Member Avatar for DoctorTracker

Hello:

I have a red circle with a white cross in the icontray, and when I click on it with the right or left mouse button, it's autoopened the internet explorer with the following address:

I also get the Error #317 windows message, regarding the ports 8080 and 3128.

This is the log reported by Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 12:41:14, on 12/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\SCARDSVR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\TCWIN45\PIPELINE\REMIND.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\ARCHIVOS DE PROGRAMA\MICROSOFT FIREWALL CLIENT\ISATRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\ARCHIVOS DE PROGRAMA\MICROSOFT OFFICE\OUTLOOK\OFFICE\OUTLOOK.EXE
C:\ARCHIVOS DE PROGRAMA\ARCHIVOS COMUNES\SYSTEM\MAPI\3082\95\MAPISP32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\ARCHIVOS DE PROGRAMA\MICROSOFT OFFICE\OUTLOOK\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\ARCHIVOS DE PROGRAMA\MSN MESSENGER\MSNMSGR.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\ARCHIVOS DE PROGRAMA\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.specialgoods.info/ad/ad0271/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = servidor:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F1 - win.ini: load=C:\TCWIN45\PIPELINE\remind.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AvxIni] c:\archivos de programa\softwin\avx professional\avxinit.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe
O4 - HKCU\..\Run: [ArGoSoftMailServer] C:\PROGRAM FILES\ARGO SOFTWARE DESIGN\MAILSERVER.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Monitor de conectividad del cliente del servidor de seguridad.LNK = C:\Archivos de programa\Microsoft Firewall Client\ISATRAY.EXE
O12 - Plugin for .exe: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O12 - Plugin for .zip: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O12 - Plugin for .com: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain =
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer =

Please could you help me?

Best regards,

Rafa

  • 4 Contributors
  • 7 Replies
  • 215 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Good work by and thanks to for confirming the removal worked. A few short follow‑up checks prevent a silent reinfection or a lingering network redirect; they take little time but save trouble later.

Quick network checks: inspect the browser’s connection/proxy settings (Internet Options > Connections > LAN Settings) and the local hosts file (open C:\Windows\hosts with Notepad) for unexpected entries. On Windows use ipconfig /all (or winipcfg on older releases) to confirm DNS and DHCP servers are those provided by the ISP or the expected router. Log into the router’s admin page and verify DNS and port‑forwarding settings; if anything looks unfamiliar, change the router admin password and reboot the router.

Startup and persistence checks: review startup items (Startup folder, msconfig/Autoruns) and browser add‑ons for anything unknown, and remove only after noting a backup. Run full scans with up‑to‑date antivirus and an anti‑malware scanner; if the infection resists, an offline rescue scan (bootable rescue media) is worth using. Back up important data before making registry or startup changes.

Practical notes for nontechnical users (as asked by ): on modern Windows right‑click a downloaded .zip and choose “Extract All”; on older systems install a reputable archiver (for example, 7‑Zip or WinZip), then open the archive and extract to the Desktop. Always disconnect from the network before running removal tools, keep copies of any logs (HijackThis, scanners), and consider moving away from unsupported OS builds (older releases lack security fixes).

Recommended Answers

All 7 Replies

Member Avatar for dlh6213

Hi DoctorTracker, welcome to DaniWeb :D

Get the PocketKillbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip

Unzip the file to your desktop.

Go offline until this is completed (you may wish to print these instructions).

Boot into Safe Mode and do a search for these files and delete any instances found:

param32.dll
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe

If any could not be deleted, (most likely param32.dll), run the PocketKillbox and paste the full file path of file in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)

Reboot normally and delete any unwanted icons from your desktop.

Empty your Recycle Bin.

Scan with hijackthis, and have it fix the following entry:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.specialgoods.info/ad/ad0271/

Be sure all windows are closed, other then hijackthis, before hitting Fix checked

Reboot, close any open browser windows, scan with hijackthis, post a new log, and let us know if you're still having problems.

Member Avatar for DoctorTracker

Thanks a lot. I have done the actions you have suggested, and everything goes well.

Thank you very much again.

Regards,

Member Avatar for dlh6213

Glad to hear things are working well :), but can you post a fresh hijackthis log just to make sure?

Member Avatar for DoctorTracker

Of course I can.

Here you have the log file...

Thank you again for your help.

Logfile of HijackThis v1.99.1
Scan saved at 9:00:03, on 13/05/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\SCARDSVR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\TCWIN45\PIPELINE\REMIND.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\ARCHIVOS DE PROGRAMA\MSN MESSENGER\MSNMSGR.EXE
C:\ARCHIVOS DE PROGRAMA\MICROSOFT FIREWALL CLIENT\ISATRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\ARCHIVOS DE PROGRAMA\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\ARCHIVOS DE PROGRAMA\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.es/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = servidor:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F1 - win.ini: load=C:\TCWIN45\PIPELINE\remind.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [AvxIni] c:\archivos de programa\softwin\avx professional\avxinit.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe
O4 - HKCU\..\Run: [ArGoSoftMailServer] C:\PROGRAM FILES\ARGO SOFTWARE DESIGN\MAILSERVER.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Monitor de conectividad del cliente del servidor de seguridad.LNK = C:\Archivos de programa\Microsoft Firewall Client\ISATRAY.EXE
O12 - Plugin for .exe: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O12 - Plugin for .zip: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O12 - Plugin for .com: C:\ARCHIV~1\INTERN~1\PLUGINS\NpAvx.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) -
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain =
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer =

Member Avatar for dlh6213

Looks good to me :) Happy computing :D

Member Avatar for ernestine725

i have the same problem with the red circle and the x in the middle i saw what you said to do but when i do it it asks me to open with . i dont know anything about computers. how do i do this (unzip) in dummies terms ? pleae help me !!!!!!!!

Member Avatar for crunchie

ernestine725. You need a utility to unzip the file that dlh6213 advised. If you have XP, then there will be that ability onboard already. If another system, you will need to download winzip or some such.
You also need to start your own thread in order to get the best help.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.