Member Avatar for Quan Chi2

I keep getting redirected while on Firefox. First the browser goes to yyy65.html, then it shows a random ad. Im sick and tired of it. Im usually fine with handleing viruses and malware. This seems to be beating me.

[IMG][/IMG]
[IMG][/IMG]

Here is my HijackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 3:38:01 PM, on 12/8/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\MSN\MSNCOREFILES\MSN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\ACCESSORIES\MSPAINT.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Program Files\My IP Suite\MyIPSuite.exe
O9 - Extra 'Tools' menuitem: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Program Files\My IP Suite\MyIPSuite.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

Please help me fix this problem. I've tried everything I could think of. Im not a newbie, so you can be short with your explainations of whats going on. Thanks a lot guys.


Also: Some of these pop ups have been putting executables(.exe) on my desktop and in my C:\Windows folder.

  • 2 Contributors
  • 4 Replies
  • 446 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

This looks like a classic Look2Me / VX2-style redirect/adware that hides as randomly named DLLs, installs as a Browser Helper Object and Winlogon‑notify DLL, and can re-create itself after naive deletes. Its behavior (random DLLs in System32 and injection into explorer/winlogon) explains why scans sometimes “find” items that return after reboot. (f-secure.com)

A pragmatic cleanup workflow (ordered, repeatable):

  1. Isolate the machine (unplug network) and back up personal data.
  2. Boot Safe Mode and temporarily disable any resident “registry guardian” or realtime tools (Spybot TeaTimer, Ad‑Watch, etc.) that can block scripted fixes.
  3. Run dedicated removal tools designed for these families — L2MFix for Look2Me variants and VundoFix (or VirtumundoBegone) for Vundo/Winfixer symptoms — then reboot and let the tool finish any on‑reboot actions. Community guides document the exact sequence and options to use. (geekstogo.com)
  4. After those tools, run up‑to‑date scanners (Spybot, Ad‑Aware/with VX2 plugin, an updated anti‑malware) and a fresh HijackThis run (HJT run from its own folder as @DMR advised). Repeat Safe‑Mode scans if suspicious items persist.

Post‑cleanup verification and cautions:

  • Use Autoruns (Sysinternals) to enumerate Winlogon Notify DLLs, BHOs and other autostarts and disable any remaining unknown entries before deleting files. (learn.microsoft.com)
  • Avoid editing or deleting core system files (for example, winlogon.exe) by hand; if core system files are infected or repeatedly re‑infected, a backup + clean reinstall of Windows is the safer, faster recovery. Some Vundo/VX2 variants used rootkit techniques historically and may require advanced tools or a reinstall. (bleepingcomputer.com)

Note: the Win98 platform limits some modern tool support and makes HJT output less informative, so the L2M/Vundo tool + Autoruns + offline scans sequence is the most reliable path before considering a full OS reinstall.

Recommended Answers

All 4 Replies

Member Avatar for DMR

1. Are you sure you posted the entire contents of the HijackThis log file? It looks light on content, even for a Win 98 system.
Also- the log shows no signs of infections, but for the particular infection you have, a HJT log may not give us many clues on a Win 98 system.

Please do the following, and we'll go from there:

At the moment, you have HJT running directly from your desktop, which is not advised; the program should be put in its own separate folder. Create a folder for HJT outside of any Temp/Temporary folders and move HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Scan with HijackThis. Once the scan is complete, the "Scan" button will turn into an option to "Save log...". Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

Member Avatar for Quan Chi2

Logfile of HijackThis v1.99.1
Scan saved at 8:09:21 AM, on 12/10/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\AIM\AIM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\HJT\HIJACKTHIS.EXE

O4 - HKLM\..\Run: [SpybotSnD] "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE" /autofix /autoclose
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Program Files\My IP Suite\MyIPSuite.exe
O9 - Extra 'Tools' menuitem: My IP Suite - {FB5F1910-F110-11d2-BB9E-80C04F795683} - C:\Program Files\My IP Suite\MyIPSuite.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

Thats all I got.

Member Avatar for Quan Chi2

Anyone know how to help me? I don't know if this is a common problem.

Member Avatar for DMR

The infection you have (a Look2Me/VX2 variant) isn't uncommon, but:

A) Due to differences in the underlying structures of Win 98 and Win 2000/XP, HijackThis doesn't give us many (if any) clues as to the exact names/locations of the infected files when used on a Win 98 system. This makes it harder to prescribe an exact fix.

B) The tools that we would normally use to detect and remove current versions of L2M/VX2 infections only work on Win 2000/XP systems.

Download, install, and run the trial version of Webroot's ; it is compatible with Win 98, and others have had success using it to removing certain versions of the L2M infection.

Please read the Help documentation that gets installed with the program, as it has easy-to-follow instructions for configuring and running the program. You'll want to run as thorough a scan as possible, and post the Sweep Results here if you can.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.