• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
gary roach

Hijacked Browser

4 posts in this topic

I'm having trouble with a hijacked browser - i've run ad-aware and spybot with up-to-date patterns and the home page of IE still keeps getting changed. It works fine under safe mode with networking (I'm running XP Home). I had a problem with something called wintime creating an irl file in a directory in program files called websiteviewer. i removed wintime using msconfig but still have hijacking probs. here's the startup log and hijack this log. thanks for the help.

 

gary

 

 

STARTUP TRACKER LOG:

 

08/07/2004 7:31:50 PM

 

-- Registry --

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

 

winkq32.exe C:\WINDOWS\winkq32.exe

winvt.exe C:\WINDOWS\system32\winvt.exe

d3fl.exe C:\WINDOWS\system32\d3fl.exe

msai32.exe C:\WINDOWS\system32\msai32.exe

appmk32.exe C:\WINDOWS\appmk32.exe

appmh.exe C:\WINDOWS\appmh.exe

sys117453 C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe delete

 

-- Registry --

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

 

NvCplDaemon RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

CHotkey zHotkey.exe

ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

NAV CfgWiz C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

CallControl 4.5 C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload

MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

Sunkist2k C:\Program Files\Multimedia Card Reader\shwicon2k.exe

nwiz nwiz.exe /install

nForce Tray Options sstray.exe /r

javatj.exe C:\WINDOWS\system32\javatj.exe

xpsystem C:\WINDOWS\System32\services\msxmidi.exe

 

-- Registry --

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

 

No Items Found

 

-- Start Menu - Current User --

No Items Found

 

-- Start Menu - All Users --

BigFix.lnk

Colorific.lnk

Microsoft Office.lnk

Register Online.lnk

True Internet Color® Icon.lnk

 

-- Disabled Items --

wintime

 

-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon --

Explorer.exe

 

-- Running Processes --

System Idle Process

System

smss.exe \SystemRoot\System32\smss.exe

csrss.exe

winlogon.exe winlogon.exe

services.exe C:\WINDOWS\system32\services.exe

lsass.exe C:\WINDOWS\system32\lsass.exe

svchost.exe C:\WINDOWS\system32\svchost -k rpcss

svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

explorer.exe C:\WINDOWS\Explorer.EXE

CCSETMGR.EXE "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

CCEVTMGR.EXE "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

spoolsv.exe C:\WINDOWS\system32\spoolsv.exe

NAVAPSVC.EXE "C:\Program Files\Norton AntiVirus\navapsvc.exe"

nvsvc32.exe C:\WINDOWS\System32\nvsvc32.exe

SAVSCAN.EXE "C:\Program Files\Norton AntiVirus\SAVScan.exe"

winkq32.exe C:\WINDOWS\winkq32.exe /s

msxmidi.exe "C:\WINDOWS\System32\services\msxmidi.exe"

zHotkey.exe "C:\WINDOWS\zHotkey.exe"

FTCtrl32.EXE "C:\Program Files\FaxTalk Communicator\FTCtrl32.exe" /autoload

shwicon2k.exe "C:\Program Files\Multimedia Card Reader\shwicon2k.exe"

sstray.exe "C:\WINDOWS\System32\sstray.exe" /r

javatj.exe "C:\WINDOWS\system32\javatj.exe"

msmsgs.exe "C:\Program Files\Messenger\msmsgs.exe" /background

BigFix.exe "C:\Program Files\BigFix\BigFix.exe" /atstartup

hgcctl95.exe "C:\Program Files\E-Color\Colorific\hgcctl95.exe"

fapiexe.exe FAPIEXE.EXE /e /ySoftware\Thought Communications\FaxTalk Communicator\4.5\

TICIcon.exe "C:\Program Files\E-Color\True Internet Color\TICIcon.exe"

wuauclt.exe "C:\WINDOWS\System32\wuauclt.exe"

38c92d68.exe C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe

StartupTracker3.exe "E:\StartupTracker3.exe"

wmiprvse.exe

 

-- Running Services --

 

Name: AudioSrv

Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Browser

Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: ccEvtMgr

Description: Symantec Event Manager

Startup Mode: Auto

Run from: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

 

Name: ccSetMgr

Description: Symantec Settings Manager

Startup Mode: Auto

Run from: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

 

Name: CryptSvc

Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

 

Name: Dhcp

Description: Manages network configuration by registering and updating IP addresses and DNS names.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Dnscache

Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService

 

Name: ERSvc

Description: Allows error reporting for services and applictions running in non-standard environments.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Eventlog

Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\services.exe

 

Name: EventSystem

Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: FastUserSwitchingCompatibility

Description: Provides management for applications that require assistance in a multiple user environment.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: helpsvc

Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: lanmanserver

Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: lanmanworkstation

Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: LmHosts

Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

 

Name: Messenger

Description: Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: navapsvc

Description: Handles Norton AntiVirus Auto-Protect events.

Startup Mode: Auto

Run from: "C:\Program Files\Norton AntiVirus\navapsvc.exe"

 

Name: Netman

Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Nla

Description: Collects and stores network configuration and location information, and notifies applications when this information changes.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: NVSvc

Description: Provides system and desktop level support to the NVIDIA display driver

Startup Mode: Auto

Run from: C:\WINDOWS\System32\nvsvc32.exe

 

Name: PlugPlay

Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\services.exe

 

Name: PolicyAgent

Description: Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\lsass.exe

 

Name: ProtectedStorage

Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\lsass.exe

 

Name: RasMan

Description: Creates a network connection.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: RpcSs

Description: Provides the endpoint mapper and other miscellaneous RPC services.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost -k rpcss

 

Name: SamSs

Description: Stores security information for local user accounts.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\lsass.exe

 

Name: SAVScan

Description: Handles Norton AntiVirus Auto-Protect Archive Scanning

Startup Mode: Auto

Run from: C:\Program Files\Norton AntiVirus\SAVScan.exe

 

Name: Schedule

Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: seclogon

Description: Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: SENS

Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

 

Name: ShellHWDetection

Description:

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Spooler

Description: Loads files to memory for later printing.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\spoolsv.exe

 

Name: srservice

Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: SSDPSRV

Description: Enables discovery of UPnP devices on your home network.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

 

Name: TapiSrv

Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: TermService

Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.

Startup Mode: Manual

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: Themes

Description: Provides user experience theme management.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: TrkWks

Description: Maintains links between NTFS files within a computer or across computers in a network domain.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

 

Name: uploadmgr

Description: Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: W32Time

Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

 

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: WebClient

Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

 

Name: winmgmt

Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

 

Name: wuauserv

Description: Enables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site.

Startup Mode: Auto

Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

 

Name: WZCSVC

Description: Provides automatic configuration for the 802.11 adapters

Startup Mode: Auto

Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

 

Name: __NS_Service_3

Description:

Startup Mode: Auto

Run from: C:\WINDOWS\winkq32.exe /s

 

 

------------------------------------------------------------------------------------------------

 

HIJACK THIS LOG:

 

Logfile of HijackThis v1.97.7

Scan saved at 7:26:06 PM, on 08/07/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\winkq32.exe

C:\WINDOWS\System32\services\msxmidi.exe

C:\WINDOWS\zHotkey.exe

C:\Program Files\FaxTalk Communicator\FTCtrl32.exe

C:\Program Files\Multimedia Card Reader\shwicon2k.exe

C:\WINDOWS\System32\sstray.exe

C:\WINDOWS\system32\javatj.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\BigFix\BigFix.exe

C:\Program Files\E-Color\Colorific\hgcctl95.exe

C:\Program Files\FaxTalk Communicator\FAPIEXE.EXE

C:\Program Files\E-Color\True Internet Color\TICIcon.exe

C:\WINDOWS\System32\wuauclt.exe

C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe

E:\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://magicsearch.us/browser/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://magicsearch.us/browser/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://magicsearch.us/browser/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://magicsearch.us/browser/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.ask.com/index.asp?origin=7019

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

F1 - win.ini: run=C:\WINDOWS\System32\services\msxmidi.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

O2 - BHO: (no name) - {7E118BD3-544A-455F-07DD-AACFDEAC5940} - C:\WINDOWS\adddd.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [CHotkey] zHotkey.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [javatj.exe] C:\WINDOWS\system32\javatj.exe

O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe

O4 - HKLM\..\RunOnce: [winkq32.exe] C:\WINDOWS\winkq32.exe

O4 - HKLM\..\RunOnce: [winvt.exe] C:\WINDOWS\system32\winvt.exe

O4 - HKLM\..\RunOnce: [d3fl.exe] C:\WINDOWS\system32\d3fl.exe

O4 - HKLM\..\RunOnce: [msai32.exe] C:\WINDOWS\system32\msai32.exe

O4 - HKLM\..\RunOnce: [appmk32.exe] C:\WINDOWS\appmk32.exe

O4 - HKLM\..\RunOnce: [appmh.exe] C:\WINDOWS\appmh.exe

O4 - HKLM\..\RunOnce: [sys117453] C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe delete

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe

O4 - Global Startup: Colorific.lnk = C:\Program Files\E-Color\Colorific\hgcctl95.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Register Online.lnk = C:\Program Files\E-Color\Registration\SonnReg.exe

O4 - Global Startup: True Internet Color® Icon.lnk = C:\Program Files\E-Color\True Internet Color\TICIcon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Real.com (HKLM)

O9 - Extra button: MoneySide (HKLM)

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

O15 - Trusted Zone: *.clickspring.net

O15 - Trusted Zone: *.mt-download.com

O15 - Trusted Zone: *.my-internet.info

O15 - Trusted Zone: *.skoobidoo.com

Share this post


Link to post
Share on other sites

First, Please make a new folder to put your HijackThis.exe into. Anywhere on your hard drive is fine other than your Desktop or the Temp folder. We suggest you use C:\Program Files\HijackThis but feel free to use any name or folder you like. Unzip HijackThis again and save the contents (Hijackthis.exe) to the new folder you made. Then navigate to it and run HijackThis from there. This is to ensure it makes the necessary backups for recovery if needed.

 

1. Download this tool called AboutBuster http://www.downloads.subratam.org/AboutBuster.zip

 

Unzip it to your desktop but don't run it yet.

 

2. You already have Adaware installed. Make sure it's up to date. Just open Adaware and click on *Check for Updates Now* and then *Connect*. It will find a new reference-file. Click *ok* and let it download and install the updates by clicking on *Finish* .This will return you to the main screen. You should now see Reference File # : 01R331 08.07.2004 or higher listed.

 

3. Print out these instructions so you have them handy as most of the steps need to be done in safe mode and you may not be able to go online.

 

4. Make sure your PC is configured to show hidden files

 

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"

Click "Apply" then "OK"

 

5. Next, go to Start->Run and type "Services.msc" (without quotes) then hit Ok

 

Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

 

6. Reboot to Safe Mode

How to start the computer in Safe mode

http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

 

7. Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://magicsearch.us/browser/

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://magicsearch.us/browser/

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\irqwq.dll/sp.html#96676

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://magicsearch.us/browser/

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://magicsearch.us/browser/

 

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.ask.com/index.asp?origin=7019

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

 

F1 - win.ini: run=C:\WINDOWS\System32\services\msxmidi.exe

 

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

 

O2 - BHO: (no name) - {7E118BD3-544A-455F-07DD-AACFDEAC5940} - C:\WINDOWS\adddd.dll

 

O4 - HKLM\..\Run: [javatj.exe] C:\WINDOWS\system32\javatj.exe

 

O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe

 

O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\System32\services\msxmidi.exe

 

O4 - HKLM\..\RunOnce: [winkq32.exe] C:\WINDOWS\winkq32.exe

 

O4 - HKLM\..\RunOnce: [winvt.exe] C:\WINDOWS\system32\winvt.exe

 

O4 - HKLM\..\RunOnce: [d3fl.exe] C:\WINDOWS\system32\d3fl.exe

 

O4 - HKLM\..\RunOnce: [msai32.exe] C:\WINDOWS\system32\msai32.exe

 

O4 - HKLM\..\RunOnce: [appmk32.exe] C:\WINDOWS\appmk32.exe

 

O4 - HKLM\..\RunOnce: [appmh.exe] C:\WINDOWS\appmh.exe

 

O4 - HKLM\..\RunOnce: [sys117453] C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe delete

 

O15 - Trusted Zone: *.clickspring.net

 

O15 - Trusted Zone: *.mt-download.com

 

O15 - Trusted Zone: *.my-internet.info

 

O15 - Trusted Zone: *.skoobidoo.com

 

and delete the following files if present.

 

C:\WINDOWS\system32\irqwq.dll

 

C:\WINDOWS\System32\services\msxmidi.exe

 

C:\WINDOWS\winkq32.exe

 

C:\WINDOWS\System32\sstray.exe

 

C:\WINDOWS\system32\javatj.exe

 

C:\WINDOWS\adddd.dll

 

C:\WINDOWS\system32\javatj.exe

 

C:\WINDOWS\System32\services\msxmidi.exe

 

C:\WINDOWS\System32\services\msxmidi.exe

 

C:\WINDOWS\winkq32.exe

 

C:\WINDOWS\system32\winvt.exe

 

C:\WINDOWS\system32\d3fl.exe

 

C:\WINDOWS\system32\msai32.exe

 

C:\WINDOWS\appmk32.exe

 

C:\WINDOWS\appmh.exe

 

C:\DOCUME~1\NANCYB~1\LOCALS~1\Temp\38c92d68.exe

 

8. Double click AboutBuster.exe that you downloaded earlier. Click OK, click Start, then click OK. This will scan your computer for the bad files and delete them. Save the report(copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

 

9. Scan with Adaware and let it remove any bad files found.

 

10. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

 

Temporary Files

Temporary Internet Files

Recycle Bin

 

11. Reboot to normal mode, scan again with Hijack This and post a new log here.

 

12. Finally, do an online scan at the following site. Let it remove any infected files found.

Trend Micro (PC-cillin) - Free on-line Scan

http://housecall.antivirus.com

 

Post a fresh HijackThis log and the AboutBuster report back here please.

Share this post


Link to post
Share on other sites

Thanks for the advice. the computer seems to work fine now. there were a number of entries that you said to click in hijackthis that weren't there. there were also some that were there that were similar to ones you said to get rid of but weren't identical. i left these because i know that telling hijackthis to get rid of the wrong thing can cause problems. the on-line scan showed some virus files that it said weren't cleanable. i compared these to a clean XP Home install and found that they weren't there in the clean one so i deleted them from the infected computer. they were:

 

C:\RECYCLER\S-1-5-21-87.......-500\Dc1.exe

C:\RECYCLER\S-1-5-21-87.......-500\Dc3.exe

C:\WINDOWS\appjq32.exe

C:\WINDOWS\crad32.exe

C:\WINDOWS\rvkhzi.dat

C:\WINDOWS\trun.exe

C:\WINDOWS\winva32.exe

 

Here's the new hijackthis log and the about buster report:

 

Logfile of HijackThis v1.97.7

Scan saved at 11:54:55 AM, on 10/07/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\zHotkey.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\FaxTalk Communicator\FTCtrl32.exe

C:\Program Files\Multimedia Card Reader\shwicon2k.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\BigFix\BigFix.exe

C:\Program Files\E-Color\Colorific\hgcctl95.exe

C:\Program Files\E-Color\True Internet Color\TICIcon.exe

C:\Program Files\FaxTalk Communicator\FAPIEXE.EXE

C:\Program Files\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wuauclt.exe

