"Only The Best" Pop up, mshp.dll homepage default? WTF???

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by AntiZeroTrip, May 23, 2004.

  1. AntiZeroTrip

    AntiZeroTrip Private E-2

    Ok so heres the deal. I have been having problems with my computer as of late, it freezes, it auto reboots, Every time i restart it I get somthing like

    res://mshp.dll/sp.html#37049

    or

    res://mshp.dll/index.html#37049

    I know its not a webpage. whats the res at the beginning standing for? I know its got to do with this mshp.dll file and I search for it, find it, delete it and voila! next restart, there it is again. I did scans with ad aware and spyware blaster and its all clean. I ran norton over and over, nothing. so whats going on? help me get rid of it.

    Also, i get 2 constant pop ups, evan with my pop up blocker (Popup ad filter).
    the first one is one called "only the best". It comes up, and i c the window is there, but its just a very tiny box in the top left of my screen. you can't evan see whats in the window its so tiny. its only like a 1/4 of in inch. the second one says "warning, if you got this you may have spyware click to install... (blah blah blah)" It says in small grey text at the bottom that its an ad.

    heres the Hijack this log.

    [​IMG]

    you can see the mshp.dll there

    HELP!
     
    AntiZeroTrip, May 23, 2004
    #1
  2. Adrynalyne

    Adrynalyne Guest

    You need to remove the BHO msiesh.dll
    You need to remove all image.dll entries.
    Remove the Oval63h.exe entry.
    You also need to remove the mshp.dll entries.

    Backup your registry first.

    To be honest, I would try running Spybot, and Pest Patrol first.

    Then rerun the log and paste the report.

    Its better than a screenshot.
     
    Adrynalyne, May 23, 2004
    #2
  3. AntiZeroTrip

    AntiZeroTrip Private E-2

    any way to find pest patrols full version? or do i have to pay for it? can I get another program that is cheaper, or free and just as good?
     
    AntiZeroTrip, May 23, 2004
    #3
  4. Adrynalyne

    Adrynalyne Guest

    I don't know. Just use Hijack This if the shareware version doesn't cut it.

    Remove the above entries after backing up the registry.
     
    Adrynalyne, May 23, 2004
    #4
  5. AntiZeroTrip

    AntiZeroTrip Private E-2

    Its ok I found the full version. thanks for pointing that prog out to me, Its awsome! everything is fine now, my homepage is back to normal and no more pop ups. The shareware version of the program dosnt do anything but scan, u cant delete or quarantine anything unless you buy the full version. Thanks again.
     
    AntiZeroTrip, May 23, 2004
    #5
  6. Adrynalyne

    Adrynalyne Guest

    Glad to help.
     
    Adrynalyne, May 23, 2004
    #6
  7. AKlein

    AKlein Private E-2

    Next time post your own thread. This is considered thread hijacking and is counter productive.

    PLEASE HELP!! My pc is giving me fits!! Could you explain (for dummies) how to:

    remove BHO msiesh.dll
    remove all image.dll entries
    remove Oval63h.exe entry

    back up your registry...

    basically everything you explained in this thread. I am having these problems with "Only the best" pop ups, new home page requests. etc. I have Spyferret (actually puchased) and it does me no good other than listing the ones detected.

    Avenue A, Inc - Cookies
    Blazefind.searchenhancer.ISTbar - hijackers
    CoolWWWSearch.008K - hijackers
    CWS - registry key - Malware

    ANy help is greatly appreciated.
     
    Last edited by a moderator: Jun 17, 2004
    AKlein, Jun 10, 2004
    #7
  8. AKlein

