Need help with tool bar that wont go away

Discussion in 'adware, spyware & hijack cleaning' started by AlisonF, Jul 16, 2004.

Thread Status:
Not open for further replies.
  1. AlisonF

    AlisonF Registered Member

    Jul 16, 2004
    I have a tool bar that just says searchbar and then comes up with 5 topics that you can click and go to. I cannot right click on it to determine what it is. I want it gone. I have run Search and Destroy and gotten rid of all spyware but this still exists. I also have an windown that keeps popping up and I cannot stop that either. I have bloced that site but it always has a new extension on the end so that does not work.

    Thanks for any help!

    Here is my log from Hijack

    Logfile of HijackThis v1.97.7
    Scan saved at 11:32:49 AM, on 7/16/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\Program Files\Common files\WinTools\WToolsS.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\Common Files\Dell\EUSW\Support.exe
    C:\Program Files\\bin\tgcmd.exe
    C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\PROGRA~1\GLUETO~1\Grim cash.exe
    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    C:\Program Files\Common files\WinTools\WToolsA.exe
    C:\Program Files\WhenUSearch\Search.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\Documents and Settings\AlisonF\Local Settings\Temp\Temporary Directory 1 for\Here are the pics.exe
    C:\Program Files\AWS\WeatherBug\Weather.exe
    C:\Program Files\Common Files\WinTools\WSup.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
    C:\Documents and Settings\AlisonF\Desktop\MozillaFirebird\MozillaFirebird.exe
    C:\Documents and Settings\AlisonF\Local Settings\Temp\Temporary Directory 2 for\HijackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
    R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\2.bin\MYSRCHAS.DLL
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {30AA645C-BB3D-7DCB-D526-6C550EAF261B} - C:\WINDOWS\System32\jdghk.dll
    O2 - BHO: (no name) - {446ABBC3-6FF0-9AD9-4B89-4F2EEEC762CF} - C:\PROGRA~1\VCSURF~1\third phone.dll
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
    O3 - Toolbar: File iso open - {7F9797BA-2CF8-2826-40D1-FE8A9A7D0978} - C:\PROGRA~1\VCSURF~1\third phone.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\\bin\tgcmd.exe" /server /startmonitor /deaf
    O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [WorkFlo] D:\Install\WorkFlow.exe
    O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\\Charter\bin\SSRunScript.exe" /script "C:\Program Files\\Charter\vbs\verifyconnection.vbs" /args //b startupdelay
    O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\Documents and Settings\AlisonF\apropos_client_loader.exe" /HideUninstall /PC="AM.NICT" /ShowLegalNote
    O4 - HKLM\..\Run: [version] C:\WINDOWS\System32\version.exe
    O4 - HKLM\..\Run: [comnvert.exe] C:\WINDOWS\System32\comnvert.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [SupportFind] C:\PROGRA~1\GLUETO~1\Grim cash.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
    O4 - HKLM\..\Run: [f0yc1igq.exe] C:\WINDOWS\f0yc1igq.exe /dk
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
    O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\System32\vbleeo.exe
    O4 - HKLM\..\RunServices: [RunDLL32] C:\WINDOWS\System32\vbleeo.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [comnvert.exe] C:\WINDOWS\System32\comnvert.exe
    O4 - HKCU\..\Run: [BrowserPop] C:\Documents and Settings\AlisonF\Local Settings\Temp\Temporary Directory 1 for\Here are the pics
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
    O4 - HKCU\..\RunServices: [Runtime Process] C:\WINDOWS\Csrss.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: f0yc1igq.lnk = C:\WINDOWS\f0yc1igq.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Whistle (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: WeatherBug (HKCU)
    O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
    O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) -
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
    O16 - DPF: {5763F8E8-0DD7-4A0F-ADB0-9F64C8F2C349} (Pixami/Snapfish Upload UI Control) -
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} -
    O16 - DPF: {7EF1788A-8C66-4A77-95D2-3341111E4ACD} (CouponsIncIECtl2 Class) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) -
  2. TonyKlein

    TonyKlein Security Expert

    Feb 9, 2002
    The Netherlands
    First, would you please send a copy of the C:\WINDOWS\System32\vbleeo.exe file to for analysis? (replace 'AT' by @)
    It would seem to be an all new baddie, and we'd like to have a closer look at it!

    Much appreciated :)

    The file could possibly have the "Hidden" attribute. Here's how to show hidden and operating system files

    After sending us the file, run an online virus scan at Panda Active Scan

    Next, download the latest version of Ad-Aware at

    After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions.

    Now do the following:

    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
    check: "Unload recognized processes during scanning."
    - Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
    Check: "Let Windows remove files in use after reboot."
    Press "Scan Now"

    - Check option "Use Custom scanning options"
    - Check option "Activate In-Depth Scan"
    - Press "Select drives\folders to scan"
    - Select the active partition which is usually C:

    Now press "Next" to let Ad-aware scan your drives...

    It will find a number of "bad" files and registry keys.

    Right-click in that pane and choose "select all"
    Now press "Next" again.

    It will ask you whether you'd like to remove all checked items. Click OK.
    Finally, close Ad-Aware, and reboot.

    That ought to get rid of most of your spyware.

    When you've done all that, restart your computer, re-run Hijack This, and show us a fresh log.
    There will be more to do!

Thread Status:
Not open for further replies.