Got a new one for you...and this one is a mess too.

[southernlady]

Mobo, Don, whoever gets to this one, her name is Suzi and she has three accounts on this computer other than the admin account I believe. Anyway, I told her to run seperate HiJack This logs on each account. Here is her's. I went thru and found enough to know that she needs more help than I can give her. So I told her I would post it and where to register and tto post the others as seperate threads to keep them from getting confused. Liz

Logfile of HijackThis v1.98.2
Scan saved at 3:21:07 PM, on 10/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32LEXBCES.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32LEXPPS.EXE
C:Program FilesCommon FilesSymantec SharedccProxy.exe
C:WINDOWSSystem32CTsvcCDA.exe
C:WINDOWSsystem32driversKodakCCS.exe
C:Program FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exe
C:WINDOWSSystem32nvsvc32.exe
C:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
C:WINDOWSSystem32ScsiAccess.EXE
C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSSystem32MsPMSPSv.exe
C:WINDOW***plorer.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmm_tray.exe
C:Program FilesCommon FilesCMEIICMESys.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesHotbarbinHbinst.exe
C:Program FilesMessengermsmsgs.exe
C:PROGRA~1AWSWEATHE~1Weather.exe
C:WINDOWSsystem32sol.exe
C:Program FilesCommon FilesGMTGMT.exe
C:Program FilesBinaryBizhabiChat Messengerhabichat.exe
C:Program FilesMicrosoft MoneySystemmnyexpr.exe
C:PROGRA~1AIMaim.exe
C:PROGRA~1Webshotswebshots.scr
C:Program FilesKodakKodak EasyShare softwarebinEasyShare.exe
Cocuments and SettingsMomLocal SettingsTempTemporary Directory 2
for hijackthis.zipHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar =
http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://mail.yahoo.com/?.intl=us
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.ramgo.com/
R1 - HKLMSoftwareMicrosoftInternet
ExplorerSearch,Default_Search_URL = http://www.ramgo.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
http://www.ramgo.com/search.html
N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://mail.yahoo.com/?.intl=us"); (Cocuments and
SettingsMomApplication DataMozillaProfilesdefaultxe28cpwh.sltprefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine",
"engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_02.src");
(Cocuments and SettingsMomApplication
DataMozillaProfilesdefaultxe28cpwh.sltprefs.js)
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} - C:Program FilesMyWebSearchSrchAstt3.binMWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:Program FilesAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} -
C:Program FilesMicrosoft MoneySystemmnyside.dll
O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} -
COCUME~1ALLUSE~1APPLIC~1SetupSetup.dll
O2 - BHO: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310}
- C:PROGRA~1INCRED~1BHOINCFIN~1.DLL
O2 - BHO: Natural Language Navigation -
{60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:WINDOWSSystemBHO001.DLL
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} -
C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O2 - BHO: AIM Helper - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} -
C:Program FilesAIM Toolbaraimhelper.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no
file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} -
C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}
- C:Program FilesNorton Internet SecurityNorton
AntiVirusNavShExt.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE
C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [QuickTime Task] "C:Program
FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec
SharedccApp.exe"
O4 - HKLM..Run: [URLLSTCK.exe] C:Program FilesNorton Internet
SecurityUrlLstCk.exe
O4 - HKLM..Run: [MyWebSearch Email Plugin]
C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
O4 - HKLM..Run: [MMTray] C:Program FilesMUSICMATCHMUSICMATCH
Jukeboxmm_tray.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon
FilesRealUpdate_OBrealsched.exe" -osboot
O4 - HKLM..Run: [CMESys] "C:Program FilesCommon
FilesCMEIICMESys.exe"
O4 - HKLM..Run: [SSC_UserPrompt] C:Program FilesCommon
FilesSymantec SharedSecurity CenterUsrPrmpt.exe
O4 - HKLM..Run: [Hotbar] C:Program FilesHotbarbinHbinst.exe
/Upgrade
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe"
/background
O4 - HKCU..Run: [MyWebSearch Email Plugin]
C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
O4 - HKCU..Run: [Weather] C:PROGRA~1AWSWEATHE~1Weather.exe 1
O4 - HKCU..Run: [Symantec NetDriver Monitor]
C:PROGRA~1SYMNET~1SNDMon.exe
O4 - HKCU..Run: [HabichatClient] C:Program FilesBinaryBizhabiChat
Messengerhabichat.exe
O4 - HKCU..Run: [MoneyAgent] "C:Program FilesMicrosoft
MoneySystemmnyexpr.exe"
O4 - HKCU..Run: [AIM] C:PROGRA~1AIMaim.exe -cnetwait.odl
O4 - Startup: MyWebSearch Email Plugin.lnk = C:Program
FilesMyWebSearchbar3.binMWSOEMON.EXE
O4 - Startup: Webshots.lnk = C:Program FilesWebshotsLauncher.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:Program
FilesMyWebSearchbar3.binMWSOEMON.EXE
O8 - Extra context menu item: &AIM Search - res://C:Program FilesAIM
ToolbarAIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html...ml?p=ZSXXXXXX36
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
C:PROGRA~1AIMaim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
C:WINDOWSSystem32Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} -
C:Program FilesMicrosoft MoneySystemmnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:Program FilesMessengerMSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengerMSMSGS.EXE
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}
- C:PROGRA~1AWSWEATHE~1Weather.exe (HKCU)
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexp...plorer1_8us.cab
O16 - DPF: {05CE4481-8015-11D3-9811-C4DA9F000000} -
http://www.care2.com/go/z/3578/C2GTU.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader
Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {76D90D08-EAB7-46D8-BF99-87445BF59E72} (SystemInfo Class) -
http://www.surfdwaynow.com/dwayready/dpcsysinfo.cab
O16 - DPF: {B79483DA-061C-4239-ABBE-6F28EC6122C0} -
http://media.euniverse.com/cursorzone/file...setup_td035.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy
Upload Tool Class) -
http://us.dl1.yimg.com/download.yahoo.com/...ropper1_4us.cab
O17 -
HKLMSystemCCSServicesTcpip..{ED0E8A0D-AB97-4493-AD83-96B0C84496FA}: NameServer = 209.244.0.3 209.244.0.4