    AKlein Private E-2

    Aklein again...for that generous and life saving soul who can help me...here is my hijack this logfileLogfile of HijackThis v1.97.7
    Scan saved at 3:11:49 PM, on 6/10/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\HistoryKill\histkill.exe
    C:\Program Files\HistoryKill\hkPopupKiller.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ScsiAccess.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Adam\Local Settings\Temporary Internet Files\Content.IE5\D9PLYRYN\HijackThis[1].exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jojo5.baseball.sportsline.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://windowsupdate.microsoft.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\Program Files\Submit\submithook.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: . - {D34F08C5-4F18-477c-86CB-1A9BEECFE37B} - C:\Documents and Settings\Adam\Application Data\winit\winit.dll
    O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\Documents and Settings\Adam\Application Data\winit\ipoy.dll
    O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\Documents and Settings\Adam\Application Data\winit\mfcuq.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\sdkqh32.dll,Install
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
    O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\sdkqh32.dll,Install
    O4 - HKLM\..\RunOnce: [delsubmit] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files\Common Files\submit.exe"
    O4 - HKCU\..\RunOnce: [Updater] rundll32 C:\DOCUME~1\Adam\APPLIC~1\winit\winit.dll,UpdateDll s
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.cheapguys.com
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1704b3b19a942ae8a820/netzip/RdxIE601.cab
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37721.3981828704
    O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://univ4.centra.com/SiteRoots/reliantrx/Install/CentraDownloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS1\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS2\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15

    Please help!!
     
    AKlein, Jun 10, 2004
    #8
  9. alanc

    alanc MajorGeek

    alanc, Jun 10, 2004
    #9
  10. AKlein

    AKlein Private E-2

    Thanks for the help. I have downloaded, updated and ran all of the above. Below is my new log. please help.

    Logfile of HijackThis v1.97.7
    Scan saved at 4:47:43 PM, on 6/10/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ScsiAccess.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\System32\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\HistoryKill\histkill.exe
    C:\Program Files\HistoryKill\hkPopupKiller.exe
    C:\Documents and Settings\Adam\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jojo5.baseball.sportsline.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://windowsupdate.microsoft.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\Program Files\Submit\submithook.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: . - {D34F08C5-4F18-477c-86CB-1A9BEECFE37B} - C:\Documents and Settings\Adam\Application Data\winit\winit.dll
    O2 - BHO: ShowSearch module - {E2DDF680-9905-4dee-8C64-0A5DE7FE133C} - C:\Documents and Settings\Adam\Application Data\winit\ipae32.dll
    O2 - BHO: (no name) - {FD9BC004-8331-4457-B830-4759FF704C22} - C:\Documents and Settings\Adam\Application Data\winit\advly32.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\sdkqh32.dll,Install
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
    O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\sdkqh32.dll,Install
    O4 - HKLM\..\RunOnce: [delsubmit] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files\Common Files\submit.exe"
    O4 - HKCU\..\RunOnce: [Updater] rundll32 C:\DOCUME~1\Adam\APPLIC~1\winit\winit.dll,UpdateDll s
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.cheapguys.com
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1704b3b19a942ae8a820/netzip/RdxIE601.cab
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37721.3981828704
    O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://univ4.centra.com/SiteRoots/reliantrx/Install/CentraDownloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS1\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS2\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
     
    AKlein, Jun 10, 2004
    #10
  11. AKlein

    AKlein Private E-2

    I did everything again and here is my NEW logfile...things are a bit better. please let me know how this looks.Logfile of HijackThis v1.97.7
    Scan saved at 6:28:21 PM, on 6/10/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\ScsiAccess.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\System32\qttask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\Messenger\MSMSGS.EXE
    C:\Program Files\HistoryKill\histkill.exe
    C:\Program Files\HistoryKill\hkPopupKiller.exe
    C:\Documents and Settings\Adam\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jojo5.baseball.sportsline.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://windowsupdate.microsoft.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
    O4 - HKCU\..\Run: [HistoryKill] C:\Program Files\HistoryKill\histkill.exe /startup
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.cheapguys.com
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1704b3b19a942ae8a820/netzip/RdxIE601.cab
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7b77298065d0b9/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37721.3981828704
    O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://univ4.centra.com/SiteRoots/reliantrx/Install/CentraDownloader.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS1\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
    O17 - HKLM\System\CS2\Services\Tcpip\..\{4EC83E17-5E26-46FA-95BE-5E5936A5D7F3}: NameServer = 63.90.6.35,199.170.121.15
     
    AKlein, Jun 10, 2004
    #11
  12. alanc

    alanc MajorGeek

    alanc, Jun 11, 2004
    #12
  13. vampyre

    vampyre Private E-2

    Thank you for the Very helpfull information. got rid of theis bug in short order.
     
    vampyre, Jun 13, 2004
    #13
  14. Capone2x

    Capone2x Private E-2

    Somebody please help meeeeeeeeeeeeee. I have had this "Only the Best" pop up on here for quite some time and it is getting rather annoying. I have every kind of spyware there is. Spybot S&D, Adaware, CWshredder and Pest Patrol and this doesnt work please help me...... here is my log if this helps.....

