Re:Cant get rid of msg121.dll and msg121.cpy.dll

sv_jim · Apr 1, 2004

quoting: dvk01 link=board=17;threadid=26142;start=0#msg151685 date=1080579357]
In approx 150 cases of msg121 that I have dealt with the only total cure has been the fix posted by Puff http://www10.brinkster.com/expl0iter/freeatlast/L2M/Msg121.htm

the others haven't been sucsessful

It's possible that the latest adaware update has included the cure but it needs a 2 or 3 stage total removal procedure

unfortunately the merijn fix only worked once for me on 121 but has worked very well on 117/118 and a couple of times on 120
Click to expand...

I've been battling this thing for 4 or 5 days now and finnally came across this great forum. I went to the URL suggeste and it appears that they have a fully automated version of the remover for win2k. Do you recommend using it? Thanks for your input.

Jim

dvk01 · Apr 1, 2004

Hi

I've split you off and given you your own thread a sit's very fdifficult to help 2 people in the same thread

first to check which versions of this parasite you have

Please download the KillBox from here:

http://download.broadbandmedic.com/VbStuff/KillBox.zip

UnZip it to it's own folder not to the Desktop or a Temp folder. Click on The KillBox.exe and it will open. Now click find then find msg.dll, then on the little pop up window, that says killbox file list, press file/create log and a pop up says do you want to create a log in notepad, say yes and then save as usual in notepad and copy & paste the resulting list here

and
so we can se what other nasties are causing you problems

go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.

sv_jim · Apr 1, 2004

OK, just need to make a couple of comments before pasting the logs. I have been working with XBlock, but so far no good results and they seem not to have been aware of the msg121, which I found by surfing the net. So some thing have been done, including running the uninstall procedure from look2me which doesn't work. I also realized that msg121.dll and msg121.cpy.dll were the problems but of course could not remove them. I did rename msg121.cpy.dll once, but it reappeared.

Having said that, I think things are still OK, but don't know for sure, so here come the logs requested.

I am extremely grateful to this forums support.

Jim

---------------

Log for KillBox ver.2.0.1
--------------------------

---msg{}dll search---
C:\WINNT\system32\msg121.cpy.dll
C:\WINNT\system32\msg121.dll
C:\WINNT\system32\MSGINA.DLL
C:\WINNT\system32\MSGSVC.DLL
C:\WINNT\system32\dllcache\MSGINA.DLL
C:\WINNT\system32\dllcache\msgsvc.dll

-------------------------

Logfile of HijackThis v1.95.0
Scan saved at 1:31:19 PM, on 4/1/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\BELKIN-SSA\UPSsrv.EXE
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\gearsec.exe
C:\WINNT\system32\hidserv.exe
e:\Ahead\InCD\InCDsrv.exe
C:\WINNT\LogWatNT.exe
e:\Conversions Plus\FORMATM.EXE
C:\Program Files\BELKIN-SSA\UPSMON.EXE
C:\Program Files\BELKIN-SSA\UPSData.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
e:\Photodex\ProShowGold\ScsiAccess.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\Tablet.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\scansoft\paperp~1\pptd40nt.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINNT\system32\wfxsnt40.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
E:\Java\j2re1.4.2_03\bin\jusched.exe
D:\Quick Time\qttask.exe
E:\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
E:\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\SpyBlocs\SpyBlocs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\WinFax\WFXCTL32.EXE
E:\Pumatech\Intellisync For NEC Wireless Phones\Intellisync For NEC.exe
E:\Conversions Plus\MacName.exe
E:\Microtek\ScannerFinder.exe
C:\Program Files\Navnt\navapw32.exe
C:\WINNT\system32\WTablet\TabUserW.exe
C:\Program Files\SBC\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
E:\WinFax\WFXMOD32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.thehungersite.com/cgi-bin/WebObjects/CTDSites.woa/577
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx?tb_id=50024
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\System32\blank.htm
N3 - Netscape 7: user_pref("browser.startup.homepage","http://yahoo.sbc.com/dsl"); (C:\Documents and Settings\jcollins\Application Data\Mozilla\Profiles\default\gg7nomq7.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CNetscape%5CNETSCA%7E1%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\jcollins\Application Data\Mozilla\Profiles\default\gg7nomq7.slt\prefs.js)
O1 - Hosts: £_À auto.search.msn.com
O1 - Hosts: £_À search.netscape.com
O1 - Hosts: £_À ieautosearch
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\Navnt\defalert.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PaperPort PTD] d:\scansoft\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo 2200] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus Photo 2200" /O6 "USB001" /M "Stylus Photo 2200"
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quick Time\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] E:\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [MacLicense] "e:\Conversions Plus\MacLic.exe"
O4 - HKLM\..\Run: [InCD] e:\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpyBlocs] E:\SpyBlocs\SpyBlocs.exe
O4 - HKCU\..\Run: [PPWebCap] d:\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: BELKIN.lnk = C:\Program Files\BELKIN-SSA\Upsmon.exe
O4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exe
O4 - Startup: Pop-Up Blocs v2.0.lnk = E:\Pop-UpBlocsv2.0\Pop-UpBlocsv2.0.exe
O4 - Global Startup: Controller.LNK = E:\WinFax\WFXCTL32.EXE
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Intellisync For NEC Wireless Phones.lnk = E:\Pumatech\Intellisync For NEC Wireless Phones\Intellisync For NEC.exe
O4 - Global Startup: MacName.lnk = E:\Conversions Plus\MacName.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = E:\Microtek\ScannerFinder.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: OptiCAL Startup.lnk = D:\PANTONE COLORVISION\OptiCAL\OptiCAL.exe
O4 - Global Startup: Quicken Startup.lnk = D:\Quicken\QWDLLS.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINNT\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &Check Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: View EXIF - E:\ViewEXIF\EXIF.htm
O9 - Extra button: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Net2Phone (HKLM)
O9 - Extra 'Tools' menuitem: Net2Phone (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://69.9.133.14/kxhcm10.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2513676125df752df801/netzip/RdxIE601.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37909.6827314815
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab

puff-m-d · Apr 1, 2004

Hi sv_jim,

Welcome to Wilders.

Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx?tb_id=50024
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\System32\blank.htm

O1 - Hosts: £_À auto.search.msn.com
O1 - Hosts: £_À search.netscape.com
O1 - Hosts: £_À ieautosearch

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2513676125df752df801/netzip/RdxIE601.cab

Please download the latest copy of CWShredder and run. Click FIX and follow the instructions given.

The go HERE and follow the instructions.

Then reboot in Safe Mode and delete the following:

C:\PROGRA~1\Toolbar\ <-- entire folder
C:\WINNT\System32\blank.htm

Reboot and then post both a fresh HijackThis log and another KillBox log.

Regards,
Kent

dvk01 · Apr 1, 2004

run this fix for the msg121 problem

http://www10.brinkster.com/expl0iter/freeatlast/L2M/Msg121.htm

sv_jim · Apr 1, 2004

THANKS!

I have to admit I was a bit scared when I rebooted after following the instructions. Outlook opened fine and I tried to follow the link in the email to the thread and both IE and Explorer hung or at least appeared to do so. Opened up my SBC/Yahoo browser and it was working, so I relogged in and things were working. So, rebooted and things seem to be just fine. Not sure what caused the burp the first time, maybe the fact that all the temp internet files were gone??

Anyway, THANKS! THANKS! THANKS!

puff-m-d · Apr 1, 2004

Hi sv_jim,

I was just glad to be of help....

If you would, could you post a new HJT and KillBox log so we can be sure your system is clean?

Regards,
Kent

sv_jim · Apr 2, 2004

Here are the logs requested. Everything still appears fine.

------------------
Log for KillBox ver.2.0.1
--------------------------

---msg{}dll search---
C:\WINNT\system32\MSGINA.DLL
C:\WINNT\system32\MSGSVC.DLL
C:\WINNT\system32\dllcache\MSGINA.DLL
C:\WINNT\system32\dllcache\msgsvc.dll

