« previous next »
Pages: 1 [2] 3

Author Topic: highjack this log  (Read 3098 times)

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #20 on: January 29, 2006, 02:26:04 AM »
I have installed ad-aware SE personal, updated it and scanned the computer with it, removing the criticle objects.
here is anouther fresh highjackthis log

Logfile of HijackThis v1.99.1
Scan saved at 2:18:36 AM, on 1/4/80
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

here is also anouther highjackthis uninstall list as well

Logfile of HijackThis v1.99.1
Scan saved at 2:18:36 AM, on 1/4/80
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #21 on: January 29, 2006, 11:53:35 AM »
Sorry for the delay
Nice to see you got this computer back online

Do a "System scan only" with Hijackthis and put a check next to these entries:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing


After you have ticked the above entry, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Reboot the computer

Back in Windows
One part of your log reads this
Scan saved at 2:18:36 AM, on 1/4/80
The date is always the same
Are you able to set the clock on this computer to the right date and time?
I would still run Spybot 1.4

In addition
Use Internet Explorer and Run the online Panda ActiveScan
    * Once you are on the Panda site click the Scan your PC button.
    * A new window will open...click the big Check Now button.
    * Enter your Country.
    * Enter your State/Province.
    * Enter your e-mail address.
    * Select either "Home User or Company."
    * Click the big Scan Now button.
    * Allow the ActiveX component to install and download the files required for the scan. This may take a couple of minutes.
    * Click on Local Disks to start the scan.

When the scan is complete
 click See Report, then click Save Report and save it to your Desktop.

Post back this report along with a fresh hijackthis log
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #22 on: February 07, 2006, 07:20:42 PM »
please help
sorry it has taken me so long to respond to your last post
my computer will no longer let me view webpages again. all i
did was restart the computer and since then i havnt been able to
veiw internet pages the modem is working again for now.
i get the message the web page could not be displayed
dns error or cannot find server

i was not able to do a panda scan on my computer because the computer stopped working
again.

thanks for all your help
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #23 on: February 08, 2006, 10:04:10 AM »
I'm on my way to work
But I do notice you have ICS enabled on the computer
Are you sharing a connection or is this comp. on it's own dedicated line
Maybe this setting was enabled from the school?
Geesh, I'm not much help with dialup

But take a look at this link please
http://www.dewassoc.com/support/networking/ics_4.htm

an updated hijackthis log would be nice to see
I wish you would of ran that scan at Panda's
or we should get an AV on this system
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #24 on: February 08, 2006, 12:45:10 PM »
the computers were networked for the school when i brought
the computer home i got the internet working im not sure if i disabled the internet connection sharing before or after it stopped working. so here is what im going to do:
im going to setup the internet connection sharing again by following the instructions
if that works then ill let you know and post a fresh high jack this log. if it doesnt work ill let you know to and post a high jack this log
if it does work i will immediatly do a panda scan
thanks
Jen
Logged

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #25 on: February 08, 2006, 03:25:47 PM »
ok so that didnt work
what do i do now?
im so sick of computers
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #26 on: February 08, 2006, 10:10:51 PM »
So does this mean your not going to show me an updated hijackthis log?

Also, do you need ICS enabled or can you uninstall it if you have a dedicated line for it
You are on dialup aren't you?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #27 on: February 09, 2006, 12:05:54 AM »
when i try to close the dial up connection box a error comes up saying

The ATRT data you are trying to
access resides on a network
drive. Please make sure that the
drive containing ATRT data is
mapped to the drive 'H'. The mapped
drive letter can be changed if
necessary. Please refer to the
Site/Network Supplement or
contact your network administrator.

here is the high jack this log you wanted:

Logfile of HijackThis v1.99.1
Scan saved at 11:43:33 PM, on 2/8/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\AQFHSN.EXE
C:\WINDOWS\SYSTEM\JSCVMD.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [D0u9] C:\DSKPDR.EXE
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\AQFHSN.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\JSCVMD.exe
O4 - HKLM\..\Run: [f3087ngt] C:\WINDOWS\SYSTEM\f3087ngt.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [msxct] msxct.exe
O4 - HKLM\..\Run: [IST Service] \ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\PROGRAM FILES\NORTON ANTIVIRUS\POProxy.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKCU\..\Run: [QKOR] C:\PROGRAM FILES\COMMON FILES\QKOR\QKORM.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #28 on: February 09, 2006, 12:07:16 AM »
How did you allow yourself to get infected again
Run updated scans with Ad-Aware and Spybot
Reboot the computer in between

Can you do the following once again
Open Hijackthis>>Open Misc tools section>>Open Uninstall List
Click the SAVE list button
Post this list back here please

Why does your log make it appear you did run a scan at Panda's

What's going on Jen3ca?
Do you have a report from Panda's
You have entries in your hijackthis log show that possibly the infections hijack your connection
This is probably the reason for your loss of Internet
« Last Edit: February 09, 2006, 12:31:59 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #29 on: February 09, 2006, 01:39:00 AM »
i started a scan on the panda website then i  had to go work so  cancelled the scan and turned the computer thinking id be able to get back online again. when i got back i couldnt get back online so i attempted to get a scan log from panda but was unsuccesful

my computer now has a boot sequence error and it wont go to windows

i dont know how i got infected again
this computer is driving me crazzy

i started a scan on the panda website then i  had to go work so  cancelled the scan and turned the computer thinking id be able to get back online again. when i got back i couldnt get back online so i attempted to get a scan log from panda but was unsuccesful

my computer now has a boot sequence error and it wont go to windows

i dont know how i got infected again
this computer is driving me crazzy

i cannot update any of the programs because it says it cannot connect to (or find) the server
Logged

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #30 on: February 09, 2006, 07:29:24 PM »
hey
good news, there is no more boot sequence error i have no idea how i fixed it but my computer will turn on now and go into windows
i still need your help with the rest of the computer
what should i do next?
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #31 on: February 09, 2006, 08:43:20 PM »
Open Hijackthis>>Open Misc tools section>>Open Uninstall List
Click the SAVE list button
Post this list back here please
Are you connected to the Internet now?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #32 on: February 09, 2006, 11:08:12 PM »
i can connect to the internet but i still cant veiw the webpages
here is the uninstall list you wanted

Ad-Aware SE Personal
Adobe Acrobat 5.0
ArcSoft PhotoStudio 2000
Caere Scan Manager 5.1
Canon CanoCraft CS-P 3.8
Canon ScanGear Toolbox CS 2.2
CCleaner (remove only)
Conexant HCF V.90/56K Modem
Corel WordPerfect Suite 8
HijackThis 1.99.1
Internet Explorer Q891781
Kurzweil 3000 v.6
LiveAdvisor (Symantec Corporation)
LiveUpdate
Macromedia Flash Player 8
Microsoft Data Access Components KB870669
Microsoft Internet Explorer 6 SP1 and Internet Tools
Microsoft Outlook Express 6
Microsoft VGX Q833989
Mozilla Firefox (1.5)
Norton AntiVirus 2000
Outlook Express Q837009
Panda ActiveScan
Select CashBack
Spybot - Search & Destroy 1.4
Win-dh
Windows 98 Q823559 Update
Windows 98 Q840315 Update
Windows 98 Q890175 Update
Windows Messaging Update 1
WinZip
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #33 on: February 09, 2006, 11:53:01 PM »
Going by your last Hijackthis log
Can you download and save the removal tool from Symantec's
FixBargainBuddy.exe
It's a small download, if you don't have internet connection
It's small enough to fit on a floppy
Transfer it too the computer with no connection, don't run it from the floppy

Run FixBargainbuddy.exe, let it finish it's scan
Reboot the computer

Back in Windows
Can you do the following please
Open Hijackthis>>Open Misc tools section>>Open Process manager
Highlight and kill these processes if running
C:\WINDOWS\SYSTEM\AQFHSN.EXE
C:\WINDOWS\SYSTEM\JSCVMD.EXE

