CastleCops® Giving Hijack a try...nxt step is to throw comp. into street

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

Giving Hijack a try...nxt step is to throw comp. into street

All -> FavForums -> Trend Micro HijackThis Logs

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

newsman

Guest
IP: 68.56.*.*

Posted: Sun Nov 30, 2003 2:31 am Post subject: Giving Hijack a try...nxt step is to throw comp. into street

Hi, I've let my system get into a pickle. I've tried norton, adware, spybot, and my trusty old cleantray and come up empty. I know I've got the nn_webband thing; can't shake it. Also, read from harddisk seems to take twice as long as usual. Nearing the end of civilized computing...Here it goes... Logfile of HijackThis v1.97.7 Scan saved at 9:37:14 PM, on 11/29/03 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\CREATIVE\AUDIO\PROGRAM\CTMIX32.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\NETSCAPE\NETSCAPE 6\NETSCP.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://ie.marketdart.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchalot.com/search.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchalot.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchalot.com/search.htm R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.the-huns-yellow-pages.com/sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchalot.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchalot.com/search.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchalot.com/search.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchalot.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchalot.com/search.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchalot.com/search.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchalot.com/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchwww.com/search.cgi?s=%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.searchalot.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.searchalot.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.fastwebfinder.com/hp.php R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://out.true-counter.com/b/?656387 (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\d2q6a0nr.slt\prefs.js) N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CMOZILLA.ORG%5CMOZILLA%5Csearchplugins%5Cgoogle.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\d2q6a0nr.slt\prefs.js) O1 - Hosts: 64.14.40.148 auto.search.msn.com O1 - Hosts: 193.125.201.50 msn.com O1 - Hosts: 193.125.201.50 search.msn.com O1 - Hosts: 193.125.201.50 ie.search.msn.com O1 - Hosts: 193.125.201.46 thehun.net O1 - Hosts: 193.125.201.46 www.thehun.net O1 - Hosts: 193.125.201.46 thehun.com O1 - Hosts: 193.125.201.46 www.thehun.com O1 - Hosts: 193.125.201.50 sitefinder.verisign.com O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_10_0.DLL O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} - C:\PROGRAM FILES\E-BOOK SYSTEMS\FLIPALBUM 5 PRO\FPLAUNCH.DLL O2 - BHO: (no name) - {66993893-61B8-47DC-B10D-21E0C86DD9C8} - (no file) O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFA2} - C:\WINDOWS\TEMP\IANK.DLL (file missing) O2 - BHO: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINDOWS\WINSHOW.DLL O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar.dll O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\GRLNT0I.DLL O2 - BHO: (no name) - {000E7270-CC7A-0786-8E7A-DA09B51938A6} - C:\WINDOWS\SYSTEM\N3TPA1.DLL O2 - BHO: (no name) - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} - C:\PROGRAM FILES\CLEARSEARCH\IE_CLRSCH.DLL O2 - BHO: (no name) - {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL O3 - Toolbar: NN_WebBand - {179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [winmain] winmain.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE O4 - HKCU\..\Run: [od-stnd236] c:\program files\Webdialer\od-stnd236.exe -m O4 - HKCU\..\Run: [od-stnd256] c:\program files\Webdialer\od-stnd256.exe -m O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape 6\Netscp.exe" -turbo O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O4 - Startup: ps2rate.lnk = C:\PS2RATE.EXE O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmbacklinks.html O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\GOOGLETOOLBAR.DLL/cmtrans.html O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O10 - Broken Internet access because of LSP provider 'lsp.dll' missing O13 - DefaultPrefix: http://193.125.201.50/?trk= O14 - IERESET.INF: SEARCH_PAGE_URL=http://www.searchalot.com/search.htm O14 - IERESET.INF: START_PAGE_URL=http://www.searchalot.com O14 - IERESET.INF: MS_START_PAGE_URL=http://www.searchalot.com O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab O16 - DPF: {1E89F686-B78D-4C85-9EFC-3474516E3FE2} - http://directplugin.com/plugin/113089.exe O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://5536239.offshoreclicks.com/dialup_files/55500947.cab O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.accessoveloce.com/webline/x/brigida1x.exe O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.samsphotoclub.com/add/XUpload.ocx O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install.exe O16 - DPF: {E6D5237D-A6C7-4C83-A67F-F9F15586FA62} (SBFullInst Control) - http://www.spyblast.com/download/SBFull.cab O16 - DPF: {645D793B-33E2-4175-A7E1-BA490839358A} (DNL Control) - http://www.huntfly.com/media/MyFIDNL.ocx O16 - DPF: {F1A51F21-59DF-4486-BA31-5B816DA481EB} (FastSeekerToolbar Control) - http://www.fastseeker.com/toolbar/download/FastSeekerSetup3.cab O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} (F1 Organizer Class) - http://www.netpaloffers.net/NetpalOffers/DMO1/GrlNt0i.cab O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} (NN_Bar_Helper) - http://download.getmirar.com/875455/files/installer.