    Logfile of HijackThis v1.97.7
    Scan saved at 9:02:26 PM, on 6/13/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
    Running processes:
    C:\WINDOWS.000\System32\smss.exe
    C:\WINDOWS.000\system32\winlogon.exe
    C:\WINDOWS.000\system32\services.exe
    C:\WINDOWS.000\system32\lsass.exe
    C:\WINDOWS.000\system32\svchost.exe
    C:\WINDOWS.000\System32\svchost.exe
    C:\WINDOWS.000\system32\spoolsv.exe
    C:\WINDOWS.000\System32\svchost.exe
    C:\WINDOWS.000\Explorer.EXE
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
    C:\WINDOWS.000\System32\syscfg32.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\AIM\aim.exe
    C:\PROGRA~1\PANICW~1\POP-UP~1\PopUpStopperProfessional.exe
    C:\PROGRA~1\PESTPA~1\PPCONT~1.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\laz\LOCALS~1\Temp\Rar$EX00.975\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.000\SYSTEM\blank.htm
    O2 - BHO: (no name) - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: . - {D34F08C5-4F18-477c-86CB-1A9BEECFE37B} - C:\WINDOWS.000\winxj\winxj.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS.000\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
    O4 - HKLM\..\Run: [Configuration Loader] syscfg32.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
    O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\RunServices: [Configuration Loader] syscfg32.exe
    O4 - HKCU\..\Run: [PopUpStopperProfessional] C:\PROGRA~1\PANICW~1\POP-UP~1\PopUpStopperProfessional.exe
    O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: PopThis! Options... (HKLM)
    O9 - Extra button: AIM (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    Capone2x, Jun 13, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

     
    chaslang, Jun 13, 2004
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Capone, first you better get yourself a virus scanner installed you have a Worm.P2P.Lolol problem.
    This is the file: C:\WINDOWS.000\System32\syscfg32.exe
    See this link: http://www.viruslist.com/eng/viruslist.html?id=58453

    And if you have Pest Patrol and ran it, it is supposed to detect and clean this. See: http://www.pestpatrol.com/pestinfo/s/sdbot_syscfg32_exe_trojan.asp

    Do a couple quick online scans:
    http://housecall.trendmicro.com/housecall/start_corp.asp
    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    If you need a free virus scan program check out AVAST! Home: http://www.majorgeeks.com/download1968.html

    It is a favorite here on MG's.
     
    chaslang, Jun 13, 2004
    #16
  17. Capone2x

    Capone2x Private E-2

    I am currently running the Virus Scanner. What am i supposed to do now?
     
    Capone2x, Jun 14, 2004
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What virus scanner are you running and you should be connecting to the net right now while running it?
    Unless you mean you are doing the fast online scans???

    Make note of what they find and clean whatever any of those find.
     
    chaslang, Jun 14, 2004
    #18
  19. Capone2x

    Capone2x Private E-2

    It says that i have the Downloader.GK trojan
     
    Capone2x, Jun 14, 2004
    #19
  20. Capone2x

    Capone2x Private E-2

    I was running the online scan. It came out to be the Downloader.gk trojan. It doesnt give me an option to delete it in anyway.
     
    Capone2x, Jun 14, 2004
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Which online scanner?

