[heres my HJT log.] - Computers



Search Tech-Forums - link takes you to our Forum's search page.

Note: The following is only a text archive!

To view the actual forum discussion, please visit our website at http://www.tech-forums.net

Pages:1


heres my HJT log.

(Click here to view the original thread with full colors/images)


Posted by: Wildfire

i clicked a link to a webpage that i saw on a forum i go to everyday, to a site that was called fungames or funway.com or something, and it loaded up like crazy tons of windows, and i ended up with search assistant and best search which i vcannot remove, so now when i surf these best search pop ups keep coming at me.. any help would be appreciated.. here the log.

Logfile of HijackThis v1.99.0
Scan saved at 9:07:48 PM, on 2/7/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\Grisoft\AVG Free\avgemc.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Terry\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Mega! - {8BC6346B-FFB0-4435-ACE3-FACA6CD77816} - C:\DOCUME~1\Terry\LOCALS~1\Temp\MegaHost.dll
O2 - BHO: (no name) - {A1034346-681B-4A7F-84A8-0D4B42975F0E} - C:\WINDOWS\System32\pael.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht![url]http://www.awmdabest.com/bltd/318.chm::/file.exe[/url]
O16 - DPF: {563EC66E-5A1B-51D2-1DB0-5080C83DA4EB} - ms-its:mhtml:file://C:ie.mht![url]http://69.50.164.12/exp/mht/sext01.chm::/MegaInstaller.exe[/url]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [url]http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1107406817804[/url]
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe


Posted by: rstones12

Hello Wildfire,
Welcome to Tech-Forums,


I have outlined some preliminary steps that we need to address. [b]You may want to print out these intructions for reference.[/b] This process will take a few steps so please be patient and follow the provided directions.

[b]1.[/b] First Download [URL=http://cwshredder.net/bin/CWShredder.exe][color=blue]CWShredder[/color][/URL]
And save it to your desktop.
Close all open browser windows and any other open windows.

Install CWShredder, then:

Open CWS and click [b]Check for Updates[/b]
Then click [b]"FIX"[/b]

I suggest doing an online scan just as a secondary check.

[b]2.[/b] Please run this online scan, allow it to delete anything it finds:
You may have to select auto-fix prior to scanning, it should be a selection on the screen.[LIST][URL=http://www.pandasoftware.com/activescan/com/activescan_principal.htm][color=blue]Panda ActiveScan[/color][/URL]
[/LIST]Please make a note of anything that wasn't or couldn't be fixed.
Reboot your machine when finished.

[b]3.[/b] You may have run these programs already, make sure they are up to date and run per provided instructions.
Current Versions are:
[b]Spybot S&D Ver: 1.3[/b] [URL=http://www.safer-networking.org/en/download/index.html][color=blue]Download Here[/color][/URL]
[b]Ad-Aware SE Build 1.05[/b] [URL=http://www.majorgeeks.com/download506.html][color=blue]Download Here[/color][/URL]

Download and install both Spybot S&D and Ad-Aware SE.

Instructions:

[b]Spybot S&D:[/b]
Go to your Start Menu >> Programs >> Spybot S&D >> then choose Spybot S&D.

[b]*[/b]Close [b]ALL [/b]windows except Spybot S&D
[b]*[/b]Click the button to [b]"Search for Updates"[/b] and download and install the Updates.
[b]*[/b]Close Spybot then launch it again
[b]*[/b]Click the button [b]"Check for Problems" [/b]
[b]*[/b]When Spybot is done scanning, it will be showing "RED" (RED) entries, "BLACK" entries and "GREEN" (GREEN) entries in the window
[b]*[/b]Put a check mark beside the RED [color=red](RED) entries ONLY.[/color]
[b]*[/b]Choose "Fix Selected Problems" and allow Spybot to fix the RED [color=red](RED)[/color] entries.


[b]Ad-Aware SE FULL SCAN:[/b]
Go to your Start Menu >> Programs >> Lavasoft Ad-Aware SE >> then choose Ad-Aware SE Personal.

When the main window opens look in the bottom right corner and click on [b]Check For Updates Now[/b] then click Connect and download the latest reference files.

From main window:
[b]*[/b]Click Start then under Select a scan Mode check [b]Perform Full System Scan.[/b]
[b]*[/b]Next [color=red]deselect [/color]Search for negligible risk entries.
[b]*[/b]To scan just click the [b]Next[/b] button.

When the scan has finished [b]mark everything for removal [/b]and get rid of it.
[i](Right-click the window and choose [b]select all[/b] from the drop down menu and click Next)[/i]
The program will ask if you want to fix/delete selected items, choose yes/fix.

Empty Your Recycle Bin.

