|
|
|||||||
| Spyware Cleaning Section Closed!! |
| Notice: The spyware cleaning (HijackThis) section is closed. Wilders Security no longer provides one on one spyware cleaning assistance. Please see this announcement for a list of websites that provide such services. |
|
|
Thread Tools | Search this Thread |
|
#1
March 12th, 2004, 04:56 PM
|
|||
|
|||
Hijack
This is my log:
Logfile of HijackThis v1.97.7 Scan saved at 21:54:48, on 12/03/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\PopupRemover\PopRController.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\System32\hphmon03.exe C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe C:\WINDOWS\System32\bayylqwu.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Ares\ares.exe C:\windows\rundll32.exe C:\Program Files\Lexmark X74-X75\lxbbbmon.exe C:\windows\winlogon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\HPHipm09.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Outlook Express\msimn.exe C:\WINDOWS\hh.exe C:\Program Files\FreshDevices\FreshDownload\fd.exe C:\Documents and Settings\Phil Watson\Local Settings\Temp\Temporary Directory 1 for hijackthis1977.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.inf/?id=54 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://riviera.cc (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://riviera.cc (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://riviera.cc (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://riviera.cc (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://riviera.cc (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.timecomputers.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://riviera.cc (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://aifind.inf/?id=54 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://riviera.cc (obfuscated) O1 - Hosts: 209.66.115.34 easypic.com O1 - Hosts: 209.66.115.34 pichunter.com O1 - Hosts: 209.66.115.34 pussyslot.com O1 - Hosts: 209.66.115.34 sexocean.com O1 - Hosts: 209.66.115.34 worldsex.com O1 - Hosts: 209.66.115.34 www.easypic.com O1 - Hosts: 209.66.115.34 www.pichunter.com O1 - Hosts: 209.66.115.34 www.pussyslot.com O1 - Hosts: 209.66.115.34 www.sexocean.com O1 - Hosts: 209.66.115.34 www.worldsex.com O1 - Hosts: 209.66.115.34 www.pinkworld.com O1 - Hosts: 209.66.115.34 pinkworld.com O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file) O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll O2 - BHO: (no name) - {3D2C1DA4-BCD3-4317-9548-2E08BD222FF0} - C:\PROGRA~1\POPUPR~1\POPUPS~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll O2 - BHO: (no name) - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Program Files\NavExcel\NavHelper\v2.0.4\NHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: IE Search Bar - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\status.exe O4 - HKLM\..\Run: [PopupRemoverCtrl] C:\Program Files\PopupRemover\PopRController.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe" O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [lxxwgtra] C:\WINDOWS\System32\bayylqwu.exe O4 - HKLM\..\Run: [sys] regedit -s sysdllwm.reg O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\ares.exe" -h O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe O4 - HKCU\..\Run: [sws.exe] c:\program files\GlobalDialer\wordi00019\3075203.exe -remove O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://213.159.117.236/buka.chm::/hz.exe O16 - DPF: {38545C2A-03CD-42C3-BC62-C537A6D5A8F6} (38545C2A-03CD-42C3-BC62-C537A6D5A8F6) - http://download.globaldialer.net/GlobalDialer.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000XP/bridge.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.2418287037 O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://juicyland.com/cab/loader.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_GB.cab O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.*****-drive.com/livecamd.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{312AFC0A-71D6-4386-B2BC-D93EEA22D419}: NameServer = 80.225.252.178 80.225.252.186 O17 - HKLM\System\CS1\Services\Tcpip\..\{312AFC0A-71D6-4386-B2BC-D93EEA22D419}: NameServer = 80.225.252.178 80.225.252.186 Please help |
|
#2
March 12th, 2004, 05:02 PM
|
||||
|
||||
|
Re:Hijack
hey watto,
Quote:
after that Have HijackThis fix all 01 entries, reboot and post a fresh Hijacklog There will be some expert soon to carry you on to Clean Computer keep posting
__________________
http://blog.emsisoft.com www.Emsisoft.com |
|
#3
March 12th, 2004, 05:17 PM
|
||||
|
||||
|
Re:Hijack
Hi watto,
