Wilders Security Forums - View Single Post - cws variant that will not shred

Pieter_Arntz · #2 April 22nd, 2004, 08:32 AM

Hi mastj,

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmeup.com/search.php?aid=1057
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchmeup.com/search.php?aid=1057
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchmeup.com/search.php?aid=1057

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchmeup.com/search.php?aid=1057

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFA4} - C:\WINDOWS.000\TEMP\DIFD.DLL (file missing)

O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS.000\TWAINTEC.DLL
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS.000\2_0_1browserhelper2.dll

O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll (file missing)

O4 - HKCU\..\Run: [wininet32] C:\WINDOWS.000\wininet32.exe
O4 - HKCU\..\Run: [runwin32] C:\WINDOWS.000\runwin32.exe
ActiveX Control) - http://download.macromedia.com/pub/...director/sw.cab
O19 - User stylesheet: (file missing)

Then reboot and find these files:
C:\WINDOWS.000\wininet32.exe
C:\WINDOWS.000\runwin32.exe

Zip them up and mail them to me please.
I will PM you the address.

Then run HijackThis again and post a new log.

Regards,

Pieter