|
|
|||||||
| Spyware Cleaning Section Closed!! |
| Notice: The spyware cleaning (HijackThis) section is closed. Wilders Security no longer provides one on one spyware cleaning assistance. Please see this announcement for a list of websites that provide such services. |
|
|
Thread Tools | Search this Thread |
|
#1
April 5th, 2004, 03:37 AM
|
|||
|
|||
My hijack Log (problems with yuhmee.com and http:/// )
I have been experiencing many problems in IE. for one, on any section of the Yahoo site, no images load.
also, not just on yahoo, when clicking a link, it sometimes connects and then goes to http:/// and is blank. going back, hitting refresh go back to the blank site. I notice sometimes when this is happening that http://www.yuhmee.com is flashing in the bottom bar of IE. I ran Ad-Aware after updating and removed all components i knew were adware and all tracking cookies. ---------- Logfile of HijackThis v1.97.7 Scan saved at 3:33:09 AM, on 4/5/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\DSentry.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Winamp\Winampa.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\AIM95\aim.exe C:\Program Files\Winamp\Winamp.exe C:\WINDOWS\system32\cidaemon.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Ares\ares.exe E:\My Documents\Matt\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = anon-proxy.autistici.org:3128 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/ O1 - Hosts: 66.98.178.19 06272002-dbase.hitcountz.net O1 - Hosts: 66.98.178.19 1ca.cqcounter.com O1 - Hosts: 66.98.178.19 2001-007.com O1 - Hosts: 66.98.178.19 ad-logics.com O1 - Hosts: 66.98.178.19 ad.trafficmp.com O1 - Hosts: 66.98.178.19 adclient.rottentomatoes.com O1 - Hosts: 66.98.178.19 adcounter.globeandmail.com O1 - Hosts: 66.98.178.19 adcounter.theglobeandmail.com O1 - Hosts: 66.98.178.19 adlog.com.com O1 - Hosts: 66.98.178.19 admanmail.com O1 - Hosts: 66.98.178.19 ads.specificpop.com O1 - Hosts: 66.98.178.19 adtech.de O1 - Hosts: 66.98.178.19 askmen.thruport.com O1 - Hosts: 66.98.178.19 banner.0catch.com O1 - Hosts: 66.98.178.19 bilbo.counted.com O1 - Hosts: 66.98.178.19 c1.statcounter.com O1 - Hosts: 66.98.178.19 c1.thecounter.com O1 - Hosts: 66.98.178.19 c2.gostats.com O1 - Hosts: 66.98.178.19 c2.thecounter.com O1 - Hosts: 66.98.178.19 c3.thecounter.com O1 - Hosts: 66.98.178.19 c3.xxxcounter.com O1 - Hosts: 66.98.178.19 cashcounter.com O1 - Hosts: 66.98.178.19 cgi.hotstat.nl O1 - Hosts: 66.98.178.19 clit6.sextracker.com O1 - Hosts: 66.98.178.19 clit8.sextracker.com O1 - Hosts: 66.98.178.19 cookies.cmpnet.com O1 - Hosts: 66.98.178.19 counter.aaddzz.com O1 - Hosts: 66.98.178.19 counter.bloke.com O1 - Hosts: 66.98.178.19 counter.hitslink.com O1 - Hosts: 66.98.178.19 counter.yadro.ru O1 - Hosts: 66.98.178.19 counter14.sextracker.com O1 - Hosts: 66.98.178.19 counter16.bravenet.com O1 - Hosts: 66.98.178.19 counter17.bravenet.com O1 - Hosts: 66.98.178.19 counter2.hitslink.com O1 - Hosts: 66.98.178.19 counter26.bravenet.com O1 - Hosts: 66.98.178.19 counter32.bravenet.com O1 - Hosts: 66.98.178.19 counter34.breavenet.com O1 - Hosts: 66.98.178.19 counter41.bravenet.com O1 - Hosts: 66.98.178.19 