Posts by caperjack

Looks ok to me to

log is clean

The updated CWShredder is suppose to fix this now.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Jack\LOCALS~1\Temp\sp.html

..............................................

Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

reboot computer and post a new log

Seems to be OK now... Thnx,
but can you tell me what DSO Exploit is, when I´m running spyboot search and destroy it always find something called DXO Exploit and when I remove it, and restart and run SD again it´s back again...

What is DXO Exploit?

Its is a bug in the new spybot ,nothing to worry about .You can set spybot to ignore it so that it doesn't report it all the time .
Run spybot in advanced mode ,go to settings /ignore products/security ,and check off dso exploit.

Important: Create a folder on the C: drive called HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.
................................................................................................
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

Fix this as it a rescource hog ,and not needed in startup .
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10c6905...ip/RdxIE601.cab
Reboot and check thisgs out ,rerun hijack and post new log

When you click on yor shortcut to go online does it auto dial ordo you have to hit connect ,if yes then oncheck auto connect.
You may have a spyware dialer ,that could be dialing a long distant # so you better get it looked at ,go to the security fourm and post a hijackthislog for review .
Get hijack here and post log on the Security section !
Download 'Hijack This!'.http://www.computercops.biz/downloads-file-328.html
Unzip to a permanent folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.

Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

Security ,http://www.daniweb.com/techtalkforums/forum64.html

don't know what to tell you ,keep playing with it ,open case and make sure the cables are plugged into cdrom right and tight .

Try Going into tools /internet options /privacy and click ,advanced and override auto cookie handling and check off block 3rd party cookies

This is bad ,
O2 - BHO: (no name) - {397D7D63-816E-4ECF-8761-775C932C5CF1} - C:\WINDOWS\iDonate.dll
check here for removal instructions .
http://www.pestpatrol.com/PestInfo/i/idonate.asp

i swap computer parts all the time ,like a motherboard for ram or case ,usually never a 32 meg card for a 16 meg ,but i will swap pc133 ram for pc 100 ,and stuff like that ,edo for dimm You get the idea,depends on what i need or they need .

not really sure but i think they are just different chipsets but are both software modems .

When buying a internal modem ,ask for a hardware one !they sell them here at local computer store for the folks who live out in the country area ,out side of town!

Are you saying you removed and you want to stop it from coming back ,or are you saying it keeps coming back and you need to stop it ,
If you got rid of it read this to help stop spyware .
.

http://www.computercops.biz/postlite7736-.html

................................................................................
I was going to suggest a ie repair ,i think you can do it in add/remove programs .add/remove windows components , unchek ie and i think you will be giving the option to repair it .

What Brand of computer is it .

windows XP reinstalation cd

,are you saying it a recovery CD for you brand name computer .and not a orginal Microsoft xp cd

When you boot computer you hit the DEL or F1 mabe depends on computer brand , key to enter the bios to change the boot sequence to first boot cdrom .
i

Try this .scroll down to: run a repair install.
http://www.webtree.ca/windowsxp/repair_xp.htm#How%20to%20Repair%20Windows%20XP%20by%20Installing%20Over%20top%20of%20Existing%20Setup:

just continus here when you come back

Same error here![thread=321]Click me [/thread]

Have you tried deleting it in safe mode !
C:\windows\mslagent\mslagent.exe is added as the results of the SIMCSS.B virus.,is there any EXE files in the C:\windows\mslagent folder
http://securityresponse.symantec.com/avcenter/venc/data/trojan.simcss.b.html

When you go to hotmail and it doesn't load fully try hitting the refresh button in the ie toolbar.
Mine has simular problems to but i still get in after a couple of refreshes,
I think its the micrsoft conspiracy,they want you to uograde to the pay for version.LOL

This microsoft page describes you error message
http://support.microsoft.com/?kbid=278839

type this in RUN ,gpedit.msc to open the police editor

Important: Create a folder on the C: drive called HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.

...............................................................Next

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

NOTE: Please copy and paste this post into notepad and save to you desktop. or print a copy of these instructions because you will be working with all windows closed except HijackThis.

.................................................................
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - D:\WINDOWS\nem219.dll (file missing)

O2 - BHO: (no name) - {432D8C41-8586-11D8-997D-00C026232EB9} - D:\WINDOWS\bvm202.dll

O4 - HKLM\..\Run: [Microsoft Update Time] wuam.exe

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [tmpxcze] D:\WINDOWS\System32\lcmhvz.exe

O4 - HKLM\..\RunServices: [Microsoft Update Time] wuam.exe

O4 - HKCU\..\Run: [Microsoft Update Time] wuam.exe

Check in control panel add/remove programs and unintall this one

O4 - HKCU\..\Run: [Weather] D:\Program Files\AWS\WeatherBug\Weather.exe 1

O9 - Extra button: SideFind (HKLM)

…

If you used hijackthis to fix , CTHELPER.EXE ,then it isn't going to show up any more in msconfig .I wouldn't delete it from the system32 folder.

The 04 entrys of the hijackthis log are whats in msconfig !

Yeah its safe to fix it with hijackthis as it will create a backup if something isn't right after the fix .
Just run hijack in normal mode ,run it again and fix all items suggested in the earlier post and reboot and run again and post the fresh log .

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

NOTE: Please print a copy of these instructions because you will be working with all windows closed except HijackThis.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mysearchnow.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

F0 - system.ini: Shell=

F2 - REG:system.ini: UserInit=D:\WINDOWS\SYSTEM32\Userinit.exe,

Check this out ,do you know what it is , i don't like the fact that its running from a temp folder ,If you know what it is leave !If you don't know what it is fix it and go to the temp folder and delete it .

O4 - HKLM\..\Run: [BTFirstRun] D:\DOCUME~1\Chris\LOCALS~1\Temp\Firstrun.exe /BT Yahoo Install

Also cant find any info on this one ,do you know what it is ??Fix if you don't know what it is.
O4 - HKLM\..\Run: [Byte dale] D:\PROGRA~1\Hide Mix Move\play four.exe

Reboot and post new log

Ok ,i need to go back one step ,Pleas do the following '.
Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

Then these 2 programs .
Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Setup Ad-Aware .
After installing AAW, and before running the program, update reference files by using the bottom right button in the program, labeled "Check for Updates."

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives & Folders, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Include additional Ad-aware settings in logfile" and
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."
Click on 'Proceed' to save these Preferences.
Please make sure that you activate IN-DEPTH scanning …

Is that all of the error message .
OE:109F:BFF8E64B

Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

Then these 2 programs .
Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Setup Ad-Aware .
After installing AAW, and before running the program, update reference files by using the bottom right button in the program, labeled "Check for Updates."

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives & Folders, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Include additional Ad-aware settings in logfile" and
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."
Click on 'Proceed' to save these Preferences.
Please make sure that you activate IN-DEPTH scanning before you proceed

Download SPYBOT

After installing Spybot S&D, update …

download and run these 2 programs .
Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Setup Ad-Aware .
After installing AAW, and before running the program, update reference files by using the bottom right button in the program, labeled "Check for Updates."

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives & Folders, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Include additional Ad-aware settings in logfile" and
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."
Click on 'Proceed' to save these Preferences.
Please make sure that you activate IN-DEPTH scanning before you proceed

Download SPYBOT

After installing Spybot S&D, update it by using the "Update" button on the left panel of the program. Search for updates and download anything it finds

How to setup Ad-Aware and Spy-Bot S&D Check my signature for details

And after that, please do the following:

reboot computer and post a new log

Important: Create a folder on the C: drive called HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.

..................................................................
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

NOTE: Please copy and paste this post into notepad and save to you desktop. or print a copy of these instructions because you will be working with all windows closed except HijackThis.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mysearchnow.com/passthrough/...p://about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/...arch.yahoo.com/

F0 - system.ini: Shell=

F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,

O2 - BHO: Forkbat - {55C375D8-7D5E-1F21-9360-3103E79E0323} - D:\PROGRA~1\ANTILE~1\Close Upload.dll

O3 - Toolbar: Heart Comp Mode - {45C50406-2BAE-7837-BD43-5FF98F0E7D57} - D:\PROGRA~1\ANTILE~1\Close Upload.dll

This one suggested fix because it a rescource hog.
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} -

After you get it all fixed and things are working good ,Download and install these two programs to help stop Spyware .

Spywareblaster

SpywareGuard

IE-SPYAD

Keep Up-to-Date!
The most important key to maintaining a secure computer is keeping your protection up-to-date.

also check how i got infected in the first place .

http://www.computercops.biz/postlite7736-.html

Well first you have the blaster worm. so go here for instruction on removing it .
http://www.pchell.com/virus/msblast.shtml
Then post back with a new log

So youve been doing this for about 2 weeks now ,did you ever have a look at how i got infected in the first place ,in Crunchies signature .and get the suggested programs .

http://news.com.com/Security+hole+found+in+Mozilla+browser/2100-1002_3-5262676.html?tag=cd.lede

Have hijack fix this '

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

Are you sure thats a full log ,usually more after the 08's

Some trojan.virus realeated info in you log ,so please go here and run the free online virus scan ,check auto fix,, before you scan .http://housecall.trendmicro.com/housecall/start_corp.asp

Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

Then these 2 programs .
Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Setup Ad-Aware .
After installing AAW, and before running the program, update reference files by using the bottom right button in the program, labeled "Check for Updates."

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives & Folders, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Include additional Ad-aware settings in logfile" and
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."
Click on 'Proceed' to save these Preferences.
Please make sure that you activate IN-DEPTH scanning before you proceed

Download SPYBOT

After installing Spybot S&D, update …

No, you were suppost to go to the security section to post the log ,

Edit : i seee you posted in the security section ,so no need to move this one!

This might help
Quick Launch - Missing or you receive an error message, to correct:

This behavior can occur if the Quick Launch folder has been deleted. To resolve this issue, recreate the Quick Launch folder. Create a folder named Quick Launch at the following location:

C:\Documents and Settings\Application Data\Microsoft\Internet Explorer

Also this .
http://www.kellys-korner-xp.com/taskbarplus!.htm

I think you should go tothe security section of this fourm and post a hijackthis log ,
get hijackthis here and post a log in security section .
Here's how to post a Hijack This log - the whole spiel, with (hopefully) every eventuality covered... :

Go to http://www.majorgeeks.com/downloadget.php?id=3155&file=9&evp=3304750663b552982a8baee6434cfc13 , and download 'Hijack This!'.
When downloading, choose "save to disk" and NOT open!

Now this download is a *.zipfile, which means you need to decompress it with a utility like WinZip

Many downloads come in the shape of a compressed file, so it's an indispensible tool, really.
It has an evaluation version which you can use for a month or so
Here's a tutorial. It's extremely easy to do.

Now create a new folder for it, C:\Hijackthis, for example.
After unzipping the file to C:\Hijack This, you'll end up with the file itself, which is Hijackthis.exe, and that's the one you'll need to doubleclick.'

When the program launches, hit the "Scan" button
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, and save the log anywhere you like.

Now if you doubleclick the log file, does it open in Notepad?

If so, go to Edit > Select all, then to Edit > copy.
Now you've copied the entire text to the Windows Clipboard (this happens behind your back.)

Next, go back to this …

Congrats on the promo ,I only seem to get demoted !:)

Welcome Newbie.JAY_2 !:)
A lot more baddies in you log than Bridge .dll
Give these programs a try one at a time following instructions carefully .Good luck .
Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

Then these 2 programs .
Ad-Aware and Spybot

Download the latest version of Ad-Aware at ADAWARE

Setup Ad-Aware .
After installing AAW, and before running the program, update reference files by using the bottom right button in the program, labeled "Check for Updates."

Launch the program, and click on the Gear at the top of the start screen.

Click the "Scanning" button.
Under Drives & Folders, select "Scan within Archives".
Click "Click here to select Drives + folders" and select your installed hard drives.

Under Memory & Registry, select all options.
Click the "Advanced" button.
Under "Log-file detail", select all options.
Click the "Tweaks" button.

Under "Scanning Engine", select the following:
"Include additional Ad-aware settings in logfile" and
"Unload recognized processes during scanning."
Under "Cleaning Engine", select the following:
"Let Windows remove files in use after reboot."

Important: Create a folder on the C: drive called HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.

...................................................................

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

NOTE: Please copy and paste this post into notepad and save to you desktop. or print a copy of these instructions because you will be working with all windows closed except HijackThis.
...........................................................

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

O2 - BHO: (no name) - {1B7D753B-1981-4bd2-91F3-6D055EE113A0} - C:\WINDOWS\System32\NDrv.dll

O2 - BHO: (no name) - {27AC09EE-C20B-4BA4-8E27-F1C33D263875} - C:\WINDOWS\SYSTEM32\nx5g.dll

R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

Check for this in control panel ,add/remove programs and unistall if there
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [DealHelperUpdate] C:\WINDOWS\DHUpdt.exe

O4 - HKLM\..\Run: [DealHelperBrwsr] C:\WINDOWS\dhbrwsr.exe

O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe

Go …

When i use win98 i always used this program to shutdown all the programs running before i did a defrag in normal mode .
http://www.docsdownloads.com/enditall.htm

For other stuff you don't want, Go to Start -> Run and type msconfig

Actuall i use hijackthis to stop the things that i don't want running at startup .
I useto use the registry before hiajckthis . as MSCONFIG is reall only a diagonist tool .

Registry edit path=
hkey_local_machine\software\Microsft\windows\currentversion\Run
Or if multiple users and you jusy want to change each one individuly go to
hkey_current_user\software\Microsft\windows\currentversion\Run

for the task manager problem just open it and double click on the large area at the bottom.don't know what happened to system restore .

This one is strange to me ,and i can't find any info on it !
Otherwise log look good!:)

If you don't know what it is do the following
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O3 - Toolbar: pile way dart - {02DFBCFC-7BE7-5B67-4471-A2932180BCB2} - C:\PROGRA~1\DOWNLO~1\BookKeep.dll

Reboot and post a new log

Please Download CWShredder from HERE and run the Program in safe mode . Press the "Fix Button" Let it fix all variants. Next, Close the program and all windows and IE windows and run hijackthis and Post a Fresh log.

Reboot to SAFE mode to run swshredder

How to start computer in safe mode

reboot computer and post a new log

I don't think this thread needs another comment but !
you guys spoiled all the fun!:)

O' ok where can i download it !:<