Windows OS
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
 
 
User Name:
Password:
Remember me
Go Back   ASP Free ForumsSystem AdministrationWindows OS

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread ASP Free Forums Sponsor:
  #1  
Old November 5th, 2004, 08:14 PM
kaygod kaygod is offline
Registered User
ASP Free Newbie (0 - 499 posts)
 
Join Date: Nov 2004
Posts: 1 kaygod User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
Exclamation Spyware Nightmare

I have experienced the worst time trying to get rid of spyware that seems to hijack the address bar in ie. I was unable to RUN regedit, msdos, taskmanager and HijackThis for a week. Also the fact that i wasn't able to download mcafee using any other browser other than i.e frustrated me to the max. Now finally after following the threads here I have learnt from jmurrayhead that this programs can run via safe mode. Going thru safe mode enabled me to run Hijack This. However now I have Hijack This running but I don't know what to delete according to log file. I now call on you adware and spyware gurus to assess the following log file and let me know what the next step is :

Logfile of HijackThis v1.98.2
Scan saved at 11:46:41 AM, on 11/6/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator.PINA-I4AEK3DUW8\My Documents\hijack\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.search-exe.com/nph-search.cgi?tcode=exebar1&look=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.angelfire.com/ut2/danjef1/bb/danjef.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: WebBho Class - {00041A26-7033-432C-94C7-6371DE343822} - C:\Program Files\se\v11\se.DLL
O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_30.dll
O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Program Files\MediaLoads Enhanced\ME2.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printra y.exe
O4 - HKLM\..\Run: [MediaLoads Installer] "C:\Program Files\DownloadWare\dw.exe" /H
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [WindowEnhancer] "C:\Program Files\winex\v2\winex.EXE" /U
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [B79AC9AC] C:\WINDOWS\System32\uvxrstt.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [Microsoft Update] wuagtrd.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] wuamgrd.exe
O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
O4 - HKLM\..\Run: [restrictanonymous] 
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\mijwkm.exe
O4 - HKLM\..\Run: [Outlook Express] jlmvf.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [RBFKREVO] c:\windows\system32\rbfkrevo.exe /install
O4 - HKLM\..\RunServices: [Microsoft Update] wuagtrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] wuamgrd.exe
O4 - HKLM\..\RunServices: [EnableDCOM] N
O4 - HKLM\..\RunServices: [Outlook Express] jlmvf.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - HKCU\..\Run: [Microsoft Update] wuagtrd.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] wuamgrd.exe
O4 - HKCU\..\Run: [MSN Messenger] osknuuz.exe
O4 - HKCU\..\RunServices: [MSN Messenger] osknuuz.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {2ABE804B-4D3A-41BF-A172-304627874B45} - http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_1029_XP.cab
O16 - DPF: {3B02AAA2-327C-40ED-A849-4BE819AE5385} (ImgSizer Control) - file://C:\Documents and Settings\Pina\Local Settings\Temp\~DlfnTmp0\imgSizer.ocx
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {DCE3340D-3568-4883-8B15-F6E296BC9445} (NCSVersion Class) - http://dolalol.landonline.com.au/ecwplugins/ncs.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://photos.extrafilm.com.au/en/Photo/XUpload.ocx
O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Neifbf32.dll

Reply With Quote
  #2  
Old November 6th, 2004, 12:28 PM
edwinbrains's Avatar
edwinbrains edwinbrains is offline
Contributing User
ASP Free Newbie (0 - 499 posts)
 
Join Date: Mar 2004
Location: UK
Posts: 140 edwinbrains User rank is Private First Class (20 - 50 Reputation Level)edwinbrains User rank is Private First Class (20 - 50 Reputation Level) 
Time spent in forums: 8 h 44 m 10 sec
Reputation Power: 5
Thread split.

There's a dedicated forum for spyware problems at Dev Shed (all part of the Developershed network). You may get more help here:

http://forums.devshed.com/forumdisplay.php?f=117

Reply With Quote
  #3  
Old November 7th, 2004, 11:36 AM
jmurrayhead's Avatar
jmurrayhead jmurrayhead is offline
The Drunken Moderator
ASP Free God 17th Plane (13000 - 13499 posts)
 
Join Date: Feb 2004
Location: Reston, VA, USA
Posts: 13,062 jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)jmurrayhead User rank is General 9th Grade (Above 100000 Reputation Level)  Folding Points: 82293 Folding Title: Advanced FolderFolding Points: 82293 Folding Title: Advanced FolderFolding Points: 82293 Folding Title: Advanced FolderFolding Points: 82293 Folding Title: Advanced FolderFolding Points: 82293 Folding Title: Advanced Folder
Time spent in forums: 3 Months 6 Days 13 h 36 m 58 sec
Reputation Power: 1576
Facebook
New.Net is spyware:

Remove all files related to this.

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s

Also, browse to this directory:

C:\Documents and Settings\Pina\Local Settings\Temp\

and remove all files from the Temp folder.

Last edited by jmurrayhead : November 7th, 2004 at 01:04 PM.

Reply With Quote
Reply

Viewing: ASP Free ForumsSystem AdministrationWindows OS > Spyware Nightmare


Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 3 hosted by Hostway