Thread
:
about: blank virus
View Single Post
•
•
Join Date: Jul 2004
Posts: 2,964
Reputation:
Solved Threads: 209
dlh6213
Offline
Posting Maven
Re: about: blank virus
0
#
7
Apr 26th, 2005
Do you use Viewpoint Manager? It's typically installed without the users knowledge.
Download Hoster from here:
http://www.funkytoad.com/download/hoster.zip
Run it, and when it opens, click on the
Restore Original Hosts
button and then exit Hoster.
Scan with HJT and have it fix the following entries (if found):
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\hulra.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about
:blank
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {20AD1F74-A76B-C5B9-54F5-8C3B0872A419} - C:\WINNT\system32\mspw.dll
O4 - HKLM\..\Run: [addzn.exe] C:\WINNT\system32\addzn.exe
O4 - HKLM\..\RunOnce: [javaik.exe] C:\WINNT\system32\javaik.exe
O4 - HKLM\..\RunOnce: [ipic.exe] C:\WINNT\system32\ipic.exe
O4 - HKCU\..\Run: [Spyware Begone] C:\freescan\freescan.exe -FastScan
(More info --
http://startup.iamnotageek.com/srch-freescan.exe.html
)
O16 - DPF: {04063354-A10E-4427-A1EC-F3CC81587BC6} (Mines Control) -
http://mirror.worldwinner.com/games/v40/mines/mines.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} -
http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {2C153C75-8476-434B-B3C3-57B63A3D1939} (Brickout Control) -
http://mirror.worldwinner.com/games...ut/brickout.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) -
http://mirror.worldwinner.com/games/v43/pool/pool.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -
http://www.fileplanet.com/fpdlmgr/c...DC_1_0_0_44.cab
O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Jigsaw Genius Control) -
http://mirror.worldwinner.com/games...gsaw/jigsaw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52...meInstaller.exe
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
http://tools.ebayimg.com/eps/wl/act...ol_v1-0-3-9.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) -
http://mirror.worldwinner.com/games...ck/bjattack.cab
O16 - DPF: {5EE92643-21CE-4949-903F-39439DCC3944} (Shapetris Control) -
http://mirror.worldwinner.com/games/v42/shape/shape.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) -
http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) -
http://mirror.worldwinner.com/games...ll/freecell.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {7BC394DE-07B8-412B-9F98-52E7E7A4ABD4} (Pencil Wars Control) -
http://mirror.worldwinner.com/games...y/territory.cab
O16 - DPF: {7CA3D0A3-7E2E-4AAB-A75E-FAB8ECA8BD95} (Skilljam Game Player Object) -
http://skill.skilljam.com/ssp/SSP.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) -
http://mirror.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {8BDF4BDB-7C40-4DC8-B2DD-138D8059698C} (Focus Control) -
http://mirror.worldwinner.com/games/v40/focus/focus.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) -
http://mirror.worldwinner.com/games...jo/wordmojo.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) -
http://mirror.worldwinner.com/games/v44/sol/sol.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {9D8D7672-93FF-417E-9024-C16AD141C50C} (Haunted Control) -
http://mirror.worldwinner.com/games...ted/haunted.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) -
http://mirror.worldwinner.com/games...man/hangman.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) -
http://games-dl.real.com/gameconsol...ArcadeRdxIE.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) -
http://game15.zylomgames.com/active...gamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) -
http://game14.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://anu.popcap.com/games/popcaploader_v5.cab
O16 - DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} (GolfSol Control) -
http://mirror.worldwinner.com/games...sol/golfsol.cab
O16 - DPF: {E5EF1E59-8AFD-425A-9F30-817FD6507215} (Darts Control) -
http://mirror.worldwinner.com/games/v40/darts/darts.cab
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\system32\apply.exe (file missing)
Be sure to close all open windows, other then hijackthis, before hitting the Fix button.
Go to the following locations and delete the highlighted folder or file:
C:\WINNT\system32\
addzn.exe
C:\WINNT\system32\
javaik.exe
C:\WINNT\system32\
ipic.exe
C:\WINNT\system32\
mspw.dll
C:\
freescan
Reboot, close any open browser windows, scan with hijackthis, and post a new log please.
Links to help you help yourself
:
Protect Your PC & Avoid Infections --
http://www.daniweb.com/techtalkforums/thread27519.html
Cleanup Procedures & Tools --
http://www.daniweb.com/techtalkforums/thread27570.html
Infection Removal & HijackThis Use --
http://www.daniweb.com/techtalkforums/thread28196.html
dlh6213
View Public Profile
Find all posts by dlh6213