00:12:42
8:59 AM: Starting Registry Sweep
8:59 AM: Found Adware: apropos
8:59 AM: HKLM\software\aprps\ (8 subtraces) (ID = 103741)
8:59 AM: HKLM\software\classes\interface\{bc333116-6ea1-40a1-9d07-ecb192db8cea}\ (5 subtraces) (ID = 103774)
9:04 AM: Found Adware: dollarrevenue
9:04 AM: HKLM\software\microsoft\drsmartload\ (1 subtraces) (ID = 916795)
9:04 AM: Registry Sweep Complete, Elapsed Time:00:05:44
9:04 AM: Starting Cookie Sweep
9:05 AM: Found Spy Cookie: clickandtrack cookie
9:05 AM: [email protected][2].txt (ID = 2397)
9:05 AM: Found Spy Cookie: exitexchange cookie
9:05 AM: hillard@exitexchange[1].txt (ID = 2633)
9:05 AM: Found Spy Cookie: yieldmanager cookie
9:05 AM: [email protected][2].txt (ID = 3751)
9:05 AM: Cookie Sweep Complete, Elapsed Time: 00:00:04
9:05 AM: Starting File Sweep
9:06 AM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because
it is being used by another process
9:06 AM: drsmartload.dat (ID = 198788)
9:12 AM: duloader.dll (ID = 163642)
9:14 AM: dcraw16.dll (ID = 163642)
9:15 AM: wgcthunk.dll (ID = 163642)
9:26 AM: dtmap.dll (ID = 163642)
9:27 AM: hkink.dll (ID = 163642)
9:27 AM: pcfmgr.dll (ID = 163642)
9:27 AM: dodmo.dll (ID = 163642)
9:27 AM: cqbinet.dll (ID = 163642)
9:27 AM: hmzrm110.dll (ID = 163642)
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7bea492f-5565-4805-8aac-4221a389b5b3.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb2fe1a7e-2062-48e1-b07e-9133805414cc.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs36bfb27b-aefb-455e-a14b-97972385a8da.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc74ff017-6fff-4e16-88de-7d7ab8bc51a1.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse23da81f-ad01-4d90-a38c-704e0f0050b0.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8527790f-3d3f-434f-b8d0-9f636ce08580.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs53b7f3fc-54a9-4dd7-b171-26355d1ac099.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs004496b7-5beb-4398-82b8-cb7a5d169b34.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1cd967b9-525d-47c2-8e29-4ba1d2cd58cf.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs97396915-fc2c-4a1e-949b-625a590b8e8c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsbfe2394c-a64c-4b32-b4a5-81185e55ea1f.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc9c9ffbf-1ed6-45b3-bbee-83c7c9d1b08b.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs85b4bf3b-92f2-47de-b949-299d40cb0c89.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0522f97e-57eb-4147-8692-9cfcaa2776fc.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs88f527d7-4a94-4ecd-bff8-6f29abc775da.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9ca99800-dd48-48ea-a828-7ccdd8f84437.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb3452032-735f-4334-a2e6-92f9fe0860ca.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs19ee155d-4133-4440-ac5a-e66077437c3c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7b3966b6-873e-46cd-a314-6231e62544e1.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5b6f8619-a247-4573-b897-151d69fffee9.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsca03a768-59a3-4a86-bafe-4e0845c1c040.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscddad64d-85e5-4480-91b4-c7555ad3c5dd.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs590fb751-a92a-49b7-a327-7dcd4c124e85.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsae3de781-0dee-4db2-86e5-34b7c2ca0689.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs63cdd53e-ae96-4e49-bf5e-4c4380e8b47e.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs206fe67b-c30e-42b8-a3c4-cb0d1181172d.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa989a7b1-9a3a-4d79-8716-3daf6aa9f2fd.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs37f0f5d7-890c-4668-9ac4-d5f6279b3ac2.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7d058a03-3ff1-48a9-a111-a8c057333514.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5d17687f-52c6-4afa-9d69-23b3218a262a.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsab666e82-e97b-4102-bf1c-84a3e831b386.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8c595f21-9ac6-40df-8d82-28f80b8e2a52.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs27588356-bb0d-4e06-95c1-00dedcc4fe3b.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfba30c60-54a3-43a9-b2a7-fcdae70ac938.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd142428e-67f8-4613-b966-30098100563c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs56dc0e0e-feef-4bfe-a2e2-d8e759885c04.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb023cd97-cc88-4aec-8bca-30f97f63e045.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsab17a5e5-16bd-42d2-b704-0f0e94b7365a.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf1cab072-6ae1-47d0-97f5-dbdcd58daba3.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs794d004e-fbde-4762-ac9c-5b6d6ba7237c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsead0f959-cf4d-4058-b992-b2101dbc45e9.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs126e14f4-510a-4261-b0cf-c632ebf1e62c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs80cb7b32-9492-48db-9300-79e3c6e5344d.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs963bedcc-6cb0-467c-b99d-4fae4f8e3ff7.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscc3057e3-0108-46fe-b0fc-bcb4b6313829.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscc846d00-c141-437d-816a-7721b9f01985.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscaf433d0-2631-4069-aa42-ca541f9b3883.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb1719908-1602-4266-83e4-3b81de4e0bb0.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3827b747-28ba-4e72-a9a3-ed7c29fc4668.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6348a4e2-fc5f-4d7b-a127-62445226d926.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs8b53bafd-9ea9-4b41-ad78-7d3f3ca41288.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsaaa951d2-d226-4ea8-a407-68d8c2d21dff.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs88394fa1-6568-4058-84b3-c01aa3831ded.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs27523558-79f7-49ab-94d6-ad9216184090.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsaa563923-4dbb-4bb4-ae12-2d6edebde023.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs34ecfe68-a17f-4a0b-bc7f-786ca2ae0a9c.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs473bede5-1f54-45d8-9a31-6d21f025b7c7.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0595565c-a80d-4292-b47e-677811a9f9f3.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0c34742f-282d-4089-aff5-1a98fbbff802.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs156753a6-c328-480d-854d-9e7240085259.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa9e39cf0-216c-428c-ad10-16464dd9886e.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs98fabbf4-afb1-4d71-92bc-5d709d66b195.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs11c8744a-88f2-4913-a3e3-2c69f81484de.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs6d01df37-1a8a-49c8-a94a-6faa494424a7.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs781b7452-cf57-4ebf-93b5-f5046e87b4ac.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs367e9fe4-f339-4b7d-a834-2f23cea8c8d7.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5e6d9681-25cd-437e-acc3-c2c1fdb5477b.tmp". The process cannot access the file because
it is being used by another process
9:36 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs55587904-4b19-49c5-bba3-f40f4ed8d33a.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1bcb14ea-9080-4d16-b1c3-233de54663d9.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5d69aa2a-0e24-4201-94a7-2c145e241ab7.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsab5f56d5-221e-4ab1-bd65-a5562535ef6c.tmp". The process cannot access the file because
it is being used by another process
January 4th, 2006, 05:52 AM
JodyWood

