HiJack Log ... Please help my computer!

To help us to best help you, please follow the steps below closely and in the order given and do not skip anything. If you have any difficulty, please post back letting us know what steps you have completed, what you found while doing the scans if anything along with details about any problems you may have encountered in completing the steps. The more details you can provide the better. Don't be afraid to ask for additional help if you don't understand something!

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following: your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message.(Do NOT copy/paste the log into your post).

- Detail instructions are covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

This has nothing to do with your problem but I wondering why in the world would you be using AOL when you have Optonline? Why pay for both? And AOL (in my opinion) is junk anyway and they install stuff on your system without asking you which waste loads of system resources.

You should not be using both Microsoft AntiSpyware and GIANTAntiSpywareCleaner. You need to uninstall both of these. Then reboot your system.
After reboot download Microsoft Windows AntiSpyware 1.0.509 (Beta 1) from http://www.majorgeeks.com/download4466.html and install it, update it and run a full system scan with it. Even if it appears like you only have one installed, please uninstall, reboot, and reinstall.

I'm hoping this will take care of a real nasty (the isrvs lines) piece of malware below. Make sure you do this before continuing. I'm leaving fixes below for these isrvs lines too but if the scan works, you will not see the lines in your log later.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side.
Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\System32\n?lookup.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hgftyn.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll (file missing)
O4 - HKLM\..\Run: [YIsk] C:\documents and settings\winme\local settings\temp\YIsk.exe
O4 - HKLM\..\Run: [VNHmVPc] C:\documents and settings\winme\local settings\temp\VNHmVPc.exe
O4 - HKLM\..\Run: [ugdxmcorqw] C:\WINDOWS\System32\mtsevjit.exe
O4 - HKLM\..\Run: [t62P37l] wlnmdmat.exe
O4 - HKLM\..\Run: [rXLz] C:\documents and settings\winme\local settings\temp\rXLz.exe
O4 - HKLM\..\Run: [qbsh] C:\WINDOWS\qbsh.exe
O4 - HKLM\..\Run: [jFMb] C:\documents and settings\winme\local settings\temp\jFMb.exe
O4 - HKLM\..\Run: [gtkp] C:\WINDOWS\gtkp.exe
O4 - HKLM\..\Run: [fvloxc] C:\WINDOWS\System32\fvloxc.exe
O4 - HKLM\..\Run: [FRPnxP] C:\documents and settings\winme\local settings\temp\FRPnxP.exe
O4 - HKLM\..\Run: [f1S5] C:\documents and settings\winme\local settings\temp\f1S5.exe
O4 - HKLM\..\Run: [DWLFrdI] C:\documents and settings\winme\local settings\temp\DWLFrdI.exe
O4 - HKLM\..\Run: [dUhnm] C:\documents and settings\winme\local settings\temp\dUhnm.exe
O4 - HKLM\..\Run: [cbrqzifeprb] C:\WINDOWS\System32\mtsevjit.exe
O4 - HKLM\..\Run: [17l2svN] C:\documents and settings\winme\local settings\temp\17l2svN.exe
O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS\system32\n20050308.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKCU\..\Run: [Dlio] C:\Documents and Settings\WinME\Application Data\ooce.exe
O4 - HKCU\..\Run: [cxtFRXJpR] vxbman32.exe
O4 - HKCU\..\Run: [Pfdsxy] C:\WINDOWS\System32\n?lookup.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {2C8EEB84-6D60-11D4-BD64-0050048A82BF} (eshare communications NetAgent Customer ActiveX Control version 2) - http://tech-b.mhi.aol.com/netagent/objects/custappx2.CAB
O16 - DPF: {D18B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.slotchbar.com/ist/softwares/remove/ist_remove.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\fp8403lqe.dll (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hgftyn.exe
C:\documents and settings\winme\local settings\temp <--- delete all files and subfolders in this temp folder (some may be denied - just note which ones and continue)
C:\WINDOWS\System32\mtsevjit.exe
C:\WINDOWS\wlnmdmat.exe or C:\WINDOWS\system32\wlnmdmat.exe
C:\WINDOWS\qbsh.exe
C:\WINDOWS\gtkp.exe
C:\WINDOWS\System32\fvloxc.exe
C:\WINDOWS\system32\n20050308.exe
C:\WINDOWS\isrvs\desktop.exe
C:\WINDOWS\isrvs\ffisearch.exe
C:\Documents and Settings\WinME\Application Data\ooce.exe
C:\WINDOWS\vxbman32.exe or C:\WINDOWS\system32\vxbman32.exe
C:\WINDOWS\isrvs\mfiltis.dll

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Let me know if you have any problems finding or deleting any of these files.
Now:
Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin
And Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.