kRaZyPsYkO

Logfile of HijackThis v1.99.1 Scan saved at 12:44:26 PM, on 2/26/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\M

Good God... I have MORE spyware and now they're f***ing with my computer even worse. My default page has been changed, and SpySweeper is going insane with alerts to change it back. I can't stand this. I may just have to call an expert in here to fix this. It's getting worse each day. Oh, and I can't get those sites to open, ActiveX isn't working. This is ridiculous.

Tons. I can't install a lot of things, like, the install option will show up, I'll choose it, and nothing will happen. The box just won't come up. It's getting REALLY annoying, and I just want this crap off my computer. Is there anyway to just go into the system32 file, and delete these? Or...would that just mess me up even more? I hate this

I already had it, so I scanned again. Deleted one problem called DS Exploit, which goes through IE. Here's the HJT log: Logfile of HijackThis v1.99.0 Scan saved at 3:15:00 PM, on 2/6/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\Sys

Nope, it just closes the install wizard, after it goes through all the steps of where to put it and such. It sucks.

I can't install it, the virus must be interfering or something.

BTW, I went back to that Kaspersky Lab site, and decided to enter the infected files I stated in my first post: C:\WINNT\System32\mac80ex.idf And it brought up this: mac80ex.idf/C:/WINNT/System32/vx1.nls - OK mac80ex.idf/C:/WINNT/System32/vx1x.nls - OK mac80ex.idfC:/WINNT/System32/msbe.dll - infected by not-a-virus:AdWare.BargainBuddy.l mac80ex.idfC:/Program Files/BullsEye Network/Uninstall.exe/stream/data0001 - OK mac80ex.idfC:/Program Files/BullsEye Network/Uninstall.exe/stream/data0002 - OK mac80ex.idfC:/Program Files/BullsEye Network/Uninstall.exe/stream/data0003 - OK mac80ex.idfC:/Progra

Ok, that website said I was clean, so I guess that file is fine. Here's the log before I deleted those things: Logfile of HijackThis v1.99.0 Scan saved at 10:42:04 PM, on 1/23/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\System32\s

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present I bought my computer from General Electric, my aunt's company, so they probably had restrictions on Internet Explorer so that the employees wouldn't fool around when they should be working or so the employees could cover their tracks when they were fooling around. Anyways, I'm in the process of doing what you said. Thanks a lot for the help.

The instructions are fine, whatever you need to figure it out Im willing to do. Here's the new HiJackThis log. ------------------------------------------------------------------------------------------------------- Logfile of HijackThis v1.99.0 Scan saved at 8:21:49 AM, on 1/21/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe

Scanned again, Here's the newer log file. ------------------------------------------------------------------------------------------------ Ad-Aware SE Build 1.05 Logfile Created on:Thursday, January 20, 2005 11:06:27 PM Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R25 11.01.2005 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):23 total references »»»»»»»»»»Â

Ok, Got it. Here's the log: Logfile of HijackThis v1.99.0 Scan saved at 9:53:13 PM, on 1/20/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINNT\system32\reg

Thanks a lot. I'm really glad you're helping me. Thanks again!

I got HijackThis, and I have a log in the HijackThis Log Board, so check it out, and let me know what's up. I really appreciate it.

POST HAS BEEN MERGED Logfile of HijackThis v1.99.0 Scan saved at 10:24:29 PM, on 1/19/2005 Platform: Windows 2000 SP2 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\SYSTEM32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINNT\system32\regsvc.ex

My girlfriend was on my computer and accidentally clicked on a popup. This sent tons of spy and adware into my computer. I removed almost all of it with Spybot S&D, and Webroot Spy Sweeper, but I still have 2 files which are said to be "Embedded" in my System32 file. I have Windows2000, and I really need these off my computer, because they wont let me install anything and they're forcing my memory to run low. The files are named: mac80ex.idf netut80ex.vxd I know these are associated with "Bargain Buddy" And something else, but I don't know how to remove them and I don't want my system to m