---------------------

Logfile of HijackThis v1.95.0
Scan saved at 8:40:01 AM, on 4/2/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\BELKIN-SSA\UPSsrv.EXE
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\gearsec.exe
C:\WINNT\system32\hidserv.exe
e:\Ahead\InCD\InCDsrv.exe
C:\WINNT\LogWatNT.exe
e:\Conversions Plus\FORMATM.EXE
C:\Program Files\BELKIN-SSA\UPSMON.EXE
C:\Program Files\BELKIN-SSA\UPSData.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
e:\Photodex\ProShowGold\ScsiAccess.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\Tablet.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\PDesk\PDesk.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\scansoft\paperp~1\pptd40nt.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINNT\system32\wfxsnt40.exe
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
E:\Java\j2re1.4.2_03\bin\jusched.exe
E:\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
E:\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\Pumatech\Intellisync For NEC Wireless Phones\Intellisync For NEC.exe
E:\Conversions Plus\MacName.exe
E:\Microtek\ScannerFinder.exe
C:\Program Files\Navnt\navapw32.exe
C:\WINNT\system32\WTablet\TabUserW.exe
C:\Program Files\SBC\Connection Manager\CManager.exe
C:\PROGRA~1\BROADJ~1\CORREC~1\CCD.exe
D:\Killbox\KillBox.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.thehungersite.com/cgi-bin/WebObjects/CTDSites.woa/577
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx?tb_id=50024
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINNT\System32\blank.htm
N3 - Netscape 7: user_pref("browser.startup.homepage","http://yahoo.sbc.com/dsl"); (C:\Documents and Settings\jcollins\Application Data\Mozilla\Profiles\default\gg7nomq7.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CNetscape%5CNETSCA%7E1%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\jcollins\Application Data\Mozilla\Profiles\default\gg7nomq7.slt\prefs.js)
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\Navnt\defalert.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PaperPort PTD] d:\scansoft\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo 2200] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus Photo 2200" /O6 "USB001" /M "Stylus Photo 2200"
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quick Time\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] E:\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [MacLicense] "e:\Conversions Plus\MacLic.exe"
O4 - HKLM\..\Run: [InCD] e:\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpyBlocs] E:\SpyBlocs\SpyBlocs.exe
O4 - HKCU\..\Run: [PPWebCap] d:\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: BELKIN.lnk = C:\Program Files\BELKIN-SSA\Upsmon.exe
O4 - Startup: Connection Manager.lnk = C:\Program Files\SBC\Connection Manager\CManager.exe
O4 - Startup: Pop-Up Blocs v2.0.lnk = E:\Pop-UpBlocsv2.0\Pop-UpBlocsv2.0.exe
O4 - Global Startup: Controller.LNK = E:\WinFax\WFXCTL32.EXE
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Intellisync For NEC Wireless Phones.lnk = E:\Pumatech\Intellisync For NEC Wireless Phones\Intellisync For NEC.exe
O4 - Global Startup: MacName.lnk = E:\Conversions Plus\MacName.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microtek Scanner Finder.lnk = E:\Microtek\ScannerFinder.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: OptiCAL Startup.lnk = D:\PANTONE COLORVISION\OptiCAL\OptiCAL.exe
O4 - Global Startup: Quicken Startup.lnk = D:\Quicken\QWDLLS.EXE
O4 - Global Startup: TabUserW.exe.lnk = C:\WINNT\system32\WTablet\TabUserW.exe
O8 - Extra context menu item: &Check Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: View EXIF - E:\ViewEXIF\EXIF.htm
O9 - Extra button: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Net2Phone (HKLM)
O9 - Extra 'Tools' menuitem: Net2Phone (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/activedata/symsupportutil.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://69.9.133.14/kxhcm10.ocx
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2513676125df752df801/netzip/RdxIE601.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37909.6827314815
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio5_0_2_7.cab

dvk01 · Apr 2, 2004

looks like just these couple of left over entries

Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.websearch.com/ie.aspx?tb_id=50024

but i would also run these to clear up any hidden left overs if you haven't already
Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

Spybot - Search & Destroy from http://security.kolla.de
AdAware 6 from http://www.lavasoft.de/support/download

Run Sybot S&D

After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

then reboot &

Run ADAWARE

Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
the current ref file should read at least 01R279 31.03.2004 or a higher number/later date

Then ........

Make sure the following settings are made and on -------"ON=GREEN"
From main window :Click "Start" then " Activate in-depth scan"

then......

click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

then.........

go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot"

then...... click "proceed" to save your settings.

Now to scan it´s just to click the "Scan" button.

When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries.

reboot again

PriMaTe · Apr 2, 2004

Hey guys I just wanted to reply and say thank you for the help with this problem. I had this msg121 spyware on my computer and I didn't know why I kept getting popups, ever after I ran adaware and spybot search and destroy. I was going to format my computer today because of it. My firewall caught the thing and then i searched for it in yahoo and this site came up and I used the fix and it worked. Thanks again guys this is a really good forum, it's great that the moderators and users are so helpful and nice.

puff-m-d · Apr 2, 2004

Hi sv_jim,

I just noticed that you are using an outdated version of HJT.

Please download the latest copy of HJT and use it when you post your next log.

Regards,
Kent

Log in or Sign up

Re:Cant get rid of msg121.dll and msg121.cpy.dll

sv_jim Registered Member

dvk01 Global Moderator

sv_jim Registered Member

puff-m-d Registered Member

dvk01 Global Moderator

sv_jim Registered Member

puff-m-d Registered Member

sv_jim Registered Member

dvk01 Global Moderator

PriMaTe Registered Member

puff-m-d Registered Member

Log in or Sign up

Re:Cant get rid of msg121.dll and msg121.cpy.dll

sv_jim Registered Member

dvk01 Global Moderator

sv_jim Registered Member

puff-m-d Registered Member

dvk01 Global Moderator

sv_jim Registered Member

puff-m-d Registered Member

sv_jim Registered Member

dvk01 Global Moderator

PriMaTe Registered Member

puff-m-d Registered Member

Useful Searches