Is der a problem?

Discussion in 'adware, spyware & hijack cleaning' started by tm6527, Jun 26, 2004.

Thread Status:
Not open for further replies.
  1. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    My computers been running a little slower then usual. I have also been recieving more popups then usual, so I'm Just curious if anythings wrong.

    with popups like, 'your computer maybe running spyware' are usually some obvious signs that their probably is spyware or adware.

    Waiting for instructions
    thx
     
    tm6527, Jun 26, 2004
    #1
  2. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    dvk01, Jun 26, 2004
    #2
  3. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    I already have adware and have ran a scan. Five files were found, but they were all cookies.

    I already have spybot and have ran a scan, Nothing threatning was found.

    I alreay have HijackThis v1.97 and have ran a scan. Below is dah log file thing


    - - - - - - - - - -
    Logfile of HijackThis v1.97.7
    Scan saved at 1:42:53 AM, on 6/26/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\brsvc01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\brss01a.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\BRMFRSMG.EXE
    C:\WINDOWS\Explorer.EXE
    C:\docume~1\roland~1\locals~1\temp\XM1.exe
    C:\WINDOWS\System32\S3apphk.exe
    C:\WINDOWS\System32\MMTrayLSI.exe
    C:\WINDOWS\System32\MMTray2k.exe
    C:\WINDOWS\System32\MMTray.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\EghX.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\System32\EghX.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\ROLAND~1\LOCALS~1\Temp\Rar$EX00.848\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.davesmotors.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Core Library - {6CDF3C49-20E6-48d7-811B-9F5DD17F1D90} - C:\WINDOWS\System32\sfg5d8c.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [XM1] C:\docume~1\roland~1\locals~1\temp\XM1.exe
    O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
    O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
    O4 - HKLM\..\Run: [MMTray] MMTray.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg5d8c.dll
    O4 - HKLM\..\Run: [3XWHLG75B3HLJ8] C:\WINDOWS\System32\Oval73H.exe
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [IM] C:\PROGRA~1\EARTHL~1\aim.exe -cnetwait.odl
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50151/QDow_AS2.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab
    O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab
     
    tm6527, Jun 26, 2004
    #3
  4. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    Several doubtful entries

    first it appears to be peper trojan so Start by downloading & running the peper trojan removal tool from the spykiller website in my signature, You must be online and connected to the internet while running it. It will flash up, say downloading temp files then close with no warning. That means it is done.

    Reboot

    Before you start, please unzip or move hijackthis to a separate folder. The program will make backups in the folder in the folder it's in.
    These easily get lost in a Temp folder or in the root of C: or get scattered all over the desktop and we need to empty the temp folders to remove the hijackers

    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked


    O2 - BHO: Core Library - {6CDF3C49-20E6-48d7-811B-9F5DD17F1D90} - C:\WINDOWS\System32\sfg5d8c.dll

    O4 - HKLM\..\Run: [XM1] C:\docume~1\roland~1\locals~1\temp\XM1.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg5d8c.dll
    O4 - HKLM\..\Run: [3XWHLG75B3HLJ8] C:\WINDOWS\System32\Oval73H.exe
    O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50151/QDow_AS2.cab

    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\System32\sfg5d8c.dll
    C:\WINDOWS\System32\Oval73H.exe
    C:\WINDOWS\System32\EghX.exe

    then go to C:\Documents and Settings\USER NAME\Local Settings\Temp and select everything in that folder and delete it

    as XP will not let you delete files less than 24 hours old as it thinks it might need them please also do this
    while in the temp folder, select view and select details.
    then right click a blank part and select arrange icons by, and select show in groups and modified, that will give a list of all files in date order with today at the top of the page.
    select all the files/folders except the today ones and delete them all.

    and select EVERYTHING in C:\windows\temp except temporary internet files, cookies and history folders and delete all that as well

    1) Open Control Panel
    2) Click on Internet Options
    3) On the General Tab, in the middle of the screen, click on Delete Files
    4) You may also want to check the box "Delete all offline content"
    5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
    6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive

    then
    Reboot normally &

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware 6 from http://www.lavasoft.de/support/download

    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &

    Run ADAWARE

    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least 01R324 22.06.2004 or a higher number/later date
    Then ........

