# The creator of the "Internet Optimizer" worm.

**URL:** <https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453>\
**Category:** The BBQ Pit\
**Created:** [August 3, 2005, 6:41pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453 "2005-08-03T18:41:07Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chance\_the\_Gardener](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@Chance\_the\_Gardener](https://boards.straightdope.com/u/Chance_the_Gardener)\
**Post date:** [August 3, 2005, 6:41pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/1 "2005-08-03T18:41:07Z")

</div>

I have a fantasy of finding out where the creator of the “Internet Optimizer” worm lives. It’s night, and I’m in a room full of computers and servers and the like; tens of thousands of dollars worth of equipment. I’m not sure how I got there, but I have a five-gallon jug of whole milk with me. I start pouring the stuff into the vents of his machines, and it starts shorting out, with sparks and pops and very loud crackling sounds. Then the guy who designed the worm hears it and bursts into the room. A brief struggle ensues, and I **kick his ass**.

This probably won’t happen, but it’d be great even if someone else does this and kicks his ass. I’d cheer that person and share the joy vicariously.

So since I probably won’t get to kick the bastard’s deserving ass and cause him property damage, the next best thing would be figuring out how to get this damned worm off my computer. Sometimes it hijacks my browser and sends it to the Internet Optimizer home page, which is a cheesy search page with ads on it. It also brings me popups, most often for porn and gambling sites. And, of course, this worm does anything _but_ optimize the internet, and makes my computer run painfully slow, even when I’m not on line. And I’ve got a six-year-old machine, so it’s pretty slow to begin with.

I’ve removed hijackers before, but I can’t for the life of me figure out how to get rid of this garbage. Does anyone have any ideas about how to kill it? Advice would be most appreciated.

And, of course, if anyone can manage to kick the ass of the creator of this abomination, I’d appreciate that, too.

---

<div class="post-metadata">

**Author:** ![Qwisp](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/qwisp/32/397_2.png) [@Qwisp](https://boards.straightdope.com/u/Qwisp)\
**Post date:** [August 3, 2005, 6:50pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/2 "2005-08-03T18:50:01Z")

</div>

Try running HiJack this  
[http://www.majorgeeks.com/download3155.html](http://www.majorgeeks.com/download3155.html)

I would be careful with it, mostly it is used by advanced computer users.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 3, 2005, 7:00pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/3 "2005-08-03T19:00:22Z")

</div>

Hijackthis will not remove anything. **Do not delete everything it finds** , most of them are files and registry entries that are required to run your computer. Post your log here.

---

<div class="post-metadata">

**Author:** ![Uvula\_Donor](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@Uvula\_Donor](https://boards.straightdope.com/u/Uvula_Donor)\
**Post date:** [August 3, 2005, 7:28pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/4 "2005-08-03T19:28:50Z")

</div>

[Here are manual removal instructions for Internet Optimizer.](http://www.spyware-removal.com/internet-optimizer-removal.html)

There are links on that page for a commercial product called “Spyware Sweeper.” Just ignore them. The manual removal instructions work fine.

You’re having trouble deleting that sonovabitch because it has roots buried in your registry.

If the instructions are too confusing, or if you have trouble, then I second **Fear Itself** - run HiJack This! and post the log here so we can look at it.

---

<div class="post-metadata">

**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\
**Post date:** [August 3, 2005, 7:56pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/5 "2005-08-03T19:56:37Z")

</div>

So, am I to understand this is not actually optimizing the Internet?

---

<div class="post-metadata">

**Author:** ![Chance\_the\_Gardener](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@Chance\_the\_Gardener](https://boards.straightdope.com/u/Chance_the_Gardener)\
**Post date:** [August 3, 2005, 8:02pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/6 "2005-08-03T20:02:34Z")

</div>

Okay, thanks for the advice and the links. I’m not at home right now, so I can’t disinfect yet, but I’ll try it tonight.

---

<div class="post-metadata">

**Author:** ![Club\_33](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@Club\_33](https://boards.straightdope.com/u/Club_33)\
**Post date:** [August 3, 2005, 8:12pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/7 "2005-08-03T20:12:28Z")

</div>

> [@Revtim](#):
>
> So, am I to understand this is not actually optimizing the Internet?

