Help

Start a discussion
UNSOLVED

bugsrevenge

updated

21 years ago

B

bugsrevenge

10 Posts

0

1021

May 20th, 2005 17:00

log-Windows ME

tried -system restore
-Norton Antivirus scan and delete infected files
My problems seem to have been caused by Trojan-Spy.html.smitfraud.c

Its causing a fatal error with the blue screen and when I click on some internet links it forwards me to clicksearch.com
THANKS

here is the log

********************************************************************************
Logfile of HijackThis v1.99.1
Scan saved at 1:56:50 PM, on 20/05/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\WINDOWS\DL.EXE
C:\WINDOWS\SWCHOST.EXE
C:\WINDOWS\SVCHOSTT.EXE
C:\WINDOWS\SVAHOST.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SLCHOST.EXE
C:\WINDOWS\SYSTEM\SRVC32.EXE
C:\WINDOWS\SYSTEM\SERVICES\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WP.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\ZIP\FBZIP.EXE
C:\PROGRAM FILES\ZIP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://in.webcounter.cc/---/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=118
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://martfinder.com/dpindex.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?vwjuo (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?vwjuo (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://ie.search.psn.cn/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://webcoolsearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/
R3 - URLSearchHook: (no name) - - (no file)
F1 - win.ini: run=fntldr.exe C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\info32.exe N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.ca/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
O1 - Hosts: 69.56.223.196 t.rack.cc
O1 - Hosts: 69.56.223.196 www.alfa-search.com
O1 - Hosts: 69.56.223.196 webcoolsearch.com
O1 - Hosts: 69.56.223.196 in.webcounter.cc
O1 - Hosts: 69.56.223.196 i-lookup.com
O1 - Hosts: 69.56.223.196 www.hand-book.com
O1 - Hosts: 69.56.223.196 www.maxxxhosters.com
O1 - Hosts: 69.56.223.196 allneedsearch.com
O1 - Hosts: 69.56.223.196 nativehardcore.com
O1 - Hosts: 69.56.223.196 teen-biz.com
O1 - Hosts: 69.56.223.196 t*ts.hardcore4ever.net
O1 - Hosts: 69.56.223.196 best.royalsearch.net
O1 - Hosts: 69.56.223.196 default-homepage-network.com
O1 - Hosts: 69.56.223.196 xwebsearch.biz
O1 - Hosts: 69.56.223.196 www.rightfinder.net
O1 - Hosts: 69.56.223.196 www.search-1.net
O1 - Hosts: 69.56.223.196 www.searchv.com
O1 - Hosts: 69.56.223.196 www.websearch.com
O1 - Hosts: 69.56.223.196 mysearchnow.com
O1 - Hosts: 69.56.223.196 www.therealsearch.com
O1 - Hosts: 69.56.223.196 www.find-itnow.com
O1 - Hosts: 69.56.223.196 find.microgirls.com
O1 - Hosts: 69.56.223.196 super-spider.com
O1 - Hosts: 69.56.223.196 www.searching-the-net.com
O1 - Hosts: 69.56.223.196 www.firstbookmark.com
O1 - Hosts: 69.56.223.196 just.find-itnow.com
O1 - Hosts: 69.56.223.196 www.find-itnow.com
O1 - Hosts: 69.56.223.196 qwertysearch123.biz
O1 - Hosts: 69.56.223.196 www.search-space.com
O1 - Hosts: 69.56.223.196 www.windowws.cc
O1 - Hosts: 69.56.223.196 aifind.info
O1 - Hosts: 69.56.223.196 www.find4u.net
O1 - Hosts: 69.56.223.196 find4u.net
O1 - Hosts: 69.56.223.196 www.lookfor.cc
O1 - Hosts: 69.56.223.196 www.008i.com
O1 - Hosts: 69.56.223.196 www.viewpornkey.com
O1 - Hosts: 69.56.223.196 www.hugesearch.net
O1 - Hosts: 69.56.223.196 www.novaf*ck.com
O1 - Hosts: 69.56.223.196 www.seznam.cz
O1 - Hosts: 69.56.223.196 aifind.cc
O1 - Hosts: 69.56.223.196 www.onet.pl
O1 - Hosts: 69.56.223.196 teenhqpics.com
O1 - Hosts: 69.56.223.196 www.ttjj.com
O1 - Hosts: 69.56.223.196 www.search-dot.com
O1 - Hosts: 69.56.223.196 www.search-and-go.com
O1 - Hosts: 69.56.223.196 www.slotch.com
O1 - Hosts: 69.56.223.196 www.2fastsearch.net
O1 - Hosts: 69.56.223.196 awebfind.biz
