Help with --- O1 - Hosts please

Question

Hy can anyone tell me what to do with all the 01 hosts thing ?? Logfile of HijackThis v1.97.7Scan saved at 3:50:43 AM, on 12/21/03Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXEC:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXEC:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\RPCSS.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\WINDOWS\SYSTEM\DESK98.EXEC:\WINDOWS\SYSTEM\ATIPTAXX.EXEC:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXEC:\PROGRAM FILES\IMMERSION CORPORATION\IMMERSION DESKTOP\IDESKTOP.EXEC:\WINDOWS\LOADQM.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXEC:\PROGRAM FILES\MYWEBSEARCH\BAR\2.BIN\MWSOEMON.EXEC:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\SYSTEM\PSTORES.EXEC:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXEC:\WINDOWS\DESKTOP\HIJACKTHIS.EXE O1 - Hosts: 81.211.105.12 www.globe-finder.ccO1 - Hosts: 81.211.105.12 globe-finder.ccO1 - Hosts: 81.211.105.12 searchscout.comO1 - Hosts: 81.211.105.12 www.searchscout.comO1 - Hosts: 81.211.105.12 193.125.201.50O1 - Hosts: 81.211.105.12 206.161.200.105O1 - Hosts: 81.211.105.12 209.66.114.130O1 - Hosts: 81.211.105.12 216.200.3.32O1 - Hosts: 81.211.105.12 64.124.45.181O1 - Hosts: 81.211.105.12 66.250.130.194O1 - Hosts: 81.211.105.12 66.40.16.131O1 - Hosts: 81.211.105.12 alfa-search.comO1 - Hosts: 81.211.105.12 allhyperlinks.comO1 - Hosts: 81.211.105.12 approvedlinks.comO1 - Hosts: 81.211.105.12 bestcrawler.comO1 - Hosts: 81.211.105.12 ewebsearch.netO1 - Hosts: 81.211.105.12 global-finder.comO1 - Hosts: 81.211.105.12 idgsearch.comO1 - Hosts: 81.211.105.12 ie-search.comO1 - Hosts: 81.211.105.12 itseasy.usO1 - Hosts: 81.211.105.12 jetseeker.comO1 - Hosts: 81.211.105.12 martfinder.comO1 - Hosts: 81.211.105.12 rightfinder.netO1 - Hosts: 81.211.105.12 runsearch.comO1 - Hosts: 81.211.105.12 search.unipages.ccO1 - Hosts: 81.211.105.12 search.xrenoder.comO1 - Hosts: 81.211.105.12 search-2003.comO1 - Hosts: 81.211.105.12 searchdot.netO1 - Hosts: 81.211.105.12 searchv.comO1 - Hosts: 81.211.105.12 searchxp.comO1 - Hosts: 81.211.105.12 seekwell.netO1 - Hosts: 81.211.105.12 slawsearch.comO1 - Hosts: 81.211.105.12 srch-us6.hpwis.comO1 - Hosts: 81.211.105.12 start-space.comO1 - Hosts: 81.211.105.12 searchmyrequest.comO1 - Hosts: 81.211.105.12 therealsearch.comO1 - Hosts: 81.211.105.12 topsearcher.comO1 - Hosts: 81.211.105.12 unipages.ccO1 - Hosts: 81.211.105.12 webcoolsearch.comO1 - Hosts: 81.211.105.12 worldnet.att.netO1 - Hosts: 81.211.105.12 yourbookmarks.wsO1 - Hosts: 1089288654 auto.search.msn.comO2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\2.BIN\MWSBAR.DLLO2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\2.BIN\MWSSRCAS.DLLO2 - BHO: CSBHO - {D14D6793-9B65-11D3-80B6-00500487BDBA} - C:\PROGRAM FILES\COMET\BIN\CSBHO.DLLO2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITBHO.DLLO3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\2.BIN\MWSBAR.DLLO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXO3 - Toolbar: Comet Toolbar - {FE6BC4EF-5676-484B-88AE-883323913256} - C:\PROGRAM FILES\COMET\BIN\CSIETB.DLLO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLLO4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorunO4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS	askmon.exeO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\Run: [HydarVisionDesktopManager] desk98.exeO4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [IDesktop] C:\Program Files\Immersion Corporation\Immersion Desktop\idesktop.exe 1O4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUPO4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\GRISOFT\AVG7\AVGREGCL.EXE /BOOTO4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\2.BIN\MWSOEMON.EXEO4 - HKLM\..\Run: [Soundmx] \soundmx.exeO4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exeO4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\RunServices: [avgamsvr.exe] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXEO4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exeO4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exeO9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O9 - Extra button: CUseeMe Conferencing Companion (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dllO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37781.7288194444O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cabO16 - DPF: {DAAD8E43-FAC2-41DD-8F02-9D2BD626F4BB} (AVChat_Inst Control) - http://chat.saram.net/avchat/AVChat_InstProj1.cabO16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://webcamnow.com/voice/voice.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cabO16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/TURB8102/turbo.cabO16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/TURB8102/payload2.cabO16 - DPF: {EB6AFDAB-E16D-430B-A5EE-0408A12289DC} - http://download.mediacharger.com/swimsuitnetwork.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {E6A3C1E2-F792-483E-9133-596215172BE9} (AcceptLang Class) - http://runonce.msn.com/setacceptlang.cabO16 - DPF: {410BB67A-C0EC-4FA7-8E71-96A208E06773} (BQMWebMessage.WebMessage) - http://community.bestqm.com/photomail/BQMWebMessage.CABO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {4FCFF034-6F56-4D65-8C31-70D98C475428} (ddm_download.ddm_control) - http://bins.dynamicdesktopmedia.com/cab/ddm_control.CABO16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/webregtest/RegDload.CABO16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/stop-sign_pop.cabO16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cabO16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabO16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cabO16 - DPF: {5AAF063D-6AF0-409A-886A-336FB5112064} (NeoBook ActiveX Control) - http://www.onmycam.org/NBActiveX.ocxO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cabO16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v45/h2hpool/h2hpool.cabO16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CABO16 - DPF: {D14D6793-9B65-11D3-80B6-00500487BDBA} (CSBHO Class) - http://files.cc.cometsystems.com/cc2/release/bin/plat-4-3-333-ccct.cabO16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1ca.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cabO16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cabO16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CABO17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.comO17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14O19 - User stylesheet: C:\WINDOWS\Web	ips.iniO19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)

volcano11 · Answer

It looks like you have been hijacked. You can either remove all the listings in the host file, or find the hosts file and rename it to hosts.old. If you want an expert analysis of you HijackThis log, post it on one of the HijackThis forums where the HijackThis experts hang out.

Steve

ChrisRLG · Answer

You have a CoolWebSearch infection as well as possably others

Use these to remove Malware (Spyware and Adware).

1) SpyBot Search and Destroy
After installing SpyBot Search & Destroy, first press Online, and search for, put a check mark at, and install all updates.
Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all it finds.

2) Get Ad-Aware
After installing Ad-Aware, and before running the program, first press “check for updates now".
Click "Connect" and install all updated components available. Click 'Finish'.
Press "Scan Now", then 'next', and let Ad-Aware scan your drives.
It will find a number of "bad" files and registry keys. Click 'Next' again.
Check all found items, and click 'next' once more.
It will ask you whether you'd like to remove all checked items. Click OK.

Then run cwshredder from http://www.merijn.org/files/cwshredder.zip

Always reboot the computer between each program - both of these may find things that they need to have a reboot of the machine to clear - please reboot and let them finish .

You will need to unzip, run and delete all that it finds.

Then reboot and post a fresh hijackthis log for me to check.

DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.

Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.
ChrisRLG
therock247uk
TomCoyote (of http://tomcoyote.org/forums/index.php fame above)
irelynmisses
YoKenny
baskar1234

HyYa · Answer

Logfile of HijackThis v1.97.7Scan saved at 5:36:32 PM, on 12/21/03Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXEC:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXEC:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\RPCSS.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\WINDOWS\SYSTEM\DESK98.EXEC:\WINDOWS\SYSTEM\ATIPTAXX.EXEC:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXEC:\PROGRAM FILES\IMMERSION CORPORATION\IMMERSION DESKTOP\IDESKTOP.EXEC:\WINDOWS\LOADQM.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXEC:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\DESKTOP\HIJACKTHIS.EXE O1 - Hosts: 81.211.105.12 www.globe-finder.ccO1 - Hosts: 81.211.105.12 globe-finder.ccO1 - Hosts: 81.211.105.12 searchscout.comO1 - Hosts: 81.211.105.12 www.searchscout.comO1 - Hosts: 81.211.105.12 193.125.201.50O1 - Hosts: 81.211.105.12 206.161.200.105O1 - Hosts: 81.211.105.12 209.66.114.130O1 - Hosts: 81.211.105.12 216.200.3.32O1 - Hosts: 81.211.105.12 64.124.45.181O1 - Hosts: 81.211.105.12 66.250.130.194O1 - Hosts: 81.211.105.12 66.40.16.131O1 - Hosts: 81.211.105.12 allhyperlinks.comO1 - Hosts: 81.211.105.12 bestcrawler.comO1 - Hosts: 81.211.105.12 global-finder.comO1 - Hosts: 81.211.105.12 idgsearch.comO1 - Hosts: 81.211.105.12 ie-search.comO1 - Hosts: 81.211.105.12 itseasy.usO1 - Hosts: 81.211.105.12 jetseeker.comO1 - Hosts: 81.211.105.12 martfinder.comO1 - Hosts: 81.211.105.12 search.unipages.ccO1 - Hosts: 81.211.105.12 search.xrenoder.comO1 - Hosts: 81.211.105.12 search-2003.comO1 - Hosts: 81.211.105.12 searchdot.netO1 - Hosts: 81.211.105.12 searchxp.comO1 - Hosts: 81.211.105.12 seekwell.netO1 - Hosts: 81.211.105.12 slawsearch.comO1 - Hosts: 81.211.105.12 srch-us6.hpwis.comO1 - Hosts: 81.211.105.12 start-space.comO1 - Hosts: 81.211.105.12 searchmyrequest.comO1 - Hosts: 81.211.105.12 topsearcher.comO1 - Hosts: 81.211.105.12 unipages.ccO1 - Hosts: 81.211.105.12 worldnet.att.netO1 - Hosts: 81.211.105.12 yourbookmarks.wsO2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITBHO.DLLO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLLO4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorunO4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS	askmon.exeO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\Run: [HydarVisionDesktopManager] desk98.exeO4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [IDesktop] C:\Program Files\Immersion Corporation\Immersion Desktop\idesktop.exe 1O4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUPO4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\GRISOFT\AVG7\AVGREGCL.EXE /BOOTO4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exeO4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\RunServices: [avgamsvr.exe] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXEO4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exeO4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exeO9 - Extra button: CUseeMe Conferencing Companion (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dllO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37781.7288194444O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cabO16 - DPF: {DAAD8E43-FAC2-41DD-8F02-9D2BD626F4BB} (AVChat_Inst Control) - http://chat.saram.net/avchat/AVChat_InstProj1.cabO16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://webcamnow.com/voice/voice.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cabO16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} - O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {410BB67A-C0EC-4FA7-8E71-96A208E06773} (BQMWebMessage.WebMessage) - http://community.bestqm.com/photomail/BQMWebMessage.CABO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {4FCFF034-6F56-4D65-8C31-70D98C475428} (ddm_download.ddm_control) - http://bins.dynamicdesktopmedia.com/cab/ddm_control.CABO16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/webregtest/RegDload.CABO16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cabO16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cabO16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cabO16 - DPF: {5AAF063D-6AF0-409A-886A-336FB5112064} (NeoBook ActiveX Control) - http://www.onmycam.org/NBActiveX.ocxO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cabO16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v45/h2hpool/h2hpool.cabO16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CABO16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1ca.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cabO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cabO16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cabO17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.comO17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14O19 - User stylesheet:  (file missing)

HyYa · Answer

Well appreciate the help how my looken :)

Logfile of HijackThis v1.97.7
Scan saved at 6:20:29 PM, on 12/21/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXE
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DESK98.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\IMMERSION CORPORATION\IMMERSION DESKTOP\IDESKTOP.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE

O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HydarVisionDesktopManager] desk98.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [IDesktop] C:\Program Files\Immersion Corporation\Immersion Desktop\idesktop.exe 1
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\GRISOFT\AVG7\AVGREGCL.EXE /BOOT
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [avgamsvr.exe] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O9 - Extra button: CUseeMe Conferencing Companion (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14
O19 - User stylesheet: (file missing)

HyYa · Answer

Hy removed 1 virus scanner and delteed the reg 1 ya told me yes thats my ip dont understand what you want me to tell ya ? :) will post hijack 1 more time need to reboot

ChrisRLG · Answer

The O19 did not go, did you fix that one. If not fix it now, its just a broken link, not bad.

Also what is your ISP. And what settings did they provide for you for DNS & Gateway server IP addresses (Like that 69.57.146.14)

Other wise you are looking clean now.

Look on my site (Link below) in the malware section for spywareblaster and spywareguard and also ie-spyad from here :- http://www.staff.uiuc.edu/~ehowes/resource.htm

Install those should help you for the future.

I notice that you are running two AV programs. Sometimes that can give problems.

ChrisRLG · Answer

Tick these in hijackthis, AND WITH ALL BROWSER WINDOWS CLOSED, fix ticked:-

O1 - Hosts: 81.211.105.12 www.globe-finder.cc
O1 - Hosts: 81.211.105.12 globe-finder.cc
O1 - Hosts: 81.211.105.12 searchscout.com
O1 - Hosts: 81.211.105.12 www.searchscout.com
O1 - Hosts: 81.211.105.12 193.125.201.50
O1 - Hosts: 81.211.105.12 206.161.200.105
O1 - Hosts: 81.211.105.12 209.66.114.130
O1 - Hosts: 81.211.105.12 216.200.3.32
O1 - Hosts: 81.211.105.12 64.124.45.181
O1 - Hosts: 81.211.105.12 66.250.130.194
O1 - Hosts: 81.211.105.12 66.40.16.131
O1 - Hosts: 81.211.105.12 allhyperlinks.com
O1 - Hosts: 81.211.105.12 bestcrawler.com
O1 - Hosts: 81.211.105.12 global-finder.com
O1 - Hosts: 81.211.105.12 idgsearch.com
O1 - Hosts: 81.211.105.12 ie-search.com
O1 - Hosts: 81.211.105.12 itseasy.us
O1 - Hosts: 81.211.105.12 jetseeker.com
O1 - Hosts: 81.211.105.12 martfinder.com
O1 - Hosts: 81.211.105.12 search.unipages.cc
O1 - Hosts: 81.211.105.12 search.xrenoder.com
O1 - Hosts: 81.211.105.12 search-2003.com
O1 - Hosts: 81.211.105.12 searchdot.net
O1 - Hosts: 81.211.105.12 searchxp.com
O1 - Hosts: 81.211.105.12 seekwell.net
O1 - Hosts: 81.211.105.12 slawsearch.com
O1 - Hosts: 81.211.105.12 srch-us6.hpwis.com
O1 - Hosts: 81.211.105.12 start-space.com
O1 - Hosts: 81.211.105.12 searchmyrequest.com
O1 - Hosts: 81.211.105.12 topsearcher.com
O1 - Hosts: 81.211.105.12 unipages.cc
O1 - Hosts: 81.211.105.12 worldnet.att.net
O1 - Hosts: 81.211.105.12 yourbookmarks.ws
O19 - User stylesheet: (file missing)

Those 01 entries could be generated by one of these O16's,. They are activeX controls and in the event of you needing one of these IE would download it the next time you go back to that site, so I suggest the removal of all these:-
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {DAAD8E43-FAC2-41DD-8F02-9D2BD626F4BB} (AVChat_Inst Control) - http://chat.saram.net/avchat/AVChat_InstProj1.cab
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://webcamnow.com/voice/voice.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} -
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} -
O16 - DPF: {410BB67A-C0EC-4FA7-8E71-96A208E06773} (BQMWebMessage.WebMessage) - http://community.bestqm.com/photomail/BQMWebMessage.CAB
O16 - DPF: {4FCFF034-6F56-4D65-8C31-70D98C475428} (ddm_download.ddm_control) - http://bins.dynamicdesktopmedia.com/cab/ddm_control.CAB
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/webregtest/RegDload.CAB
O16 - DPF: {5AAF063D-6AF0-409A-886A-336FB5112064} (NeoBook ActiveX Control) - http://www.onmycam.org/NBActiveX.ocx
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v45/h2hpool/h2hpool.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1ca.cab

These could be your ISP's data. The first is MyDomain.com the second is detailed below, but is also known as ev1.net
If neither of these is your ISP, they sould be fixed.
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14
------------
12/21/03 22:57:01 IP block 69.57.146.14
Trying 69.57.146.14 at ARIN
Trying 69.57.146 at ARIN

OrgName:    Everyones Internet, Inc.
OrgID:      EVRY
Address:    2600 Southwest Freeway
Address:    Suite 500
City:       Houston
StateProv: TX
PostalCode: 77098
Country:    US
------------------

after fixing with hijackthis, please reboot your computer, and post another log for us to check.

HyYa · Answer

Logfile of HijackThis v1.97.7Scan saved at 7:00:58 PM, on 12/21/03Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGAMSVR.EXEC:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\SYSTEM\RPCSS.EXEC:\WINDOWS\TASKMON.EXEC:\WINDOWS\SYSTEM\SYSTRAY.EXEC:\WINDOWS\SYSTEM\DESK98.EXEC:\WINDOWS\SYSTEM\ATIPTAXX.EXEC:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXEC:\PROGRAM FILES\IMMERSION CORPORATION\IMMERSION DESKTOP\IDESKTOP.EXEC:\WINDOWS\LOADQM.EXEC:\PROGRAM FILES\GRISOFT\AVG7\AVGCC.EXEC:\WINDOWS\SYSTEM\WMIEXE.EXEC:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITBHO.DLLO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\PROGRAM FILES\TECHSMITH\SNAGIT 7\SNAGITIEADDIN.DLLO4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorunO4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS	askmon.exeO4 - HKLM\..\Run: [SystemTray] SysTray.ExeO4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\Run: [HydarVisionDesktopManager] desk98.exeO4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [IDesktop] C:\Program Files\Immersion Corporation\Immersion Desktop\idesktop.exe 1O4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUPO4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\GRISOFT\AVG7\AVGREGCL.EXE /BOOTO4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrSchemeO4 - HKLM\..\RunServices: [avgamsvr.exe] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXEO4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exeO9 - Extra button: CUseeMe Conferencing Companion (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dllO17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = mydomain.comO17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.57.146.14

HyYa · Answer

Nope thats not my ip sorry

ChrisRLG · Answer

All Clear. Do follow the suggested extra programs.

HyYa · Answer

Well thank you for all the help ChrisRLG it was 1 heck of a nite mere hehe that 1 trojan i had called Update911.js was a real pain to get rid of think its gone now thats what kinda all started this hehe sorry for so many posts and the help is very much appreciated thanks :)

Windows General

Was this post helpful?