    You really should give AVAST! Home a try. You need a full blown virus scanner/protection program.
     
    chaslang, Jun 14, 2004
    #21
  22. jolliff

    jolliff Private E-2

    Similarly, Spybot couldn't get rid of coolwwwsearch.008k for me. I searched for files updated since I was infected. I got rid of msiesh.dll. The major can of worms seemed to be in documents and settings\me\application data\mspt, which had exactly the offending time stamp. Also a number of other folders shared the stamp: 4c744d1f.zip, incoming, and portal (under windows, I believe, xp style). My wife on the same computer didn't have the symptoms under her profile. Having a bunch of dlls in my documents folder was suspicious. I appreciate everyone's help with this nastiness.
     
    jolliff, Jun 14, 2004
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please start your own thread for this issue. There have been three hijacks of this thread already. Each new individuals problem should be covered in there own thread especially when the problem is different. There is no similarity between Spybot with coolwebsearch problems which is adware/hijacker related and the last problem that Capone is having which is virus related.

    That being said Jolliff, download and run these:
    CWShredder http://www.majorgeeks.com/download4086.html
    CoolWWWSearch.SmartKiller http://www.majorgeeks.com/download4113.html
     
    chaslang, Jun 14, 2004
    #23
  24. jolliff

    jolliff Private E-2

    Yes, thank you Chaslang. Neither the CWshredder nor Smart Killer fixed me, but the directory deletion campaign I described (in association with Spybot) did remove the infestation I had, which is accurately described by the thread title "Only the Best" Pop up, mshp.dll homepage default, etc. So I wanted to contribute my less than quick fix, in response to AKlein and Capone2x, for those who may be searching for why the cleanups are ineffective against this problem.
     
    jolliff, Jun 14, 2004
    #24
  25. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    I seem to be having the same problems, as the others here... so thats why I seek advice. I ran spybot, ad-aware, cw shredder, and my symantec virus scanner and it definately helped clean out some garbage, yet im still having problems getting the ONLY THE BEST pop-ups to stop and my homepage to stay the same.

    after running the programs I noticed my homepage is different now than what it was before...

    res://idvxj.dll/index.html#37049

    instead of the

    res://mshp.dll/sp.html#37049

    ...that was listed before. After running the 4 programs I ran hijack this, to see if any of the files matched up as the others. Below my log is posted, and I guess I'm looking for some assistance.
    --------------------------------------------------------------------------------------------------------------------------
    Logfile of HijackThis v1.97.7
    Scan saved at 11:22:55 PM, on 6/14/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\WINDOWS\System32\wltrysvc.exe
    C:\Program Files\WZCBDL Service\WZCBDLS.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\ipbb32.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\System32\pctspk.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Dell\AccessDirect\dadapp.exe
    C:\Program Files\D-Link\Air Utility\AirCFG.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
    C:\WINDOWS\netyg32.exe
    C:\Program Files\Lime_Shop\Limeshop0.exe
    C:\Program Files\Lime_Shop\Limeshop1.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\HijackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\idvxj.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://idvxj.dll/index.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://idvxj.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\idvxj.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://idvxj.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\idvxj.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie/button/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {92B26DF9-71EB-63F5-BEEF-8CC4348A71E7} - C:\WINDOWS\system32\nettx.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
    O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [Limeshop0] "C:\Program Files\Lime_Shop\Limeshop0.exe"
    O4 - HKLM\..\Run: [netyg32.exe] C:\WINDOWS\netyg32.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm
    O9 - Extra button: ComcastHSI (HKLM)
    O9 - Extra button: Support (HKLM)
    O9 - Extra button: Help (HKLM)
    O9 - Extra button: AIM (HKLM)
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
     
    ThatsSoRolodex, Jun 14, 2004
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to MG's ThatsSo,

    Probably would have been better to start a new thread of your own and reference this thread as being similar. But at any rate now that your here,

    Get DLLFIX.EXE from: http://tools.zerosrealm.com/dllfix.exe
    1) Save the file to your Desktop, double click dllfix.exe and follow the prompts. This will create a folder called dllfix on your desktop.
    2) Click on this folder and then double click on start.bat.
    3) Select option 1 Run Find-All to scan your PC. This will create a log file.
    4) Post this log back here before running any fixes.
     
    chaslang, Jun 14, 2004
    #26
  27. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    I ran that .exe and my log is attached as so, next time ill start a new thread, thank you though.
     

