Can not get rid of iPend

I have been trying to get rid of ClientMan. I have run Spybot and Ad-a-ware to fix things and have used manual methods from Kephyer to remove it. After I remove everthing on rebooting the following registry items reappear.
Hkey_Usersefault\Software\iPend
Hkey_Current_User:Software\iPend
I hear hard disk activity even though nothing is being used. If I open Windows Task Manager and click on End task for Explorer.exe the hard disk activity stops.

I have run HiJack This and included the log as well as startup list below.

Any help to remove iPend will graetly be appreciated.

Thanks
Hoople

Logfile of HijackThis v1.97.7
Scan saved at 9:34:09 PM, on 5/3/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE UTILITIES\FAMONHKW.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE UTILITIES\FADSKMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE FIREWALL\CPD.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\CRASH PROTECTOR\CRASHMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\CRASH PROTECTOR\CMCP16.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_1_6_0.DLL
O2 - BHO: (no name) - {753af0e0-1c2e-11d8-8cdb-00080e9c6689} - C:\WINDOWS\APPLICATION DATA\STNAOALYMGR.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {73C53DA0-1E9B-11D8-8CDB-00080E9C6689} - (no file)
O2 - BHO: (no name) - {0982868C-47F0-4EFB-A664-C7B0B1015808} - C:\WINDOWS\SYSTEM\MSKHHE.DLL
O2 - BHO: (no name) - {0BA1C6EB-D062-4E37-9DB5-B07743276324} - C:\WINDOWS\SYSTEM\MSDAIM.DLL
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\SYSTEM\MSIBKD.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_1_6_0.DLL
O3 - Toolbar: huttgldrkmk - {753af0e1-1c2e-11d8-8cdb-00080e9c6689} - C:\WINDOWS\APPLICATION DATA\STNAOALYMGR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [alogserv] c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [scanregistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [vshwin32exe] c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\VSHWIN32.EXE
O4 - HKLM\..\Run: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [POINTER] C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [taskmonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [mcafee guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [mcafeevirusscanservice] c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [loadpowerprofile] rundll32.exe powrprof.dll,loadcurrentpwrscheme
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Dell Home (HKCU)
O12 - Plugin for .ali: C:\PROGRA~1\INTERN~1\PLUGINS\NPAlice.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.dellnet.com/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {0122955E-1FB0-11D2-A238-006097FAEE8B} (CscClnt Class) - http://central1.clevercontent.com/cccabs/CleverContent.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://D:\VJ98\VSTUDIO6.CAB
O16 - DPF: Microsoft WFC Forms Designer - file://D:\VJ98\WFCFORMS.CAB
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.cedarpoint.com/CFIDE/classes/CFJava.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (WficaCtl Object) - http://demoroom.citrix.com/nfusemedia/wfica.cab
O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://powe45.vwh.net/downloads/upgradefinder.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37767.8465046296
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab
O16 - DPF: {023A3744-EA13-4C8A-8B23-ABF98974A9F5} (JoyOnPack Control) - http://gunbound.joyon.com/joyonpack.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll


StartupList report, 5/3/04, 9:38:48 PM
StartupList version: 1.52
Started from : C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v5.00 (5.00.2614.3500)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE VIRUSSCAN\ALOGSERV.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE UTILITIES\FAMONHKW.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE UTILITIES\FADSKMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE OFFICE\MCAFEE FIREWALL\CPD.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\CRASH PROTECTOR\CRASHMON.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\CRASH PROTECTOR\CMCP16.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
alogserv = c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\alogserv.exe
scanregistry = c:\windows\scanregw.exe /autorun
vshwin32exe = c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\VSHWIN32.EXE
Machine Debug Manager = C:\WINDOWS\SYSTEM\MDM.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
POINTER = C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
taskmonitor = c:\windows\taskmon.exe
mcafee guardian = "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

winmodem = WINMODEM.101\wmexe.exe
mcafeevirusscanservice = c:\Program Files\McAfee\McAfee Office\McAfee VirusScan\AVSYNMGR.EXE
loadpowerprofile = rundll32.exe powrprof.dll,loadcurrentpwrscheme

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

msmc = C:\WINDOWS\SYSTEM\msgked.exe

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 24/4/2004, 12:30:14)

