PLEASE HELP QUICK!!!

Discussion in 'adware, spyware & hijack cleaning' started by annie_lynn, Jun 30, 2004.

Thread Status:
Not open for further replies.
  1. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    I've been tyring to fix some problems on my computer for over a week now.
    First, I have a Program called S3Display when I go in to add/remove programs and it won't let me delete that program. Second, I have all kinds of popups that I've never gotten before. I have MSN Toolbar and it seems to be stopping all the ones it used to, but it's not stopping some of these stange ones. Tonight the only thing I've had open was this website and one of the common popups I get it just says Loading... in the menu bar, there are a couple more that just have letters and numbers in the title. Also, my Quick Launch toolbar won't load and it keeps telling me it can't creat the toolbar.

    PLEASE HELP!!!

    Here is my Hijack This log:

    Logfile of HijackThis v1.97.7
    Scan saved at 10:30:51 PM, on 6/30/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
    C:\Program Files\MSN Apps\Updater\01.02.0000.2693\en-us\msnappau.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Andrea Harwell\Desktop\Andrea's Music & Stuff\Other\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/
    O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-us\msntb.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\en-us\msntb.dll
    O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
    O4 - HKLM\..\Run: [Updater] "C:\Program Files\MSN Apps\Updater\01.02.0000.2693\en-us\msnappau.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O9 - Extra button: ICQ Pro (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38119.944525463
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    Last edited: Jun 30, 2004
  2. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
  3. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    it said that it didn't detect a virus
     
  4. Marianna

    Marianna Spyware Fighter

    Joined:
    Apr 23, 2002
    Posts:
    1,215
    Location:
    B.C. Canada
    I really can't see anything in your log what could cause a problem. You could always try to repair your browser and see if that helps.

    Have a look here HOW to do it:

    http://www.theeldergeek.com/repair_ie6.htm
     
  5. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
    Click Here and download the VX2Finder.exe tool. Click on the VX2Finder.exe and then click on the Click to Find VX2.Betterinternet button. It will display the files, the Guardian Key and User Agent string. Now click the Make Log button. It will open the log in notepad. Copy and paste that log here and wait for further instructions.
     
  6. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    Here's the log that was requested:


    Log for VX2.BetterInternet File Finder

    Files Found---
    C:\WINDOWS\System32\6jo4svc.dll
    C:\WINDOWS\System32\6ko4svc.dll
    C:\WINDOWS\System32\6po4svc.dll
    C:\WINDOWS\System32\6yo4svc.dll


    Guardian Key--- is called:

    User Agent String---
    {5836E557-6A81-4D84-919A-F2AA78F2C0AD}
     
  7. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
    IMPORTANT!: Before you run this tool please close ALL running programs. Sign off and stay off the internet until the entire procedure is complete.


    Now run VX2Finder again and click on the Find VX2.Betterinternet button. It will display the entries as before. Select all these files

    C:\WINDOWS\System32\6jo4svc.dll
    C:\WINDOWS\System32\6ko4svc.dll
    C:\WINDOWS\System32\6po4svc.dll
    C:\WINDOWS\System32\6yo4svc.dll


    This time click on the Delete these files button. It will give you a message about one file to be deleted on reboot.
    It will ask to reboot to delete the last file. Go ahead and Restart the computer

    After it reboots run VX2Finder again and click on the User Agent button and it will delete the user agent string.

    Next click on the Guardian.reg button and it will delete the Guardian Key.

    Finally click the Restore Policy button to restore the Debug policy altered in the look2Me installation.

    Restart computer and come back here and post another log from VX2Finder.
     
  8. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    Log for VX2.BetterInternet File Finder

    Files Found---


    Guardian Key--- is called:

    User Agent String---
     
  9. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    So far none of the strange popups.
    But it still isn't letting me have a quick launch button. I've gone into properties and Taskbar & Start Menu Properties and selected the option Show Quick Launch and then apply, but it doesn't save it, the check mark keeps disappearing.
     
  10. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
    Put your XP or 2K installation disk in the drive and go to Start > Run and copy and paste this line in the Run box:

    sfc /scannow

    It will scan for and replace any altered or missing system files.
     
  11. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    All I have are emachines Restore CDs and there's two of them. I put in the first one and did what you said, but my Quick Launch still isn't working.
     
  12. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
  13. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    That link isn't working. I get a page cannot be displayed error.
     
  14. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
    It works for me. Copy and Paste it into the addressbar and see if it works.
     
  15. annie_lynn

    annie_lynn Registered Member

    Joined:
    May 22, 2004
    Posts:
    23
    That website is being really strange. I got it to load the page by doing copy and paste, but it kept looping around and wouldn't download. It finally brought up a download box but it only took like 1 second and now when I click on the UnInstaller icon it says no version is found to install. Then if I try to download again it tells me that I've already downloaded it and I can't try again until tomorrow.
     
  16. flrman1

    flrman1 Spyware Fighter

    Joined:
    Apr 11, 2004
    Posts:
    41
    Location:
    North Carolina
Thread Status:
Not open for further replies.