    Attached Files:

    ThatsSoRolodex, Jun 15, 2004
    #27
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I did not find what I was looking for there. Can you please try this:

    1) go here and download Registrar lite and install it:
    http://www.resplendence.com/reglite
    2) Run it, copy and paste this line to reglite's address bar:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
    3) Click the "go" tab
    4) Find: "Appinit_Dlls" value on the right side panel.
    5) DoubleClick, copy and post what you find in the following fields in your next post....
    -Size:
    -Value:
     
    chaslang, Jun 15, 2004
    #28
  29. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    !!!! okay so i downloaded, installed and ran registar lite... when i go to copy and past in:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

    I hit "go" and nowhere do i see the following "Applnit_DLLs" anywhere on the screen.

    Also when I hit go, I also noticed that the adress bar changes from what I type to simply...

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

    and the description says...

    Configuration data used by 16-bit Windows 3.x applications running on Windows 2000 and earlier.

    (that may have no relevance, but I figured too much information is better than not enough)

    hopefully this may clear something up, thank you still for your help. Let me know what I can do.
     
    ThatsSoRolodex, Jun 15, 2004
    #29
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jun 15, 2004
    #30
  31. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Also, see this link from Microsoft on AppInit_DLLs: http://support.microsoft.com/default.aspx?scid=kb;en-us;197571

    I'm wondering if there is some kind of problem with Administrator priviledges and maybe that is why you cannot see it. See text in the MS link saying:

    "Normally, only the Administrators group and the LocalSystem account have write access to the key containing the AppInit_DLLs value."
     
    chaslang, Jun 15, 2004
    #31
  32. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    Okay, I am on an administrator account, so I can't imagine that being the reason... when I use registrarlite there are several things that come up... my guess is, and tell me if I'm wrong, is that the fact the 32 character limit cuts off the DLLs in each name???? I dont know, if you'd like me to post the keys registar lite comes up with, I can do that, maybe it would help.


    I apologize now that im hopping threads...

    I wish I knew how to do a screen shot, because mine comes up with keys... itd be easier to explain if i knew how to do it... if not I can list of what is show... let me know. thank you still
     
    ThatsSoRolodex, Jun 15, 2004
    #32
  33. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm little confused now....do you mean you can now see the AppInit_DLLs that I was looking for?
     
    chaslang, Jun 15, 2004
    #33
  34. Andy R

    Andy R Private E-2

    i downloaded a screenshot untility 1.0, very simple program. Saves jpg onto desktop using ctr-alt-F12
     
    Andy R, Jun 15, 2004
    #34
  35. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    According to the link that explained why the DLLs weren't coming up, I was under the impression that they might not come up due to the fact I may not be using an administrative account. I am using one, so then I was under the impression that the DLLs in the title were cut off due to the 32 character limit... therefore why when I use registar lite, several keys come up, but don't specifically show anyhwere on the screen "DLLs"... this is the impression I was under... but who am I... I took a screen shot to make this more clear, I figured this will make the most sense.

    Sorry for the confusion, and thank you for screenshot utility 1.0 Andy R
     

    Attached Files:

    ThatsSoRolodex, Jun 16, 2004
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    In RegistrarLite go to the top of the the registry then select search and enter AppInit_DLL.

    There should be two, one where I previously indicated and one in:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows\\AppInit_DLLs

    Edit:

    Size: 48
    Value: SYS:Microsoft\Windows NT\CurrentVersion\Windows
     
    chaslang, Jun 16, 2004
    #36
  37. tblanx

    tblanx Private E-2

    Howdy folks - new to the boards to please forgive me if im not being descriptive enough or whatnot. I have the Only the Best popups that popup frequently when I am loading IE. I also have an issue with when I boot up IE getting an error for my homepage = res://orugt.dll/index.html. I have a feeling I'm in the right board for this. I've ran Adaware and Spybot S&D and although they detected things on my machine, and claim to have whipped them from my computer, none of them seem to rid me of this problem. Some of the errors found on Spybot seem to reappear on reboots. I tried researching through various boards and also attempted to do the dll.exe fix thing but it was setup for windows 2000 or better and I am running on windows 98 on this machine. Anyone have any ideas or suggestions for me? I'm not sure what to really do, I know how to get to the registry and I downloaded HijackThis because that is what everyone hear seems to use as reference but I'm not sure if I need to be showing anythign at this point in my questioning?