Spy Sweeper Log, Part 2:
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd3e75f77-058f-46d5-ad22-cf547dd1329d.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs80987da1-6928-4c05-868c-e3ab5f6a3ad3.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsb414d3b6-f8cf-43ff-99d8-2268c6459242.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf596748d-ddaf-46ec-b614-d4380bc4f038.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc9705b68-7151-4697-b227-987d417b03b0.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs150a6830-28a4-4f2b-93cc-a353d4dd757c.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc780b9d6-9d4b-4847-9bc5-c06c64cdc314.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs267cdb25-38c8-4894-b1d6-06b72ed0fd11.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs1cd4252a-7753-4247-9e47-ee25e3057f27.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsfed2bf4f-c83d-45b2-86ec-3faa756b95f5.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsec0aac93-da44-4cda-be4d-f550c23b1056.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7317be1f-f432-447a-ba33-746453a81dba.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5aadc2fd-91c5-4d61-9e11-f6ac2fafe899.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsc2507979-72cb-4697-aeda-4c5b9d0cd4b6.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0abd6221-0265-4b70-9fad-70ea06c63ee4.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs63506a15-02e9-4958-a04e-60b2fe2e63b7.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs0fc956b8-8973-40c0-8ed8-63b1827998ce.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse073a55b-2e86-4f5d-8bd8-19714ff5f81f.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs3122a4f2-e3a2-4dd8-b7b0-c75033e439e2.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs66332242-c525-424d-bd4d-5dd7a68b046a.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsd64151cf-51ab-4bb8-80d2-59d3cbf8ef64.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs4d86c096-af1d-4185-b1b3-4f1f070981a7.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs005f9630-6dcd-4718-b59f-7a8849eca467.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs49a74302-6531-4af6-81d5-e3f3ca44e453.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsa6436bbe-023c-4715-81ac-5c561dd79893.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscse8792fa9-dc68-46db-ac4f-ff073230f250.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsedfc2199-c309-436a-9487-f38dfe695867.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs09202afc-61c9-4356-9c46-538b2f1b408f.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs7b1cda05-f9ef-4a83-9861-deb0b8c54dde.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs544f8603-8c0f-4e1d-8259-ecf2ceefe7f9.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscscec2a087-6222-4932-a0b9-c627e3d7c67f.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs5e8fabf2-001c-47d8-a016-411d16f48dd3.tmp". The process cannot access the file because
it is being used by another process
9:38 AM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscs9f12650a-de55-486f-a0ce-7dd4abaa9f7c.tmp". The process cannot access the file because
it is being used by another process
10:35 AM: Found Adware: targetsaver
10:35 AM: class-barrel (ID = 78229)
10:36 AM: vocabulary (ID = 78283)
10:44 AM: c:\program files\aprps (2 subtraces) (ID = -2147481420)
10:59 AM: File Sweep Complete, Elapsed Time: 01:54:03
10:59 AM: Full Sweep has completed. Elapsed time 02:12:55
10:59 AM: Traces Found: 37
11:08 AM: Removal process initiated
11:09 AM: Removal process completed. Elapsed time 00:00:44
12:50 AM: Your spyware definitions have been updated.
12:51 AM: Updating spyware definitions
12:51 AM: Your definitions are up to date.
12:51 AM: | End of Session, Wednesday, January 04, 2006 |
********
8:20 AM: | Start of Session, Saturday, December 24, 2005 |
8:20 AM: Spy Sweeper started
8:24 AM: Your spyware definitions have been updated.
8:24 AM: | End of Session, Saturday, December 24, 2005 |
January 4th, 2006, 05:54 AM
JodyWood