counter47.bravenet.com O1 - Hosts: 66.98.178.19 counter6.sextracker.com O1 - Hosts: 66.98.178.19 counter8.bravenet.com O1 - Hosts: 66.98.178.19 data.coremetrics.com O1 - Hosts: 66.98.178.19 delivery.loopingclick.com O1 - Hosts: 66.98.178.19 dwclick.com O1 - Hosts: 66.98.178.19 ebay.doubleclick.net O1 - Hosts: 66.98.178.19 ehg-amerix.hitbox.com O1 - Hosts: 66.98.178.19 ehg-bestbuy.hitbox.com O1 - Hosts: 66.98.178.19 ehg-crain.hitbox.com O1 - Hosts: 66.98.178.19 ehg-dig.hitbox.com O1 - Hosts: 66.98.178.19 ehg-eckounlimited.hitbox.com O1 - Hosts: 66.98.178.19 ehg-espn.hitbox.com O1 - Hosts: 66.98.178.19 ehg-idg.hitbox.com O1 - Hosts: 66.98.178.19 ehg-liveperson.hitbox.com O1 - Hosts: 66.98.178.19 ehg-oreilley.hitbox.com O1 - Hosts: 66.98.178.19 ehg-space.hitbox.com O1 - Hosts: 66.98.178.19 ehg-sportsline.hitbox.com O1 - Hosts: 66.98.178.19 ehg-techtarget.hitbox.com O1 - Hosts: 66.98.178.19 ehg-tigerdirect.hitbox.com O1 - Hosts: 66.98.178.19 ehg-uniontrib.hitbox.com O1 - Hosts: 66.98.178.19 ehg-viacom.hitbox.com O1 - Hosts: 66.98.178.19 ehg.commjun.hitbox.com O1 - Hosts: 66.98.178.19 ehg.hitbox.com O1 - Hosts: 66.98.178.19 fastclick.net O1 - Hosts: 66.98.178.19 fcstats.bcentral.com O1 - Hosts: 66.98.178.19 flycast.com O1 - Hosts: 66.98.178.19 g-wizzads.net O1 - Hosts: 66.98.178.19 gostats.com O1 - Hosts: 66.98.178.19 gtcc1.acecounter.com O1 - Hosts: 66.98.178.19 hc2.humanclick.com O1 - Hosts: 66.98.178.19 hit2.hotlog.ru O1 - Hosts: 66.98.178.19 hit37.chark.dk O1 - Hosts: 66.98.178.19 hitbox.com O1 - Hosts: 66.98.178.19 hits.webstat.com O1 - Hosts: 66.98.178.19 images.dailydiscounts.com O1 - Hosts: 66.98.178.19 imp.clickability.com O1 - Hosts: 66.98.178.19 impacts.alliancehub.com O1 - Hosts: 66.98.178.19 insightfirst.com O1 - Hosts: 66.98.178.19 int.sitestat.com O1 - Hosts: 66.98.178.19 jkearns.freestats.com O1 - Hosts: 66.98.178.19 linktrack.bravenet.com O1 - Hosts: 66.98.178.19 logs.comics.com O1 - Hosts: 66.98.178.19 m1.nedstatbasic.net O1 - Hosts: 66.98.178.19 media101.sitebrand.com O1 - Hosts: 66.98.178.19 mediatrack.revenue.net O1 - Hosts: 66.98.178.19 mt122.mtree.com O1 - Hosts: 66.98.178.19 nedstat.s0.nl O1 - Hosts: 66.98.178.19 nl.sitestat.com O1 - Hosts: 66.98.178.19 partner.alerts.aol.com O1 - Hosts: 66.98.178.19 paxito.sitetracker.com O1 - Hosts: 66.98.178.19 perso.estat.com O1 - Hosts: 66.98.178.19 pmg.ad-logics.com O1 - Hosts: 66.98.178.19 postclick.adcentriconline.com O1 - Hosts: 66.98.178.19 prof.estat.com O1 - Hosts: 66.98.178.19 s10.sitemeter.com O1 - Hosts: 66.98.178.19 s11.sitemeter.com O1 - Hosts: 66.98.178.19 s12.sitemeter.com O1 - Hosts: 66.98.178.19 s13.sitemeter.com O1 - Hosts: 66.98.178.19 s14.sitemeter.com O1 - Hosts: 66.98.178.19 s15.sitemeter.com O1 - Hosts: 66.98.178.19 s16.sitemeter.com O1 - Hosts: 66.98.178.19 s2.statcounter.com O2 - BHO: (no name) - {15C138C1-0F0B-CCFE-E4E3-C5B12DBCDF15} - C:\WINDOWS\system32\lglorwgm.dll O2 - BHO: (no name) - {86275816-A5D7-3EB1-DBA4-D3BFCB7FBBF5} - C:\WINDOWS\system32\bygxyamw.