    Please help!
    Thanks,
    TB
     
    tblanx, Jun 16, 2004
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to MG's tblanx,

    You really need to start your own thread for this Only The Best problem. We are having a bunch of these show up right now and they are proving to be quite difficult to resolve. If we mix multiple problems in one thread it will make it even more difficult. If you check thru a the other thread on this, you will notice we are still trying to track down how to cure the sucker. Begin a new thread with the info you just posted here. Include your HijaakThis log too. Then get in line and keep your eyes on the threads in process.
     
    chaslang, Jun 16, 2004
    #38
  39. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    I searched and found what you described... it had exactly what you had as the size and type.. heres the screenshot
     
    ThatsSoRolodex, Jun 16, 2004
    #39
  40. Capone2x

    Capone2x Private E-2

    Capone here again....I thought that i got rid of this problem but i when i went back on the internet i saw that my home page had changed and i kept on getting the "Only the best" pop up. I would really appreciate if someone could help me get rid of this.
     
    Capone2x, Jun 16, 2004
    #40
  41. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did not get screenshot, but don't need it. If you match what I showed, it's okay. I just wanted to check.


    Question: I don't remember if we discussed this or not (I'm working on too many of these logs right now :confused: ) Do you use the P2P Networking stuff? If not you should go to Add/Remove programs and uninstall it. It is not the cause of the "Only the Best" problem but it is another item that you do not want.
     
    chaslang, Jun 16, 2004
    #41
  42. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Capone,

    We are working on them. There are lot's of people having a problem with this. Last message I remember you posting here in this thread you were trying to fix some virus problems. Did you get all those worked out? If not, we need to get you virus free.
     
    chaslang, Jun 16, 2004
    #42
  43. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    Whoops sorry it was late last night... alrighty I'll get rid of the p2p stuff, I know it's a problem. If you have an idea where I can go from here, let me know, thank you still.
     
    ThatsSoRolodex, Jun 16, 2004
    #43
  44. Capone2x

    Capone2x Private E-2

    Chaslang......Thank you for responding. Unfortunately i have not been able to solve my virus problem. I really appreciate it if u guys can help me get rid of this virus or trojan or whatever it is that is.
     
    Capone2x, Jun 16, 2004
    #44
  45. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay this message is for both Capone2x and ThatsSoRolodex,

    I think you both should start a new thread for each of your problems. In those threads, state what your problem (or problems) are and what you have tried so far (i.e., Ad-aware, SpyBot, virus scans etc). Be specific! Add a current HijaakThis log to that first message. But don't forget to shutdown all applications first before running HijaakThis to make the logs smaller. And oh yeah...since things constantly evolve, update and run both Ad-aware & SpyBot before running HijaakThis too (I know you may have updated recently but it does not hurt to check first).

    The reason I am asking for you to do this is that this thread is getting to confusing to follow what has been going on and I think you both have different problems. Also, there have been requests for help by 5 different people. Needless to say with everything going on with these Only The Best issues we are getting quite dizzy. And if your problem is truly with "Only the Best" , be patient! Lot's of users are having problems and we are all working on this. So if there is no answer right away, it is probably because we do not have one yet.

    Thanks,
    Chas
     
    chaslang, Jun 17, 2004
    #45
  46. ThatsSoRolodex

    ThatsSoRolodex Private E-2

    with that... I still thank you for your help thus far.
     
    ThatsSoRolodex, Jun 17, 2004
    #46
  47. Capone2x

    Capone2x Private E-2

    Chaslang i made my own thread. Thank you for all of your help so far. The name of my thread is called "Only the Best" Pop-up and annoying home page problems.
    All i can do now is just wait for your response and your help on getting rid of this problem
     
    Capone2x, Jun 17, 2004
    #47
  48. harris12

    harris12 Private E-2

    I would very much appreciate anyones help on this.

    I too have 'acquired' the same BHOs/Pop ups. I have run awaware, spybot, spyblaster, and tried to run trend micro's scan (IE would shut down before the scan began). I then ran Hijack This with the following result...