So far, it appears the pop-ups are gone, but I do want to make sure this issue is cleared up. Are there any other items that need to be cleaned up? Do I need another Hijack This log posted for review?
Thanks a bunch,
Jody Wood
January 4th, 2006, 07:43 PM
askey127

Jodywood,

My initial response:

Quote:

PLEASE DON"T START A NEW THREAD WHEN YOU RESPOND.
THE HELPER MAY NOT EVER KNOW.

WE CAN CONTINUE HERE : http://discussions.virtualdr.com/sho...d.php?t=199645

THIS THREAD WILL BE CLOSED

Edit : Maybe I spoke too soon. Do you have a different machine posted in that thread? OS posted is different. You didn't mention it. I was confused.
I'll continue here.
thanks
askey127
January 4th, 2006, 08:13 PM
askey127

Jodywood,

Yes, let's run another HJT log and have a look.
It may be just fine, but better be sure.
Are you getting all normal machine responses?

askey127
January 9th, 2006, 04:40 AM
JodyWood

Sorry for the confusion. This is a different computer as you eventually determined. When people have issues, they come to me for help as I can usually find a solution. And thanks to this great forum, I typically can find a solution.

I will get a new HJT log for this computer sometime on Monday. Thanks for the help!
Jody Wood
January 18th, 2006, 01:05 AM
JodyWood

Finally, an opportunity to address this machine further.
Here is a new log.
It appears that the pop-up issues have been resolved.
However, this computer is still having shutdown issues. When shutting down, it goes through the shutdown process properly and then suddenly it starts to reboot. I am reviewing Microsoft's site for a possible solution, but if there are any suggestions, I would be glad to review.
How does the new Hijack This log look?
Thanks,
Jody Wood

Logfile of HijackThis v1.99.1
Scan saved at 11:00:39 PM, on 01/17/2006
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\WEBSHOTS\WEBSHOTS.SCR
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\PROGRAM FILES\VERIZON ONLINE\CONTROLPAD\Misc\a_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/v...fo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 204.127.202.4,216.148.227.68
January 18th, 2006, 07:57 AM
askey127

JodyWood,

I don't see any problems showing up in the log. This is a notorious issue in W98.

I would start here with the shutdown supplement:
http://support.microsoft.com/default...b;EN-US;239887

and check out the other stuff in Axcel's website here:
http://www.mdgx.com/

askey127