• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
ByT3z

some CWS that just wont go away :(

8 posts in this topic

I can remove this brower hijack with Hijack this or CWS shredder, but when i reboot ( a few times) it just comes back

 

i'm assuming that there's another file on my pc that creates all these .dll files

 

in this case, its lgcab.dll

it's been all sorts of dll files in the past that i've removed (cccg.dll, cijhh.dll, ...)

 

 

here's the log

 

Logfile of HijackThis v1.97.7

Scan saved at 20:18:04, on 9/06/2004

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\System32\devldr32.exe

D:\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\lgcab.dll/sp.html (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {9862A1F8-3980-4364-9474-FB49487845BB} - C:\WINDOWS\System32\lgcab.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [mswspl] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Sha...t//DexiaIIA.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

Share this post


Link to post
Share on other sites

I have been experiencing the same problem, and I may have a temporary solution. Try opening regedit (Start > Run > regedit) or any other registry editor. Do a search for the name of that DLL file, and you should find it somewhere around HKEY_LOCAL_MACHINE. Right click it, select "Modify," and simply change the location, to a DLL that doesn't exist.

 

If you do not delete the DLL, it shouldn't regenerate another one, and you shouldn't experience the problems by that simple registry edit. I'm not sure if it will work for you, but so far I haven't been getting any problems from it, although this is probably better left to the much more experienced helpers ;)

Share this post


Link to post
Share on other sites

hey, that is a good (temporary) solution !

 

too bad it'll keep popping up on every spyware scan i do :|

Share this post


Link to post
Share on other sites

fixed it, just run the command "regsvr32 /u xxxx.dll" to unregister that damn dll that keeps CWS coming back

 

thx to mirry :p

Share this post


Link to post
Share on other sites
Sign in to follow this  
Followers 0