Hi
Don't go crazy but you are right you have many visitors.
Before the log is dealt with please do these things first.
It will help a alot.
Go to this sight
http://www.trendmicro.com/en/home/us/enterprise.htm and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched.
After that could you please go to
http://www.majorgeeks.com/download506.html and download AdAwareSE and delete what it finds. Then while using AdAware, click on add-ons and get their plug-in for the VX2 variant, and run that and delete what it finds.
After that please go to
http://www.majorgeeks.com/download2471.html and download SpyBot and run that and delete what it finds.
Now we are done with that. All these procedures will help the people that will deal with your HJT log.
Thanks
Steve
Message Edited by zbestwun2001 on 12-21-2004 03:03 PM
Try Shutting off MSN Instant messenger, I had the Same Problem I shut off IM and I never had The trouble Again I hope it Works once you Shut it off Run ad aware
zbestwun2001
3 Apprentice
•
8.8K Posts
0
December 21st, 2004 21:00
Don't go crazy but you are right you have many visitors.
Before the log is dealt with please do these things first.
It will help a alot.
Go to this sight http://www.trendmicro.com/en/home/us/enterprise.htm and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched.
After that could you please go to http://www.majorgeeks.com/download506.html and download AdAwareSE and delete what it finds. Then while using AdAware, click on add-ons and get their plug-in for the VX2 variant, and run that and delete what it finds.
After that please go to http://www.majorgeeks.com/download2471.html and download SpyBot and run that and delete what it finds.
Now we are done with that. All these procedures will help the people that will deal with your HJT log.
Thanks
Steve
Message Edited by zbestwun2001 on 12-21-2004 03:03 PM
Midnight Star
4.8K Posts
0
December 21st, 2004 23:00
Run HiJackThis and click " Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=9
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startnow.com/
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: Search - {3396DE92-A482-590A-2759-975CFDBAA5AF} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: FunBar - {2CA511C5-C677-4e33-A018-EADF07E08299} - C:\PROGRA~1\FUNBAR~1.01\funbar.dll
O3 - Toolbar: Search Bar - {4E7BD74F-2B8D-469E-A1F6-FC7EB590A97D} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\PROGRA~1\YOURSI~1\ysb.dll
O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - C:\Program Files\IEMenuExtension\tbextn.dll
O4 - HKLM\..\Run: [Jawa32] C:\WINDOWS\jawa32.exe
O4 - HKLM\..\Run: [pg943HX] C:\documents and settings\ariane\local settings\temp\pg943HX.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\Lxiv1Va.exe
O4 - HKLM\..\Run: [tlzyfjv] C:\WINDOWS\System32\pktefw.exe
O4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe
O4 - HKLM\..\Run: [oghogc] C:\WINDOWS\System32\oghogc.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\system32\tibs3.exe
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - Global Startup: winlogin.exe
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildtangent.com/bgn/partners/aolim/install.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} - http://dialxs.nl/install/dialxs.ocx
O23 - Service: ISEXEng - Unknown - C:\WINDOWS\system32\angelex.exe (file missing)
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe (file missing)
Now, with all windows closed except HiJackThis, click " Fix checked".
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
folders...
C:\Program Files\SurfSideKick 2
C:\PROGRA~1\FUNBAR~1.01
C:\PROGRA~1\YOURSI~1
files...
C:\WINDOWS\aqadcup.exe
C:\WINDOWS\jawa32.exe
C:\WINDOWS\System32\Lxiv1Va.exe
C:\WINDOWS\System32\pktefw.exe
C:\WINDOWS\System32\idctup20.exe
C:\WINDOWS\System32\winupdtl.exe
C:\WINDOWS\System32\oghogc.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\system32\tibs3.exe
C:\WINDOWS\System32\winst.exe
C:\Program Files\IEMenuExtension\tbextn.dll
Reboot your computer normally.
Post back a new log.
Mike.
opmsatellite
1 Message
0
December 24th, 2004 14:00