Welcome to Wilders. Before you start, please unzip or move HijackThis to a separate folder. The program will make backups in the folder in the folder it's in. These easily get lost in a temporary folder. Check the following items in HijackThis. Close all windows except HijackThis and click Fix checked: R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.inf/?id=54 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://riviera.cc (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://riviera.cc (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://riviera.cc (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://riviera.cc (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://riviera.cc (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://riviera.cc (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.blazefind.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://aifind.inf/?id=54 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://riviera.cc (obfuscated) O1 - Hosts: 209.66.115.34 easypic.com O1 - Hosts: 209.66.115.34 pichunter.com O1 - Hosts: 209.66.115.34 p*ssyslot.com O1 - Hosts: 209.66.115.34 sexocean.com O1 - Hosts: 209.66.115.34 worldsex.com O1 - Hosts: 209.66.115.34 www.easypic.com O1 - Hosts: 209.66.115.34 www.pichunter.com O1 - Hosts: 209.66.115.34 www.p*ssyslot.com O1 - Hosts: 209.66.115.34 www.sexocean.com O1 - Hosts: 209.66.115.34 www.worldsex.com O1 - Hosts: 209.66.115.34 www.pinkworld.com O1 - Hosts: 209.66.115.34 pinkworld.com O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file) O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll O2 - BHO: (no name) - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Program Files\NavExcel\NavHelper\v2.0.4\NHelper.dll O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load O4 - HKLM\..\Run: [lxxwgtra] C:\WINDOWS\System32\bayylqwu.exe O4 - HKLM\..\Run: [sys] regedit -s sysdllwm.reg O4 - HKCU\..\Run: [sws.exe] c:\program files\GlobalDialer\wordi00019\3075203.exe -remove O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://213.159.117.236/buka.chm::/hz.exe O16 - DPF: {38545C2A-03CD-42C3-BC62-C537A6D5A8F6} (38545C2A-03CD-42C3-BC62-C537A6D5A8F6) - http://download.globaldialer.net/GlobalDialer.cab O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://juicyland.com/cab/loader.cab O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin_GB.cab O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.p*ssy-drive.com/livecamd.exe Download CWShredder and run. Be sure ALL other windows are closed and use the Fix button and follow the instructions you will receive. Then reboot in Safe Mode and delete the following: c:\progra~1\iesearchbar C:\WINDOWS\2_0_1browserhelper2.dll C:\WINDOWS\Downloaded Program Files\bridge.dll C:\Program Files\NavExcel C:\WINDOWS\winh.exe C:\WINDOWS\System32\bayylqwu.exe c:\program files\GlobalDialer c:\windows\winlogon.exe Reboot and then post a fresh HijackThis log. Regards, Kent
__________________
Best regards, Kent AX64 Time Machine - Travel in Time Current Version 1.1.0.996 |
|
#5
March 13th, 2004, 09:16 AM
|
|||
|
|||
|
Re:Hijack
Everything seems to be ok but cannot search from address bar. When I press search in menu the small search is msn, but from the address page a total different page comes up, don't know what its called. Here is my log. ( maybe I missed one)
Logfile of HijackThis v1.97.7 Scan saved at 14:09:52, on 13/03/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\PopupRemover\PopRController.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\System32\hphmon03.exe C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Ares\ares.exe C:\windows\rundll32.exe C:\Program Files\Lexmark X74-X75\lxbbbmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\HPHipm09.exe C:\Documents and Settings\Phil Watson\Local Settings\Temp\Temporary Directory 4 for hijackthis1977.zip\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.timecomputers.com O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll O2 - BHO: (no name) - {3D2C1DA4-BCD3-4317-9548-2E08BD222FF0} - C:\PROGRA~1\POPUPR~1\POPUPS~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\status.exe O4 - HKLM\..\Run: [PopupRemoverCtrl] C:\Program Files\PopupRemover\PopRController.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\ares.exe" -h O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - http://www2.flingstone.com/cab/2000XP/bridge.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.2418287037 Thanks |
|
#6
March 13th, 2004, 09:47 AM
|
||||
|
||||
|
Re:Hijack
Hi watto,
Check the following items in HijackThis. Close all windows except HijackThis and click Fix checked: O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - (no file) O4 - HKCU\..\Run: [rundll32] C:\windows\rundll32.exe O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - http://www2.flingstone.com/cab/2000XP/bridge.cab Then reboot. It is important to know where the search from the address bar takes you. So if you could please test that and post it. Regards, Pieter
__________________
Regards, Pieter Itīs nice to be important, but itīs more important to be nice. It's human to make mistakes. It's even more so to blame the computer for it. |
|
#7
March 13th, 2004, 10:52 AM
|
|||
|
|||
|
Re:Hijack
Done what you said but, search still isn't right this is the page it goes to:
http://real-yellow-page.com/index.php?aid=20038 Dont know if you want it but this is my log now. Logfile of HijackThis v1.97.7 Scan saved at 15:52:19, on 13/03/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\PopupRemover\PopRController.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\System32\hphmon03.exe C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Ares\ares.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Lexmark X74-X75\lxbbbmon.exe C:\WINDOWS\System32\HPHipm09.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Outlook Express\msimn.exe C:\Documents and Settings\Phil Watson\Local Settings\Temp\Temporary Directory 6 for hijackthis1977.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/broadband/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.timecomputers.com O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll O2 - BHO: (no name) - {3D2C1DA4-BCD3-4317-9548-2E08BD222FF0} - C:\PROGRA~1\POPUPR~1\POPUPS~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SUPASTATUS] C:\Program Files\Internet Explorer\Connection Wizard\status.exe O4 - HKLM\..\Run: [PopupRemoverCtrl] C:\Program Files\PopupRemover\PopRController.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\ares.exe" -h O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.2418287037 O17 - HKLM\System\CCS\Services\Tcpip\..\{312AFC0A-71D6-4386-B2BC-D93EEA22D419}: NameServer = 80.225.252.178 80.225.252.186 O17 - HKLM\System\CS1\Services\Tcpip\..\{312AFC0A-71D6-4386-B2BC-D93EEA22D419}: NameServer = 80.225.252.178 80.225.252.186 Thanks |
|
#8
March 13th, 2004, 02:24 PM
|
||||
|
||||
|
Re:Hijack
Hi watto,
First download FAR explorer from here: Install it, then start FAR. Hit Alt-F1 and drive list should come up, go to '0 process list'. Scroll to Iexplore.exe in the left panel, highlight it and hit F5. Now go to the right pane of FAR and double click 'iexplore.exe.txt', it should open in notepad. Look for a file with this size and beginning to it. The filename will always be different: 61C00000 F000 c:\windows\system32\wingn.dll This part indicates the bad file: 61C00000 F000 It will always start with that header. Write down the filename behind it. Now download KillBox: Unzip and run it. Paste the filename you wrote down into the white kill line, then hit the bottom green arrow button to move the file to the bottom of killbox. Hit the 'remove on reboot' button and reboot. Once it reboots, make sure the file is gone. Post back as to the results of doing the above. You may also want to post a new HJT log afterwards. Regards, Kent
__________________
Best regards, Kent AX64 Time Machine - Travel in Time Current Version 1.1.0.996 |
|
#10
March 14th, 2004, 12:43 PM
|
||||
|
||||
|
Re:Hijack
I cannot reproduce what is happening with you and FAR. Maybe the download was corrupt or the install bad. You may want to try an uninstall and the reinstall and see what happens.
If you still have the same problem, I am sure one of the experts here will jump in and help. Regards, Kent
__________________
Best regards, Kent AX64 Time Machine - Travel in Time Current Version 1.1.0.996 |
|
#11
March 17th, 2004, 05:48 PM
|
|||
|
|||
|
Re:Hijack
I am answering for watto as I am helping her sort out her hijack problem per your instructions. We downloaded Far as directed but when pressing Alt + F1 the correct window does not appear. I am sending you what she sees and hope you can help.
|
|
#13
March 18th, 2004, 02:43 AM
|
||||
|
||||
|
Re:Hijack
In the main screen of FAR try pressing F11 and then press "r" or scroll down to Process list.
Does that work? Regards, Pieter
__________________
Regards, Pieter Itīs nice to be important, but itīs more important to be nice. It's human to make mistakes. It's even more so to blame the computer for it. |
|
#16
March 19th, 2004, 04:50 PM
|
||||
|
||||
|
Re:Hijack
Hi watto,
In the first screen doubleclick iexplore.exe.txt That should give you the txt file we need. Regards, Pieter
__________________
Regards, Pieter Itīs nice to be important, but itīs more important to be nice. It's human to make mistakes. It's even more so to blame the computer for it. |
|
#18
March 19th, 2004, 05:17 PM
|
||||
|
||||
|
Re:Hijack
Hi watto,
This is the one you need to kill: c:\windows\system32\ctlmd.dll with the Killbox. Regards, Pieter
__________________
Regards, Pieter Itīs nice to be important, but itīs more important to be nice. It's human to make mistakes. It's even more so to blame the computer for it. |
|
#20
March 19th, 2004, 05:40 PM
|
|||
|
|||
|
Re:Hijack
did you do it this way? do not hit the button right next to the line.
Paste the filename you wrote down into the white kill line, then hit the bottom green arrow button to move the file to the bottom of killbox. Hit the 'remove on reboot' button and reboot. Once it reboots, make sure the file is gone. After you try that please post a new far log.
__________________
Rich Matteo Malwarebytes Researcher |
|
#25
March 19th, 2004, 06:04 PM
|
|||
|
|||
|
Re:Hijack
Ok.. if its version two it gets a little more complicated.
paste the filename. go to action and select delete on reboot a new box should open. go to file/add filename should appear in box. go to action and hit process and reboot. The system will reboot and remove the file. post back when done.
__________________
Rich Matteo Malwarebytes Researcher |
| « Previous Thread | Next Thread » |
| Thread Tools | Search this Thread |
|
|