O1 - Hosts: 69.56.223.196 www.power-search.info
O1 - Hosts: 69.56.223.196 www.naver.com
O1 - Hosts: 69.56.223.196 www.daum.net
O1 - Hosts: 69.56.223.196 www.ohcorea.com
O1 - Hosts: 69.56.223.196 www.hao123.com
O1 - Hosts: 69.56.223.196 58q.com
O1 - Hosts: 69.56.223.196 www.hotwebsearch.com
O1 - Hosts: 69.56.223.196 www.startium.com
O1 - Hosts: 69.56.223.196 www.gajai.com
O1 - Hosts: 69.56.223.196 www.wazzupnet.com
O1 - Hosts: 69.56.223.196 freshvideogals.com
O1 - Hosts: 69.56.223.196 www.xgmm.com
O1 - Hosts: 69.56.223.196 searchmyrequest.com
O1 - Hosts: 69.56.223.196 yourbookmarks.ws
O1 - Hosts: 69.56.223.196 wmmse.com
O1 - Hosts: 69.56.223.196 link.startmake.com
O1 - Hosts: 69.56.223.196 www.boredlife.com
O1 - Hosts: 69.56.223.196 approvedlinks.com
O1 - Hosts: 69.56.223.196 www.nkvd.us
O1 - Hosts: 69.56.223.196 www.8095.com
O1 - Hosts: 69.56.223.196 www.dreamwiz.com
O1 - Hosts: 69.56.223.196 ie-search.com
O1 - Hosts: 69.56.223.196 auto.ie.searchforge.com
O1 - Hosts: 69.56.223.196 search.psn.cn
O1 - Hosts: 69.56.223.196 www.couldnotfind.com
O1 - Hosts: 69.56.223.196 www.iquicksearch.com
O1 - Hosts: 69.56.223.196 1-se.com
O1 - Hosts: 69.56.223.196 www.spidersearch.com
O1 - Hosts: 69.56.223.196 search.ieplugin.com
O1 - Hosts: 69.56.223.196 itseasy.us
O1 - Hosts: 69.56.223.196 searchbar.findthewebsiteyouneed.com
O1 - Hosts: 69.56.223.196 www.searchxl.com
O1 - Hosts: 69.56.223.196 www.hotsearchbox.com
O1 - Hosts: 69.56.223.196 www.searchforge.com
O1 - Hosts: 69.56.223.196 www.omega-search.com
O1 - Hosts: 69.56.223.196 searchcentrix.com
O2 - BHO: Microsoft Excel - {17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972} - C:\WINDOWS\APPLIC~1\MICROS~1\OFFICE\EXCEL10.DLL (file missing)
O2 - BHO: ExplorerExtObj Class - {23BC1CCF-4BE7-497F-B154-6ADA68425FBB} - C:\WINDOWS\SYSTEM\EXPEXT.DLL
O2 - BHO: MSM32 Helper - {1E1B2879-88FF-11D2-8D96-000000000004} - C:\WINDOWS\SYSTEM\SSOCKS32.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D8274} - C:\WINDOWS\SYSTEM\SPM8274.DLL
O3 - Toolbar: (no name) - {6EF3AE25-5A7D-40C2-9B44-9ED0068621C0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Soundmx] C:\WINDOWS\SYSTEM\soundmx.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [Syscpy] C:\WINDOWS\SYSTEM\syscpy.exe
O4 - HKLM\..\Run: [Explkw] C:\WINDOWS\SYSTEM\expup.exe
O4 - HKLM\..\Run: [Updates] C:\WINDOWS\system32\msupdate.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Reg32] C:\WINDOWS\reg32.exe
O4 - HKLM\..\Run: [Dial32] C:\WINDOWS\dl.exe
O4 - HKLM\..\Run: [Online Special] C:\WINDOWS\swchost.exe
O4 - HKLM\..\Run: [Online Systems] C:\WINDOWS\svchostt.exe
O4 - HKLM\..\Run: [System Restore] C:\WINDOWS\svahost.exe
O4 - HKLM\..\Run: [Alive SYstem] C:\WINDOWS\SYSTEM\scchost.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Systems Restart] C:\WINDOWS\slchost.exe
O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\SYSTEM\Services\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [Desktop] rundll32.exe msconfd,Restore ControlPanel
O4 - HKLM\..\RunServices: [Srv32 spool service] C:\WINDOWS\System\spoolsrv32.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Service Manager] C:\windows\dxsound.exe
O4 - HKCU\..\Run: [sws.exe] c:\program files\GlobalDialer\tonex00174\SVCHOST.EXE -remove
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
O15 - Trusted Zone: *.teensguru.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.offshoreclicks.com
O16 - DPF: {4B55FE21-325E-48D5-9B39-9B430D639EE8} (ScanFile.FileScan) - http://www.contentpurity.com/ScanFile.CAB
O19 - User stylesheet: C:\WINDOWS\Web\tips.ini
O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
  • Z

    zbestwun2001

    4 Apprentice

    •

    8831 Posts

    235

    0

    Posted May 20th, 2005 18:00

    Hi and welcome,

    Let's try and clear up the Smitfraud problem first.