[southernlady]

This is what I found wrong:

R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.ramgo.com/
R1 - HKLMSoftwareMicrosoftInternet
ExplorerSearch,Default_Search_URL = http://www.ramgo.com/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
http://www.ramgo.com/search.html
O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} - C:Program FilesMyWebSearchSrchAstt3.binMWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL
O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} -
COCUME~1ALLUSE~1APPLIC~1SetupSetup.dll
O2 - BHO: Natural Language Navigation -
{60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:WINDOWSSystemBHO001.DLL
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL
O4 - HKLM..Run: [MyWebSearch Email Plugin]C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommonFilesRealUpdate_OBrealsched.exe" -osboot
O4 - HKLM..Run: [CMESys] "C:Program FilesCommon FilesCMEIICMESys.exe"
O4 - HKLM..Run: [Hotbar] C:Program FilesHotbarbinHbinst.exe/Upgrade
O4 - HKCU..Run: [MyWebSearch Email Plugin]C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
O4 - HKCU..Run: [Weather] C:PROGRA~1AWSWEATHE~1Weather.exe 1
O4 - Startup: MyWebSearch Email Plugin.lnk = C:ProgramFilesMyWebSearchbar3.binMWSOEMON.EXE
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:ProgramFilesMyWebSearchbar3.binMWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html...ml?p=ZSXXXXXX36
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:WINDOWSSystem32Shdocvw.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:PROGRA~1AWSWEATHE~1Weather.exe (HKCU)
O16 - DPF: {05CE4481-8015-11D3-9811-C4DA9F000000} - http://www.care2.com/go/z/3578/C2GTU.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocache/funwe...etup1.0.0.8.cab
O16 - DPF: {B79483DA-061C-4239-ABBE-6F28EC6122C0} -
http://media.euniverse.com/cursorzone/file...setup_td035.cab



C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe
C:Program FilesCommon FilesCMEIICMESys.exe
C:Program FilesHotbarbinHbinst.exe
C:PROGRA~1AWSWEATHE~1Weather.exe
C:Program FilesCommon FilesGMTGMT.exe

My reasoning for putting RealPlayer on there is that altho it's TECHNICALLY a legit program, it's bundled with adware. Liz

[Mobo]

Hi Liz, sorry for the delay. I was out

Have her rescan again and check each of these then close all browser weindows and click "fix checked"

O1 - Hosts: 216.177.73.139 auto.search.msn.com

O1 - Hosts: 216.177.73.139 search.netscape.com

O1 - Hosts: 216.177.73.139 ieautosearch

O2 - BHO: Natural Language Navigation -
{60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:WINDOWSSystemBHO001.DLL

O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} - C:Program FilesMyWebSearchSrchAstt3.binMWSSRCAS.DLL

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL

O4 - HKLM..Run: [Hotbar] C:Program FilesHotbarbinHbinst.exe/Upgrade

O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} -
COCUME~1ALLUSE~1APPLIC~1SetupSetup.dll

O2 - BHO: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310}
- C:PROGRA~1INCRED~1BHOINCFIN~1.DLL

O2 - BHO: AIM Helper - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} -
C:Program FilesAIM Toolbaraimhelper.dll (file missing)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no
file)


O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} -
C:Program FilesMyWebSearchbar3.binMWSBAR.DLL

O4 - HKLM..Run: [MyWebSearch Email Plugin]
C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe

O4 - HKLM..Run: [CMESys] "C:Program FilesCommon
FilesCMEIICMESys.exe"

O4 - HKCU..Run: [MyWebSearch Email Plugin]
C:PROGRA~1MYWEBS~1bar3.binmwsoemon.exe

O4 - Startup: MyWebSearch Email Plugin.lnk = C:Program
FilesMyWebSearchbar3.binMWSOEMON.EXE

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:Program
FilesMyWebSearchbar3.binMWSOEMON.EXE

O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html...ml?p=ZSXXXXXX36


then reboot into safe mode, open internet explorer, find then delete:
C:ProgramFilesMyWebSearch
C:PROGRA~1MYWEBS~1
C:Program FilesCommonFilesCMEII
C:Program FilesHotbar

[southernlady]

Mobo, Suzi needs to know about this tutorial on how to get into safe mode: http://dotcomsecurity.org/forum/viewtopic.php?t=17

I was chatting with her online while she was getting registered and the subject came up cause I know that she doesn't know that much about her computer. Liz

[dingysfamily]

Hi, this is Suzi. I've seen safe mode on the computer, but don't really know what it is. I saved the page with Liz's & Mobo's posts and see about trying to do what you have said Mobo. I guess I'm just not fully convinced of how bad y'all say my computer is since I can go anywhere; Liz said she was surprised I could go anywhere. But, I'll try it.

[Mobo]

There are some real security breaches there suzi that should be taken care of. I see those all the time and they arent real serious in nature but serious enough that they should be removed at first chance.

[dingysfamily]

Well, since I'm not computer tech savy that's why I saved your previous response so that I can try and follow the instructions you gave. I do realize that just because I'm not having any real problems, that isn't a sign I'm really 'safe'.

[Mobo]

Correct : and just take it one step at a time and you should be ok..

[dingysfamily]

Thank you. I'll holler if I need any help.

[Mobo]

Sure thing :mexican