# The creator of the "Internet Optimizer" worm.

**URL:** <https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453>\
**Category:** The BBQ Pit\
**Created:** [August 3, 2005, 6:41pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453 "2005-08-03T18:41:07Z")\
**Posts on this page:** 2\
**Page:** 2

<div class="post-metadata">

**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\
**Post date:** [August 4, 2005, 9:02pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/21 "2005-08-04T21:02:31Z")

</div>

Thanks, **Lib**. Just trying to give a little back.

---

<div class="post-metadata">

**Author:** ![flood](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@flood](https://boards.straightdope.com/u/flood)\
**Post date:** [August 5, 2005, 6:50pm UTC](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453/22 "2005-08-05T18:50:16Z")

</div>

**Fear Itself** , I did what you said and ended up with this a few minutes ago. Please advise. Many thanks in advance.

> [@](#):
>
> Logfile of HijackThis v1.99.1  
> Scan saved at 1:52:51 PM, on 8/5/2005  
> Platform: Windows 2000 SP4 (WinNT 5.00.2195)  
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> 
> Running processes:  
> C:\WINNT\System32\smss.exe  
> C:\WINNT\system32\winlogon.exe  
> C:\WINNT\system32\services.exe  
> C:\WINNT\system32\lsass.exe  
> C:\WINNT\system32\svchost.exe  
> C:\WINNT\system32\LEXBCES.EXE  
> C:\WINNT\system32\spoolsv.exe  
> C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\DefWatch.exe  
> C:\WINNT\System32\svchost.exe  
> C:\WINNT\LogWatNT.exe  
> C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe  
> C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\Rtvscan.exe  
> C:\WINNT\system32  
> vsvc32.exe  
> C:\WINNT\system32\regsvc.exe  
> C:\WINNT\system32\MSTask.exe  
> C:\WINNT\system32\svchost.exe  
> C:\WINNT\Explorer.EXE  
> C:\WINNT\system32\pctspk.exe  
> C:\Program Files\Apoint\Apoint.exe  
> C:\Program Files\Dell\AccessDirect\dadapp.exe  
> C:\WINNT\system32\PRPCUI.exe  
> C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe  
> C:\Program Files\Apoint\Apntex.exe  
> C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe  
> C:\WINNT\System32\DSentry.exe  
> C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe  
> C:\Program Files\Java\jre1.5.0\_02\bin\jusched.exe  
> C:\Program Files\iTunes\iTunesHelper.exe  
> C:\Program Files\Microsoft AntiSpyware\gcasServ.exe  
> C:\WINNT\system32\ctfmon.exe  
> C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe  
> C:\Program Files\iPod\bin\iPodService.exe  
> C:\Program Files\MSN Messenger\msnmsgr.exe  
> C:\WINNT\SYSTEM32\Rpcnet.exe  
> C:\Documents and Settings\agarza\My Documents\Programs\HijackThis.exe
> 
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank  
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank  
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank  
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank  
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank  
> R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank  
> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
> R3 - Default URLSearchHook is missing  
> O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINNT\dsr.dll  
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll  
> O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll  
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx  
> O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll  
> O4 - HKLM…\Run: [Synchronization Manager] mobsync.exe /logon  
> O4 - HKLM…\Run: [PCTVOICE] pctspk.exe  
> O4 - HKLM…\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe  
> O4 - HKLM…\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe  
> O4 - HKLM…\Run: [PRPCMonitor] PRPCUI.exe  
> O4 - HKLM…\Run: [CreateCD50] “C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe” -r  
> O4 - HKLM…\Run: [AdaptecDirectCD] “C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe”  
> O4 - HKLM…\Run: [DVDSentry] C:\WINNT\System32\DSentry.exe  
> O4 - HKLM…\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe  
> O4 - HKLM…\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe  
> O4 - HKLM…\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe  
> O4 - HKLM…\Run: [nwiz] nwiz.exe /installquiet  
> O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup  
> O4 - HKLM…\Run: [6xjz4a99.exe] C:\WINNT\6xjz4a99.exe /dk  
> O4 - HKLM…\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\_02\bin\jusched.exe  
> O4 - HKLM…\Run: [MessengerPlus3] “C:\Program Files\Messenger Plus! 3\MsgPlus.exe”  
> O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime  
> O4 - HKLM…\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe  
> O4 - HKLM…\Run: [gcasServ] “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”  
> O4 - HKLM…\RunServices: [Microsoft Windows DLL Services Configuration] winDSL.exe  
> O4 - HKLM…\RunOnce: [DeleteMe] “C:\WINNT\system32\cmd.exe” /c “C:\DOCUME~1\agarza\LOCALS~1\Temp\DeleteMe.bat”  
> O4 - HKCU…\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl  
> O4 - HKCU…\Run: [ctfmon.exe] ctfmon.exe  
> O4 - HKCU…\Run: [6xjz4a99.exe] C:\WINNT\6xjz4a99.exe /dk  
> O4 - HKCU…\Run: [MessengerPlus3] “C:\Program Files\Messenger Plus! 3\MsgPlus.exe” /WinStart  
> O4 - HKCU…\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet  
> O4 - HKCU…\Run: [atiupdate] C:\WINNT\system32\msupdateQ49500x86.exe  
> O4 - HKCU…\Run: [msyuv] C:\WINNT\system32\msyuv.exe  
> O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE  
> O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html  
> O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html  
> O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html  
> O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html  
> O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000  
> O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html  
> O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html  
> O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\_02\bin  
> pjpi150\_02.dll  
> O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\_02\bin  
> pjpi150\_02.dll  
> O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll  
> O9 - Extra ‘Tools’ menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll  
> O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe  
> O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - [http://messenger.coolmb.com](http://messenger.coolmb.com) (file missing)  
> O9 - Extra ‘Tools’ menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - [http://messenger.coolmb.com](http://messenger.coolmb.com) (file missing)  
> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)  
> O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - [http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab](http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab)  
> O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - [http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab](http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab)  
> O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - [http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab](http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab)  
> O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [http://a1408.g.akamai.net/7/1408/9955/20031016/akamai.info.apple.com/iTunes4/WW/win/061-0848.20031022.TtzS4/iTunesSetup.exe](http://a1408.g.akamai.net/7/1408/9955/20031016/akamai.info.apple.com/iTunes4/WW/win/061-0848.20031022.TtzS4/iTunesSetup.exe)  
> O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab](http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab)  
> O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - [http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab](http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab)  
> O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - [http://a19.g.akamai.net/7/19/7125/4054/ftp.coupons.com/r3302/cpbrkpie.cab](http://a19.g.akamai.net/7/19/7125/4054/ftp.coupons.com/r3302/cpbrkpie.cab)  
> O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab](http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab)  
> O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll  
> O20 - Winlogon Notify: Type 1 Installer - C:\WINNT\system32\AhAAMON.DLL (file missing)  
> O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\DefWatch.exe  
> O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe  
> O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe  
> O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE  
> O23 - Service: Event Log Watch (LogWatch) - Unknown owner - C:\WINNT\LogWatNT.exe  
> O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe  
> O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec\_Client\_Security\Symantec AntiVirus\Rtvscan.exe  
> O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32  
> vsvc32.exe  
> O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)  
> O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Unknown owner - C:\WINNT\SYSTEM32\Rpcnet.exe

[Previous page](https://boards.straightdope.com/t/the-creator-of-the-internet-optimizer-worm/315453.md?page=1)