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [] c:\WINDOWS\System32\ O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [] c:\WINDOWS\System32\ O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members16.clubphoto.com/_img/uploader/atl_uploader.cab O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - ms-its:mhtml:file://C:\ss.MHT!http://toolbar.isearch.com/install/00003/chm.chm::/files/initial.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildtangent.com/bgn/partners/aolim/install.cab O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://saltwaterchimp.com/nsvplayx.cab O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) - http://web1.nugs.net/dev/dlControl.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab |
|
#2
April 5th, 2004, 05:02 AM
|
||||
|
||||
|
Re:My hijack Log (problems with yuhmee.com and http:/// )
Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked
O1 - Hosts: 66.98.178.19 06272002-dbase.hitcountz.net O1 - Hosts: 66.98.178.19 1ca.cqcounter.com O1 - Hosts: 66.98.178.19 2001-007.com O1 - Hosts: 66.98.178.19 ad-logics.com O1 - Hosts: 66.98.178.19 ad.trafficmp.com O1 - Hosts: 66.98.178.19 adclient.rottentomatoes.com O1 - Hosts: 66.98.178.19 adcounter.globeandmail.com O1 - Hosts: 66.98.178.19 adcounter.theglobeandmail.com O1 - Hosts: 66.98.178.19 adlog.com.com O1 - Hosts: 66.98.178.19 admanmail.com O1 - Hosts: 66.98.178.19 ads.specificpop.com O1 - Hosts: 66.98.178.19 adtech.de O1 - Hosts: 66.98.178.19 askmen.thruport.com O1 - Hosts: 66.98.178.19 banner.0catch.com O1 - Hosts: 66.98.178.19 bilbo.counted.com O1 - Hosts: 66.98.178.19 c1.statcounter.com O1 - Hosts: 66.98.178.19 c1.thecounter.com O1 - Hosts: 66.98.178.19 c2.gostats.com O1 - Hosts: 66.98.178.19 c2.thecounter.com O1 - Hosts: 66.98.178.19 c3.thecounter.com O1 - Hosts: 66.98.178.19 c3.xxxcounter.com O1 - Hosts: 66.98.178.19 cashcounter.com O1 - Hosts: 66.98.178.19 cgi.hotstat.nl O1 - Hosts: 66.98.178.19 clit6.sextracker.com O1 - Hosts: 66.98.178.19 clit8.sextracker.com O1 - Hosts: 66.98.178.19 cookies.cmpnet.com O1 - Hosts: 66.98.178.19 counter.aaddzz.com O1 - Hosts: 66.98.178.19 counter.bloke.com O1 - Hosts: 66.98.178.19 counter.hitslink.com O1 - Hosts: 66.98.178.19 counter.yadro.ru O1 - Hosts: 66.98.178.19 counter14.sextracker.com O1 - Hosts: 66.98.178.19 counter16.bravenet.com O1 - Hosts: 66.98.178.19 counter17.bravenet.com O1 - Hosts: 66.98.178.19 counter2.hitslink.com O1 - Hosts: 66.98.178.19 counter26.bravenet.com O1 - Hosts: 66.98.178.19 counter32.bravenet.com O1 - Hosts: 66.98.178.19 counter34.breavenet.com O1 - Hosts: 66.98.178.19 counter41.bravenet.com O1 - Hosts: 66.98.178.19 counter47.bravenet.com O1 - Hosts: 66.98.178.19 counter6.sextracker.com O1 - Hosts: 66.98.178.19 counter8.bravenet.com O1 - Hosts: 66.98.178.19 data.coremetrics.com O1 - Hosts: 66.98.178.19 delivery.loopingclick.com O1 - Hosts: 66.98.178.19 dwclick.com O1 - Hosts: 66.98.178.19 ebay.doubleclick.net O1 - Hosts: 66.98.178.19 ehg-amerix.hitbox.com O1 - Hosts: 66.98.178.19 ehg-bestbuy.hitbox.com O1 - Hosts: 66.98.178.19 ehg-crain.hitbox.com O1 - Hosts: 66.98.178.19 ehg-dig.hitbox.com O1 - Hosts: 66.98.178.19 ehg-eckounlimited.hitbox.com O1 - Hosts: 66.98.178.19 ehg-espn.hitbox.com O1 - Hosts: 66.98.178.19 ehg-idg.hitbox.com O1 - Hosts: 66.98.178.19 ehg-liveperson.hitbox.com O1 - Hosts: 66.98.178.19 ehg-oreilley.hitbox.com O1 - Hosts: 