[Rename]
NUL=c:\windows\cookies\default@z1.adserver[1].txt
NUL=c:\windows\cookies\default@bravenet[1].txt
NUL=c:\windows\cookies\default@atdmt[1].txt
NUL=c:\windows\cookies\default@as-us.falkag[1].txt
NUL=c:\windows\cookies\default@mediaplex[1].txt

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET BLASTER=A240 I5 D1 T4
LH C:\WINDOWS\AU30DOS.COM
PATH C:\PROGRA~1\MICROS~7\OFFICE;%PATH%;C:\PROGRA~1\NETWOR~1\MCAFEE~1
PATH=C:\BC5\BIN;%PATH%
SET CLASSPATH=C:\PROGRA~1\CANONC~1\PHOTOD~1\ADOBEC~1

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_1_6_0.DLL - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\WINDOWS\APPLICATION DATA\STNAOALYMGR.DLL - {753af0e0-1c2e-11d8-8cdb-00080e9c6689}
NavErrRedir Class - (no file) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}
(no name) - (no file) - {73C53DA0-1E9B-11D8-8CDB-00080E9C6689}
(no name) - C:\WINDOWS\SYSTEM\MSKHHE.DLL - {0982868C-47F0-4EFB-A664-C7B0B1015808}
(no name) - C:\WINDOWS\SYSTEM\MSDAIM.DLL - {0BA1C6EB-D062-4E37-9DB5-B07743276324}
(no name) - C:\WINDOWS\SYSTEM\MSIBKD.DLL - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85}

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[CscClnt Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\CSCCTRL.DLL
CODEBASE = http://central1.clevercontent.com/cccabs/CleverContent.cab

[CFForm Runtime]
InProcServer32 = C:\WINDOWS\SYSTEM\MSJAVA.DLL
CODEBASE = http://www.cedarpoint.com/CFIDE/classes/CFJava.cab

[WficaCtl Object]
InProcServer32 = C:\WINDOWS\SYSTEM\WFICA.OCX
CODEBASE = http://demoroom.citrix.com/nfusemedia/wfica.cab

[Cpuid Control]
InProcServer32 = C:\WINDOWS\CPUID.OCX
CODEBASE = http://powe45.vwh.net/downloads/upgradefinder.cab

[Microsoft Office Tools on the Web Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTC.DLL
CODEBASE = http://dgl.microsoft.com/downloads/outc.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37767.8465046296

[&Yahoo! Companion]
InProcServer32 = C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_1_6_0.DLL
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab

[JoyOnPack Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\JOYONP~1.OCX
CODEBASE = http://gunbound.joyon.com/joyonpack.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst0309.cab

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 7,087 bytes
Report generated in 1.220 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Hi Hoople,

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com

R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)

O2 - BHO: (no name) - {753af0e0-1c2e-11d8-8cdb-00080e9c6689} - C:\WINDOWS\APPLICATION DATA\STNAOALYMGR.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {73C53DA0-1E9B-11D8-8CDB-00080E9C6689} - (no file)
O2 - BHO: (no name) - {0982868C-47F0-4EFB-A664-C7B0B1015808} - C:\WINDOWS\SYSTEM\MSKHHE.DLL
O2 - BHO: (no name) - {0BA1C6EB-D062-4E37-9DB5-B07743276324} - C:\WINDOWS\SYSTEM\MSDAIM.DLL
O2 - BHO: (no name) - {447160CD-ECF5-4EA2-8A8A-1F70CA363F85} - C:\WINDOWS\SYSTEM\MSIBKD.DLL

O3 - Toolbar: huttgldrkmk - {753af0e1-1c2e-11d8-8cdb-00080e9c6689} - C:\WINDOWS\APPLICATION DATA\STNAOALYMGR.DLL

O4 - HKCU\..\Run: [msmc] C:\WINDOWS\SYSTEM\msgked.exe

O16 - DPF: {0122955E-1FB0-11D2-A238-006097FAEE8B} (CscClnt Class) - http://central1.clevercontent.com/cccabs/CleverContent.cab

Then reboot into safe mode and delete:
C:\WINDOWS\SYSTEM\msgked.exe

Then visit Windows Update. Install all available updates for Windows and IE
Post a new log when you are done.

Regards,

Pieter

 

Pieter
Wanted to thank you for your help. I followed your instructions and have run Adaware and Spybot and they come up clean; no iPend. Finally after several weeks of trying .
I still need to update Windows and IE but that will be for another day.
Thanks again
Hoople