    Make sure the following settings are made and on -------"ON=GREEN"
    From main window :Click "Start" then " Activate in-depth scan"

    then......

    click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

    then.........

    go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot"

    then...... click "proceed" to save your settings.

    Now to scan it´s just to click the "Scan" button.

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries.

    reboot again

    then post a new hijackthis log to check what is left and tell us if it has cured the problem
     
    dvk01, Jun 26, 2004
    #4
  5. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    srry about the long response, but most of dis was new 2 me.

    first it appears to be peper trojan so Start by downloading & running the peper trojan removal tool

    Well, I went to http://www.computercops.us/downloads-cat-6.html and from there I downloaded...

    Peper Removal Tool
    Description: Tool for removal of the Peper Trojan a/k/a SandBoxer
    Version: Filesize: 800.00 Kb
    Added on: 13-Feb-2004 Downloads: 7766

    hehe...

    The program will make backups in the folder in the folder it's in.

    Wasn't to sure how to move program (cut & paste and placed in some folder I can get from internet explorer favorites?) so I deleted the old backups in folder.

    When I ran HiJack, I did not find this one------>
    O4 - HKLM\..\Run: [3XWHLG75B3HLJ8] C:\WINDOWS\System32\Oval73H.exe

    eventhough I see it's listed above, I doubled checked, so I musta deleted it or something?

    Reboot into safe mode ....."Apply to all folders" Click "Apply" then "OK"

    I followed all instructions, but when I'm done should I undo how I left settings to its recommendationso_O

    Delete these files

    C:\WINDOWS\System32\sfg5d8c.dll
    C:\WINDOWS\System32\Oval73H.exe
    C:\WINDOWS\System32\EghX.exe

    I search as administrator and I didn't find any of these files, did I do something wrongo_O

    then go to C:\Documents and Settings\USER NAME\Local Settings\Temp and select everything in that folder and delete it

    I did all of this and they were mostly microsoft office suite files.

    and select EVERYTHING in C:\windows\temp... and delete all that as well

    I deleted:

    ISTMP0.DIR
    ISTMP1.DIR
    ~offilt
    ~WZS2A29.TMP
    Altnet
    BullGuard
    SprintLTD_501254​

    I also deleted way over 30 'Perfib_perfda ta_xxx.dat' files and:

    Report.xml
    T30DebugLogFile.txt
    Xtet._x_
    Xtext.exe

    and have not deleted any '.TMP' files

    3) On the General Tab, in the middle of the screen, click on Delete Files
    ... check the box "Delete all offline content"
    5) ...
    6) You can now click on Delete Cookies ...

    Did all this and reboted.


    Well I'm tired now, so I'll continue tommorow. :ninja:
     
    tm6527, Jun 26, 2004
    #5
  6. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    Off topic for awhile to something thats been bothering me

    As I have been going through old Word/notepad files, I have either seen some new files I have never seen before or some inserted text I have never seen or placed in before.

    This is what they read:

    Wordpad File:vocab23 discovered 6.25.04
    'I won't back off one damned inch when the truth is at stake! I don't make a point of ridiculing people in general, but when an organization like this, or any enemy, parades itself as divinely sanctioned, and all the while they brainwash the ignorant, and assure that they will not be saved'

    I dont know what it means but it sounds scary to me :eek:

    msWord file:Document created: Wednesday, September 03, 2003, 3:57:42 AM
    'NO matter who you are, no matter where you live, and no matter how many people are chasing you, what you do read. For instance, if you are walking in the mountains, and you don't read the sign that says "Beware of Cliff" because you are busy reading a joke book instead, you may suddenly find yourself walkig on air tather than on a sturdy bed of rocks. I'

    I *can't write like this or explain somthing like that, its amuzing but at the same time, I dont like finding them.

    msWord file:Documentsdfasdfadsfasdfadsfadsf created: Saturday, December 20, 2003, 6:31:00 PM
    '#etg +tncl 152
    #Betas-XDCC +mntrL'

    Now this one look like a download info for a file via VIRC


    Has any1 seen anything like this before, files moved or new docs or text added to existing before?