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab O19 - User stylesheet: c:\windows\java\my.css O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM) also start up is: StartupList report, 11/29/03, 9:36:20 PM StartupList version: 1.52 Started from : C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE Detected: Windows 98 SE (Win9x 4.10.2222A) Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106) * Using default options ================================================== Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\CREATIVE\AUDIO\PROGRAM\CTMIX32.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\NETSCAPE\NETSCAPE 6\NETSCP.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE -------------------------------------------------- Listing of startup folders: Shell folders Startup: [C:\WINDOWS\Start Menu\Programs\StartUp] Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ps2rate.lnk = C:\PS2RATE.EXE -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ScanRegistry = C:\WINDOWS\scanregw.exe /autorun TaskMonitor = C:\WINDOWS\taskmon.exe SystemTray = SysTray.Exe CreativeMixer = C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" ccRegVfy = "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" Advanced Tools Check = C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE NPROTECT = C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme winmain = winmain.exe QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices ccEvtMgr = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme SchedulingAgent = mstask.exe NPROTECT = C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run (Default) = od-stnd236 = c:\program files\Webdialer\od-stnd236.exe -m od-stnd256 = c:\program files\Webdialer\od-stnd256.exe -m Mozilla Quick Launch = "C:\Program Files\Netscape\Netscape 6\Netscp.exe" -turbo -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=Explorer.exe SCRNSAVE.EXE= drivers=mmsystem.dll power.drv -------------------------------------------------- C:\WINDOWS\WININIT.BAK listing: (Created 29/11/2003, 0:56:24) [rename] C:\WINDOWS\SYSTEM\RICHED20.DLL=C:\WINDOWS\SYSTEM\RICHED20.1 NUL=C:\WINDOWS\TEMP\_iu14D2N.tmp -------------------------------------------------- C:\AUTOEXEC.BAT listing: SET BLASTER=A220 I7 D1 H7 P330 T6 SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV SET Path=%Path% -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_10_0.DLL - {02478D38-C3F9-4efb-9B51-7695ECA05670} (no name) - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872} (no name) - C:\PROGRAM FILES\E-BOOK SYSTEMS\FLIPALBUM 5 PRO\FPLAUNCH.DLL - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} (no name) - (no file) - {66993893-61B8-47DC-B10D-21E0C86DD9C8} (no name) - C:\WINDOWS\TEMP\IANK.DLL (file missing) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFA2} (no name) - C:\WINDOWS\WINSHOW.DLL - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} (no name) - c:\windows\googletoolbar.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7} (no name) - C:\WINDOWS\SYSTEM\GRLNT0I.DLL - {00000EF1-0786-4633-87C6-1AA7A44296DA} (no name) - C:\WINDOWS\SYSTEM\N3TPA1.DLL - {000E7270-CC7A-0786-8E7A-DA09B51938A6} (no name) - C:\PROGRAM FILES\CLEARSEARCH\IE_CLRSCH.DLL - {947E6D5A-4B9F-4CF4-91B3-562CA8D03313} (no name) - C:\WINDOWS\SYSTEM\NN_BAR31.DLL - {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} -------------------------------------------------- Enumerating Task Scheduler jobs: Tune-up Application Start.job Symantec NetDetect.job Norton AntiVirus - Scan my computer.job -------------------------------------------------- Enumerating Download Program Files: [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [QuickTime Object] InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab [{41F17733-B041-4099-A042-B518BB6A408C}] CODEBASE = http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe [InstallShield International Setup Player] InProcServer32 = c:\WINDOWS\DOWNLO~1\ISETUP.DLL CODEBASE = http://www.installengine.com/engine/isetup.cab [{1E89F686-B78D-4C85-9EFC-3474516E3FE2}] CODEBASE = http://directplugin.com/plugin/113089.exe [Tukati Launcher] InProcServer32 = C:\WINDOWS\SYSTEM\TUKATICLIENTINSTALLER.DLL CODEBASE = http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab [{A45F39DC-3608-4237-8F0E-139F1BC49464}] CODEBASE = http://5536239.offshoreclicks.com/dialup_files/55500947.cab [Loader Class] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MACONNECT.DLL CODEBASE = http://connect.online-dialer.com/MaConnect.cab [Installer Class] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.6\ISTACTIVEX.DLL CODEBASE = http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab [{00000000-0000-0000-0000-000020030000}] CODEBASE = http://www.accessoveloce.com/webline/x/brigida1x.exe [Persits Software XUpload] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\XUPLOAD.OCX CODEBASE = http://www.samsphotoclub.com/add/XUpload.ocx [{13197ACE-6851-45C3-A7FF-C281324D5489}] CODEBASE = http://www.2nd-thought.com/files/install.exe [SBFullInst Control] InProcServer32 = C:\WINDOWS\DOWNLO~1\SBFULL.OCX CODEBASE = http://www.spyblast.com/download/SBFull.cab [DNL Control] InProcServer32 = C:\WINDOWS\DOWNLO~1\MYFIDNL.OCX CODEBASE = http://www.huntfly.com/media/MyFIDNL.ocx [FastSeekerToolbar Control] InProcServer32 = C:\WINDOWS\DOWNLO~1\FASTSE~1.OCX CODEBASE = http://www.fastseeker.com/toolbar/download/FastSeekerSetup3.cab [F1 Organizer Class] InProcServer32 = C:\WINDOWS\SYSTEM\GRLNT0I.DLL CODEBASE = http://www.netpaloffers.net/NetpalOffers/DMO1/GrlNt0i.cab [{086A694F-91FB-4068-B44C-124FB69BF05D}] CODEBASE = http://www.searchwww.com/search.cab [NN_Bar_Helper] InProcServer32 = C:\WINDOWS\SYSTEM\NN_BAR31.DLL CODEBASE = http://download.getmirar.com/875455/files/installer.cab [YInstStarter Class] InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.1\YINSTHELPER.DLL CODEBASE = http://download.yahoo.com/dl/installs/yinstc.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL -------------------------------------------------- End of report, 8,537 bytes Report generated in 0.200 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only

wawadave

Special Response Team
Special Response Team

Joined: Nov 22, 2002
Posts: 21503
Location: Installing Vista http://tinyurl.com/2l9qyd

Posted: Sun Nov 30, 2003 5:56 am Post subject:

hello you can get rid off all the search alot ones at the start. fast web finder allso. all the 01 enteries.and the 03 enterie as well.remove all the 014 ones as well. and this one i,m not100% on O16 - DPF: {F1A51F21-59DF-4486-BA31-5B816DA481EB} (FastSeekerToolbar Control) - http://www.fastseeker.com/toolbar/download/FastSeekerSetup3.cab theres more but these i know are spyware. you may want to wait till an expert comes in. allso do you update your ad-ware and spybot? d/l cwsheader and update it and run it. _________________ Brycetechs new tut dvd http://tinyurl.com/2u7rpk The Pixel Palladium Bryce Newby help and tuts, d/l,s How 2s Updated 18 Apr 2008

Bulldog

General

Premium Member

Joined: Nov 16, 2003
Posts: 4375
Location: Canada

Posted: Sun Nov 30, 2003 9:10 am Post subject:

Hi newsman Please do this: Download , unzip and run the newest version of CWShredder http://www.spywareinfo.com/~merijn/files/cwshredder.zip Then: Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing. O2 - BHO: (no name) - {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL O3 - Toolbar: NN_WebBand - {179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF} - C:\WINDOWS\SYSTEM\NN_BAR31.DLL O16 - DPF: {1E89F686-B78D-4C85-9EFC-3474516E3FE2} - http://directplugin.com/plugin/113089.exe O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://3dgamers.tukati.com/tukati/1.7.20.20/tukati.cab O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://5536239.offshoreclicks.com/dialup_files/55500947.cab O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} (Loader Class) - http://connect.online-dialer.com/MaConnect.cab O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.accessoveloce.com/webline/x/brigida1x.exe O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.samsphotoclub.com/add/XUpload.ocx O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install.exe O16 - DPF: {E6D5237D-A6C7-4C83-A67F-F9F15586FA62} (SBFullInst Control) - http://www.spyblast.com/download/SBFull.cab O16 - DPF: {645D793B-33E2-4175-A7E1-BA490839358A} (DNL Control) - http://www.huntfly.com/media/MyFIDNL.ocx O16 - DPF: {F1A51F21-59DF-4486-BA31-5B816DA481EB} (FastSeekerToolbar Control) - http://www.fastseeker.com/toolbar/download/FastSeekerSetup3.cab O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} (F1 Organizer Class) - http://www.netpaloffers.net/NetpalOffers/DMO1/GrlNt0i.cab O16 - DPF: {086A694F-91FB-4068-B44C-124FB69BF05D} - http://www.searchwww.com/search.cab O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} (NN_Bar_Helper) - http://download.getmirar.com/875455/files/installer.cab Reboot. There is much more to clean...however please Download Spybot - Search & Destroy Short tutorial and download link here: http://tomcoyote.org/SPYBOT/index1.html Now press Settings, and Settings again. Go to the Webupdate section, and check "Display also available beta versions". Now press Online, and search for, put a check mark at, and install all updates. Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all it finds. Reboot. After all the above is done, please post a new HijackThis log. .

	All -> FavForums -> Trend Micro HijackThis Logs	All times are GMT
Page 1 of 1

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 166ppm 0.370s (0.066s) Making cybercriminals unhappy since 2002*