Reboot your machine and post a new HJT log, by clicking [b]"Post a Reply"[/b]

Thanks,
rstones12


Posted by: Wildfire

thanks for helping. i did all that you said to do, and as the adaware scan was scanning, my avg a/v popped up telling me it found a virus, something like this, but not exactly >>>>>> C:/SystemVolumizeInformation(21343324234 and a bunch more #s, 2354235235).dll ...i sent it to the vault, then deleted the file. i will await further instruction, heres the new log. thanks.

Logfile of HijackThis v1.99.0
Scan saved at 8:22:48 PM, on 2/8/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Terry\LOCALS~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Mega! - {8BC6346B-FFB0-4435-ACE3-FACA6CD77816} - C:\DOCUME~1\Terry\LOCALS~1\Temp\MegaHost.dll
O2 - BHO: (no name) - {A1034346-681B-4A7F-84A8-0D4B42975F0E} - C:\WINDOWS\System32\pael.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht![url]http://www.awmdabest.com/bltd/318.chm::/file.exe[/url]
O16 - DPF: {563EC66E-5A1B-51D2-1DB0-5080C83DA4EB} - ms-its:mhtml:file://C:ie.mht![url]http://69.50.164.12/exp/mht/sext01.chm::/MegaInstaller.exe[/url]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [url]http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1107406817804[/url]
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - [url]http://www.pandasoftware.com/activescan/as5/asinst.cab[/url]
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - [url]http://chat.msn.com/bin/msnchat45.cab[/url]
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe


Posted by: rstones12

Wildfire,

You may need to print out these instructions for a reference.

First Click [url]http://forums.techguy.org/attachment.php?attachmentid=44318[/url]
to download cwsserviceremove.zip and unzip it to your desktop and have
it ready to run later.

Click [URL=http://www.spyware911.net/downloads/CWShredder.exe]CWShredder[/URL]
to download CWShredder. Do Not run it yet. Download it to the desktop
and have it ready to run later.

Click [URL=http://www.spyware911.net/downloads/AboutBuster.zip]About
Buster 4.0[/URL] to download AboutBuster created by Rubber Ducky.

Unzip AboutBuster to the Desktop then click the "Update Button" then
click "Check for Update" and download the updates and then click
"Exit" because I don't want you to run it yet. Just get the updates so
it is ready to run later in safe mode.

Now go ahead and set your computer to
[URL=http://www.spyware911.net/showhiddenfiles.htm]Show hidden files &
folders[/URL] like so:

Because XP will not always show you hidden files and folders by
default, Go to Start > Search and under "More advanced search
options".
Make sure there is a check by "Search System Folders" and "Search
hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go to Tools > Folder Options. Click on the
View tab and make sure that "Show hidden files and folders" is
checked. Also uncheck "Hide protected operating system files" and
"Hide extensions for known file types" . Now click "Apply to all
folders"
Click "Apply" then "OK"

Sign off the internet and remain offline until this procedure is
complete. Unplug your modem or disconnect the cable or phone line.
Copy these instructions to notepad and save them on your desktop for
easy access. You must follow these directions exactly and you cannot
skip any part of it.

Click Start > Run > and type in:

services.msc

Click OK.

In the services window find Workstation NetLogon Service.
Rightclick and choose "Properties". On the "General" tab under
"Service Status" click the "Stop" button to stop the service. Beside
"Startup Type" in the dropdown menu select "Disabled". Click Apply
then OK. Exit the Services utility.

Restart to [URL=http://www.spyware911.net/safemode.htm]Safe Mode[/URL].

How to start your computer in [url]http://www.spyware911.net/safemode.htm[/url]

Perform the following steps in safe mode:

Double click on the cwsserviceemove.reg file you downloaded at the
beginning to enter into the registry. Answer yes when asked to have
it's contents added to the registry.

Go to Start > Run and type Hijackthis. Press enter to start
HijackThis. [B]DO NOT OPEN ANYTHING ELSE![/B]

Put a check by these entries in Hijack This and click the [B]"Fix
Checked"[/B] button:

[b]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\Terry\LOCALS~1\Temp\sp.dll/sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about :blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :blank

O2 - BHO: Mega! - {8BC6346B-FFB0-4435-ACE3-FACA6CD77816} - C:\DOCUME~1\Terry\LOCALS~1\Temp\MegaHost.dll

O2 - BHO: (no name) - {A1034346-681B-4A7F-84A8-0D4B42975F0E} - C:\WINDOWS\System32\pael.dll (file missing)

O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://c:\nosuch.mht![url]http://www.awmdabest.com/bltd/318.chm::/file.exe[/url]

O16 - DPF: {563EC66E-5A1B-51D2-1DB0-5080C83DA4EB} - ms-its:mhtml:file://C:ie.mht![url]http://69.50.164.12/exp/mht/sext01....gaInstaller.exe[/url]
[/b]

Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to
Edit > Select All then Edit > Delete to delete the entire contents of
the Temp folder.

