Jump to content


Photo

http://213.159.117.132/redir.php


  • Please log in to reply
14 replies to this topic

#1 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 06:43 AM

Hi.

Got a real problem here. Havent seen any other topics here that had http://213.159.117.132/redir.php as a problem. I cant change the startpage.

Ive tried Hijackthis and found "http://213.159.117.132/redir.php" in a couple of lines and deleted them but they keep on coming back!!
I also tried CWShredder and it didt found anything. Of course i have tried spybot and ad aware.

can anyone se whats wrong with my log file?

My log file:

Logfile of HijackThis v1.97.7
Scan saved at 13:43:27, on 28.05.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\sstray.exe
C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~2\NORTON~1\navapw32.exe
C:\Programfiler\Microsoft IntelliPoint\point32.exe
C:\Programfiler\Java\j2re1.4.2_01\bin\jusched.exe
C:\Programfiler\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programfiler\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Documents and Settings\Terje.THETERJE\Skrivebord\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENONO/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/redir.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/redir.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/redir.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/redir.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/redir.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/redir.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
F0 - system.ini: Shell=
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~2\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programfiler\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programfiler\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpit.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download with GetRight - C:\Programfiler\GetRight\GRdownload.htm
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Programfiler\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programfiler\GetRight\GRbrowse.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com...ex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-downlo...tsInstaller.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivi...n/ravonline.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

#2 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 09:04 AM

anyone? please?

#3 mnm

mnm

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 28 May 2004 - 09:34 AM

I have this as well, and have had no luck removing it. I have posted my log into a similar named topic so that someone may be able to find something common to solve this.

#4 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 09:58 AM

thanks...lets hope somone will help us!

#5 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 10:51 AM

anyone see anything that i should delete from this log?

#6 mnm

mnm

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 28 May 2004 - 10:56 AM

I found something that may help here: http://www.computerc...postt44951.html

I haven't deleted C:\WINNT\system32\system32.dll yet, but suspected it from other hijack variants. I'm going to give it a go and see what happens.

#7 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 11:00 AM

yeah i read that too... but it didnt make sense... try it...hopes it works...

#8 mnm

mnm

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 28 May 2004 - 11:10 AM

Well I deleted C:\WINNT\system32\system32.dll (after renaming it and rebooting), and everything seems to be good. No more changing start pages etc. (it would happen pretty quick before, as soon as I opened IE).

Woo Hoo!

#9 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 11:13 AM

hmm i wonder if this works with windows XP

#10 shadowwar

shadowwar

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 1,361 posts

Posted 28 May 2004 - 11:16 AM

Yes it will. that file is now responsible for about 5 different hijackts.

go to this post..
http://forums.tomcoy...?showtopic=8380

Follow my instructions about halfway down about the regmerge and deleting file.
Than fix the r0 r1 infected entries with hijackthis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/redir.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/redir.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/redir.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/redir.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/redir.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/redir.php

Edited by shadowwar, 28 May 2004 - 11:16 AM.




#11 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 11:22 AM

hi! ive startet windows in safe mode and got rid of the system32.dll file! And it worked!!! Is it permantly gone now?

#12 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 11:25 AM

hmm can i use that "clear.reg" after i deleted system32 file?

#13 shadowwar

shadowwar

    Forum Deity

  • Global Moderator
  • PipPipPipPipPip
  • 1,361 posts

Posted 28 May 2004 - 11:26 AM

yes. That will remove the registry entries that you left behind.



#14 terkje

terkje

    Member

  • Full Member
  • Pip
  • 9 posts

Posted 28 May 2004 - 11:27 AM

VICTOOOORYYYYYYYYYY!!!!!!!!!! Thanx u so much! Thanks for beeing a testbunny mnm!!!

#15 mnm

mnm

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 28 May 2004 - 11:37 AM

Your welcome, I'm glad to be rid of it as well. Thanks to Shadowwar for the registry clean.

Edited by mnm, 28 May 2004 - 11:44 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button