|
| ||
| hotoffers & others on pc-please help I need help getting rid of several problems. I'm pretty new to this so please be gental. Here is my hijack this log. Any help would be gratly appreciated. Logfile of HijackThis v1.99.1 Scan saved at 9:35:27 AM, on 7/31/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\system32\rundll32.exe C:\WINNT\system32\drivers\KodakCCS.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Netscape Internet Service\ncupdatesvc.exe C:\WINNT\System32\NMSSvc.exe C:\Program Files\Norton Utilities\NPROTECT.EXE C:\WINNT\Explorer.exe C:\WINNT\System32\ScsiAccess.EXE C:\Program Files\Speed Disk\nopdb.exe C:\WINNT\System32\svchost.exe c:\winnt\system32\osxvceb.exe C:\WINNT\system32\SK9910DM.EXE C:\WINNT\GWMDMMSG.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\PhoneTools\CapFax.EXE C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe C:\Program Files\Media Access\MediaAccK.exe C:\Program Files\Media Access\MediaAccess.exe C:\Program Files\Wesw\Vzazvsg.exe C:\WINNT\System32\PSof1.exe C:\WINNT\system32\ntpdecod.exe C:\Program Files\AutoUpdate\AutoUpdate.exe C:\WINNT\system32\RUNDLL32.exe C:\WINNT\System32\vidctrl\vidctrl.exe C:\WINNT\System32\apisvc.exe C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe C:\WINNT\system32\anjbpa.exe C:\Program Files\NaviSearch\bin\nls.exe C:\Program Files\CashBack\bin\cashback.exe C:\Program Files\Netscape Internet Service\dialer.exe C:\WINNT\System32\secserv.exe C:\WINNT\dinst.exe C:\WINNT\System32\secserv.exe C:\WINNT\system\msfhtrmhvd.exe C:\Program Files\Messenger\msmsgs.exe C:\WINNT\System32\?hkntfs.exe C:\WINNT\system32\ntlmdmsp.exe C:\WINNT\system32\rundll32.exe C:\WINNT\System32\SMSSU.EXE C:\WINNT\System32\Tmntsrv32.EXE C:\Program Files\reoe\hcpc.exe C:\PROGRA~1\COMMON~1\firq\firqm.exe C:\Program Files\InetGet\stubinstaller6002.exe C:\Program Files\Norton Utilities\SYSDOC32.EXE C:\PROGRA~1\COMMON~1\firq\firqa.exe C:\Program Files\Common Files\Windows\services32.exe C:\PROGRA~1\COMMON~1\firq\firql.exe C:\Program Files\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0278/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - _{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - (no file) R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe O1 - Hosts: 69.31.81.22 www.google.ae O1 - Hosts: 69.31.81.22 www.google.am O1 - Hosts: 69.31.81.22 www.google.as O1 - Hosts: 69.31.81.22 www.google.at O1 - Hosts: 69.31.81.22 www.google.az O1 - Hosts: 69.31.81.22 www.google.be O1 - Hosts: 69.31.81.22 www.google.bi O1 - Hosts: 69.31.81.22 www.google.ca O1 - Hosts: 69.31.81.22 www.google.cd O1 - Hosts: 69.31.81.22 www.google.cg O1 - Hosts: 69.31.81.22 www.google.ch O1 - Hosts: 69.31.81.22 www.google.ci O1 - Hosts: 69.31.81.22 www.google.cl O1 - Hosts: 69.31.81.22 www.google.co.cr O1 - Hosts: 69.31.81.22 www.google.co.hu O1 - Hosts: 69.31.81.22 www.google.co.il O1 - Hosts: 69.31.81.22 www.google.co.in O1 - Hosts: 69.31.81.22 www.google.co.je O1 - Hosts: 69.31.81.22 www.google.co.jp O1 - Hosts: 69.31.81.22 www.google.co.ke O1 - Hosts: 69.31.81.22 www.google.co.kr O1 - Hosts: 69.31.81.22 www.google.co.ls O1 - Hosts: 69.31.81.22 www.google.co.nz O1 - Hosts: 69.31.81.22 www.google.co.th O1 - Hosts: 69.31.81.22 www.google.co.ug O1 - Hosts: 69.31.81.22 www.google.co.uk O1 - Hosts: 69.31.81.22 www.google.co.ve O1 - Hosts: 69.31.81.22 www.google.com O1 - Hosts: 69.31.81.22 www.google.com.ag O1 - Hosts: 69.31.81.22 www.google.com.ar O1 - Hosts: 69.31.81.22 www.google.com.au O1 - Hosts: 69.31.81.22 www.google.com.br O1 - Hosts: 69.31.81.22 www.google.com.co O1 - Hosts: 69.31.81.22 www.google.com.cu O1 - Hosts: 69.31.81.22 www.google.com.do O1 - Hosts: 69.31.81.22 www.google.com.ec O1 - Hosts: 69.31.81.22 www.google.com.fj O1 - Hosts: 69.31.81.22 www.google.com.gi O1 - Hosts: 69.31.81.22 www.google.com.gr O1 - Hosts: 69.31.81.22 www.google.com.gt O1 - Hosts: 69.31.81.22 www.google.com.hk O1 - Hosts: 69.31.81.22 www.google.com.ly O1 - Hosts: 69.31.81.22 www.google.com.mt O1 - Hosts: 69.31.81.22 www.google.com.mx O1 - Hosts: 69.31.81.22 www.google.com.my O1 - Hosts: 69.31.81.22 www.google.com.na O1 - Hosts: 69.31.81.22 www.google.com.nf O1 - Hosts: 69.31.81.22 www.google.com.ni O1 - Hosts: 69.31.81.22 