Unsolved
This post is more than 5 years old
3 Posts
0
25330
August 22nd, 2004 00:00
Web hijackers and spyware dont go away!!! please help
I have win xp, and internet explorer 6. Used spybot and adaware to delete the problems but my homepage gets hijacked and now i cannot enter in URLs. there are many worms as well. I would appreciate any help. Here is my fixed S&D log. I can give a hijackthis log if that helps.
--- Search result list ---
Avenue A, Inc.: Tracking cookie (Internet Explorer: Jeff) (Cookie, nothing done)
BFast: Tracking cookie (Internet Explorer: Jeff) (Cookie, nothing done)
Common hijacker: Prefix change (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes\www!=http://
Common hijacker: Prefix change (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix\!=http://
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1801674531-1767777339-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
MagicControl.Agent: Program file (File, nothing done)
C:\WINDOWS\mslagent\mslagent.exe
MagicControl.Agent: Autorun settings (Registry value, nothing done)
HKEY_USERS\S-1-5-21-1801674531-1767777339-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mslagent
MagicControl.Agent: Program folder (Directory, nothing done)
C:\WINDOWS\mslagent\
MagicControl.Agent: Uninstall settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent
--- Process list ---
Spybot - Search && Destroy process list report, 8/19/2004 7:05:48 PM
PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 128 (1480) C:\windows\rundll32.exe
PID: 260 ( 748) C:\Program Files\Ahead\InCD\InCDsrv.exe
PID: 300 (1480) C:\Program Files\CASIO\Photo Loader\Plauto.exe
PID: 324 ( 748) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
PID: 416 ( 376) C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
PID: 436 (2888) C:\WINDOWS\System32\YdagAr.exe
PID: 468 ( 936) C:\Program Files\Internet Explorer\iexplore.exe
PID: 612 ( 4) \SystemRoot\System32\smss.exe
PID: 680 ( 612) csrss.exe
PID: 704 ( 612) \??\C:\WINDOWS\system32\winlogon.exe
PID: 748 ( 704) C:\WINDOWS\system32\services.exe
PID: 760 ( 704) C:\WINDOWS\system32\lsass.exe
PID: 936 ( 748) C:\WINDOWS\system32\svchost.exe
PID: 1036 ( 748) C:\WINDOWS\System32\svchost.exe
PID: 1132 ( 748) C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
PID: 1176 ( 748) svchost.exe
PID: 1244 ( 748) svchost.exe
PID: 1404 ( 192) C:\WINDOWS\System32\ctfmon.exe
PID: 1480 (1460) C:\WINDOWS\Explorer.EXE
PID: 1492 ( 748) C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
PID: 1544 ( 748) C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
PID: 1708 ( 748) C:\WINDOWS\system32\spoolsv.exe
PID: 1868 (1480) C:\WINDOWS\System32\services\msxmidi.exe
PID: 1884 (1480) C:\WINDOWS\SOUNDMAN.EXE
PID: 1908 (1480) C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
PID: 1920 (1480) C:\Program Files\iTunes\iTunesHelper.exe
PID: 1936 (1480) C:\WINDOWS\System32\internst32.exe
PID: 1964 (1480) C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PID: 1988 ( 748) C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
PID: 1992 (1480) C:\WINDOWS\system32\d3vu.exe
PID: 2036 (1480) C:\WINDOWS\System32\ctfmon.exe
PID: 2068 ( 748) C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
PID: 2100 ( 748) C:\WINDOWS\system32\crrp.exe
PID: 2200 (3204) C:\WINDOWS\mslagent\mslagent.exe
PID: 2204 ( 748) C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
PID: 2260 ( 748) C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
PID: 2284 ( 748) C:\WINDOWS\System32\svchost.exe
PID: 2316 ( 748) C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PID: 2584 ( 748) C:\Program Files\iPod\bin\iPodService.exe
PID: 2644 (1480) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
PID: 2888 (1376) C:\WINDOWS\System32\Lppk3f.exe


pskelley
933 Posts
0
August 22nd, 2004 00:00
If it helps, I can tell you this:
Please note the free Spybot 1.3 does have a slight bug...it detects some DSO exploits falsely. Hopefully an upgrade will fix this.The problem is not serious and should not deter people from using Spybot.
ChrisRLG recently posted this, hope it help: Lots of the regular posting anti-malware experts on this board have moved to pastures new for various reasons. You may find it better to find another support site to assist you.
Please go to this link and choose one of the websites on the left of the page.
Alliance of Security Analysis Professionals: http://www.a-sap.org/
As you can see they all work together in cleaning malware (Virus, Spyware and adware).
To help you choose from that list
TomCoyotes contains the anti-malware school - Classroom.
SpyWareInfo contains the anti-malware school - BootCamp.
Net-Intergration is the support site of Spybot S&D.
Lavasoft Support is the support site of Ad-aware.
Wilders Security has since stopped hijackthis log support due to the lack of experienced helpers.
Others that I would recommend Zerosrealm, Subratam.org, SpyWare BeWare and ComputerCops, but generally all those on that list will have experts to help you.
Texruss and ChrisRLG are Teachers at The TomCoyote Forum.
There are still some knowledgable people left posting here at Dell, so you may still get help from them.
I wish you all the best at getting your computer clean.
pskelley
in training at
TomCoyote and
SpywareInfo
jack988
3 Posts
0
August 24th, 2004 04:00
jwatt
4.4K Posts
0
August 24th, 2004 04:00
TomCoyote.org
SpywareInfo.com
Net-Integration.net
Jim
jack988
3 Posts
0
August 24th, 2004 04:00