What's wrong with my computer?

Discussion in 'adware, spyware & hijack cleaning' started by Amanda8675309, Jun 28, 2004.

Thread Status:
Not open for further replies.
  1. Amanda8675309

    Amanda8675309 Registered Member

    Joined:
    Jun 28, 2004
    Posts:
    2
    I ran adware and hijack this because i got this message when signing on to my computer: Error loading C:\WINDOWS\System32\bridge.dll

    this is the log that hijack this gave me.... what do i need to delete.

    Logfile of HijackThis v1.97.7
    Scan saved at 12:31:41 AM, on 6/28/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\PackethSvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\xwxnwhcw.exe
    C:\Program Files\AIM95\aim.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\America Online 7.0\waol.exe
    C:\Documents and Settings\default\Desktop\HijackThis.exe
    C:\WINDOWS\System32\svchost.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R3 - URLSearchHook: (no name) - {965A592F-8EFA-4250-8630-7960230792F1} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
    O4 - HKLM\..\Run: [ibktoyktyb] C:\WINDOWS\System32\xwxnwhcw.exe
    O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
    O4 - HKLM\..\Run: [dbc32gto] C:\WINDOWS\System32\dbc32gto.exe
    O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\System32\stcloader.exe
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\E_SRCV02.EXE
    O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
    O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
    O9 - Extra button: Encarta Encyclopedia (HKLM)
    O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
    O9 - Extra button: Define (HKLM)
    O9 - Extra 'Tools' menuitem: Define (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O9 - Extra button: Dell Home (HKCU)
    O16 - DPF: Win32 Classes -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9D8153C5-F7D6-469F-A749-BEA1F195CDFB}: NameServer = 205.188.146.146
     
  2. subratam

    subratam Registered Member

    Joined:
    Nov 14, 2003
    Posts:
    1,310
    Location:
    Issaquah, WA
    Hello ,

    press ctrl, alt and del and end task

    C:\WINDOWS\System32\xwxnwhcw.exe

    Now fix the following entries in HijackThis,

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    R3 - URLSearchHook: (no name) - {965A592F-8EFA-4250-8630-7960230792F1} - (no file)
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
    O4 - HKLM\..\Run: [ibktoyktyb] C:\WINDOWS\System32\xwxnwhcw.exe
    O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
    O4 - HKLM\..\Run: [dbc32gto] C:\WINDOWS\System32\dbc32gto.exe
    O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\System32\stcloader.exe

    Reboot in SAFE MODE and Show Hidden Files/Folders and delete if found,

    C:\WINDOWS\SYSTEM\blank.htm
    C:\WINDOWS\System32\xwxnwhcw.exe
    c:\installer\id53.exe
    C:\WINDOWS\System32\dbc32gto.exe
    C:\WINDOWS\System32\stcloader.exe

    Reboot in normal mode and post a fresh log

    Regards
     
  3. Amanda8675309

    Amanda8675309 Registered Member

    Joined:
    Jun 28, 2004
    Posts:
    2
    I did everything that you told me to do, i forgot to tell you i had XP-so i didn't have to go into safe mode to find the other files, it worked out fine.

    thank you so much.

    -amanda
     
  4. subratam

    subratam Registered Member

    Joined:
    Nov 14, 2003
    Posts:
    1,310
    Location:
    Issaquah, WA
    Post a fresh hijackthis log please

    Regards
     
Thread Status:
Not open for further replies.