www.google.com.np O1 - Hosts: 69.31.81.22 www.google.com.pa O1 - Hosts: 69.31.81.22 www.google.com.pe O1 - Hosts: 69.31.81.22 www.google.com.ph O1 - Hosts: 69.31.81.22 www.google.com.pk O1 - Hosts: 69.31.81.22 www.google.com.pr O1 - Hosts: 69.31.81.22 www.google.com.py O1 - Hosts: 69.31.81.22 www.google.com.sa O1 - Hosts: 69.31.81.22 www.google.com.sg O1 - Hosts: 69.31.81.22 www.google.com.sv O1 - Hosts: 69.31.81.22 www.google.com.tr O1 - Hosts: 69.31.81.22 www.google.com.tw O1 - Hosts: 69.31.81.22 www.google.com.ua O1 - Hosts: 69.31.81.22 www.google.com.uy O1 - Hosts: 69.31.81.22 www.google.com.vc O1 - Hosts: 69.31.81.22 www.google.com.vn O1 - Hosts: 69.31.81.22 www.google.de O1 - Hosts: 69.31.81.22 www.google.dj O1 - Hosts: 69.31.81.22 www.google.dk O1 - Hosts: 69.31.81.22 www.google.es O1 - Hosts: 69.31.81.22 www.google.fi O1 - Hosts: 69.31.81.22 www.google.fm O1 - Hosts: 69.31.81.22 www.google.fr O1 - Hosts: 69.31.81.22 www.google.gg O1 - Hosts: 69.31.81.22 www.google.gl O1 - Hosts: 69.31.81.22 www.google.gm O1 - Hosts: 69.31.81.22 www.google.hn O1 - Hosts: 69.31.81.22 www.google.ie O1 - Hosts: 69.31.81.22 www.google.it O1 - Hosts: 69.31.81.22 www.google.kz O1 - Hosts: 69.31.81.22 www.google.li O1 - Hosts: 69.31.81.22 www.google.lt O1 - Hosts: 69.31.81.22 www.google.lu O1 - Hosts: 69.31.81.22 www.google.lv O1 - Hosts: 69.31.81.22 www.google.mn O1 - Hosts: 69.31.81.22 www.google.ms O1 - Hosts: 69.31.81.22 www.google.mu O1 - Hosts: 69.31.81.22 www.google.mw O1 - Hosts: 69.31.81.22 www.google.nl O1 - Hosts: 69.31.81.22 www.google.no O1 - Hosts: 69.31.81.22 www.google.off.ai O1 - Hosts: 69.31.81.22 www.google.pl O1 - Hosts: 69.31.81.22 www.google.pn O1 - Hosts: 69.31.81.22 www.google.pt O1 - Hosts: 69.31.81.22 www.google.ro O1 - Hosts: 69.31.81.22 www.google.ru O1 - Hosts: 69.31.81.22 www.google.rw O1 - Hosts: 69.31.81.22 www.google.se O1 - Hosts: 69.31.81.22 www.google.sh O1 - Hosts: 69.31.81.22 www.google.sk O1 - Hosts: 69.31.81.22 www.google.sm O1 - Hosts: 69.31.81.22 www.google.td O1 - Hosts: 69.31.81.22 www.google.tm O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINNT\cfgmgr52.dll O2 - BHO: (no name) - {5483427F-93B8-1470-5A89-E6B56484CDB2} - C:\DOCUME~1\Owner\LOCALS~1\Temp\nelipohqxuf.dll O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINNT\xmllib.dll O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [CapFax] C:\Program Files\PhoneTools\CapFax.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe O4 - HKLM\..\Run: [AtariBanner] "C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe" /0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [Qqlzuqic] C:\Program Files\Wesw\Vzazvsg.exe O4 - HKLM\..\Run: [PSof1] C:\WINNT\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [C:\WINNT\VCMnet11.exe] C:\WINNT\VCMnet11.exe O4 - HKLM\..\Run: [uF9g32T] ntpdecod.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [vidctrl] C:\WINNT\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [apisvc.exe] C:\WINNT\System32\apisvc.exe O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program Files\WeirdOnTheWeb\WeirdOnTheWeb.exe" O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\anjbpa.exe reg_run O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [secserv.exe] C:\WINNT\System32\secserv.exe O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKLM\..\Run: [enkehpr] c:\winnt\system32\osxvceb.exe r O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINNT\System32\oobe\msoobe.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [Lro] C:\WINNT\System32\?hkntfs.exe O4 - HKCU\..\Run: [foqmRSf7j] ntlmdmsp.exe O4 - HKCU\..\Run: [SMSSU] C:\WINNT\System32\SMSSU.EXE O4 - HKCU\..\Run: [Tmntsrv32] C:\WINNT\System32\Tmntsrv32.EXE O4 - HKCU\..\Run: [Atha] C:\Program Files\reoe\hcpc.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [Win32res] C:\WINNT\win32res.exe O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe O4 - HKCU\..\Run: [firq] C:\PROGRA~1\COMMON~1\firq\firqm.exe O4 - HKCU\..\Run: [180ClientStubInstall] "C:\Program Files\InetGet\stubinstaller6002.exe" O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com O16 - DPF: Backgammon by pogo - http://gammon.pogo.com/applet-5.9.0....-ob-assets.cab O16 - DPF: Dice Derby by pogo - http://checkeredflag.pogo.com/applet...-ob-assets.cab O16 - DPF: First Class Solitaire by pogo - http://solitaire.pogo.com/applet-5.9...-ob-assets.cab O16 - DPF: Greenback Bayou by pogo - http://greenback.pogo.com/applet-5.9...-ob-assets.cab O16 - DPF: Mah Jong Garden by pogo - http://mahjong2.pogo.com/applet-5.9....-ob-assets.cab O16 - DPF: Pop Fu by pogo - http://popfu.pogo.com/applet-5.9.0.1...-ob-assets.cab O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet-5....-ob-assets.cab O16 - DPF: Tri-Peaks by pogo - http://peaks.pogo.com/applet-5.9.0.1...-ob-assets.cab O16 - DPF: Word Whomp Whackdown by pogo - http://whackdown.pogo.com/applet-5.9...-ob-assets.cab O16 - DPF: World Class Solitaire by pogo - http://klondike.pogo.com/applet-5.9....-ob-assets.cab O16 - DPF: Yahoo! Bingo - http://download.games.yahoo.com/game...ts/y/xt0_x.cab O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/game...ts/y/yt1_x.cab O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/game...s/y/dct2_x.cab O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/game...s/y/dot7_x.cab O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs10_x.cab O16 - DPF: Yahoo! Go Fish - http://download.games.yahoo.com/game...ts/y/zt3_x.cab O16 - DPF: Yahoo! GoStop - http://download.games.yahoo.com/game...s/y/gst1_x.cab O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt3_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/game...ts/y/pt1_x.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/game...s/y/pyt1_x.cab O16 - DPF: Yahoo! Spades - http://download.games.yahoo.com/game...ts/y/st2_x.cab O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/game...ts/y/wt0_x.cab O16 - DPF: {09C6CAC0-936E-40A0-BC26-707480103DC3} - http://www.uproar.com/applets/active...side_web18.cab O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Me...bridge-c17.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Puzzle Control) - http://mirror.worldwinner.com/games/...saw/jigsaw.cab O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://mirror.worldwinner.com/games/.../blockwerx.cab O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.g...tl_0_0_0_1.ocx O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://mirror.worldwinner.com/games/shared/dephlp.cab O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://mirror.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://mirror.worldwinner.com/games/...o/wordmojo.cab O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - http://mirror.worldwinner.com/games/v55/cubis/cubis.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTick...cab?refid=3092 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v5.cab O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yaho...bio5_1_5_0.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/pages/scanner/Wi...nerInstall.cab O20 - Winlogon Notify: App Paths - C:\WINNT\system32\kmdkyr.dll O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Owner\Desktop\CWShredder.exe (file missing) O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINNT\System32\ScsiAccess.EXE O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe |
| ||
| Re: hotoffers & others on pc-please help Hi Akdraw, welcome to DaniWeb :D Please follow the recommendations and instructions in the links below. When you get to the end of the third one (Infection removal), go to post #4 and complete the instructions there. When you've finished, please post a new HijackThis log so we can clean up what's left. |
| ||
| Re: hotoffers & others on pc-please help Thank you, that cleaned up alot but I still have the hotoffer. Any ideas on what I can do next. Thank you. Logfile of HijackThis v1.99.1 Scan saved at 11:41:20 PM, on 7/31/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\system32\rundll32.exe C:\WINNT\system32\drivers\KodakCCS.exe C:\Program Files\Netscape Internet Service\ncupdatesvc.exe C:\Program Files\Norton Utilities\NPROTECT.EXE C:\WINNT\Explorer.exe C:\WINNT\System32\ScsiAccess.EXE C:\Program Files\Speed Disk\nopdb.exe C:\WINNT\System32\svchost.exe c:\winnt\system32\suwweh.exe C:\WINNT\system32\SK9910DM.EXE C:\WINNT\GWMDMMSG.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\PhoneTools\CapFax.EXE C:\WINNT\system32\RunDll32.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Media Access\MediaAccK.exe C:\Program Files\Media Access\MediaAccess.exe C:\Program Files\Wesw\Vzazvsg.exe C:\WINNT\System32\PSof1.exe C:\WINNT\System32\exp.exe C:\WINNT\System32\wintask.exe C:\WINNT\system32\ntpdecod.exe C:\WINNT\system32\RUNDLL32.exe C:\WINNT\System32\vidctrl\vidctrl.exe C:\WINNT\System32\apisvc.exe C:\WINNT\system32\anjbpa.exe C:\WINNT\dinst.exe C:\WINNT\system\dsvnmdkdr.exe C:\Program Files\Messenger\msmsgs.exe C:\WINNT\System32\?hkntfs.exe C:\WINNT\system32\ntlmdmsp.exe C:\WINNT\System32\SMSSU.EXE C:\WINNT\System32\Tmntsrv32.EXE C:\WINNT\system32\rundll32.exe C:\Program Files\reoe\hcpc.exe C:\PROGRA~1\COMMON~1\firq\firqm.exe C:\Program Files\Common Files\Windows\services32.exe C:\PROGRA~1\COMMON~1\firq\firqa.exe C:\Program Files\Norton Utilities\SYSDOC32.EXE C:\PROGRA~1\COMMON~1\firq\firql.exe C:\Program Files\Hijack This\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0278/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINNT\cfgmgr52.dll O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINNT\dsr.dll O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINNT\xmllib.dll O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [CapFax] C:\Program Files\PhoneTools\CapFax.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe O4 - HKLM\..\Run: [AtariBanner] "C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe" /0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [Qqlzuqic] C:\Program Files\Wesw\Vzazvsg.exe O4 - HKLM\..\Run: [PSof1] C:\WINNT\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [C:\WINNT\VCMnet11.exe] C:\WINNT\VCMnet11.exe O4 - HKLM\..\Run: [uF9g32T] ntpdecod.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [vidctrl] C:\WINNT\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [apisvc.exe] C:\WINNT\System32\apisvc.exe O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\anjbpa.exe reg_run O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe O4 - HKLM\..\Run: [wakuamf] c:\winnt\system32\suwweh.exe r O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINNT\System32\oobe\msoobe.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Lro] C:\WINNT\System32\?hkntfs.exe O4 - HKCU\..\Run: [foqmRSf7j] ntlmdmsp.exe O4 - HKCU\..\Run: [SMSSU] C:\WINNT\System32\SMSSU.EXE O4 - HKCU\..\Run: [Tmntsrv32] C:\WINNT\System32\Tmntsrv32.EXE O4 - HKCU\..\Run: [Atha] C:\Program Files\reoe\hcpc.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [Win32res] C:\WINNT\win32res.exe O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe O4 - HKCU\..\Run: [firq] C:\PROGRA~1\COMMON~1\firq\firqm.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: MCD - C:\WINNT\system32\kmdkyr.dll O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Owner\Desktop\CWShredder.exe (file missing) O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINNT\System32\ScsiAccess.EXE O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe |
| ||
| Re: hotoffers & others on pc-please help Please visit at least two of the following sites for an online virus scan: BitDefender Free Online Virus Scan http://www.bitdefender.com/scan/licence.php Make sure you tick AutoClean under Scan Options. Panda ActiveScan http://www.pandasoftware.com/actives..._principal.htm Make sure you tick Disinfect automatically under Scan Options. Housecall at TrendMicro http://housecall.trendmicro.com/hous...start_corp.asp Make sure you tick Auto Clean. eTrust Antivirus Web Scanner http://www3.ca.com/securityadvisor/virusinfo/scan.aspx == Download Killbox v2.0.0.175 and unzip the file to your Desktop and have it ready to use. - Save all the below files to a text document (notepad) to be used shortly. C:\WINDOWS\System32\param32.dll C:\WINDOWS\System32\guninst.exe C:\WINDOWS\System32\popup_bl.dll C:\WINDOWS\System32\svrhost.exe C:\WINDOWS\System32\systr.dll Reboot into safe mode following the instructions here. Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows and hit the "Fix checked" button. R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0278/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q= == Open the text file you saved previously and right click and drag your cursor over the files to highlight them and then use Control+C to copy them to the clipboard.. Open KILLBOX and go to File...."Paste From Clipboard". All the files should now appear in the box (click on the Tab and check to make sure that only the files I have identified as malware and marked for deletion are there) . Then checkmark the "Delete on Reboot" box..and click the red X. You will get a message saying "File will be deleted on next reboot" , Process and Reboot now?" Click "Yes" and reboot. == When done, please do the following; Please download the trial version of Ewido Security Suite here: http://www.ewido.net/en/download/ Install it, and update the definitions to the newest files. Do NOT run a scan yet. Please download Nailfix from here: http://www.noidea.us/easyfile/file.p...50515010747824 It will self-extract to the desktop, but please do NOT run it yet. Next, please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Select the first option, to run Windows in Safe Mode. For additional help in booting into Safe Mode, see the following site: http://www.pchell.com/support/safemode.shtml Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal. Then please run Ewido, and run a full scan. During the scan it will prompt you to clean files, click OK. Save the logfile from the scan. Next please run HijackThis, click Scan, and check: F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe Close all open windows except for HijackThis and click Fix Checked. Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan. |
| ||
| Re: hotoffers & others on pc-please help I must be doing something wrong. I tried to follow your directions but I cant seem to make progress. Here whats happened so far. I had downloaded Hijack this, Killbox and spybotsd on another computer cuz I cant access the internet on the one with the virus. When I did try to go on line I cant open any pages but the "hotoffers" junk and more bugs get downloaded. No way to access online virus scans you recomended. I transfer hijack this & killbox. I start in safe mode and a "Windows Explorer" window opens stateing "Windows Explorer has encounterd a problem and needs to close. When I close it it cycles and comes up again. If I dont close the "Windows Explorer" window I can access hijack this and killbox but following directions for the programs dont seem to be effective. Hotoffers still there. Sorry to be a pain, I'm a beginner thats ready to shoot my computer. Is there any hope me to to get rid of the hotoffer stuff? Is there another way to kill it? Thanks for trying to help a newbie. Your assistance is apriciated. Here is my latest Hijack this log. Logfile of HijackThis v1.99.1 Scan saved at 8:50:29 PM, on 8/1/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\svchost.exe c:\winnt\system32\fgojih.exe C:\WINNT\system32\rundll32.exe C:\WINNT\Explorer.exe C:\WINNT\system32\dwwin.exe C:\Program Files\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0278/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id= R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.gateway.net F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINNT\xmllibw.dll O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [CapFax] C:\Program Files\PhoneTools\CapFax.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe" O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe O4 - HKLM\..\Run: [AtariBanner] "C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe" /0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [Qqlzuqic] C:\Program Files\Wesw\Vzazvsg.exe O4 - HKLM\..\Run: [PSof1] C:\WINNT\System32\PSof1.exe O4 - HKLM\..\Run: [exp.exe] C:\WINNT\System32\exp.exe O4 - HKLM\..\Run: [WinTask driver] C:\WINNT\System32\wintask.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINNT\cfgmgr52.dll,DllRun O4 - HKLM\..\Run: [C:\WINNT\VCMnet11.exe] C:\WINNT\VCMnet11.exe O4 - HKLM\..\Run: [uF9g32T] ntpdecod.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [vidctrl] C:\WINNT\System32\vidctrl\vidctrl.exe O4 - HKLM\..\Run: [apisvc.exe] C:\WINNT\System32\apisvc.exe O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\anjbpa.exe reg_run O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINNT\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [mwicpk] c:\winnt\system32\fgojih.exe r O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINNT\System32\oobe\msoobe.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: dani.exe O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Owner\Desktop\CWShredder.exe (file missing) O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINNT\System32\ScsiAccess.EXE O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe |
| ||
| Re: hotoffers & others on pc-please help Did you run the Nailfix at all? Nothing appears to have changed in your log. Ewido will also get rid of a lot of those nasties for you. == Run hijackthis and go to misc tools\delete a file on reboot and enter the full path to the file. If more than 1 file needs to be entered, when asked to reboot, do so only after the last file entered. C:\WINDOWS\System32\param32.dll C:\WINDOWS\System32\guninst.exe C:\WINDOWS\System32\popup_bl.dll C:\WINDOWS\System32\svrhost.exe C:\WINDOWS\System32\systr.dll Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows and hit the "Fix checked" button. R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/ad0278/ == Make sure you scan with hijackthis in normal mode before posting :). |
| ||
| Re: hotoffers & others on pc-please help Thank you very much for your patience, time and help. I believe most of the problems are fixed now. The worst, Hotoffers is gone. I tried to follow your advice exactly but I had a couple problems doing all you recommended. One problem was trying to reboot after running Hjijack this & killbox. My system would freeze, not logging off or restarting and the fix’s didn’t take. I ran Hijack this & Killbox in regular mode and that helped greatly. Ewido, as you said also fixed a lot of my problems. Running Ewido let me go online to run virsus scans from Trend micro andBitDefender. Some of the problem I still have may not be related to the bugs I had. I ran add and remove in safe mode and regular to get rid of OIN but it’s still there. ?? I cant turn on “Automatic Updates� . Ater downloading them from microsoft I get a Message�Updates were unable to be succcessfully installed� Anyway, thanks again for all your help. Here is my latest log. R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file) O2 - BHO: (no name) - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - (no file) O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] C:\OEMDRVRS\KEYB\SK9910DM.EXE O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [CapFax] C:\Program Files\PhoneTools\CapFax.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Atari icon.exe O4 - HKLM\..\Run: [AtariBanner] "C:\Program Files\Infogrames\Atari Anniversary Edition\Volume 2\Banner.exe" /0 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE ,DllRun O4 - HKLM\..\Run: [C:\WINNT\VCMnet11.exe] C:\WINNT\VCMnet11.exe O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16 O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\RunOnce: [OOBEDDDemise] cmd /x /c erase C:\WINNT\System32\oobe\msoobe.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Lro] C:\WINNT\System32\?hkntfs.exe O4 - HKCU\..\Run: [foqmRSf7j] ntlmdmsp.exe O4 - HKCU\..\Run: [SMSSU] C:\WINNT\System32\SMSSU.EXE O4 - HKCU\..\Run: [Tmntsrv32] C:\WINNT\System32\Tmntsrv32.EXE O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [Win32res] C:\WINNT\win32res.exe O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe O4 - HKCU\..\Run: [firq] C:\PROGRA~1\COMMON~1\firq\firqm.exe O4 - HKCU\..\Run: [Atha] C:\Program Files\reoe\hcpc.exe O4 - Startup: PowerReg Scheduler.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1122971066046 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1123015426468 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O23 - Service: CWShredder Service - Unknown owner - C:\Documents and Settings\Owner\Desktop\CWShredder.exe (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINNT\System32\ScsiAccess.EXE O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe (file missing) |
| ||
| Re: hotoffers & others on pc-please help Run the PurityScan uninstaller. You only posted half of your log. Please post the entire one for me to see :). |
| All times are GMT -4. The time now is 9:37 pm. |
Forum system based on vBulletin Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
©2003 - 2009 DaniWeb® LLC