1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

need help

Discussion in 'Windows - Virus and spyware problems' started by sevy6788, Dec 27, 2006.

Thread Status:
Not open for further replies.
  1. sevy6788

    sevy6788 Member

    Joined:
    Jun 23, 2006
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    my computer keeps messing up and it runs really slow..heres my log file of hijack this

    Logfile of HijackThis v1.99.1
    Scan saved at 1:03:21 PM, on 12/27/06
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
    C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\GWHOTKEY.EXE
    C:\WINDOWS\STARTER.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
    C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
    C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPCLIENT.EXE
    C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMON32.EXE
    C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
    C:\PROGRAM FILES\DROPSPAM\OESRV.EXE
    C:\PROGRAM FILES\AIM\AIM.EXE
    C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\WINAMP\WINAMP.EXE
    C:\HJT\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: TVEngine Helper /fleok=1D8A83A5C2E6107D98AE75760EA83FA5EF80752B94E2DE7E5F7946203BC6 - {4B18DD50-C996-44fc-AC52-0FECFF82ED58} - C:\PROGRAM FILES\SPAMBLOCKERUTILITY\SBTV\SBTVHELPER.DLL (file missing)
    O2 - BHO: Drop Spam Toolbar - {2DEA8791-C2B7-48E1-8992-8E8E6A6FE789} - C:\PROGRAM FILES\DROPSPAM\EWWIE.DLL (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
    O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPClient.exe" -l
    O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPMon32.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
    O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\Run: [oe_drop_spam] C:\Program Files\DropSpam\oesrv.exe
    O4 - HKLM\..\Run: [DropSpam Lifestyle] "C:\Program Files\dslifestyle\dslifestyle.exe"
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKLM\..\RunServices: [ALU Scheduler Service] C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
    O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
    O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
    O4 - Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - Startup: hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm088KOUS
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
    O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
    O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL
    O9 - Extra button: (no name) - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\PROGRAM FILES\DROPSPAM\EWWIE.DLL (file missing)
    O9 - Extra 'Tools' menuitem: Looksitup Toolbar - {B6E649FA-5461-40d7-AB4D-54FC3C8DB767} - C:\PROGRAM FILES\DROPSPAM\EWWIE.DLL (file missing)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
    O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
    O16 - DPF: {18871EA7-1B30-46DE-9283-E96E707492BA} (Playcom_ATL_Object Class) - http://www.netbabyworld.com/media/playcom/Playcom.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: Lottso by pogo - http://game1.pogo.com/applet-6.2.4.32/lottso/lottso-ob-assets.cab
    O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
    O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://home3.ca.com/PestPatrol/uniblue/pestscan/pestscan.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab
    O16 - DPF: {65FDEDF3-8ED9-4F5B-825E-18C2D44191A7} (OneCCCtl Class) - http://d.69.25.47.31.downloads.esta...9.25.47.31_55674&=&req=1152934557810OneCC.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://aolsvc.aol.com/onlinegames/chuzzledeluxe/popcaploader_v7.cab
    O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://aolsvc.aol.com/onlinegames/trydinerdash2/DinerDash2.1.0.0.48.cab
    O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - http://aolsvc.aol.com/onlinegames/trypiratepoppers/PiratePoppers.1.0.0.24.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
    O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/gold/UnSkin/gf.cab
    O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://mrsupergames.aavalue.com/toolbars/msg/msg-toolbar.cab
     
  2. rav009

    rav009 Active member

    Joined:
    Nov 14, 2005
    Messages:
    2,204
    Likes Received:
    0
    Trophy Points:
    66
    Hi,

    * Run HijackThis
    * Click on the Scan button
    * Put a check beside all of the items listed below:

    O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\PROGRAM FILES\VISUAL NETWORKS\VISUAL IP INSIGHT\SBC\IPClient.exe"

    O4 - HKLM\..\Run: [oe_drop_spam] C:\Program Files\DropSpam\oesrv.exe

    O4 - HKLM\..\Run: [DropSpam Lifestyle] "C:\Program Files\dslifestyle\dslifestyle.exe"

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache...tup1.0.0.15.cab


    * Close all open windows and browsers/email, etc...
    * Click on the "Fix Checked" button
    * When completed, close the application.

    You can now do the following:

    =============================
    Step 1
    =============================

    *Go Start > Control Panel.

    *Double-click Internet Options.

    *Under Temporary Internet Files, click the Settings button.

    *Click the View Files button.

    *Press CTRL+A to select all files.

    *Press DEL or click the Delete option at the top of the window.

    *Click the Yes button on the dialog box that appears.

    *After all the files are gone, close the window.

    *Click OK two times.

    *Close Control Panel.

    And.....

    ATF-Cleaner

    Please download ATF Cleaner by Atribune from here. Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.