Next navigate to the C:\Documents and Settings\Administrator (Repeat
for all user names)\Local Settings\Temp folder. Open the Temp folder
and go to Edit > Select All then Edit > Delete to delete the entire
contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab
under "Temporary Internet Files" Click "Delete Files". Put a check by
"Delete Offline Content" and click OK. Click on the Programs tab then
click the "Reset Web Settings" button. Click Apply then OK.

Next run aboutbuster. Double click aboutbuster.exe, click OK, click
Start, then click OK. This will scan your computer for the bad files
and delete them.

Finally, run CWShredder. Just click on the cwshredder.exe then click
"Fix" (Not "Scan only") and let it do it's thing.

Boot out of safe mode back into Windows normally now.

Download [URL=http://www.mvps.org/winhelp2002/DelDomains.inf]DelDomains.inf[/URL]
from here:

Rightclick DelDomains.inf and choose install.

Click [URL=http://www.cexx.org/LSPFix.exe]LspFix[/URL] to download LspFix

Launch the application, and click the "I know what I'm doing" checkbox.

Check all instances of osmim.dll (and nothing else) , and move them to
the [B]"Remove"[/B] pane.
Then click [B]Finish.[/B]

Turn off System Restore:
[URL=http://www.spyware911.net/systemrestore.htm]Disable System
Restore[/URL]

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer.

Go [URL=http://housecall.trendmicro.com/]Trend Micro - Free online
virus Scan[/URL] and do an online virus scan.

Be sure and put a check in the box by "Auto Clean" before you do the
scan. If it finds anything that it cannot clean have it delete it or
make a note of the file location so you can delete it yourself.
Housecall will detect the leftover files from this hijacker.

This hijacker is known to alter or delete certain files so check this
out please:

Download the [URL=http://www.spyware911.net/downloads/hoster.zip]Hoster.zip[/URL]
. UnZip the file and press "Restore Original Hosts" and press "OK".
Exit Program.

If you have Spybot S&D installed you will also need to replace one file.
Go [URL=http://www.spywareinfo.com/~merijn/winfiles.html#sdhelper]SDHelper.dll[/URL]
and download SDHelper.dll. Copy the file to the folder containing your
Spybot S&D program (normally C:\Program Files\Spybot - Search &
Destroy)

Check in the C:\Windows\system32 folder to be sure you have a file
named Shell.dll. If you do not have one, go to the
C:\Windows\system32\dllcache folder.
Find shell.dll and right click on it. Choose Copy from the menu.
Open the System32 folder and right click on an empty space in the
window. Choose Paste from the menu.

control.exe may have been deleted.
See if control.exe is present in C:\windows\system32

If control.exe isn't there, go
[url]http://www.spywareinfo.com/~merijn/winfiles.html,[/url] and
download control.exe per the instructions at the site.

IMPORTANT!: Please check your ActiveX security settings. They may have
been changed by this CWS variant to allow ALL ActiveX!! If they have
been changed, reset your active x security settings in IE as
recommended here.

When you are sure you are clean turn System Restore back on and create
a restore point.

To create a restore point:

Single-click Start and point to All Programs.
Mouse over Accessories, then System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled
"Create a restore point" and click the Next button.
Type a description for your new restore point. Something like "After
trojan/spyware cleanup". Click Create and you're done.

Empty your recycle bin.
Then post a new HJT log by using [b]Post a Reply[/b]


Posted by: Wildfire

thanks again for the continuing help...

in your last post you said.. "Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search
options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

...i use xp pro, and cannot complete this part of what you said to do...

can u calrify it before i procedd? tyvm...

.....wildfire


Posted by: rstones12

In XP when you do a search you should have some options in the search window. It will allow you to check for system files.

Look in the left part of the search box for down arrow I believe. This will expand more options.

Hope that helps.


Posted by: Wildfire

upon further review of all tasks i must complete, i believe ill do a format both drives, and reinstall my o/s and whatnot, which i have done 3 times in 2005 so far..
what can i do to keep search programs from getting on my pc?? certain websites will get you as soon as you open the window, is there any program that would prevent the page from opening? or do i need to just stay away from going to sites i havent been to before, possibly unsafe sites.


Posted by: rstones12

Wildfire,
Here is a thread that should help you out:

[url]http://www.tech-forums.net/showthread.php?s=&threadid=36259[/url]

Also if you look at the signature in that thread, there are a couple of addditional programs that work really well.
SpywareBlaster
SpywareGuard.

You may want to consider an alternative browser if you are currently using IE.
I suggest Firefox
[url]http://www.mozilla.org/products/firefox/[/url]

Good luck,
rstones12


Posted by: southernlady

Closing thread since decided to reformat. Liz




vBulletin Copyright ©2000 - 2003, Jelsoft Enterprises Limited.


PPC Management
vB Easy Archive Final - Created by Xenon