Sure it is. More people with broken machines who can’t go online means a smoother surfing experience for everyone! 😉

---

<div class="post-metadata">

**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\
**Post date:** [August 3, 2005, 8:33pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/8 "2005-08-03T20:33:28Z")

</div>

> [@Revtim](#):
>
> So, am I to understand this is not actually optimizing the Internet?

Not for the person using a computer it’s on, no. Also beware of “IE Plugin”–the name implies it’s an Internet Explorer plugin from Microsoft but it’s not.

---

<div class="post-metadata">

**Author:** ![Uvula\_Donor](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@Uvula\_Donor](https://boards.straightdope.com/u/Uvula_Donor)\
**Post date:** [August 4, 2005, 12:48am UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/9 "2005-08-04T00:48:34Z")

</div>

“Internet Optimizer” is especially sneaky, too. It only activates in response to 404 “file not found” error, and then hijacks you over to Internet Optimizer’s “search” page (which then, of course, loads other popups and “helper objects.”)

---

<div class="post-metadata">

**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\
**Post date:** [August 4, 2005, 4:35am UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/10 "2005-08-04T04:35:13Z")

</div>

> [@Uvula Donor](#):
>
> “Internet Optimizer” is especially sneaky, too. It only activates in response to 404 “file not found” error, and then hijacks you over to Internet Optimizer’s “search” page (which then, of course, loads other popups and “helper objects.”)

It’s even worse when [VeriSign does this](http://slashdot.org/article.pl?sid=03/09/16/0034210). It wasn’t as bad from a spyware/hijack/worm point of view, but it broke the Web for anyone who wasn’t using it through a web browser. VeriSign eventually stopped, but the fundamental problem of focusing so much power in one company’s hands is still unsolved.

---

<div class="post-metadata">

**Author:** ![Chance\_the\_Gardener](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@Chance\_the\_Gardener](https://boards.straightdope.com/u/Chance_the_Gardener)\
**Post date:** [August 4, 2005, 9:51am UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/11 "2005-08-04T09:51:07Z")

</div>

Okay, so I tried **Uvula Donor** ’s instructions first. I’d found similar instructions on the web before, and I had the same problem then: none of the files it told me to remove were in my Windows “Downloaded Files” folder. All information I can find about it says there are four variants to the worm; maybe I’ve got a fifth one? Regardless, thanks.

So I’ve run _HiJack This!_\* and have gotten a scan. I haven’t removed anything, but I’ve got a log. So, with no further ado, here 'tis:

> [@"HiJack This!](#):
>
> Logfile of HijackThis v1.99.1  
> Scan saved at 5:54:20 AM, on 8/4/05  
> Platform: Windows 98 SE (Win9x 4.10.2222A)  
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> 
> Running processes:  
> C:\WINDOWS\SYSTEM\KERNEL32.DLL  
> C:\WINDOWS\SYSTEM\MSGSRV32.EXE  
> C:\WINDOWS\SYSTEM\MPREXE.EXE  
> C:\WINDOWS\SYSTEM\mmtask.tsk  
> C:\WINDOWS\SYSTEM\MSTASK.EXE  
> C:\COMPAQ\INTERNET\ISDBDC.EXE  
> C:\WINDOWS\EXPLORER.EXE  
> C:\WINDOWS\TASKMON.EXE  
> C:\COMPAQ\CPQINET\CPQINET.EXE  
> C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE\_OB\REALSCHED.EXE  
> C:\YLJEENKU.EXE  
> C:\WINDOWS\SYSTEM\DDHELP.EXE  
> C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE  
> C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE  
> C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE  
> C:\PROGRAM FILES\AMERICA ONLINE 7.0\WAOL.EXE  
> C:\WINDOWS\SYSTEM\SPOOL32.EXE  
> C:\WINDOWS\SYSTEM\TAPISRV.EXE  
> C:\WINDOWS\SYSTEM\RNAAPP.EXE  
> C:\PROGRAM FILES\WINZIP\WINZIP32.EXE  
> C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE
> 
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c00&s=searchbar&LC=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c00&s=searchbar&LC=0409)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer  
> R3 - URLSearchHook: (no name) - \_{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)  
> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX  
> O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL  
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL  
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX  
> O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRAM FILES\YOURSITEBAR\YSB.DLL  
> O4 - HKLM…\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun  
> O4 - HKLM…\Run: [TaskMonitor] c:\windows askmon.exe  
> O4 - HKLM…\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme  
> O4 - HKLM…\Run: [SystemTray] SysTray.Exe  
> O4 - HKLM…\Run: [EM\_EXEC] c:\mouse\system\em\_exec.exe  
> O4 - HKLM…\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSEcomR.EXE  
> O4 - HKLM…\Run: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE  
> O4 - HKLM…\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING  
> O4 - HKLM…\Run: [CountrySelection] pctptt.exe  
> O4 - HKLM…\Run: [PTSNOOP] ptsnoop.exe  
> O4 - HKLM…\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe  
> O4 - HKLM…\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe  
> O4 - HKLM…\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe  
> O4 - HKLM…\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe  
> O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update\_OB\realsched.exe” -osboot  
> O4 - HKLM…\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE  
> O4 - HKLM…\Run: [QuickTime Task] “C:\WINDOWS\SYSTEM\QTTASK.EXE” -atboottime  
> O4 - HKLM…\Run: [IST Service] \ISTsvc\istsvc.exe  
> O4 - HKLM…\Run: [WoF71a] C:\YLJEENKU.EXE  
> O4 - HKLM…\Run: [Internet Optimizer] “C:\Program Files\Internet Optimizer\optimize.exe”  
> O4 - HKLM…\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme  
> O4 - HKLM…\RunServices: [SchedulingAgent] mstask.exe  
> O4 - HKLM…\RunServices: [isdbdc] c:\compaq\internet\isdbdc.exe  
> O4 - HKLM…\RunServices: [Vshwin32EXE] C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE  
> O4 - HKCU…\Run: [MoneyAgent] “C:\Program Files\Microsoft Money\System\Money Express.exe”  
> O4 - HKCU…\Run: [180ClientStubInstall] “C:\WINDOWS\TEMP\SAIS.EXE”  
> O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe  
> O4 - Startup: PowerReg Scheduler.exe  
> O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE  
> O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE  
> O4 - Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe  
> O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm  
> O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm  
> O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=1c00&lc=0409) (file missing)  
> O9 - Extra ‘Tools’ menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avbabelfish&c=1c00&lc=0409) (file missing)  
> O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=1c00&lc=0409) (file missing)  
> O9 - Extra ‘Tools’ menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avlinksearch&c=1c00&lc=0409) (file missing)  
> O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=1c00&lc=0409) (file missing)  
> O9 - Extra ‘Tools’ menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - [http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=1c00&lc=0409](http://search.presario.net/scripts/redirectors/presario/srchredir.dll?s=avhostsearch&c=1c00&lc=0409) (file missing)  
> O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll  
> O12 - Plugin for .org/app/fswe\_admission/fswe\_admission?cmd=showticket&page=downloadticket&token=247004127: C:\PROGRA~1\INTERN~1\PLUGINS  
> ppdf32.dll  
> O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [http://207.188.7.150/2218cc922f6412e83722/netzip/RdxIE601.cab](http://207.188.7.150/2218cc922f6412e83722/netzip/RdxIE601.cab)  
> O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe](http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe)  
> O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} (ctadlctrl Class) - [http://www.clicktracking.info/ctadl1.cab](http://www.clicktracking.info/ctadl1.cab)  
> O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - [http://www.ysbweb.com/ist/softwares/v4.0/ysb\_regular.cab](http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab)

Lemme know what you think, if you don’t mind, and I’ll get back to this hopefully tonight, since I don’t have access to my computer at home during the day. Thanks.

---

<div class="post-metadata">

**Author:** ![The\_Mad\_Hermit](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@The\_Mad\_Hermit](https://boards.straightdope.com/u/The_Mad_Hermit)\
**Post date:** [August 4, 2005, 11:54am UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/12 "2005-08-04T11:54:21Z")

</div>

I found another page with more detailed instructions.

[http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076206](http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076206)

From there, I see that you need to remove this line, and reboot the machine immediately:

> [@](#):
>
> O4 - HKLM…\Run: [Internet Optimizer] “C:\Program Files\Internet Optimizer\optimize.exe”

Check the box in HijackThis! and let it remove the entry.

