possible hijacker

Discussion in 'adware, spyware & hijack cleaning' started by rob9, Jan 11, 2004.

Thread Status:
Not open for further replies.
  1. rob9

    rob9 Registered Member

    Joined:
    Oct 22, 2003
    Posts:
    11
    From reading your forum, I believe I have a hijacker on my system which appears as part of my homepage on the net. I have downloaded "hijackthis" and am sending you their log as a txt file.

    Any suggestion you would have would be appreciated.

    thanks,
    rob9
     

    Attached Files:

  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi rob9,

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    O2 - BHO: (no name) - {4B021269-DD24-48B2-96B4-DA121E9C0502} - C:\WINDOWS\SYSTEM\CTPP1.DLL (disabled by BHODemon)
    O2 - BHO: (no name) - {DB0018A2-F7D9-4B71-9651-640143DF23F9} - C:\WINDOWS\SYSTEM\CTAP3.DLL (disabled by BHODemon)
    O2 - BHO: NN_Bar_Helper - {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL
    O3 - Toolbar: NN_WebBand - {179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL

    O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} (NN_Bar_Helper) - http://download.getmirar.com/875455/files/installer.cab

    Then reboot and delete:
    C:\WINDOWS\SYSTEM\NN_BAR31.DLL

    Regards,

    Pieter
     
  3. rob9

    rob9 Registered Member

    Joined:
    Oct 22, 2003
    Posts:
    11
    Good very early morning Pieter,

    I was able to do all you suggested above except for the last step:

    "Then reboot and delete:
    C:\WINDOWS\SYSTEM\NN_BAR31.DLL"

    I could not find the file in "C:\WINDOWS\SYSTEM\" or, after running "START\FIND" anywhere on my system. o_OPerhaps this is a good thing. My hijacker seems to have disappeared in any case. :D

    Thanks again for your help. It was most appreciated.

    still from the good side of the snow, ;)
    rob9
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi rob9,

    Do you have hidden files showing?
    To "unhide" hidden files and folders:
    Launch My Computer from the Desktop Icon.
    Select View, Details.
    Select the Folders button.
    Select Tools, Folder Options. Then select the View Tab. Select the Show hidden files and folders radio button is selected
    and that the Hide file extensions for known file types check box is unchecked. Once this is done, select Apply and then
    Like Current Folder (located near the top of the Folder Options box). Then select OK.

    No real problem if you can't find it, as long as it is disabled.

    Regards,

    Pieter
     
  5. rob9

    rob9 Registered Member

    Joined:
    Oct 22, 2003
    Posts:
    11
    Thanks for your quick response Pieter,

    All of your instructions above had already been done. This file: "NN_BAR32.DLL" does not appear to exist on my computer. Is there a reason for this? Could I have inadvertently rid my system of it in some other way?

    In any case, I guess it's either gone or disabled since I no longer seem to have the problem for which I contacted you.

    from the edge of day,
    rob9
     
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi rob9,

    It probably didn't survive HijackThis. It still happens sometimes with BHO's and Toolbars. (Good riddens in this case anyway.)

    Regards,

    Pieter
     
Thread Status:
Not open for further replies.