66.98.178.19 ehg-space.hitbox.com O1 - Hosts: 66.98.178.19 ehg-sportsline.hitbox.com O1 - Hosts: 66.98.178.19 ehg-techtarget.hitbox.com O1 - Hosts: 66.98.178.19 ehg-tigerdirect.hitbox.com O1 - Hosts: 66.98.178.19 ehg-uniontrib.hitbox.com O1 - Hosts: 66.98.178.19 ehg-viacom.hitbox.com O1 - Hosts: 66.98.178.19 ehg.commjun.hitbox.com O1 - Hosts: 66.98.178.19 ehg.hitbox.com O1 - Hosts: 66.98.178.19 fastclick.net O1 - Hosts: 66.98.178.19 fcstats.bcentral.com O1 - Hosts: 66.98.178.19 flycast.com O1 - Hosts: 66.98.178.19 g-wizzads.net O1 - Hosts: 66.98.178.19 gostats.com O1 - Hosts: 66.98.178.19 gtcc1.acecounter.com O1 - Hosts: 66.98.178.19 hc2.humanclick.com O1 - Hosts: 66.98.178.19 hit2.hotlog.ru O1 - Hosts: 66.98.178.19 hit37.chark.dk O1 - Hosts: 66.98.178.19 hitbox.com O1 - Hosts: 66.98.178.19 hits.webstat.com O1 - Hosts: 66.98.178.19 images.dailydiscounts.com O1 - Hosts: 66.98.178.19 imp.clickability.com O1 - Hosts: 66.98.178.19 impacts.alliancehub.com O1 - Hosts: 66.98.178.19 insightfirst.com O1 - Hosts: 66.98.178.19 int.sitestat.com O1 - Hosts: 66.98.178.19 jkearns.freestats.com O1 - Hosts: 66.98.178.19 linktrack.bravenet.com O1 - Hosts: 66.98.178.19 logs.comics.com O1 - Hosts: 66.98.178.19 m1.nedstatbasic.net O1 - Hosts: 66.98.178.19 media101.sitebrand.com O1 - Hosts: 66.98.178.19 mediatrack.revenue.net O1 - Hosts: 66.98.178.19 mt122.mtree.com O1 - Hosts: 66.98.178.19 nedstat.s0.nl O1 - Hosts: 66.98.178.19 nl.sitestat.com O1 - Hosts: 66.98.178.19 partner.alerts.aol.com O1 - Hosts: 66.98.178.19 paxito.sitetracker.com O1 - Hosts: 66.98.178.19 perso.estat.com O1 - Hosts: 66.98.178.19 pmg.ad-logics.com O1 - Hosts: 66.98.178.19 postclick.adcentriconline.com O1 - Hosts: 66.98.178.19 prof.estat.com O1 - Hosts: 66.98.178.19 s10.sitemeter.com O1 - Hosts: 66.98.178.19 s11.sitemeter.com O1 - Hosts: 66.98.178.19 s12.sitemeter.com O1 - Hosts: 66.98.178.19 s13.sitemeter.com O1 - Hosts: 66.98.178.19 s14.sitemeter.com O1 - Hosts: 66.98.178.19 s15.sitemeter.com O1 - Hosts: 66.98.178.19 s16.sitemeter.com O1 - Hosts: 66.98.178.19 s2.statcounter.com O2 - BHO: (no name) - {15C138C1-0F0B-CCFE-E4E3-C5B12DBCDF15} - C:\WINDOWS\system32\lglorwgm.dll O2 - BHO: (no name) - {86275816-A5D7-3EB1-DBA4-D3BFCB7FBBF5} - C:\WINDOWS\system32\bygxyamw.dll O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [] c:\WINDOWS\System32\ O4 - HKCU\..\Run: [] c:\WINDOWS\System32\ O4 - Startup: PowerReg Scheduler V3.exe O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - ms-its:mhtml:file://C:\ss.MHT!http://toolbar.isearch.com/install/00003/chm.chm::/files/initial.cab O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://saltwaterchimp.com/nsvplayx.cab O16 - DPF: {CE74A05D-ED12-473A-97F8-85FB0E2F479F} (dlControl.UserControl1) - http://web1.nugs.net/dev/dlControl.CAB Then download this attached isearchfix file, rename it to isearchfix.reg and double click on it,say yes to the prompts,that will restore the toolbar options that removing this pest damages (right click the link at the bottom of the post & select save target as., then save to desktop ) then Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described Spybot - Search & Destroy from http://security.kolla.de AdAware 6 from http://www.lavasoft.de/support/download Run Sybot S&D After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED. then reboot & Run ADAWARE Before you scan with AdAware, check for updates of the reference file by using the "webupdate". the current ref file should read at least 01R279 31.03.2004 or a higher number/later date Then ........ Make sure the following settings are made and on -------"ON=GREEN" From main window :Click "Start" then " Activate in-depth scan" then...... click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files" then......... go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot" then...... click "proceed" to save your settings. Now to scan it´s just to click the "Scan" button. When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries. reboot again then post a new hijackthis log to check what is left, but as you might have disabled some entries previously withn MSconfig, please enable everything on the start up tab before posting the new log
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy | Hedgehog Rescue |
|
#3
April 5th, 2004, 02:09 PM
|
|||
|
|||
|
Re:My hijack Log (problems with yuhmee.com and http:/// )
Followed all instructions.....
Yahoo now loads pictures and works fine. problems with IMDB subsided.... everything seems better. Thanks a lot for the help here is the new log....just in case anything lingers ----- Logfile of HijackThis v1.97.7 Scan saved at 2:01:15 PM, on 4/5/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Winamp\Winampa.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Digital Line Detect\DLG.exe E:\My Documents\Matt\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = anon-proxy.autistici.org:3128 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/ O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [nvid] C:\WINDOWS\System32\dhoqnker.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe" O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" O4 - HKCU\..\Run: [Cool Mouse] C:\Program Files\Shelltoys\Cool Mouse\cmouse.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\ares.exe" -h O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {03177121-226B-11D4-B0BE-005004AD3039} (UploaderCtrl Class) - http://members16.clubphoto.com/_img/uploader/atl_uploader.cab O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab |
|
#4
April 5th, 2004, 02:15 PM
|
||||
|
||||
|
Re:My hijack Log (problems with yuhmee.com and http:/// )
a couple of new ones have arrived
Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked O4 - HKLM\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe O4 - HKLM\..\Run: [nvid] C:\WINDOWS\System32\dhoqnker.exe Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406 then as some of the files or folders you need to delete may be hidden do this: Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders" Click "Apply" then "OK" Delete these files c:\WINDOWS\System32\zzb.exe C:\WINDOWS\System32\dhoqnker.exe then Reboot normally & post another log to check
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy | Hedgehog Rescue |
| « Previous Thread | Next Thread » |
| Thread Tools | Search this Thread |
|
|