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://magicsearch.us/browser/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://magicsearch.us/browser/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.ask.com/index.asp?origin=7019

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [CHotkey] zHotkey.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe

O4 - Global Startup: Colorific.lnk = C:\Program Files\E-Color\Colorific\hgcctl95.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Register Online.lnk = C:\Program Files\E-Color\Registration\SonnReg.exe

O4 - Global Startup: True Internet Color® Icon.lnk = C:\Program Files\E-Color\True Internet Color\TICIcon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: Real.com (HKLM)

O9 - Extra button: MoneySide (HKLM)

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com

 

 

 

-------------------------------- aboutbuster -----------------------------------------------

 

-- Scan 1 --------

About:Buster Version 1.27

Removed! : C:\WINDOWS\adddd.dll

Removed! : C:\WINDOWS\crad32.exe.bak

Removed! : C:\WINDOWS\dsvxwj.dat

Removed! : C:\WINDOWS\fyoxdv.dat

Removed! : C:\WINDOWS\gjhmqb.dat

Removed! : C:\WINDOWS\goswut.dat

Removed! : C:\WINDOWS\jnlave.dat

Removed! : C:\WINDOWS\kqewik.dat

Removed! : C:\WINDOWS\msgt.exe

Removed! : C:\WINDOWS\mudhtz.dat

Removed! : C:\WINDOWS\netfz32.exe

Removed! : C:\WINDOWS\ofvdof.dat

Removed! : C:\WINDOWS\shhvuj.dat

Removed! : C:\WINDOWS\tkzrhp.dat

Removed! : C:\WINDOWS\wauuyb.dat

Removed! : C:\WINDOWS\winkq32.exe

Removed! : C:\WINDOWS\xdfzif.dat

Removed! : C:\WINDOWS\xlnqlh.dat

Removed! : C:\WINDOWS\xzmjcy.dat

Removed! : C:\WINDOWS\System32\gwafs.dat

Removed! : C:\WINDOWS\System32\irqwq.dll

Removed! : C:\WINDOWS\System32\kxjsi.dat

Attempted Clean Of Temp folder.

Removed LEGACY___NS_Service_3 Key

Removed __NS_Service_3 Key

Removed Uninstall Key (HSA)

Removed Uninstall Key (SE)

Removed Uninstall Key (SW)

Pages Reset... Done!

Share this post


Link to post
Share on other sites

Thanks for all the great feedback! Yes, you did right to ONLY delete the files listed and not similar file names (that is because malware often will mimic a valid file name to fool the user).

 

Next, we need to update your HijackThis tool. Open HijackThis.exe and press *config* {bottom right corner} and then press *Misc. Tools* at the top. Next press *check for online update* and you should see version 1.98.0 available. Download that.

 

P.S. If you have any problems getting the update. Simply delete your old version of HijackThis and download the new version from this link.

 

http://www.spywareinfo.com/~merijn/files/HijackThis.exe

..........................................................

Then, please also download this free program that will produce a different type of log I can see.

 

Download FINDnFIX.exe from here (choose *save* not "open with"): http://freeatlast.worldbreak.com/

 

Find the FINDnFIX icon on your desktop and doubleclick and choose *extract*.

 

post-154-1089377821.gif

 

This will place a new folder on your system at: C: FindnFIX which will open for you. Doubleclick on the !LOG!.bat

 

post-154-1089378763.gif

 

IMPORTANT! Before you run this tool please close ALL running programs and ALL open windows except for the FindnFix folder.

 

Relax, sit back and wait a few minutes while the program collects the necessary information.

 

post-154-1089378856.gif

 

*NOTE:If your AntiVirus is running a scriptblocker, when you run this tool, you will probably receive an alert warning you that the script is running. "Allow" the script to run.

 

When the program is finished it will open Notepad and produce a log.txt file. Copy and paste the contents of that log back here in a reply.

 

Also include a new log from a fresh scan of HijackThis with the new version 1.98.0

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0