    Logfile of HijackThis v1.97.7
    Scan saved at 10:16:24 AM, on 6/25/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Common Files\Microsoft Shared\Media Manager\airsvcu.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\system32\apiof.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\apphs32.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Dell\AccessDirect\dadapp.exe
    C:\Program Files\Dell\QuickSet\QuickSet.exe
    C:\Program Files\Dell\AccessDirect\DadTray.exe
    C:\WINDOWS\BCMSMMSG.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\System32\msiexec.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\unzipped\hijackthis[1]\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bhcaz.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://bhcaz.dll/index.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://bhcaz.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bhcaz.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://bhcaz.dll/index.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\bhcaz.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.isearch.com/index.php?ref=none
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {BD4BD4BF-792A-00AE-4757-C53BDB4E22C1} - C:\WINDOWS\appcs.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [apphs32.exe] C:\WINDOWS\system32\apphs32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKCU\..\Run: [PopularScreensaversWallpaper] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\F3SCRCTR.DLL,LES
    O4 - HKCU\..\Run: [Aodo] C:\Documents and Settings\Chris Pilgrim\Application Data\wouo.exe
    O4 - Startup: MyWebSearch Email Plugin.lnk = ?
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: MyWebSearch Email Plugin.lnk = ?
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {034CC2DC-3245-4B26-B5C7-7B8777739CB7} - http://64.158.165.147/060570/ca/adult1/adult1.exe
    O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - file://C:\install.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {683DFF0F-331F-44D2-B69B-46D7BFB58F32} (VacPro.canada_ver3) - http://www.advnt01.com/dialer/canada_ver3.CAB
    O16 - DPF: {69432678-2906-2705-1128-068943397621} -
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - http://download.getmirar.com/875505/files/installer.cab
    O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
    O16 - DPF: {CCA6CE4C-2199-4A4F-9542-12E0163D6841} (Dialer Class) - http://sessa.isprime.com:81/tel2net/CABEDialer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bondcollege.com
    O17 - HKLM\Software\..\Telephony: DomainName = bondcollege.com
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1B8BC0DD-4C4C-4B44-9C74-5991A18CFE92}: NameServer = 209.115.142.1,209.115.142.129,192.168.0.96
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bondcollege.com
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1B8BC0DD-4C4C-4B44-9C74-5991A18CFE92}: NameServer = 209.115.142.1,209.115.142.129,192.168.0.96
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = bondcollege.com
    O17 - HKLM\System\CS2\Services\Tcpip\..\{1B8BC0DD-4C4C-4B44-9C74-5991A18CFE92}: NameServer = 209.115.142.1,209.115.142.129,192.168.0.96

    I have also been having problems whenever I launch an MS program. Office attempts to reinstall???

    I would really appreciate your help.

    regards
     
    harris12, Jun 25, 2004
    #48
  49. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Harris,

    As I said to Capone2x and ThatsSoRolodex, you need to post in your own thread. This Only the Best hijacker has been an annoying, complex, confusing problem to resolve. It make it more difficult when trying to work multiple users problems in a single thread. It is worthwhile for you to look at the info in these other threads (especially ones that seem to come to a fix). A good one to look at would be this one: http://www.majorgeeks.com/vb/showthread.php?t=35165 because thats where we will be headed anyway. So post your log in your own thread with a good subject line indicating another Only the Best hijack and start learning about things like:
    1) Disabling System Restore
    2) Safe mode boot
    3) Disabling Network Security Service
    4) Enabling viewing of Hidden Files and Folders
    5) File searching for hidden files

    But before posting your HijaakThis log again, shut ALL applications down first and run a new log.
     
    chaslang, Jun 25, 2004
    #49
  50. thenewdeal

    thenewdeal Private E-2

    Hey guys, I went to spyware tools on here and downloaded HSRemove 2.32 and that took away whatever was taking over my homepage and it stopped the "only the best" and spyware ads that were popping up. I'd recommend giving it a try for yourself. Hope it works out.
     
    thenewdeal, Jul 3, 2004
    #50

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds