trojan ciadoor122

Discussion in 'adware, spyware & hijack cleaning' started by lobs, Mar 16, 2004.

Thread Status:
Not open for further replies.
  1. lobs

    lobs Registered Member

    Mar 15, 2004
    Web cam kept turning on
    Run spybot and HJT
    Log below
    Get error message every time we log on saying Windows cannot find C:windows\inet...
    Is the trojan still active on my pc?

    Attached Files:

  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Apr 27, 2002
    Hi lobs,

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =*
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =*

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =*
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =*
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =*
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =*
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =*
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =*

    F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\inet services.exe
    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\inet services.exe

    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [BearShare] C:\Program Files\BearShare\BearShare.exe /pause

    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe

    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    O4 - HKCU\..\Run: [Services Controller] C:\WINDOWS\inet services.exe
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    O9 - Extra button: Erotic (HKLM)
    O9 - Extra button: Erotic (HKLM)

    O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) -

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

    O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -

    Then reboot and uninstall:
    P2P Nwetworking in Add/Remove Software
    If you have not bought SpyHunter, do the same for that program.


Thread Status:
Not open for further replies.