These lines are also suspect, but from a different browser hijack:

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [http://a1540.g.akamai.net/7/1540/52...meInstaller.exe](http://a1540.g.akamai.net/7/1540/52...meInstaller.exe)  
O16 - DPF: {87D1A6EF-8CBC-458A-84B5-0333562418CD} (ctadlctrl Class) - [http://www.clicktracking.info/ctadl1.cab](http://www.clicktracking.info/ctadl1.cab)  
Good luck!

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 2:02pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/13 "2005-08-04T14:02:27Z")

</div>

Put a check next to the following items:

**R3 - URLSearchHook: (no name) - \_{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)  
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM220.DLL  
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRAM FILES\YOURSITEBAR\YSB.DLL  
O4 - HKLM…\Run: [IST Service] \ISTsvc\istsvc.exe  
O4 - HKLM…\Run: [WoF71a] C:\YLJEENKU.EXE  
O4 - HKLM…\Run: [Internet Optimizer] “C:\Program Files\Internet Optimizer\optimize.exe”  
O4 - HKCU…\Run: [180ClientStubInstall] "C:\WINDOWS\TEMP\SAIS.EXE"**

Click on “Fix checked” to remove them.

Do a Windows file search on the following items, and delete them if they are found:

**NEM220.DLL  
YSB.DLL  
istsvc.exe  
YLJEENKU.EXE  
SAIS.EXE**

If you have not done so already, download and install [Adaware SE Personal 1.06](http://www.majorgeeks.com/download506.html), [Microsoft AntiSpyware](http://www.majorgeeks.com/download4466.html), and [Spybot Search & Destroy 1.4](http://www.majorgeeks.com/download2471.html). After installing, be sure to use the update function of each to check for updates. Restart in Safe Mode, and run each of these programs, and delete everything they find.

You also appear to be using a very old version of McAfee antivirus that may not be updating with current virus definitions. If this is the case, uninstall McAfee, and install a new antivirus, such as [AVG Free Edition 7.0](http://www.majorgeeks.com/AVG_Free_Edition_d886.html). After installing be sure to use the update function to check for the latest virus definitions. Run AVG, and it will automatically remove everything it finds.

When you get done with all of this, reboot and post a new HijackThis log here.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 2:28pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/14 "2005-08-04T14:28:56Z")

</div>

Sorry, find and delete **optimize.exe** as well.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 2:31pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/15 "2005-08-04T14:31:55Z")

</div>

Also, skip Microsoft AntiSpyware, it won’t install in Win98, it is for WinXP only.

---

<div class="post-metadata">

**Author:** ![Futile\_Gesture](https://avatars.discourse-cdn.com/v4/letter/f/f05b48/32.png) [@Futile\_Gesture](https://boards.straightdope.com/u/Futile_Gesture)\
**Post date:** [August 4, 2005, 3:58pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/16 "2005-08-04T15:58:14Z")

</div>

> [@Fear Itself](#):
>
> Also, skip Microsoft AntiSpyware, it won’t install in Win98, it is for WinXP only.

Not true. I’m running it just fine on Win 2k.

I always find Hijack This log files interesting (Og, I am soo sad). It’s amazing the amount of cruft that people collect as continually running services on their computers. Little wonder they find their computer slowing if they allow every bit of nonsense on their computer to install itself as a startup.

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 4:23pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/17 "2005-08-04T16:23:00Z")

</div>

> [@Futile Gesture](#):
>
> Not true. I’m running it just fine on Win 2k.

I stand corrected. But it won’t run on Win98 or WinMe.

---

<div class="post-metadata">

**Author:** ![flood](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@flood](https://boards.straightdope.com/u/flood)\
**Post date:** [August 4, 2005, 6:59pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/18 "2005-08-04T18:59:06Z")

</div>

Hey guys, how 'bout me?

