Help! this one wont go away

Discussion in 'adware, spyware & hijack cleaning' started by rockaction, Apr 17, 2004.

Thread Status:
Not open for further replies.
  1. rockaction

    rockaction Registered Member

    Joined:
    Apr 17, 2004
    Posts:
    2
    I have done all the running of adaware and spybot several times, even have cws shredder which says it removes 6 items and then the thing squirms back later. its a typical start page thing but this one will not go away. can somebody help? here is the o_O hijack this log:


    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\System32\CTSvcCDA.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
    C:\Program Files\INTEL\DSLSetup\ProDsl.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\Program Files\Jetico\BestCrypt\BCResident.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator.LTUK3\My Documents\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.firstreport.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {2EA6C03D-1583-4E92-8B55-02CB2430C6E2} - C:\WINDOWS\System32\bmdfa.dll
    O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BestCrypt\BCWipeTM.exe" startup
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [DSL Connection Manager] C:\Program Files\INTEL\DSLSetup\ProDsl.exe
    O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: BestCrypt Auto Open.lnk = C:\Program Files\Jetico\BestCrypt\BestCrypt.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O9 - Extra button: Help (HKCU)
    O9 - Extra button: Homepage (HKCU)
    O9 - Extra button: BT (HKCU)
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38094.5717708333
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0723271A-306F-41A4-95C4-A81CFEF9C868}: NameServer = 212.159.13.49 212.159.13.50
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0723271A-306F-41A4-95C4-A81CFEF9C868}: NameServer = 212.159.13.49 212.159.13.50
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi rockaction,

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {2EA6C03D-1583-4E92-8B55-02CB2430C6E2} - C:\WINDOWS\System32\bmdfa.dll

    Then run CWShredder again (version 1.56.2) and reboot.

    Regards,

    Pieter
     
  3. rockaction

    rockaction Registered Member

    Joined:
    Apr 17, 2004
    Posts:
    2
    Peter,

    Thanks for the tips, so far no recurring :) problems. Your a star!

    cheers,

    Rock
     
Thread Status:
Not open for further replies.