• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
srob

Browser under attack

11 posts in this topic

I have Browser Hyjack Blaster running at the startup - Netsearchsoft tries to take over my browser - Blaster stops this and reassigns the original home page. A while later the Blaster pop up warns of another attack - this time there is no web address listed. When I click on restore my original Blaster tries and the same pop up warning box reappears. After a few tries IE closes and will not re-open. I have to re start and the whole sequence starts again. My Norman virus control also hangs when scanning my files. It hangs at the same files and just continues in a loop.

Can anyone help me - this the log before Blaster reassigns my home page.

 

There also a numer of files in a temp folder that I cannot delete - If I try I get a file sharing violation and IE shuts down - files are DFAC96.tmp , pch4.exe and

sta36.exe

 

Logfile of HijackThis v1.97.7

Scan saved at 19:25:48, on 04/06/2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SFS Services AG

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,pcssfrrx.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {EDA9EEAD-D9F4-51EE-7787-7F0E2AED0B6E} - C:\PROGRA~1\WARNBE~1\extra16.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe

O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9

O4 - HKLM\..\Run: [Promon.exe] Promon.exe

O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe

O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9

O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

O4 - Startup: bhblaster.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O4 - Startup: Shortcut to SUITEST.EXE.lnk = C:\Program Files\lotus\smartctr\SUITEST.EXE

O4 - Global Startup: ACT! Speed Loader.lnk = C:\Program Files\Symantec\ACT\ACTLDR.EXE

O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: SideACT!.lnk = C:\Program Files\Symantec\ACT\SideACT.exe

O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: RealGuide (HKLM)

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab

Edited by srob

Share this post


Link to post
Share on other sites

Hi,

You are missing the "Running Processes" section of your log ...

 

But let's try this anyway ...

 

First thing to do is ...

 

Reconfigure Windows Explorer to show Hidden Files:

Open the Windows Explorer Folder Options - View [tab]:

 

Scroll down to the "Files and Folders" section.

Select: "Display the contents of system folders".

 

Scroll down to the "Hidden Files and Folders" section.

Select: "Show hidden files and folders", Ok the prompt

Uncheck: "Hide file extensions for known file types"

Uncheck: "Hide protected operating system files" Ok the Prompt, click Apply

 

Click the "Apply to all Folders" button. Close Windows Explorer.

(the above is for XP, but you get the idea ...)

 

Next:

 

Close all open windows, except for HijackThis place a check in each of the following:

Then click "Fix checked".

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

O2 - BHO: (no name) - {EDA9EEAD-D9F4-51EE-7787-7F0E2AED0B6E} - C:\PROGRA~1\WARNBE~1\extra16.dll

O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

 

Then reboot, on restart, restart in Safe Mode (see "How To" below)

 

Open Windows Explorer locate and delete the following:

 

C:\PROGRAM FILES\WARNBE~1 <--this folder

To locate: search on > extra16.dll

c:\winnt\tour.reg <--this file

C:\PROGRAM FILES\ONLINE~1 <--this folder

To locate: search on > memo frag.exe

 

Start | Run (type) "%temp%" (no quotes)

Completely delete the entire contents of that "temp" folder.

 

Restart normally and then post a fresh (complete) log ...

Share this post


Link to post
Share on other sites

Hello

I have been of holiday - I have pasted in my latest log - It is slightly different to the last one, so perhaps you will want to look at this before I do anything else. Your help is really appreciated. Thanks srob

 

Logfile of HijackThis v1.97.7

Scan saved at 11:56:14, on 14/06/2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\ibmpmsvc.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\System32\drivers\trcboot.exe

C:\Program Files\Personal Communications\PCS_AGNT.EXE

C:\WINNT\System32\drivers\ldlcserv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\NORMAN\nvc\bin\zanda.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\WFXSVC.EXE

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Program Files\WinFax\WFXMOD32.EXE

C:\WINNT\System32\wm.exe

C:\WINNT\system32\svchost.exe

C:\NORMAN\Nvc\BIN\NVCSCHED.EXE

C:\NORMAN\Nvc\BIN\nvcoas.exe

C:\NORMAN\Nvc\BIN\NJEEVES.EXE

C:\WINNT\system32\pcssfrrx.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\tp4serv.exe

C:\WINNT\system32\ltcm000c.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\WINNT\system32\ltmsg.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

C:\WINNT\system32\RunDll32.exe

C:\WINNT\System32\dpmw32.exe

C:\WINNT\system32\NWTRAY.EXE

C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

C:\WINNT\system32\wfxsnt40.exe

C:\NORMAN\Nvc\BIN\ZLH.EXE

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\ONLINE~1\memo frag.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\NORMAN\Nvc\BIN\cclaw.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\NORMAN\Nvc\BIN\NYMSE.EXE