    Open this link and save it to your desktop in Notepad.

    Smitfraud
    Fix Reg File

    • After you have saved it to your desktop, double-click on the smitfraud.reg file
      on your Desktop. When it asks if you want to merge the information, allow
      it to do so.

    • Reboot and you can now change your desktop properties back to the way you
      want to. If you have trouble with some settings, click on the Themes tab
      in the display settings and change the theme to Windows 2000 to
      use the default settings


    • Now post a new log and see if that Smitfraud has disappeared?

      Then post a new log and we will go from there.

      Steve
  • B

    bugsrevenge

    10 Posts

    235

    0

    Posted May 20th, 2005 19:00

    thanks! worked like a charm. I still have the weird links to clicksearch.com and I am also getting a error message at startup " failure msconfd"

    here is the new log"

    Logfile of HijackThis v1.99.1
    Scan saved at 4:37:12 PM, on 20/05/2005
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
    C:\WINDOWS\DL.EXE
    C:\WINDOWS\SWCHOST.EXE
    C:\WINDOWS\SVCHOSTT.EXE
    C:\WINDOWS\SVAHOST.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SLCHOST.EXE
    C:\WINDOWS\SYSTEM\SRVC32.EXE
    C:\WINDOWS\SYSTEM\SERVICES\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
    C:\WINDOWS\RunDLL.exe
    C:\WINDOWS\DXSOUND.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\WP.EXE
    C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\ZIP\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=118
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://martfinder.com/dpindex.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://ie.search.psn.cn/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://webcoolsearch.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/
    R3 - URLSearchHook: (no name) - - (no file)
    F1 - win.ini: run=fntldr.exe C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\info32.exe N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.ca/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
    O1 - Hosts: 69.56.223.196 t.rack.cc
    O1 - Hosts: 69.56.223.196 www.alfa-search.com
    O1 - Hosts: 69.56.223.196 webcoolsearch.com
    O1 - Hosts: 69.56.223.196 in.webcounter.cc
    O1 - Hosts: 69.56.223.196 i-lookup.com
    O1 - Hosts: 69.56.223.196 www.hand-book.com
    O1 - Hosts: 69.56.223.196 www.maxxxhosters.com
    O1 - Hosts: 69.56.223.196 allneedsearch.com
    O1 - Hosts: 69.56.223.196 nativehardcore.com
    O1 - Hosts: 69.56.223.196 teen-biz.com
    O1 - Hosts: 69.56.223.196 t*ts.hardcore4ever.net
    O1 - Hosts: 69.56.223.196 best.royalsearch.net
    O1 - Hosts: 69.56.223.196 default-homepage-network.com
    O1 - Hosts: 69.56.223.196 xwebsearch.biz
    O1 - Hosts: 69.56.223.196 www.rightfinder.net
    O1 - Hosts: 69.56.223.196 www.search-1.net
    O1 - Hosts: 69.56.223.196 www.searchv.com
    O1 - Hosts: 69.56.223.196 www.websearch.com
    O1 - Hosts: 69.56.223.196 mysearchnow.com
    O1 - Hosts: 69.56.223.196 www.therealsearch.com
    O1 - Hosts: 69.56.223.196 www.find-itnow.com
    O1 - Hosts: 69.56.223.196 find.microgirls.com
    O1 - Hosts: 69.56.223.196 super-spider.com
    O1 - Hosts: 69.56.223.196 www.searching-the-net.com
    O1 - Hosts: 69.56.223.196 www.firstbookmark.com
    O1 - Hosts: 69.56.223.196 just.find-itnow.com
    O1 - Hosts: 69.56.223.196 www.find-itnow.com
    O1 - Hosts: 69.56.223.196 qwertysearch123.biz
    O1 - Hosts: 69.56.223.196 www.search-space.com
    O1 - Hosts: 69.56.223.196 www.windowws.cc
    O1 - Hosts: 69.56.223.196 aifind.info
    O1 - Hosts: 69.56.223.196 www.find4u.net
    O1 - Hosts: 69.56.223.196 find4u.net
    O1 - Hosts: 69.56.223.196 www.lookfor.cc
    O1 - Hosts: 69.56.223.196 www.008i.com
    O1 - Hosts: 69.56.223.196 www.viewpornkey.com
    O1 - Hosts: 69.56.223.196 www.hugesearch.net
    O1 - Hosts: 69.56.223.196 www.novaf**k.com
    O1 - Hosts: 69.56.223.196 www.seznam.cz
    O1 - Hosts: 69.56.223.196 aifind.cc
    O1 - Hosts: 69.56.223.196 www.onet.pl
    O1 - Hosts: 69.56.223.196 teenhqpics.com
    O1 - Hosts: 69.56.223.196 www.ttjj.com
    O1 - Hosts: 69.56.223.196 www.search-dot.com
    O1 - Hosts: 69.56.223.196 www.search-and-go.com
    O1 - Hosts: 69.56.223.196 www.slotch.com
    O1 - Hosts: 69.56.223.196 www.2fastsearch.net
    O1 - Hosts: 69.56.223.196 awebfind.biz
    O1 - Hosts: 69.56.223.196 www.power-search.info
    O1 - Hosts: 69.56.223.196 www.naver.com
    O1 - Hosts: 69.56.223.196 www.daum.net
    O1 - Hosts: 69.56.223.196 www.ohcorea.com
    O1 - Hosts: 69.56.223.196 www.hao123.com
    O1 - Hosts: 69.56.223.196 58q.com
    O1 - Hosts: 69.56.223.196 www.hotwebsearch.com
    O1 - Hosts: 69.56.223.196 www.startium.com
    O1 - Hosts: 69.56.223.196 www.gajai.com
    O1 - Hosts: 69.56.223.196 www.wazzupnet.com
    O1 - Hosts: 69.56.223.196 freshvideogals.com
    O1 - Hosts: 69.56.223.196 www.xgmm.com
    O1 - Hosts: 69.56.223.196 searchmyrequest.com
    O1 - Hosts: 69.56.223.196 yourbookmarks.ws
    O1 - Hosts: 69.56.223.196 wmmse.com
    O1 - Hosts: 69.56.223.196 link.startmake.com
    O1 - Hosts: 69.56.223.196 www.boredlife.com
    O1 - Hosts: 69.56.223.196 approvedlinks.com
    O1 - Hosts: 69.56.223.196 www.nkvd.us
    O1 - Hosts: 69.56.223.196 www.8095.com
    O1 - Hosts: 69.56.223.196 www.dreamwiz.com
    O1 - Hosts: 69.56.223.196 ie-search.com
    O1 - Hosts: 69.56.223.196 auto.ie.searchforge.com
    O1 - Hosts: 69.56.223.196 search.psn.cn
    O1 - Hosts: 69.56.223.196 www.couldnotfind.com
    O1 - Hosts: 69.56.223.196 www.iquicksearch.com
    O1 - Hosts: 69.56.223.196 1-se.com
    O1 - Hosts: 69.56.223.196 www.spidersearch.com
    O1 - Hosts: 69.56.223.196 search.ieplugin.com
    O1 - Hosts: 69.56.223.196 itseasy.us
    O1 - Hosts: 69.56.223.196 searchbar.findthewebsiteyouneed.com
    O1 - Hosts: 69.56.223.196 www.searchxl.com
    O1 - Hosts: 69.56.223.196 www.hotsearchbox.com
    O1 - Hosts: 69.56.223.196 www.searchforge.com
    O1 - Hosts: 69.56.223.196 www.omega-search.com
    O1 - Hosts: 69.56.223.196 searchcentrix.com
    O2 - BHO: Microsoft Excel - {17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972} - C:\WINDOWS\APPLIC~1\MICROS~1\OFFICE\EXCEL10.DLL (file missing)
    O2 - BHO: ExplorerExtObj Class - {23BC1CCF-4BE7-497F-B154-6ADA68425FBB} - C:\WINDOWS\SYSTEM\EXPEXT.DLL
    O2 - BHO: MSM32 Helper - {1E1B2879-88FF-11D2-8D96-000000000004} - C:\WINDOWS\SYSTEM\SSOCKS32.DLL (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL
    O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D8274} - C:\WINDOWS\SYSTEM\SPM8274.DLL
    O3 - Toolbar: (no name) - {6EF3AE25-5A7D-40C2-9B44-9ED0068621C0} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [Soundmx] C:\WINDOWS\SYSTEM\soundmx.exe
    O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
    O4 - HKLM\..\Run: [Syscpy] C:\WINDOWS\SYSTEM\syscpy.exe
    O4 - HKLM\..\Run: [Explkw] C:\WINDOWS\SYSTEM\expup.exe
    O4 - HKLM\..\Run: [Updates] C:\WINDOWS\system32\msupdate.exe
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\Run: [Reg32] C:\WINDOWS\reg32.exe
    O4 - HKLM\..\Run: [Dial32] C:\WINDOWS\dl.exe
    O4 - HKLM\..\Run: [Online Special] C:\WINDOWS\swchost.exe
    O4 - HKLM\..\Run: [Online Systems] C:\WINDOWS\svchostt.exe
    O4 - HKLM\..\Run: [System Restore] C:\WINDOWS\svahost.exe
    O4 - HKLM\..\Run: [Alive SYstem] C:\WINDOWS\SYSTEM\scchost.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [Systems Restart] C:\WINDOWS\slchost.exe
    O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe
    O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\SYSTEM\Services\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
    O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
    O4 - HKLM\..\RunServices: [Desktop] rundll32.exe msconfd,Restore ControlPanel
    O4 - HKLM\..\RunServices: [Srv32 spool service] C:\WINDOWS\System\spoolsrv32.exe
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - HKCU\..\Run: [Service Manager] C:\windows\dxsound.exe
    O4 - HKCU\..\Run: [sws.exe] c:\program files\GlobalDialer\tonex00174\SVCHOST.EXE -remove
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
    O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE
    O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra button: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
    O15 - Trusted Zone: *.teensguru.com
    O15 - Trusted Zone: *.xxxtoolbar.com
    O15 - Trusted Zone: *.offshoreclicks.com
    O16 - DPF: {4B55FE21-325E-48D5-9B39-9B430D639EE8} (ScanFile.FileScan) - http://www.contentpurity.com/ScanFile.CAB
    O19 - User stylesheet: C:\WINDOWS\Web\tips.ini
    O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)
  • Z

    zbestwun2001

    4 Apprentice

    •

    8831 Posts

    236

    0

    Posted May 20th, 2005 19:00

    Boy you got your handsful of trouble.

    But we should be able to clean it up.


    Be sure to look this solution over before you begin. There are a some item(s) i'm not familar with. If you recognze any, then just omit them from this fix.


    The version of Internet Explorer your currently using might be out of date, since there's no indication of a version in the header. Be sure to check for, and upgrad to the newest version as soon as possible, it necessary.


    Download, unzip to your desktop CWShredder and run it, then:

    1. Click " Check For Update"

    ( If an update isn't available, skip to step #4.)

    2. Click " Click here to Download the upate".
    3. When the new version has been downloaded, click " Save".
    4. Click " Fix ->"



    Download the Adware.Istbar removal utility from Symantec and following the instructions on the same page. Follow the instuctions and run it.


    Run HiJackThis then:

    1. Click " Config..."
    2. Click " Misc Tools"
    3. Click " Open Process manager"

    -

    Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

    C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
    C:\WINDOWS\DL.EXE
    C:\WINDOWS\SWCHOST.EXE
    C:\WINDOWS\SVCHOSTT.EXE
    C:\WINDOWS\SVAHOST.EXE
    C:\WINDOWS\SLCHOST.EXE
    C:\WINDOWS\SYSTEM\SRVC32.EXE
    C:\WINDOWS\SYSTEM\SERVICES\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
    C:\WP.EXE

    Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.


    Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

    regsvr32 /u EXPEXT.DLL
    regsvr32 /u MTC.DLL
    regsvr32 /u SPM8274.DLL

    It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.


    Run HiJackThis and click " Scan", then check(tick) the following, if present:


    R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://in.webcounter.cc/-/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=9
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.allhyperlinks.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=118
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://about-blank.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://in.webcounter.cc/---/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://in.webcounter.cc/--/?vwjuo (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://martfinder.com/dpindex.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://ie.search.psn.cn/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://webcoolsearch.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure32.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://about-blank.biz/

    R3 - URLSearchHook: (no name) - - (no file)

    O1 - Hosts: 69.56.223.196 t.rack.cc
    O1 - Hosts: 69.56.223.196 www.alfa-search.com
    O1 - Hosts: 69.56.223.196 webcoolsearch.com
    O1 - Hosts: 69.56.223.196 in.webcounter.cc
    O1 - Hosts: 69.56.223.196 i-lookup.com
    O1 - Hosts: 69.56.223.196 www.hand-book.com
    O1 - Hosts: 69.56.223.196 www.maxxxhosters.com
    O1 - Hosts: 69.56.223.196 allneedsearch.com
    O1 - Hosts: 69.56.223.196 nativehardcore.com
    O1 - Hosts: 69.56.223.196 teen-biz.com
    O1 - Hosts: 69.56.223.196 t*ts.hardcore4ever.net
    O1 - Hosts: 69.56.223.196 best.royalsearch.net
    O1 - Hosts: 69.56.223.196 default-homepage-network.com
    O1 - Hosts: 69.56.223.196 xwebsearch.biz
    O1 - Hosts: 69.56.223.196 www.rightfinder.net
    O1 - Hosts: 69.56.223.196 www.search-1.net
    O1 - Hosts: 69.56.223.196 www.searchv.com
    O1 - Hosts: 69.56.223.196 www.websearch.com
    O1 - Hosts: 69.56.223.196 mysearchnow.com
    O1 - Hosts: 69.56.223.196 www.therealsearch.com
    O1 - Hosts: 69.56.223.196 www.find-itnow.com
    O1 - Hosts: 69.56.223.196 find.microgirls.com
    O1 - Hosts: 69.56.223.196 super-spider.com
    O1 - Hosts: 69.56.223.196 www.searching-the-net.com
    O1 - Hosts: 69.56.223.196 www.firstbookmark.com
    O1 - Hosts: 69.56.223.196 just.find-itnow.com
    O1 - Hosts: 69.56.223.196 www.find-itnow.com
    O1 - Hosts: 69.56.223.196 qwertysearch123.biz
    O1 - Hosts: 69.56.223.196 www.search-space.com
    O1 - Hosts: 69.56.223.196 www.windowws.cc
    O1 - Hosts: 69.56.223.196 aifind.info
    O1 - Hosts: 69.56.223.196 www.find4u.net
    O1 - Hosts: 69.56.223.196 find4u.net
    O1 - Hosts: 69.56.223.196 www.lookfor.cc
    O1 - Hosts: 69.56.223.196 www.008i.com
    O1 - Hosts: 69.56.223.196 www.viewpornkey.com
    O1 - Hosts: 69.56.223.196 www.hugesearch.net
    O1 - Hosts: 69.56.223.196 www.novaf**k.com
    O1 - Hosts: 69.56.223.196 www.seznam.cz
    O1 - Hosts: 69.56.223.196 aifind.cc
    O1 - Hosts: 69.56.223.196 www.onet.pl
    O1 - Hosts: 69.56.223.196 teenhqpics.com
    O1 - Hosts: 69.56.223.196 www.ttjj.com
    O1 - Hosts: 69.56.223.196 www.search-dot.com
    O1 - Hosts: 69.56.223.196 www.search-and-go.com
    O1 - Hosts: 69.56.223.196 www.slotch.com
    O1 - Hosts: 69.56.223.196 www.2fastsearch.net
    O1 - Hosts: 69.56.223.196 awebfind.biz
    O1 - Hosts: 69.56.223.196 www.power-search.info
    O1 - Hosts: 69.56.223.196 www.naver.com
    O1 - Hosts: 69.56.223.196 www.daum.net
    O1 - Hosts: 69.56.223.196 www.ohcorea.com
    O1 - Hosts: 69.56.223.196 www.hao123.com
    O1 - Hosts: 69.56.223.196 58q.com
    O1 - Hosts: 69.56.223.196 www.hotwebsearch.com
    O1 - Hosts: 69.56.223.196 www.startium.com
    O1 - Hosts: 69.56.223.196 www.gajai.com
    O1 - Hosts: 69.56.223.196 www.wazzupnet.com
    O1 - Hosts: 69.56.223.196 freshvideogals.com
    O1 - Hosts: 69.56.223.196 www.xgmm.com
    O1 - Hosts: 69.56.223.196 searchmyrequest.com
    O1 - Hosts: 69.56.223.196 yourbookmarks.ws
    O1 - Hosts: 69.56.223.196 wmmse.com
    O1 - Hosts: 69.56.223.196 link.startmake.com
    O1 - Hosts: 69.56.223.196 www.boredlife.com
    O1 - Hosts: 69.56.223.196 approvedlinks.com
    O1 - Hosts: 69.56.223.196 www.nkvd.us
    O1 - Hosts: 69.56.223.196 www.8095.com
    O1 - Hosts: 69.56.223.196 www.dreamwiz.com
    O1 - Hosts: 69.56.223.196 ie-search.com
    O1 - Hosts: 69.56.223.196 auto.ie.searchforge.com
    O1 - Hosts: 69.56.223.196 search.psn.cn
    O1 - Hosts: 69.56.223.196 www.couldnotfind.com
    O1 - Hosts: 69.56.223.196 www.iquicksearch.com
    O1 - Hosts: 69.56.223.196 1-se.com
    O1 - Hosts: 69.56.223.196 www.spidersearch.com
    O1 - Hosts: 69.56.223.196 search.ieplugin.com
    O1 - Hosts: 69.56.223.196 itseasy.us
    O1 - Hosts: 69.56.223.196 searchbar.findthewebsiteyouneed.com
    O1 - Hosts: 69.56.223.196 www.searchxl.com
    O1 - Hosts: 69.56.223.196 www.hotsearchbox.com
    O1 - Hosts: 69.56.223.196 www.searchforge.com
    O1 - Hosts: 69.56.223.196 www.omega-search.com
    O1 - Hosts: 69.56.223.196 searchcentrix.com

    O2 - BHO: Microsoft Excel - {17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972} - C:\WINDOWS\APPLIC~1\MICROS~1\OFFICE\EXCEL10.DLL (file missing)
    O2 - BHO: ExplorerExtObj Class - {23BC1CCF-4BE7-497F-B154-6ADA68425FBB} - C:\WINDOWS\SYSTEM\EXPEXT.DLL
    O2 - BHO: MSM32 Helper - {1E1B2879-88FF-11D2-8D96-000000000004} - C:\WINDOWS\SYSTEM\SSOCKS32.DLL (file missing)
    O2 - BHO: Tubby - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL
    O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D8274} - C:\WINDOWS\SYSTEM\SPM8274.DLL

    O3 - Toolbar: (no name) - {6EF3AE25-5A7D-40C2-9B44-9ED0068621C0} - (no file)
    O3 - Toolbar: Search Toolbar - {9EAC0102-5E61-2312-BC2D-4D54434D5443} - C:\WINDOWS\SYSTEM\MTC.DLL

    O4 - HKLM\..\Run: [Syscpy] C:\WINDOWS\SYSTEM\syscpy.exe
    O4 - HKLM\..\Run: [Explkw] C:\WINDOWS\SYSTEM\expup.exe
    O4 - HKLM\..\Run: [Updates] C:\WINDOWS\system32\msupdate.exe
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\Run: [Reg32] C:\WINDOWS\reg32.exe
    O4 - HKLM\..\Run: [Dial32] C:\WINDOWS\dl.exe
    O4 - HKLM\..\Run: [Online Special] C:\WINDOWS\swchost.exe
    O4 - HKLM\..\Run: [Online Systems] C:\WINDOWS\svchostt.exe
    O4 - HKLM\..\Run: [System Restore] C:\WINDOWS\svahost.exe
    O4 - HKLM\..\Run: [Alive SYstem] C:\WINDOWS\SYSTEM\scchost.exe
    O4 - HKLM\..\Run: [Systems Restart] C:\WINDOWS\slchost.exe
    O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe
    O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\SYSTEM\Services\{79088C42-F31C-424D-A90A-8F67B2741C97}\SVCHOST.EXE
    O4 - HKCU\..\Run: [sws.exe] c:\program files\GlobalDialer\tonex00174\SVCHOST.EXE -remove
    O4 - HKCU\..\Run: [WindowsFY] C:\WP.EXE

    O15 - Trusted Zone: *.teensguru.com
    O15 - Trusted Zone: *.xxxtoolbar.com
    O15 - Trusted Zone: *.offshoreclicks.com

    O19 - User stylesheet: C:\WINDOWS\Web\tips.ini
    O19 - User stylesheet: C:\WINDOWS\hh.htt (HKLM)


    Now, with all windows closed except HiJackThis, click " Fix checked".



    When your done, rescan your system and make sure the following isn't present:

    N3 - Netscape ... 5CSBWeb_01.src ( or) 5CSBWeb_02.src

    If it is, then fix that entry again; sometimes it'll take more than one pass. The actual entry is ok, and won't be deleted, it's the java wrapper marked in red that needs to be removed.


    Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

    folders...

    C:\PROGRAM FILES\ISTSVC
    C:\WINDOWS\SYSTEM\SERVICES
    c:\program files\GlobalDialer

    files...

    C:\WINDOWS\DL.EXE
    C:\WINDOWS\SWCHOST.EXE
    C:\WINDOWS\SVCHOSTT.EXE
    C:\WINDOWS\SVAHOST.EXE
    C:\WINDOWS\SLCHOST.EXE
    C:\WINDOWS\SYSTEM\SRVC32.EXE
    C:\WP.EXE
    C:\WINDOWS\SYSTEM\EXPEXT.DLL
    C:\WINDOWS\SYSTEM\MTC.DLL
    C:\WINDOWS\SYSTEM\SPM8274.DLL
    C:\WINDOWS\SYSTEM\syscpy.exe
    C:\WINDOWS\SYSTEM\expup.exe
    C:\WINDOWS\system32\msupdate.exe
    C:\WINDOWS\reg32.exe
    C:\WINDOWS\SYSTEM\scchost.exe

    -

    Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".


    Post back a new log, and let me know how everything goes.

    Steve
  • B

    bugsrevenge

    10 Posts

    236

    0

    Posted May 21st, 2005 15:00

    I just noticed that I missed
    O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe

    I just removed it...
  • B

    bugsrevenge

    10 Posts

    236

    0

    Posted May 21st, 2005 15:00

    Steve

    here is the new log, I did download the new version of internet explorer, but I believe that one of the softwares you told me to download removed the files. I will download again

    Thanks for your help


    Logfile of HijackThis v1.99.1
    Scan saved at 12:19:54 PM, on 21/05/2005
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Unable to get Internet Explorer version!

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SPOOLSRV32.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\SRVC32.EXE
    C:\WINDOWS\RunDLL.exe
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
    C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
    C:\PROGRAM FILES\ZIP\HIJACKTHIS.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.savewealth.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.savewealth.com/support/ie6/welcome.html
    N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.google.ca/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_01.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\wxq0tcm9.slt\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
    O4 - HKLM\..\Run: [Local runole service] C:\WINDOWS\System\srvc32.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
    O4 - HKLM\..\RunServices: [Srv32 spool service] C:\WINDOWS\System\spoolsrv32.exe
    O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
    O4 - HKCU\..\Run: [Service Manager] C:\windows\dxsound.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
    O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra button: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {B21229E8-F9AD-45F7-BF69-2311A6F5C983} - (no file) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.savewealth.com
    O16 - DPF: {4B55FE21-325E-48D5-9B39-9B430D639EE8} (ScanFile.FileScan) - http://www.contentpurity.com/ScanFile.CAB
  • Z

    zbestwun2001

    4 Apprentice

    •

    8831 Posts

    236

    0

    Posted May 21st, 2005 15:00

    Log looks good to me.

    How is the system working?

    Steve
  • B

    bugsrevenge

    10 Posts

    236

    0

    Posted May 21st, 2005 16:00

    Steve

    It's working much better now. The only problem I have uncovered is that the computer plays all songs at chipmunk speed even from an original CD!

    Is there any software I should download to prevent my system from being polluted like that again?


    Thank you very much for all your help. I am so happy that I didn't have to reformat and reinstall!!

    Thanks,

    Chantal
  • Z

    zbestwun2001

    4 Apprentice

    •

    8831 Posts

    236

    0

    Posted May 21st, 2005 17:00

    That is a question that is no in my league.

    But I will tell you who can help you. Go to the DVD/CD forum and post this problem to the attention of Predetor(Jeff).
    Great guy and smart as a whip when it comes to this area of troubleshooting. If anyone can figure out a DVD/CD problem it's Jeff.

    I am glad you didn't reformat either, I have been in your position and know the lousy feeling.

    If you run these programs below in my signature it will help you out alot.

    Let's clean up and finish:

    This is my normal post for when you are clear - which you now are - or seem to be. Please advise of any problems you still have :-

    Here are some last minute instructions.

    • Download and run CleanUp and clean up all the junk we have left.

    • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
    • You can find instructions on how to enable and re enable system restore here:
      Managing Windows Millennium System Restore
      or
      Windows XP System Restore Guide
      re-enable system restore with instructions from tutorial above

    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.

        2. Change the Download signed ActiveX controls to Prompt
        3. Change the Download unsigned ActiveX controls to Disable
        4. Change the Initialise and script ActiveX controls not marked as safe to Disable
        5. Change the Installation of desktop items to Prompt
        6. Change the Launching programs and files in an IFRAME to Prompt
        7. Change the Navigate sub-frames across different domains to Prompt
        8. When all these settings have been made, click on the OK button.
        9. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      6. Next press the Apply button and then the OK to exit the Internet Properties page.
      7. Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
      8. Computer Safety On line - Anti-Virus

      9. Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

      11. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
      12. Computer Safety On line - Software Firewalls

      13. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

      15. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
      16. This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
        Instructions for - Spybot S & D and Ad-aware

      17. Install Ad-Aware - Install and download Ad-Aware. You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here:
      18. Instructions for - Spybot S & D and Ad-aware

      19. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
      20. Computer Safety on line - Anti-Malware

      21. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
      22. Follow this list and your potential for being infected again will reduce dramatically.

        Steve

        SpyBoT~~~ AVG7-AntiVirus-FREE~~~ SygateFirewall-FREE~~~ AdAwareSE~~~ SpywareBlaster~~~
        CleanUp

        Message Edited by zbestwun2001 on 05-21-2005 11:15 AM

    • M

      milehighguy

      28 Posts

      236

      0

      Posted May 23rd, 2005 19:00

      Hi, Steve (zbestwun2001),
       
      My Windows 2000 laptop picked up the clicksearch problems last night - and nothing I've found will clean it completely.
       
      Looks like you really know your stuff - May I prevail upon you to walk me through a cleanup?
       
      If so, I can post a HiJack log.
       
      Thanks!
       
      Milehighguy
    • Z

      zbestwun2001

      4 Apprentice

      •

      8831 Posts

      77

      0

      Posted May 23rd, 2005 19:00

      Mile,

      You need to start your own thread and I'll take it if I can.

      Steve

    Dell Support Resources

    Latest Solutions

    View More