Need Help: The Quicklink Toolbar removal

[irishbum04]

Just did a total reformat and reinstall and I already I have some evil stuff on my puter.

Got this "quicklink" toolbar with a bogus removal link as well as some aurora popups through ABI ( a better internet )

Logfile of HijackThis v1.99.1
Scan saved at 10:40:25 AM, on 6/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\NoAdware3\NoAdware3.exe
D:\Program Files\AIM\aim.exe
D:\Program Files\Yahoo!\Messenger\ypager.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\system32\wpabaln.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Owner\Desktop\New Folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: (no name) - {964CA8ED-A4E0-018D-BDA3-B45055530625} - TorontoMail.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - D:\WINDOWS\System32\sxtxi.dll
O2 - BHO: Internet Explorer Hot Fix - {7A445B67-9E29-4647-99F2-9F43FDF1B580} - D:\WINDOWS\System32\gymzd.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - D:\WINDOWS\System32\sxtxi.dll
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hjtjaef] d:\windows\system32\bxxgitc.exe
O4 - HKLM\..\Run: [borlandg] LOPTCON.exe
O4 - HKLM\..\Run: [control64] abrek.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NoAdware3] "D:\Program Files\NoAdware3\NoAdware3.exe" /s
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [WareOut] "D:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [AppMasterCenter] Bogobot.exe
O4 - HKCU\..\Run: [Kargo] browsebar.exe
O4 - HKCU\..\Run: [mozilla-text] sbin.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.82/users/zoom/web/axe/x.chm::/update.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1117983599998
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60081345-6F9C-4D0A-A279-288574470F40}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{ADE7E7AF-E1C9-49AE-8926-6BC91CFB341D}: NameServer = 69.50.184.84,195.225.176.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{60081345-6F9C-4D0A-A279-288574470F40}: NameServer = 69.50.184.84,195.225.176.37
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[dlh6213]

Hi irishbum, welcome to DaniWeb :D

Go to Add/Remove Programs in your Control Panel and remove WareOut.

For every User listed under C:\Documents and Settings, delete the entire contents of these folders (not the folders themselves):

Local Settings\Temp
Cookies
History
Local Settings\Temporary Internet Files\Content.IE5

Delete the entire contents of your C:\Windows\Temp folder.

Delete the entire contents of your C:\Temp folder (if you have one).

Do a search for *.tmp and delete all entries found.

(Note: if any of these temporary files cannot be deleted while in ‘normal mode,’ try Safe Mode.

I don't see an antivirus program running on your system, I suggest you get one ASAP. I recommend Nod32 (best) -- http://www.nod32.com/home/home.htm);
Or, AVG (better then nothing) http://www.grisoft.com/doc/1.

Run a at least two of these free online anti-virus/anti-spyware scans and have them clean what they can:

http://www.kaspersky.com/scanforvirus.html
http://housecall.trendmicro.com/
http://us.mcafee.com/root/mfs/default.asp?cid=9914
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php

Download, install, update, and run these tools:

CWShredder -- http://www.intermute.com/spysubtract/cwshredder_download.html
about:Buster -- http://www.majorgeeks.com/download4289.html
HSRemove -- http://www.majorgeeks.com/download4286.html
PurityScan uninstaller -- http://www.purityscan.com/uninstall.html

Download Ewido Security Suite -- http://fileforum.betanews.com/detail/ewido_security_suite/1098736486/1
Install it, and while installing, under Additional Options, uncheck Install background guard and Install scan via context menu.
From the main Ewido screen, click on Update in the left menu, and then click the Start update button. After the update finishes (the status bar at the bottom will display Update successful), close the program (don't scan yet). If you have problems updating see here:
http://www.ewido.net/en/download/updates/
Note -- When you run Ewido for the first time, you will get the warning Database could not be found!, click OK when you do.

Download Nailfix from here:
http://www.noidea.us/easyfile/file.php?download=20050515010747824,
Unzip it to your desktop, but do not run it yet.

Reboot into Safe Mode (reboot your computer and tap the F8 key while it's starting back up).

Double-click on the Nailfix.bat that is on your desktop. Your desktop and icons will disappear and reappear, and a window should open and close very quickly -- this is normal.

Then run a full system scan with Ewido (note: you will be posting the log from this scan when back in normal mode).

Reboot normally.

Empty your Recycle Bin.

Scan with hijackthis and have it fix the following entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: (no name) - {964CA8ED-A4E0-018D-BDA3-B45055530625} - TorontoMail.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe D:\WINDOWS\Nail.exe
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - D:\WINDOWS\System32\sxtxi.dll
O2 - BHO: Internet Explorer Hot Fix - {7A445B67-9E29-4647-99F2-9F43FDF1B580} - D:\WINDOWS\System32\gymzd.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - D:\WINDOWS\System32\sxtxi.dll
O4 - HKLM\..\Run: [hjtjaef] d:\windows\system32\bxxgitc.exe
O4 - HKLM\..\Run: [borlandg] LOPTCON.exe
O4 - HKLM\..\Run: [control64] abrek.exe
O4 - HKCU\..\Run: [WareOut] "D:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\Run: [AppMasterCenter] Bogobot.exe
O4 - HKCU\..\Run: [Kargo] browsebar.exe
O4 - HKCU\..\Run: [mozilla-text] sbin.exe
O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.82/users/zoom/web...hm::/update.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1117983599998
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab

Close any open windows, other then hijackthis, before hitting Fix checked.

Go to the following locations and delete the highlight files and folder:

D:\WINDOWS\Nail.exe
D:\WINDOWS\System32\sxtxi.dll
D:\WINDOWS\System32\gymzd.dll
D:\WINDOWS\System32\sxtxi.dll
D:\windows\system32\bxxgitc.exe

D:\Program Files\WareOut

Do a search for the following files and delete any instances found:

LOPTCON.exe
abrek.exe
Bogobot.exe
browsebar.exe
sbin.exe

Note: if any files cannot be deleted while in normal mode, try Safe Mode.

Empty your Recycle Bin and reboot.

Close any open browser windows, scan with hijackthis, and post a new log along with the Ewido log.

I would recommend removing NoAdware3 and replacing it with Ad-Aware SE (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10399602.html?tag=lst-0-1)

Next time you reformat, follow the tips in this thread:
http://www.daniweb.com/techtalkforums/thread16365.html