    =============================
    Step 2
    =============================

    Install Ad-Aware and scan your computer

    http://www.lavasoft.com/software/adaware/

    - Download the Ad-Aware installation file from this link
    - Run the installer and install with default options
    - Start the program, if you are asked if you wish to update the definitions file, then say yes, and go ahead with the update
    - If you are not asked, press Check for updates now and update the definitions file
    - Next, press the Start, choose Perform full system scan, de-select Search for negligible risk entries, and check Search for low-risk threats is selected, then press Next
    - When the scan is complete, press Next and select the Critical Objects tab, right-click inside the window and choose Select All Objects, then select next, and confirm the removal.
    - Close Ad-Aware

    =============================
    Step 3
    =============================

    Install and configure Ewido Anti-Spyware

    http://www.ewido.net/en/download/

    - Download the Ewido anti-spyware setup program from this link
    - Run the program to start installation of Ewido, accept the EULA and the default options
    - Once Ewido has been installed and is running, open the Ewido window and under Your Computer's Security select Update Now, then select Start Update
    - Ewido will now update it's definition files
    - If for any reason Ewido cannot update, download the Full Database from here: http://www.ewido.net/en/download/updates/, execute the update file and this will complete the update
    - Next, under Your Computer's Security select Scan Now, and then choose the Settings tab.
    ----- Under How to act? select Quarantine
    ----- Under How to scan? and Possibly unwanted software make sure all boxes are ticked
    ----- Under Reports select Automatically generate report after every scan and make sure Only if threats are found is unchecked
    ----- Under What to scan? select Scan every file
    - Close Ewido

    =============================
    Step 5
    =============================

    Install Spybot S&D and scan your computer

    http://www.safer-networking.org/en/mirrors/index.html

    - Download the Spybot S&D installation file from this link
    - Run the installer and install with default options
    - Start the program, select Search for Updates
    - A list of updates should appear, right-click the list and select Select All, then click Download Updates near the top
    - Next, click Search & Destroy from the toolbar on the left side, and then click Check for problems from the top
    - When the scan is complete, place a check mark in the box next to all entries marked in red, and press Fix selected problems
    - Close Spybot S&D

    =============================
    Step 6
    =============================

    Now I would like you to run an online scan, from here http://www.trendmicro.com/hc_intro/default.asp.

    1. Once up click on "Scan now. It's Free"
    2. Read the Term & Use and check "Yes, I accept the Terms of Use" and then click on "Launching HouseCall"
    3. Quick Select: "Scan complete computer for Malware, grayware and vulnerabilities" click "Next"
    4. Let Housecall go through ALL three "Steps". It can take upto 30 minutes or more to scan.
    5. Please do not use your computer whilst the scan is in progress.
    6. Once the scan is done select "clean all detected infections automatically"
    7. For detected HTTP cookies, select "Remove all deteccted cookies". And click "Clean Now"
    8. Then a message will come up; click "OK" and let it delete the selected infections.
    9. During the clean up. Note any infected files down into a .txt file in Notepad. Ready to post in your next reply.
    10. When asked to perforn a full scan again click "No". And restart your computer.

    =============================
    Step 7
    =============================

    ComboFix

    1. Download ComboFix by sUB combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    =============================
    Step 8
    =============================

    Open your add/remove programs tab and remove any of the following programs if you find them listed. These are all malware (spyware/adware) entry’s that may appear in the add/remove programs tab so IF you find the entry...uninstall the program.

    180 Search Assistant
    180Solutions
    Active alert
    Ad Service
    AdTools
    AdTools Service
    Alexa toolbar
    BargainBuddy
    Bullseye Networks
    CashBack
    cosmi
    DH
    EasySearchBar
    Elite Sidebar
    Elite Toolbar
    Freeze Clip Art
    GAIN
    Gator
    Hotbar Outlook Tools
    Hotbar Web Tools
    HuntBar
    Internet Optimizer
    ISTbar
    ISTSvc
    MaxiFiles
    Media Access
    Media Gateway
    MySearch
    MyWay Search Bar
    MyWebSearch
    NavExcel Search Toolbar
    NavHelper
    ncase
    Oemji Toolbar
    Open Site
    Preview AdService
    Search Toolbar (HuntBar/WinTools)
    ShopperReports by Hotbar
    Sidefind
    SideSearch
    Slotchbar
    Software Update Manager
    SurfAccuracy
    SurfSideKick
    Upspiral Toolbar
    TurboDownload
    VBouncer
    Viewpoint
    Viewpoint Manager
    Viewpoint Media Player
    WareOut
    WeatherBug
    Web Rebates
    Web Search Toolbar (WinTools)
    Webhancer
    WhenU (any entry)
    WeirdOnTheWeb
    Windows AdService
    Windows AdStatus
    Windows ServeAd
    WinTools
    WinTools Easy Installer
    WSEM Update


    These are Optional removals but we recommend you remove them as well.

    Download Accelerator Plus
    Kazaa
    Kontiki
    Messenger Plus
    NetPumper
    NewDotNet
    P2P Networking
    StarWare
    WildTangent


    =============================
    Step 9
    =============================

    Visit http://windowsupdate.microsoft.com/

    Check for updates & install all updates found.

    Get back to me :)

     
  3. vurbal

    vurbal Administrator Staff Member

    Joined:
    Nov 30, 2002
    Messages:
    2,573
    Likes Received:
    1
    Trophy Points:
    66
Thread Status:
Not open for further replies.

Share This Page