Afterwards, click BACK under 'Other Stuff'

Do a "SCAN" with Hijackthis and put a check next to these entries:

O4 - HKLM\..\Run: [D0u9] C:\DSKPDR.EXE
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\SYSTEM\AQFHSN.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\SYSTEM\JSCVMD.exe
O4 - HKLM\..\Run: [f3087ngt] C:\WINDOWS\SYSTEM\f3087ngt.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [msxct] msxct.exe
O4 - HKLM\..\Run: [IST Service] \ISTsvc\istsvc.exe
O4 - HKCU\..\Run: [QKOR] C:\PROGRAM FILES\COMMON FILES\QKOR\QKORM.EXE

After you have ticked the above entry, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Access your add/remove programs via control panel and remove the following
Win-dh
Select CashBack

Run FixBargainbuddy.exe again
Reboot the computer
Back in windows
Locate the Hoster folder , open it and double click on Hoster.exe
Click on Restore Original Hosts
In the confirmation window, click on OK.

Find and send the next files or folders to the recycle bin
FILES
C:\DSKPDR.EXE
C:\WINDOWS\SYSTEM\AQFHSN.exe
C:\WINDOWS\SYSTEM\JSCVMD.exe
C:\WINDOWS\SYSTEM\f3087ngt.exe
FOLDERS
c:\program files\180solutions
C:\Program Files\BullsEye Network
C:\Program Files\ISTsvc
C:\PROGRAM FILES\COMMON FILES\QKOR

Post back a fresh hijackthis log afterwards
« Last Edit: February 10, 2006, 12:27:18 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #34 on: February 10, 2006, 01:21:18 PM »
here is the high jack this log

Logfile of HijackThis v1.99.1
Scan saved at 12:52:56 PM, on 2/10/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\ICSMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [ICSMGR] ICSMGR.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\PROGRAM FILES\NORTON ANTIVIRUS\POProxy.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
Logged

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #35 on: February 10, 2006, 03:14:40 PM »
i fergot to mention earlier that i still can't view webpages
but i can connect to the internet
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #36 on: February 11, 2006, 03:02:47 PM »
Is this happening with both IE and Firefox?

Can you try the following and see if it helps
Open Notepad (START>>>RUN>>>type in notepad)
Hit OK
Copy the contents of the CODE box to notepad, not including the word "code"
Paste to the empty notepad file
In Notepad click FILE>>SAVE AS
IMPORTANT>>>Change the Save as Type to All Files.
Name the file as fix.reg

Save this file on the desktop of the computer that won't display web pages
Ensure to save REGEDIT4 and below in the code box

 
Code: [Select]
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

Delete the contents of your temp folders, use CCleaner, don't clean the registry, just temp directories

go to start>>run>>type in the following commands and click OK after each

regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 cryptdlg.dll

Double click on fix.reg and allow to add/merge to the registry

Reboot the computer
Back in Windows
Don't open the browser yet
Instead
Access Internet Options via Control Panel
Under the Programs tab "Reset Web Settings"
« Last Edit: February 11, 2006, 03:06:23 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #37 on: February 12, 2006, 11:32:49 PM »
it didnt work

the following said Load Library ("slbcsp.dll") failed. GetLastError returns 0x00000485

regsvr32 dssenh.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
highjack this log
« Reply #38 on: February 12, 2006, 11:36:36 PM »
Quote
Is this happening with both IE and Firefox?

Did you do the rest of what I posted????

You can try and repair IE
Go into the Add/remove programs
Find Internet explorer
Highlight it and click uninstall, follow the prompts to run the Repair

Reboot the computer afterwards
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline jen3ca

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +0/-0
    • View Profile
highjack this log
« Reply #39 on: February 13, 2006, 12:36:24 PM »
sorry it happens in both firefox and internet explorer
yes i did the rest of the post as well im going to try and repair internet explorer now
Logged
Pages: 1 [2] 3
« previous next »