> [@HijackThis!](#):
>
> Logfile of HijackThis v1.99.1  
> Scan saved at 2:02:24 PM, on 8/4/2005  
> Platform: Windows 2000 SP4 (WinNT 5.00.2195)  
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> 
> Running processes:  
> C:\WINNT\System32\smss.exe  
> C:\WINNT\system32\winlogon.exe  
> C:\WINNT\system32\services.exe  
> C:\WINNT\system32\lsass.exe  
> C:\WINNT\system32\svchost.exe  
> C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  
> C:\Program Files\Norton Personal Firewall\NISUM.EXE  
> C:\WINNT\system32\LEXBCES.EXE  
> C:\WINNT\system32\spoolsv.exe  
> C:\Program Files\Norton Personal Firewall\ccPxySvc.exe  
> C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\DefWatch.exe  
> C:\WINNT\System32\svchost.exe  
> C:\WINNT\LogWatNT.exe  
> C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe  
> C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\Rtvscan.exe  
> C:\WINNT\system32  
> vsvc32.exe  
> C:\WINNT\system32\regsvc.exe  
> C:\WINNT\SYSTEM32\Rpcnet.exe  
> C:\WINNT\system32\MSTask.exe  
> C:\WINNT\system32\svchost.exe  
> C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE  
> C:\WINNT\Explorer.EXE  
> C:\WINNT\system32\pctspk.exe  
> C:\Program Files\Apoint\Apoint.exe  
> C:\Program Files\Dell\AccessDirect\dadapp.exe  
> C:\WINNT\system32\PRPCUI.exe  
> C:\Program Files\Apoint\Apntex.exe  
> C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe  
> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe  
> C:\WINNT\System32\DSentry.exe  
> C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe  
> C:\Program Files\Common Files\Symantec Shared\ccApp.exe  
> C:\Program Files\Java\jre1.5.0\_02\bin\jusched.exe  
> C:\Program Files\iTunes\iTunesHelper.exe  
> C:\WINNT\system32\ctfmon.exe  
> C:\Program Files\iPod\bin\iPodService.exe  
> C:\Program Files\MSN Messenger\msnmsgr.exe  
> c:\winnt\system32\grqzui.exe  
> C:\WINNT\system32\ACTMOVIE.EXE  
> C:\WINNT\explorer.exe  
> C:\Program Files\Internet Explorer\IEXPLORE.EXE  
> C:\Documents and Settings\agarza\My Documents\Programs\HijackThis.exe
> 
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = [http://websearch.drsnsrch.com/sidesearch.cgi?id=](http://websearch.drsnsrch.com/sidesearch.cgi?id=)  
> R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = [websearch.drsnsrch.com/q.cgi?q=](http://websearch.drsnsrch.com/q.cgi?q=)  
> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
> R3 - Default URLSearchHook is missing  
> O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINNT\ceres.dll  
> O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINNT\dsr.dll  
> O2 - BHO: SABHO - {21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} - c:\program files\180searchassistant\sachook.dll (file missing)  
> O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)  
> O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll  
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx  
> O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll  
> O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)  
> O4 - HKLM…\Run: [Synchronization Manager] mobsync.exe /logon  
> O4 - HKLM…\Run: [PCTVOICE] pctspk.exe  
> O4 - HKLM…\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe  
> O4 - HKLM…\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe  
> O4 - HKLM…\Run: [PRPCMonitor] PRPCUI.exe  
> O4 - HKLM…\Run: [CreateCD50] “C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe” -r  
> O4 - HKLM…\Run: [AdaptecDirectCD] “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”  
> O4 - HKLM…\Run: [DVDSentry] C:\WINNT\System32\DSentry.exe  
> O4 - HKLM…\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe  
> O4 - HKLM…\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe  
> O4 - HKLM…\Run: [ccRegVfy] “C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe”  
> O4 - HKLM…\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe  
> O4 - HKLM…\Run: [nwiz] nwiz.exe /installquiet  
> O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup  
> O4 - HKLM…\Run: [6xjz4a99.exe] C:\WINNT\6xjz4a99.exe /dk  
> O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”  
> O4 - HKLM…\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\_02\bin\jusched.exe  
> O4 - HKLM…\Run: [MessengerPlus3] “C:\Program Files\Messenger Plus! 3\MsgPlus.exe”  
> O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime  
> O4 - HKLM…\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe  
> O4 - HKLM…\Run: [grqzui] c:\winnt\system32\grqzui.exe  
> O4 - HKLM…\RunServices: [Microsoft Windows DLL Services Configuration] winDSL.exe  
> O4 - HKCU…\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl  
> O4 - HKCU…\Run: [ctfmon.exe] ctfmon.exe  
> O4 - HKCU…\Run: [6xjz4a99.exe] C:\WINNT\6xjz4a99.exe /dk  
> O4 - HKCU…\Run: [MessengerPlus3] “C:\Program Files\Messenger Plus! 3\MsgPlus.exe” /WinStart  
> O4 - HKCU…\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet  
> O4 - HKCU…\Run: [atiupdate] C:\WINNT\system32\msupdateQ49500x86.exe  
> O4 - HKCU…\Run: [msyuv] C:\WINNT\system32\msyuv.exe  
> O4 - HKCU…\Run: [SpySweeper] “C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe” /0  
> O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE  
> O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html  
> O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html  
> O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html  
> O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000  
> O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html  
> O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html  
> O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\_02\bin  
> pjpi150\_02.dll  
> O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\_02\bin  
> pjpi150\_02.dll  
> O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll  
> O9 - Extra ‘Tools’ menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll  
> O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe  
> O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - [http://messenger.ipfox.com](http://messenger.ipfox.com) (file missing)  
> O9 - Extra ‘Tools’ menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - [http://messenger.ipfox.com](http://messenger.ipfox.com) (file missing)  
> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)  
> O15 - Trusted Zone: \*.media-motor.net  
> O15 - Trusted Zone: \*.popuppers.com  
> O15 - Trusted Zone: [http://ny.contentmatch.net](http://ny.contentmatch.net) (HKLM)  
> O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - [http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab](http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab)  
> O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - [http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab](http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab)  
> O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - [http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c1.cab](http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c1.cab)  
> O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - [http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab](http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab)  
> O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [http://a1408.g.akamai.net/7/1408/9955/20031016/akamai.info.apple.com/iTunes4/WW/win/061-0848.20031022.TtzS4/iTunesSetup.exe](http://a1408.g.akamai.net/7/1408/9955/20031016/akamai.info.apple.com/iTunes4/WW/win/061-0848.20031022.TtzS4/iTunesSetup.exe)  
> O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - [http://www.ysbweb.com/ist/softwares/v4.0/ysb\_1002952.cab](http://www.ysbweb.com/ist/softwares/v4.0/ysb_1002952.cab)  
> O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab](http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab)  
> O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - [http://cabs.media-motor.net/cabs/alien.cab](http://cabs.media-motor.net/cabs/alien.cab)  
> O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - [http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab](http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab)  
> O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - [http://a19.g.akamai.net/7/19/7125/4054/ftp.coupons.com/r3302/cpbrkpie.cab](http://a19.g.akamai.net/7/19/7125/4054/ftp.coupons.com/r3302/cpbrkpie.cab)  
> O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab](http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab)  
> O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll  
> O20 - Winlogon Notify: Type 1 Installer - C:\WINNT\system32\AhAAMON.DLL (file missing)  
> O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  
> O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe  
> O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPxySvc.exe  
> O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\DefWatch.exe  
> O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe  
> O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe  
> O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE  
> O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINNT\LogWatNT.exe  
> O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe  
> O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\NISUM.EXE  
> O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\Rtvscan.exe  
> O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32  
> vsvc32.exe  
> O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)  
> O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Unknown owner - C:\WINNT\SYSTEM32\Rpcnet.exe