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Symantec\ACT\ACTLDR.EXE

C:\PROGRA~1\COMMON~1\Nokia\Services\SERVIC~1.EXE

C:\CFGSAFE\AUTOCHK.EXE

C:\Program Files\Symantec\ACT\SideACT.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Documents and Settings\srob\Start Menu\Programs\Startup\bhblaster.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

C:\Palm\HOTSYNC.EXE

C:\Program Files\lotus\smartctr\SUITEST.EXE

C:\AROBIN\HyjackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SFS Services AG

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,pcssfrrx.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe

O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9

O4 - HKLM\..\Run: [Promon.exe] Promon.exe

O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe

O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9

O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

O4 - Startup: bhblaster.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O4 - Startup: Shortcut to SUITEST.EXE.lnk = C:\Program Files\lotus\smartctr\SUITEST.EXE

O4 - Global Startup: ACT! Speed Loader.lnk = C:\Program Files\Symantec\ACT\ACTLDR.EXE

O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: SideACT!.lnk = C:\Program Files\Symantec\ACT\SideACT.exe

O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: RealGuide (HKLM)

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab

Share this post


Link to post
Share on other sites

Hi,

Close all open windows, except for HijackThis place a check in each of the following:

Then click "Fix checked".

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

 

Then reboot, on restart, restart in Safe Mode (see "How To" below)

 

Start | Run (type) "%temp%" (no quotes)

Completely delete the entire contents of that "temp" folder.

 

Open Windows Explorer locate and delete the following:

 

C:\PROGRA~1\ONLINE~1\memo frag.exe <--this file

Note: locate via Start > Search

c:\winnt\tour.reg <--this file

 

Restart normally, update SpyBot, rescan, reboot and post a fresh log.

 

Note: Can you tell me what these actually are?

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

Share this post


Link to post
Share on other sites

Thanks

 

Not able to delete memo frag.exe in safe mode - file violation ?

 

deleted all other files as suggested.

 

Spybot detectec only 1 file - DSO Exploit - this one keeps returning

 

Sorry I have no idea what these two files are

 

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

 

 

New log listed below

 

Logfile of HijackThis v1.97.7

Scan saved at 14:12:59, on 14/06/2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\ibmpmsvc.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\System32\drivers\trcboot.exe

C:\Program Files\Personal Communications\PCS_AGNT.EXE

C:\WINNT\System32\drivers\ldlcserv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\NORMAN\nvc\bin\zanda.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\WFXSVC.EXE

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Program Files\WinFax\WFXMOD32.EXE

C:\WINNT\System32\wm.exe

C:\WINNT\system32\svchost.exe

C:\NORMAN\Nvc\BIN\NJEEVES.EXE

C:\NORMAN\Nvc\BIN\NVCSCHED.EXE

C:\NORMAN\Nvc\BIN\nvcoas.exe

C:\WINNT\system32\pcssfrrx.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\tp4serv.exe

C:\WINNT\system32\ltcm000c.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\WINNT\system32\ltmsg.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

C:\WINNT\system32\RunDll32.exe

C:\WINNT\System32\dpmw32.exe

C:\WINNT\system32\NWTRAY.EXE

C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

C:\WINNT\system32\wfxsnt40.exe

C:\NORMAN\Nvc\BIN\ZLH.EXE

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\NORMAN\Nvc\BIN\cclaw.exe

C:\NORMAN\Nvc\BIN\NYMSE.EXE

C:\PROGRA~1\ONLINE~1\memo frag.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Symantec\ACT\ACTLDR.EXE

C:\PROGRA~1\COMMON~1\Nokia\Services\SERVIC~1.EXE

C:\CFGSAFE\AUTOCHK.EXE

C:\Program Files\Symantec\ACT\SideACT.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Documents and Settings\srob\Start Menu\Programs\Startup\bhblaster.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

C:\Palm\HOTSYNC.EXE

C:\Program Files\lotus\smartctr\SUITEST.EXE

C:\AROBIN\HyjackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SFS Services AG

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,pcssfrrx.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe

O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9

O4 - HKLM\..\Run: [Promon.exe] Promon.exe

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe

O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9

O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

O4 - Startup: bhblaster.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O4 - Startup: Shortcut to SUITEST.EXE.lnk = C:\Program Files\lotus\smartctr\SUITEST.EXE

O4 - Global Startup: ACT! Speed Loader.lnk = C:\Program Files\Symantec\ACT\ACTLDR.EXE

O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: SideACT!.lnk = C:\Program Files\Symantec\ACT\SideACT.exe

O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: RealGuide (HKLM)

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab

Share this post


Link to post
Share on other sites

Hi,

Download: Process Viewer [freeware] WinNT/2K/XP/ME/95/98

http://www.xmlsp.com/pview/prcview.htm

Unzip, but don't run it yet ...

