TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Guest_Jim_* on May 31, 2005, 04:37:46 PM

Title: CWS.Hidden.Dll
Post by: Guest_Jim_* on May 31, 2005, 04:37:46 PM

I've found other threads about this little bastard, but I can't seem to get rid of it using the methods recommended. Here's one I tried to follow exactly http://www.thetechguide.com/forum/lofivers...php/t17119.html (http://\"http://www.thetechguide.com/forum/lofiversion/index.php/t17119.html\") but the problem still comes back. I run Windows Me (yeah I'm old-school) so programs like Ewido aren't supported. Basically my case is common, CWS shredder/HiJackThis will get rid of of it, but only for about 30 minutes, and ta-da! It's back /sad.gif\' class=\'bbc_emoticon\' alt=\':(\' />

And here's what my hijckthis log has to say right now (right before i run CWS and scan HJT which will then show up clean for about a half hour):


Logfile of HijackThis v1.99.1
Scan saved at 5:18:52 PM, on 5/19/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall