• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
jimmyjimmy

Internet Explorer Being Attacked?

9 posts in this topic

Hi all. For the record, I have run ad-aware and it has not solved this problem.

 

My internet explorer has for some time now been under siege by an adware program that posts an explorer toolbar at the top of my screen (under the address bar.) MORE recently, it has been attacked by something that adds a thick explorer bar at the BOTTOM of the screen, though this one is clearly a pop-up of some kind because it literally is opened as a new Explorer window and I can just click an x and close it immediately.

 

HOWEVER, more recently, I have had a problem that I son't really understand. When I start explorer, something opens up a blank toolbar under the address bar, and the whole program seems to go screwy for a second. Then, after a few minutes of surfing, it opens ANOTHER blank toolbar underneath that, and the whole thing slows down and locks up. Then I have to close all of my programs and start again.

 

SOMETIMES, if I hit "stop" repeatedly upon opening Explorer, it can be bypassed.

 

Being the oh-so-clever (sarcasm) techie that I am, I looked in my task manager processes section today and discovered TWO instances of IEXPLORE.EXE running. When I try to close them, they just immediately open back up. The same happens if I try to "end process tree."

 

At this point I have no idea what to do aside from throwing my laptop out the window. PLEASE help!

 

For your reference:

I'm running Windows 2000

Yes, my laptop is, by technological standards, ancient. It is an NEC VERSA 5X, about 7 years old, but in perfect working order.

 

Thanks in advance,

Jim

Share this post


Link to post
Share on other sites

Please do this.

Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

 

When the scan is finished, the "Scan" button will change into a "Save Log" button.

Press that, save the log, Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

Share this post


Link to post
Share on other sites

Logfile of HijackThis v1.98.0

Scan saved at 11:04:03 PM, on 7/29/2004

Platform: Windows 2000 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\wanmpsvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\Explorer.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\USBStorage\USBDetector.exe

C:\Program Files\D-Link\Air Utility\AirCFG.exe

C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe

C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

C:\Program Files\mIRC\mirc.exe

c:\progra~1\intern~1\iexplore.exe

c:\progra~1\intern~1\iexplore.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\HIJACK\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbycfcikgqvuuzmqokigu.com/KontJ...KpM9jkxQeU.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://rjovnurfvvkvivwp.com/KontJsx0aM0O6o...14SAp22IlUF.jpg

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

O1 - Hosts: 69.20.16.183 auto.search.msn.com

O1 - Hosts: 69.20.16.183 search.netscape.com

O1 - Hosts: 69.20.16.183 ieautosearch

O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sarvrs.dat

O2 - BHO: (no name) - {BF0A63A7-0DC5-A010-8661-CC1A3ECB7DCF} - C:\PROGRA~1\NAMERE~1\Info Tray.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O3 - Toolbar: Bore Bin Deaf - {A9353082-94B2-3567-E8A6-5B220FB2F847} - C:\PROGRA~1\NAMERE~1\Download bib.dll (file missing)

O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [systemSearch] REGEDIT.EXE -S c:\ie.reg

O4 - HKLM\..\Run: [uSBDetector] C:\USBStorage\USBDetector.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [bsx3] RunDLL32.EXE C:\WINNT\bs3.dll,DllRun

O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINNT\bsx5.dll,DllRun

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINNT\System32\bridge.dll",Load

O4 - HKLM\..\Run: [sysUpd] C:\WINNT\sysupd.exe

O4 - HKLM\..\Run: [Encboob] C:\PROGRA~1\blueanti\Rdrcool.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe

O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [srvras] C:\WINNT\java\classes\srvras.exe

O4 - HKLM\..\Run: [4holdmeetthe] C:\Documents and Settings\All Users\Application Data\CAMPLINK4HOLD\mail copy.exe

O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll

O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll

O16 - DPF: {01118D00-3E00-11D2-8470-0060089874ED} - http://support.fastaccess.com/sdccommon/download/tgctlpw.cab

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} - http://streamp.babenet.com/cabs/videox.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...ol_v1-0-3-9.cab

O16 - DPF: {5C7F15E1-F31A-44FD-AA1A-2EC63AAFFD3A} - http://www.atelys.com/src/Speedup.ocx

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

Share this post


Link to post
Share on other sites

Hi there.

 

First, place a checkmark next to the following entries in HijackThis and press the "Fix Checked" button (make sure ALL other windows are closed):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pbycfcikgqvuuzmqokigu.com/KontJ...KpM9jkxQeU.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://rjovnurfvvkvivwp.com/KontJsx0aM0O6o...14SAp22IlUF.jpg

O1 - Hosts: 69.20.16.183 auto.search.msn.com

O1 - Hosts: 69.20.16.183 search.netscape.com

O1 - Hosts: 69.20.16.183 ieautosearch

O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sarvrs.dat

O2 - BHO: (no name) - {BF0A63A7-0DC5-A010-8661-CC1A3ECB7DCF} - C:\PROGRA~1\NAMERE~1\Info Tray.exe

O3 - Toolbar: Bore Bin Deaf - {A9353082-94B2-3567-E8A6-5B220FB2F847} - C:\PROGRA~1\NAMERE~1\Download bib.dll (file missing)

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINNT\System32\bridge.dll",Load

O4 - HKLM\..\Run: [sysUpd] C:\WINNT\sysupd.exe

O4 - HKLM\..\Run: [Encboob] C:\PROGRA~1\blueanti\Rdrcool.exe

O4 - HKLM\..\Run: [srvras] C:\WINNT\java\classes\srvras.exe

O4 - HKLM\..\Run: [4holdmeetthe] C:\Documents and Settings\All Users\Application Data\CAMPLINK4HOLD\mail copy.exe

O16 - DPF: {01118D00-3E00-11D2-8470-0060089874ED} - http://support.fastaccess.com/sdccommon/download/tgctlpw.cab

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} - http://streamp.babenet.com/cabs/videox.cab

 

Next, reboot you computer and delete the following files:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sarvrs.dat

C:\PROGRAM FILES\NAMERE~1\ <-folder

C:\WINNT\System32\bridge.dll

C:\WINNT\java\classes\srvras.exe

C:\Documents and Settings\All Users\Application Data\CAMPLINK4HOLD\ <-folder

 

And, finally, reboot again and post a new HijackThis log.

 

Thanks

Share this post


Link to post
Share on other sites

Here is the new log. Also, the following windows appear upon startup - there used to be three but now there's only two:

 

RUNDLL:

Error Loading C:/WINNT/bsx5.dll

 

RUNDLL:

Error loading C:/WINNT/bs3.dll

 

 

LOG:

 

Logfile of HijackThis v1.98.0

Scan saved at 11:44:14 PM, on 7/29/2004

Platform: Windows 2000 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\wanmpsvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\Explorer.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\USBStorage\USBDetector.exe

C:\Program Files\D-Link\Air Utility\AirCFG.exe

C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe

C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

C:\HIJACK\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchxl.com/ie/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.htm...p://about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchxl.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchxl.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [systemSearch] REGEDIT.EXE -S c:\ie.reg

O4 - HKLM\..\Run: [uSBDetector] C:\USBStorage\USBDetector.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [bsx3] RunDLL32.EXE C:\WINNT\bs3.dll,DllRun

O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINNT\bsx5.dll,DllRun

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe

O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

O4 - Startup: MemTurbo.lnk = C:\Program Files\Silicon Prairie Software\MemTurbo\memturbo.exe

O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll

O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll

O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305...meInstaller.exe

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP...ol_v1-0-3-9.cab

O16 - DPF: {5C7F15E1-F31A-44FD-AA1A-2EC63AAFFD3A} - http://www.atelys.com/src/Speedup.ocx

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

Share this post


Link to post
Share on other sites

Again, place a checkmark next to these entries:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchxl.com/ie/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.htm...p://about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchxl.com/ie/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchxl.com/ie/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchxl.com/ie/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchxl.com/ie/

O4 - HKLM\..\Run: [systemSearch] REGEDIT.EXE -S c:\ie.reg

O4 - HKLM\..\Run: [bsx3] RunDLL32.EXE C:\WINNT\bs3.dll,DllRun

O4 - HKLM\..\Run: [bxsx5] RunDLL32.EXE C:\WINNT\bsx5.dll,DllRun

 

Reboot.

 

And delete the following files/folders:

C:\WINNT\bsx5.dll

C:\WINNT\bs3.dll

c:\ie.reg

 

Post one final log...hopefully your problems will be gone by then.

Share this post


Link to post
Share on other sites

Sorry to butt in Gwyrox732,

 

Please also download and run CWShredder before posting back... After you open it, choose to FIX and note what it says it has fixed, include that info when you post back....

Share this post


Link to post
Share on other sites

No problem, Budfred. I realized it was a cws domain, but I figure that one of those run entries would clear it up without the need to download any other programs.

 

Though, I suppose, it couldn't hurt.

Share this post


Link to post
Share on other sites

CWShredder usually does a more thorough job of ferreting out the garbage than doing it manually....

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0