Help with Slotch.com - hijack log

Discussion in 'privacy problems' started by Exbenedict, Jun 26, 2003.

Thread Status:
Not open for further replies.
  1. Exbenedict
    Offline

    Exbenedict Guest

    OK, I've been reading some of the posts on how to get rid of the Slotch.com and any other pop-ups, but I am still a little confused and figured it would be safer to just upload my Hijack This log and have someone who knows what they are doing explain it to me. thanks in advance for any help ya'll can give.

    Logfile of HijackThis v1.95.0
    Scan saved at 12:32:24 PM, on 6/26/2003
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
    C:\WINDOWS\msagent\AgentSvr.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\Program Files\ISTsvc\istsvc.exe
    C:\Program Files\180Solutions\msbb.exe
    C:\Temp\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://www.i-lookup.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.couldnotfind.com/search_page.html?&account_id=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.couldnotfind.com/search_page.html?&account_id=
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.couldnotfind.com/search_page.html?&account_id=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://yahoo.sbc.com/dsl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://yahoo.sbc.com/dsl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://search.ieplugin.com/search.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default)=http://search.ieplugin.com/q.cgi?q=%s
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak=http://www.yahoo.com/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {69135BDE-5FDC-4B61-98AA-82AD2091BCCC} - C:\WINDOWS\systb.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Super Popup Blocker] C:\Saga\Super Popup Blocker\popkill.exe
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\Run: [msbb] C:\Program Files\180Solutions\msbb.exe
    O4 - HKLM\..\Run: [DKQXFMT] C:\WINDOWS\DKQXFMT.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra 'Tools' menuitem: IMI (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
    O16 - DPF: {556DDE35-E955-11D0-A707-000000521958} - http://www.ieplugin.com/uninstall.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
    O16 - DPF: {ED3ADB6E-5AA9-41B0-9DDC-6F31A34552BE} -
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio5_1_4_0.cab
  2. Dan Perez
    Offline

    Dan Perez Retired Moderator

    Hi,

    There are a few entries in there that I am unsure of (su8ch as the ieplugin.com ones) so you may want to wait for someone better qualified then myself for a more definitive answer but the following would get my vote for removal;

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL=http://www.i-lookup.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.couldnotfind.com/search_page.html?&account_id=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.couldnotfind.com/search_page.html?&account_id=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://www.couldnotfind.com/search_page.html?&account_id=
    O2 - BHO: (no name) - {69135BDE-5FDC-4B61-98AA-82AD2091BCCC} - C:\WINDOWS\systb.dll (file missing)
    O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\Program Files\ISTbar\istbar.dll
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\Run: [msbb] C:\Program Files\180Solutions\msbb.exe
    O4 - HKLM\..\Run: [DKQXFMT] C:\WINDOWS\DKQXFMT.exe
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
    com/dl/toolbar/ym/yiebio5_1_4_0.cab

    If you want to remove these without waiting be sure to close out of all apps before selecting and removing and do a reboot once done.
  3. Pieter_Arntz
    Offline

    Pieter_Arntz Spyware Veteran

    Yup. What Dan said plus these:

    O16 - DPF: {556DDE35-E955-11D0-A707-000000521958} - http://www.ieplugin.com/uninstall.cab
    O16 - DPF: {ED3ADB6E-5AA9-41B0-9DDC-6F31A34552BE} -

    Close all windows except HijackThis after checking the listed items and click Fix checked.
    Reboot after doing so and delete these folders:
    C:\Program Files\ISTsvc
    C:\Program Files\180Solutions
    and this file:
    C:\WINDOWS\DKQXFMT.exe

    I would advise you to download Ad-Aware at http://www.lavasoft.usa.com/software/adaware/

    After installing AAW, and before running the program, update by using the Globe icon.

    Shut down and restart Ad-Aware.

    Now press "Scan Now", then 'next', and let Ad-Aware scan your drives.
    It will find a number of "bad" files and registry keys. Click 'Next' again.
    Rightclick in that pane and choose "select all and click 'next'.
    It will ask you whether you'd like to remove all checked items. Click OK.

    Finally, close Ad-Aware, and reboot.

    It does a better job at cleaning up, then you could accomplish manually.

    Regards,

    Pieter
Thread Status:
Not open for further replies.