---

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 8:48pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/19 "2005-08-04T20:48:58Z")

</div>

> [@flood](#):
>
> Hey guys, how 'bout me?

You have a lot of spyware installed. Start with this:

Download and install [Adaware SE Personal 1.06](http://www.majorgeeks.com/download506.html), [Microsoft AntiSpyware](http://www.majorgeeks.com/download4466.html), and [Spybot Search & Destroy 1.4](http://www.majorgeeks.com/download2471.html). After installing, be sure to use the update function of each to check for updates. Restart in Safe Mode, and run each of these programs, and delete everything they find.

Check your Norton Antivirus to see if it is a current subscription with current updates. Ifit is not current, uninstall Norton and install a new antivirus, such as [AVG Free Edition 7.0](http://www.majorgeeks.com/AVG_Free_Edition_d886.html). After installing be sure to use the update function to check for the latest virus definitions. Run AVG, and it will automatically remove everything it finds.

When you get done with all of this, reboot and post a new HijackThis log here.

---

<div class="post-metadata">

**Author:** ![Liberal](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@Liberal](https://boards.straightdope.com/u/Liberal)\
**Post date:** [August 4, 2005, 8:51pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/20 "2005-08-04T20:51:34Z")

</div>

Fear, I just wanted to say that it’s very decent of you to do this for people. You’re a good guy.

[Next page](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453.md?page=2)