Sorry it took so long to reply back...the program takes about 8 to 12 hours to run, and we couldn't go without using the computer that long. I set it to run last night again while I slept, but so many Explorer windows opened that the computer locked up and didn't finish scanning the last 20,000 or so files. This is what it has so far, though, and the new hijack this file. It still has the virus and open4d two windows while I was sending this.
http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/sad.gif\' class=\'bbc_emoticon\' alt=\'
\' /> BTW, I did run a LOT of registry repair programs, hoping that would help clean/organize things to find the problem easier (and maybe fix some of it...) Thanks!
Logfile of HijackThis v1.99.1
Scan saved at 2:12:40 PM, on 7/22/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS-1.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://hp.my.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://hp.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.yahoo.com/ext/search/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://hp.my.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE"
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - Startup: PowerReg Scheduler.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YAHOOMESSENGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YAHOOMESSENGER.EXE
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRAM FILES\YAHOO!\COMMON\YIESRVC.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cabO16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) -
http://fdl.msn.com/zone/datafiles/heartbeat.cabO16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -
http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cabO16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -
http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cabO16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) -
http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cabO16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) -
http://zone.msn.com/binframework/v10/StProxy.cab41227.cabO16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) -
http://zone.msn.com/bingame/zpagames/zpa_shvl.cab46704.cabO16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (ZPA_HRTZ Object) -
http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab40641.cabO16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) -
http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cabO16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) -
http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cabO16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) -
http://www.symantec.com/techsupp/asa/ctrl/SymAData.cabO16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -
http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cabO16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) -
http://symantec.atgnow.com/sdccommon/download/tgctlsi.cabDZLAY.DLL;C:\WINDOWS\SYSTEM;Adware.Look2me;Incurable.Moved.;
TTPI32.DLL;C:\WINDOWS\SYSTEM;Adware.Look2me;Incurable.Will be moved after reboot.;
mjls2.dll;C:\WINDOWS\SYSTEM;Adware.Look2me;Incurable.Will be moved after reboot.;
RegistryCheckUp.exe;C:\WINDOWS\Desktop\registry repairs\registry checkup;Adware.Fastseeker;Incurable.Moved.;
EJSUI32.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
MYISIP.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
SNTUPX32.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
CZPASSWD.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
UWNP.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
DKSFNT01.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
OOBCTL32.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
OLMREG.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
SMNCENG.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
WFVDMOD.0;C:\_RESTORE\TEMP;Adware.Look2me;Incurable.Will be moved after reboot.;
MUSTERY.DLL.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
MUSTERY.DLL.2.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
MUSTERY.DLL.3.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
NNSWAN32.DLL.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
NNSWAN32.DLL.2.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
WGBVW.DLL.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
WGBVW.DLL.2.vir;C:\Program Files\Alwil Software\Avast4\DATA\moved;Adware.Look2me;Incurable.Moved.;
Show Posts
\' /> Everything does seem to be running smoothly, and if Norton is not working for some reason I can reinstall and reupdate it from my disk and my purchased license, so no real worries there. Thanks again, this was a HUGE relief, and so frustrating when none of my programs and none of my hands-on file deleting/reinstalling/replacing could even TOUCH it. If you need any help from me--from checking to see how a virus affects Me or old logs or anything--just ask. I really appreciate the time and effort you spent fixing this computer.