|
|
|||||||
| Spyware Cleaning Section Closed!! |
| Notice: The spyware cleaning (HijackThis) section is closed. Wilders Security no longer provides one on one spyware cleaning assistance. Please see this announcement for a list of websites that provide such services. |
|
|
Thread Tools | Search this Thread |
|
#1
June 17th, 2004, 07:28 PM
|
|||
|
|||
Help, spyware killing me
i used Ad aware to clean the spyware. My problem is i keep getting my homepage constantly redirected through "allaboutsearching.com" and additional folders placed in my favorites( I use mostly IE for internet, recently starting using mozilla). i run ad aware AND spybot to clean anything malicious but neither seem to be doing the job. I have been fighting this problem for about 5 weeks or so. HELP ME
 Logfile of HijackThis v1.97.7 Scan saved at 6:15:10 PM, on 6/17/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\regsvc.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\System32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\DIGStream\digstream.exe C:\documents and settings\scott\local settings\temp\kQR.exe C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe C:\documents and settings\scott\local settings\temp\kQR.exe C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe C:\PROGRA~1\DALESO~1\keepopen.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\scott\Local Settings\Temporary Internet Files\Content.IE5\1HO0ASOQ\HijackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: Slow acid - {27842A56-F795-D9BD-B057-D144B8A300BC} - C:\PROGRA~1\GREYPL~1\blehfunk.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [kQR] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\scott\LOCALS~1\Temp\tb_setup.exe /dcheck O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [YiyKNCiq] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKLM\..\Run: [kQR.exe] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [YiyKNCiq.exe] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKLM\..\Run: [Axishide] C:\PROGRA~1\DALESO~1\keepopen.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WNST] C:\WINDOWS\system32\wnsapisv.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O12 - Plugin for .bmp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub...ctor/swdir.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/16df5a507fe5dfc...zip/RdxIE2.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...034.7727430556 O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.6/ttinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...60/mcfscan.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_1_5_0.cab O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab |
|
#2
June 19th, 2004, 09:34 AM
|
||||
|
||||
|
Re: Help, spyware killing me
Hello adverse_squid,
Download CWShredder Click on update, then close all browsers, and then click on Fix, not scan. Next, you are running hijackthis out of a temporary directory. Can you please create a folder in My Documents and call it Hijack (or something similar). Then extract hijackthis into the folder you have created and run it from there. The reason for this is that Hijackthis creates backups and we would like the backups to not be in the Temp folder. Post a new hijackthis log here when you are done. |
|
#3
June 21st, 2004, 05:29 PM
|
|||
|
|||
|
Re: Help, spyware killing me
I ran CWshredder and this is this log from hijackthis, thanks for your help
Logfile of HijackThis v1.97.7 Scan saved at 4:23:07 PM, on 6/21/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\regsvc.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\System32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\DIGStream\digstream.exe C:\documents and settings\scott\local settings\temp\kQR.exe C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe C:\documents and settings\scott\local settings\temp\kQR.exe C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe C:\PROGRA~1\DALESO~1\keepopen.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\scott\Local Settings\Temporary Internet Files\Content.IE5\1HO0ASOQ\HijackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: Slow acid - {27842A56-F795-D9BD-B057-D144B8A300BC} - C:\PROGRA~1\GREYPL~1\blehfunk.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [kQR] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\scott\LOCALS~1\Temp\tb_setup.exe /dcheck O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [YiyKNCiq] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKLM\..\Run: [kQR.exe] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [YiyKNCiq.exe] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKLM\..\Run: [Axishide] C:\PROGRA~1\DALESO~1\keepopen.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WNST] C:\WINDOWS\system32\wnsapisv.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O12 - Plugin for .bmp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub...ctor/swdir.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/16df5a507fe5dfc...zip/RdxIE2.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...034.7727430556 O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.6/ttinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...60/mcfscan.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_1_5_0.cab O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab |
|
#4
June 21st, 2004, 08:27 PM
|
||||
|
||||
|
Re: Help, spyware killing me
Hello adverse_squid,
Quote:
Now, you still have HJT in a temp folder and I need you to move it. Can you please create a folder in My Documents and call it Hijack (or something similar). Then extract hijackthis into the folder you have created and run it from there. Do a Ctrl+Alt+Del and end task all instances of these processes if running: kQR.exe YiyKNCiq.exe Next: 1. Open My Computer 2. Right click on your hard drive that you wish to clean (C drive, for example) 3. In the context menu that opens, select properties 4. Under the general tab you should select Disk Cleanup 5. Windows will scan your drive which will take a few seconds/minutes 6. A box will display the various files you can remove. Here are some safe examples: Temporary Internet Files Recycle Bin Temporary Files 7. Click OK and windows will comply. When done moving HJT, run HJT again with all browsers closed and check these items and then on Fix: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file) F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe O4 - HKLM\..\Run: [kQR] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [TB_setup] C:\DOCUME~1\scott\LOCALS~1\Temp\tb_setup.exe /dcheck O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\Run: [YiyKNCiq] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKLM\..\Run: [kQR.exe] C:\documents and settings\scott\local settings\temp\kQR.exe O4 - HKLM\..\Run: [YiyKNCiq.exe] C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe O4 - HKCU\..\Run: [WNST] C:\WINDOWS\system32\wnsapisv.exe O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/16df5a507fe5df...tzip/RdxIE2.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab Reboot the computer into safe mode Make sure you can view all hidden files and folders Find and delete these files/folders: C:\documents and settings\scott\local settings\temp\kQR.exe C:\DOCUME~1\scott\LOCALS~1\Temp\tb_setup.exe C:\Program Files\Common files\WinTools...........Folder C:\documents and settings\scott\local settings\temp\YiyKNCiq.exe C:\WINDOWS\system32\wnsapisv.exe Reboot and post a new log here. |
|
#5
June 29th, 2004, 08:30 PM
|
|||
|
|||
|
Re: Help, spyware killing me
This si the first log i ran
Log for VX2.BetterInternet File Finder Files Found--- C:\WINDOWS\system32\apaamon.dll Guardian Key--- is called: GuardianRNMZY Asynchronous 000 DllName C:\WINDOWS\system32\apaamon.dll Impersonate 000 Logon WinLogon Logoff WinLogoff Version 124 ID {73CD9F78-AD2E-44DD-89EC-51C08BAAE495} IDex DS3 User Agent String--- {73CD9F78-AD2E-44DD-89EC-51C08BAAE495} this is the second Log for VX2.BetterInternet File Finder Files Found--- C:\WINDOWS\system32\3iViewer.dll C:\WINDOWS\system32\abtiveds.dll C:\WINDOWS\system32\akledit.dll C:\WINDOWS\system32\apaamon.dll C:\WINDOWS\system32\assldpc.dll C:\WINDOWS\system32\axaamon.dll C:\WINDOWS\system32\azledit.dll Guardian Key--- is called: GuardianIRPTH Asynchronous 000 DllName C:\WINDOWS\system32\apaamon.dll Impersonate 000 Logon WinLogon Logoff WinLogoff Version 124 ID {73CD9F78-AD2E-44DD-89EC-51C08BAAE495} IDex DS3 User Agent String--- {73CD9F78-AD2E-44DD-89EC-51C08BAAE495} here is the hijackthis log: I am still having problems with the redirect from allaboutsearching.com Logfile of HijackThis v1.97.7 Scan saved at 7:26:42 PM, on 6/29/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\regsvc.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\system32\stisvc.exe C:\WINDOWS\System32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\DIGStream\digstream.exe C:\PROGRA~1\DALESO~1\keepopen.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\CheckIt\86\CheckIt86.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\My Documents\My Chat Logs\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.bellsouth.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: Slow acid - {27842A56-F795-D9BD-B057-D144B8A300BC} - C:\PROGRA~1\GREYPL~1\setup pile.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe O4 - HKLM\..\Run: [Axishide] C:\PROGRA~1\DALESO~1\keepopen.exe O4 - HKLM\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: CheckIt 86.lnk = C:\Program Files\CheckIt\86\CheckIt86.exe O9 - Extra 'Tools' menuitem: CheckIt &86 (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O12 - Plugin for .bmp: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/pub...ctor/swdir.cab O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...034.7727430556 O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.6/ttinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...60/mcfscan.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_1_5_0.cab |
|
#6
June 30th, 2004, 02:26 AM
|
||||
|
||||
|
Re: Help, spyware killing me
Hi adverse_squid,
Since you are usuing AdAware anyway, please read and put to use: http://www.wilderssecurity.com/showp...49&postcount=6 Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked: O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O3 - Toolbar: Slow acid - {27842A56-F795-D9BD-B057-D144B8A300BC} - C:\PROGRA~1\GREYPL~1\setup pile.dll O4 - HKLM\..\Run: [Axishide] C:\PROGRA~1\DALESO~1\keepopen.exe O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.13.6/ttinst.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab Then reboot into safe mode and delete: C:\Program Files\SEP <= entire folder C:\Program Files\DALESO~1 <= entire folder that holds keepopen.exe C:\Program Files\GREYPL~1 <= entire folder that holds setup pile.dll Regards, Pieter
__________________
Regards, Pieter It´s nice to be important, but it´s more important to be nice. It's human to make mistakes. It's even more so to blame the computer for it. |
| « Previous Thread | Next Thread » |
| Thread Tools | Search this Thread |
|
|