    I think its either spyware/adware doh not sure, I remember once when I visit this *special sites, dis strange message popup up in vbokay. From memory it read "Naught boy". I dont remember what it said exactly but it was around there.

    I know theirs more, I cant remember anymore

    Just looking for comfort so feel free to commit
     
    Last edited: Jun 27, 2004
    tm6527, Jun 26, 2004
    #6
  7. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    delete all the tmp files you found that you didn't delete last time

    don't worry if the other files were missing as they should have gone with the peper removal tool, we like to check though

    now please post a new hjt log so we can see if you are clear

    if you suspect that you have a hidden hacker program and by the sound of it, it's a possibility try this as well

    I would strongly recommend downloading and running a specialised anti trojan
    lists here http://www.wilders.org/anti_trojans.htm

    the antitrojan that I use for dealing with them is

    TDS3 from http://tds.diamondcs.com.au/

    download & install the 30 day free trial, update it manually as described here http://tds.diamondcs.com.au/index.php?page=update as the trial version doesn't have auto update enabled

    then press scan control & tick all the little boxes in the bottom part of that window, press save configuration and then close that window by pressing the red X in top right corner, then select system testing and select full system scan

    sit back with a cup of coffee and watch what it finds

    NOTE:

    Unlike set and forget av's TDS works with you, it doesn't auto delete anything but puts a list of found suspect files in the bottom window

    right click any file it finds and it gives you options on dealing with it, the normal selection would be delete , but first select "save as text", that will create a logfile of all the found suspect files and put it in the TDS directory called scandump.txt.

    post back with the tds log after running please, just copy & paste the entries from the scandump.txt
     
    dvk01, Jun 27, 2004
    #7
  8. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    ooooooooohhhh I see, so thats what u meant by downloading & running the peper trojan removal tool from the spykiller website in my signature, u suggested/recommended me visiting ur website at www.thespykiller.co.uk not google search it. :oops:

    Well, I have done both an adware and spyware check below is dat hiijack log:

    Logfile of HijackThis v1.97.7
    Scan saved at 9:45:05 AM, on 6/27/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\brsvc01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\brss01a.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\System32\BRMFRSMG.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\S3apphk.exe
    C:\WINDOWS\System32\MMTrayLSI.exe
    C:\WINDOWS\System32\MMTray2k.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\System32\MMTray.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\ROLAND~1\LOCALS~1\Temp\Rar$EX00.731\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.davesmotors.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
    O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
    O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
    O4 - HKLM\..\Run: [MMTray] MMTray.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [Microsoft Tray] C:\Program Files\Kazaa\My Shared Folder\WinterSports4 (1).exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [IM] C:\PROGRA~1\EARTHL~1\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    O4 - Startup: BadBlue.lnk = C:\Documents and Settings\Rolando M\Desktop\badblue.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct1_x.cab
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
    O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab
    O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab

    Now I will delete those TMP files
     
    tm6527, Jun 27, 2004
    #8
  9. tm6527

    tm6527 Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    40
    5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files

    I think I deleted those .TMP in this step

    O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
    (Can I delete this, I don't need it anymore)
    O4 - HKLM\..\Run: [Microsoft Tray] C:\Program Files\Kazaa\My Shared Folder\WinterSports4 (1).exe
    (I dont know what this is and I dont have Kazaa, I have Kazaa lite, so i think I should delete this)
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    (I downloaded this but later deleted, I think I can delete this)
    O4 - Startup: BadBlue.lnk = C:\Documents and Settings\Rolando M\Desktop\badblue.exe
    (I also deleted this one, I was worried about the RIAA when I downloaded this one, I think its safe to delete)

    Well I'll continue the next set of steps tommorrow and will tell u of the results, thanks so far.

    About my computers current condition, popups are back to normal amount, computers still slow, probably cause I'm downloading, so everything is better.
     
    tm6527, Jun 27, 2004
    #9
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...