Member Avatar for aslpunkr

hi sorry to bother but i have a bit of a problem.
i came home one day and i found this prosearching.com installed on my desktop and internet explorer bar. and i tried everything to rid of it. but nothing has work.
i did wat someone told me to do and download Hijack so i did.
here is my log.
Logfile of HijackThis v1.98.2
Scan saved at 5:35:32 PM, on 8/13/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://prosearching.com/passthrough/index.html?http://yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod-1.dll
O2 - BHO: (no name) - {AB035CB7-6D5E-7FBD-5079-D1A4C258ECA1} - C:\PROGRA~1\WAITTO~1\aim third.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [bias inter] C:\PROGRA~1\TIMEFR~1\BAGS SPAM.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: ChatSpace Full Java Client -
O16 - DPF: ChatSpace Full Java Client 2.1.0.95L -
O16 - DPF: ChatSpace Full Java Client -
O16 - DPF: ChatSpace Full Java Client -
O16 - DPF: ChatSpace Full Java Client -
O16 - DPF: ChatSpace Java Client -
O16 - DPF: ChatSpace Java Client -
O16 - DPF: ChatSpace Java Client -
O16 - DPF: ChatSpace Java Client -
O16 - DPF: Yahoo! Pool 2 -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.
O16 - DPF: {502D6B75-E970-47B7-A4CB-A09CC799EFE6} (PP3D Control) -
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) -
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} -
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com/games/v49/h2hpool/h2hpool.cab

if anyone would gladly give me there time in helping me with this situation i would be more than happy.

thank u.

  • 3 Contributors
  • 5 Replies
  • 329 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Short diagnosis and a plan. This looks like a typical browser‑hijacker/adware: persistent add‑ons or startup entries change Internet Explorer’s home/search settings and install helper objects so the redirect comes back after a normal reboot. Good starts by (safe‑mode/HijackThis) and (check msconfig/Normal startup) — those are the right first moves. For reference on using HijackThis safely and what the log items mean, see the HijackThis guide. (bleepingcomputer.com)

Concrete, safe workflow (in this order)

  1. Disconnect the PC from the network and back up any important personal files to external media.
  2. Boot into Safe Mode (F8 on XP-era systems) and save a fresh HijackThis log — don’t randomly delete unknown items. Use automated cleaners designed for toolbars/hijackers first: run AdwCleaner, then a full scan with an up‑to‑date anti‑malware product (Malwarebytes), and follow with a second‑opinion scanner such as HitmanPro. Those tools target PUPs, toolbars and browser redirects where manual deletion often misses files or registry keys. (malwarebytes.com)

Manual checks to follow

  • Inspect and restore the Hosts file to Microsoft’s default if it contains redirects.
  • Reset Internet Explorer to defaults (Tools → Internet Options → Advanced → Reset) and set Normal startup in msconfig before rebooting. If you remove registry/run entries manually, only do so after documenting them (export a registry key) so you can restore if needed. (support.microsoft.com)

After cleanup and prevention
Reboot normally, re‑scan with AV/anti‑malware, change any online passwords used on the infected machine, and keep the system patched. If the hijack survives these steps, back up data and consider a clean OS reinstall. If posting here for more help, attach a new HijackThis log and list the exact steps and tools you ran so helpers don’t repeat work already done. For background on browser‑hijacker behavior and prevention, see the Malwarebytes overview. (malwarebytes.com)

Hosts file path (for reference)

C:\Windows\System32\drivers\etc\hosts

Recommended Answers

All 5 Replies

Member Avatar for aslpunkr

wat would be cool. is someone actually helped me.

Member Avatar for aslpunkr

help with this HIJACK LOG.

Logfile of HijackThis v1.98.2
Scan saved at 9:25:27 PM, on 8/13/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Daniel\My Documents\hijackthis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: search.netscape.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod-1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [pwsockxd] C:\WINDOWS\System32\pwsockxd.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [_UnwiseDMO] cmd.exe /c del C:\WINDOWS\System32\ATPartners.dll
O4 - HKLM\..\RunOnce: [_UnwiseDMO_] cmd.exe /c del C:\WINDOWS\System32\im64.dll
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: ChatSpace Full Java Client -
O16 - DPF: ChatSpace Full Java Client 2.1.0.95L -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.
O16 - DPF: {502D6B75-E970-47B7-A4CB-A09CC799EFE6} (PP3D Control) -
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) -
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} -
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com/games/v49/h2hpool/h2hpool.cab

Member Avatar for caperjack

This one indicates that you are using msconfig to kill some programs please go to msconfig and set it to Normal startup and restart computer and then run hijack angain and post a new log .
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

................................

Also a trip to windows updates is needed for critical updates and Service Packs

Also you don't say what kind of problems you are having .

Member Avatar for crunchie

Reboot into safe mode following the instructions & Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://prosearching.com/passthrough...tp://yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod-1.dll
O2 - BHO: (no name) - {AB035CB7-6D5E-7FBD-5079-D1A4C258ECA1} - C:\PROGRA~1\WAITTO~1\aim third.exe

O4 - HKLM\..\Run: [bias inter] C:\PROGRA~1\TIMEFR~1\BAGS SPAM.exe

Delete the following manually;

C:\PROGRA~1\WAITTO~1-folder
C:\PROGRA~1\TIMEFR~1-folder

Reboot normally.
Click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', '', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:

Member Avatar for crunchie

I have merged your two threads & deleted the other two. Please do not post more than one thread for the same problem.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.