 

Close all open windows, except for HijackThis place a check in each of the following:

Then click "Fix checked".

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://netsearchsoft.com/passthrough/index...w.google.co.uk/

O4 - HKLM\..\Run: [Clock Htm] C:\PROGRA~1\ONLINE~1\memo frag.exe

O4 - HKCU\..\Run: [1] Ô

O4 - HKCU\..\Run: [2] Ô

 

Open "Process Viewer", highlight "memo frag.exe"

Right-click and select: Kill

Then delete the file.

 

If you still can not delete, repeat the above from Safe Mode.

 

[Alternate Method]

Download: KillBox

http://www.downloads.subratam.org/KillBox.zip

Unzip and run (double-click) killbox.exe

 

In the "Paste Full Path of File to Delete" box, copy and paste this entry:

 

C:\Program Files\Online Services\memo frag.exe

 

Note: assuming that "C:\PROGRA~1\ONLINE~1" = "C:\Program Files\Online Services"

Edit as needed if not ...

 

Next: click on the "Action" menu (up top)and select: "Delete on Reboot".

In the window that opens up, click on the File menu and select: "Add File".

The "C:\Program Files\Online Services\memo frag.exe" listing should show up in the window.

 

In the same window choose the "Action" menu and select "Process and Reboot".

You'll be prompted to reboot, do so.

Share this post


Link to post
Share on other sites

Thanks Mike

 

Process Viewer killed off the memo frag.exe file

Netsearch tool bar has also been killed off

 

All is back to normal - log pasted below

 

Brilliant job - A++++++++

 

Many thanks

 

srob

 

Logfile of HijackThis v1.97.7

Scan saved at 16:29:57, on 14/06/2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\ibmpmsvc.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\System32\drivers\trcboot.exe

C:\Program Files\Personal Communications\PCS_AGNT.EXE

C:\WINNT\System32\drivers\ldlcserv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\NORMAN\nvc\bin\zanda.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\WFXSVC.EXE

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Program Files\WinFax\WFXMOD32.EXE

C:\WINNT\System32\wm.exe

C:\WINNT\system32\svchost.exe

C:\NORMAN\Nvc\BIN\NVCSCHED.EXE

C:\NORMAN\Nvc\BIN\nvcoas.exe

C:\NORMAN\Nvc\BIN\NJEEVES.EXE

C:\WINNT\system32\pcssfrrx.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\tp4serv.exe

C:\WINNT\system32\ltcm000c.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\WINNT\system32\ltmsg.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

C:\WINNT\system32\RunDll32.exe

C:\WINNT\System32\dpmw32.exe

C:\WINNT\system32\NWTRAY.EXE

C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

C:\WINNT\system32\wfxsnt40.exe

C:\NORMAN\Nvc\BIN\ZLH.EXE

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\NORMAN\Nvc\BIN\cclaw.exe

C:\NORMAN\Nvc\BIN\NYMSE.EXE

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Symantec\ACT\ACTLDR.EXE

C:\PROGRA~1\COMMON~1\Nokia\Services\SERVIC~1.EXE

C:\CFGSAFE\AUTOCHK.EXE

C:\Program Files\Symantec\ACT\SideACT.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Documents and Settings\srob\Start Menu\Programs\Startup\bhblaster.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

C:\Palm\HOTSYNC.EXE

C:\Program Files\lotus\smartctr\SUITEST.EXE

C:\AROBIN\HyjackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = SFS Services AG

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,pcssfrrx.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe

O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9

O4 - HKLM\..\Run: [Promon.exe] Promon.exe

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe

O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9

O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY.EXE

O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - Startup: bhblaster.exe

O4 - Startup: Hewlett-Packard Recorder.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\FRU\Remind32.exe

O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE

O4 - Startup: Shortcut to SUITEST.EXE.lnk = C:\Program Files\lotus\smartctr\SUITEST.EXE

O4 - Global Startup: ACT! Speed Loader.lnk = C:\Program Files\Symantec\ACT\ACTLDR.EXE

O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: SideACT!.lnk = C:\Program Files\Symantec\ACT\SideACT.exe

O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: RealGuide (HKLM)

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab

Share this post


Link to post
Share on other sites

Glad we could help!

 

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0