Jump to content


Photo

Another res:// problem


  • Please log in to reply
3 replies to this topic

#1 tenderometer

tenderometer

    Member

  • New Member
  • Pip
  • 3 posts

Posted 29 July 2004 - 01:18 AM

I have been looking at a multiple of posts on the internet to try and sort this out but to no avail. Tried every spyware program spybot, adaware, cwshredder, hsremover and spywareblaster.

Can you help me? If you need any more info please ask.

Logfile of HijackThis v1.98.0
Scan saved at 22:25:56, on 28/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Documents and Settings\Andy Chase.HOME\Desktop\sPYWARE\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = NOT USED (OK)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ANDYCH~1.HOM\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ANDYCH~1.HOM\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [zSPGuard] c:\program files\pjw\spguard\spguard.exe /s /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - {5C5574E8-7557-4C0C-ABD4-FB32857D32F9} - C:\WINDOWS\System32\klebf.dll
O18 - Filter: text/plain - {5C5574E8-7557-4C0C-ABD4-FB32857D32F9} - C:\WINDOWS\System32\klebf.dll

#2 garry

garry

    Member

  • New Member
  • Pip
  • 3 posts

Posted 29 July 2004 - 06:45 AM

What about about:buster & in safe mode with the spyware removers having the latest updates?

#3 tenderometer

tenderometer

    Member

  • New Member
  • Pip
  • 3 posts

Posted 29 July 2004 - 07:01 AM

Yeah tried that after i found out how to get my computer in safe mode. Trouble is it keeps coming back.

Tried
HSremove
start page guard
hijackthis obviously
winpatrol
dsostop
bsbclean
aboutbuster
adaware
spybot

All with updates and even tried them in safe mode. It's gettin serious now.

#4 tenderometer

tenderometer

    Member

  • New Member
  • Pip
  • 3 posts

Posted 29 July 2004 - 09:41 AM

I tried re-installing windows last night, this did help and allowed me to get back on the internet as the virus/spyware had completely stopped internet access. Spybot and startpage thingy still both keep saying that the start page keeps being changed. Originally when i got this bug it stopped my anti-virus software script blocker and also spybots resident ie blocker, but since re-installing xp i have manged to regain both these options.

I have religiously kept everything up to date like everyone always says but it's worrying this is attacking so many people. Maybe trojans and the like aren't the real threat anymore but it's these malicious spyware attacks!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button