Web & Email & Search Engines & Domain: Hijack this help required please...cheers

• adelcrow / 210 / Tues, 31 Mar 2009 23:55:00 GMT / Comments (1)
• Logfile of HijackThis v1.97.7
  Scan saved at 9:33:26 AM, on 12/06/2004
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\DIGStream\digstream.exe
  C:\WINDOWS\System32\ctfmon.exe
  C:\Program Files\WinZip\WZQKPICK.EXE
  C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\System32\devldr32.exe
  C:\Documents and Settings\Steven\Desktop\Downloads\HijackThis.exe
  C:\Program Files\Messenger\msmsgs.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fantasysports.yahoo.com/
  O1 - Hosts: 127.0.0.0 localhost
  O1 - Hosts: 127.0.0.2 auditmypc.com
  O1 - Hosts: 127.0.0.3 boards.cexx.org
  O1 - Hosts: 127.0.0.4 bulletproofsoft.net
  O1 - Hosts: 127.0.0.5 camtech2000.net
  O1 - Hosts: 127.0.0.6 cexx.org
  O1 - Hosts: 127.0.0.7 computercops.us
  O1 - Hosts: 127.0.0.8 ct7support.com
  O1 - Hosts: 127.0.0.9 doxdesk.com
  O1 - Hosts: 127.0.0.20 kellys-korner-xp.com
  O1 - Hosts: 127.0.0.21 kephyr.com
  O1 - Hosts: 127.0.0.22 lavasoft.de
  O1 - Hosts: 127.0.0.23 lavasoftusa.com
  O1 - Hosts: 127.0.0.24 lurkhere.com
  O1 - Hosts: 127.0.0.25 majorgeeks.com
  O1 - Hosts: 127.0.0.26 merijn.org
  O1 - Hosts: 127.0.0.27 mjc1.com
  O1 - Hosts: 127.0.0.28 moosoft.com
  O1 - Hosts: 127.0.0.29 mvps.org
  O1 - Hosts: 127.0.0.30 net-integration.net
  O1 - Hosts: 127.0.0.31 noadware.net
  O1 - Hosts: 127.0.0.32 no-spybot.com
  O1 - Hosts: 127.0.0.33 onlinepcfix.com
  O1 - Hosts: 127.0.0.34 pchell.com
  O1 - Hosts: 127.0.0.35 pestpatrol.com
  O1 - Hosts: 127.0.0.36 safer-networking.org
  O1 - Hosts: 127.0.0.37 secure.spykiller.com
  O1 - Hosts: 127.0.0.38 secureie.com
  O1 - Hosts: 127.0.0.39 security.kolla.de
  O1 - Hosts: 127.0.0.40 spybot.info
  O1 - Hosts: 127.0.0.41 spychecker.com
  O1 - Hosts: 127.0.0.42 spychecker.com
  O1 - Hosts: 127.0.0.43 spycop.com
  O1 - Hosts: 127.0.0.44 spyguard.com
  O1 - Hosts: 127.0.0.45 spykiller.com
  O1 - Hosts: 127.0.0.46 spyware.co.uk
  O1 - Hosts: 127.0.0.47 spyware-cop.com
  O1 - Hosts: 127.0.0.48 spywareinfo.com
  O1 - Hosts: 127.0.0.49 spywarenuker.com
  O1 - Hosts: 127.0.0.50 spywareremove.com
  O1 - Hosts: 127.0.0.51 spywareremove.com
  O1 - Hosts: 127.0.0.52 stopzillapro.com
  O1 - Hosts: 127.0.0.53 sunbelt-software.com
  O1 - Hosts: 127.0.0.54 thiefware.com
  O1 - Hosts: 127.0.0.55 tomcoyote.org
  O1 - Hosts: 127.0.0.56 unwantedlinks.com
  O1 - Hosts: 127.0.0.57 webattack.com
  O1 - Hosts: 127.0.0.58 wilders.org
  O1 - Hosts: 127.0.0.59 www.auditmypc.com
  O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net
  O1 - Hosts: 127.0.0.61 www.cexx.org
  O1 - Hosts: 127.0.0.62 www.computercops.us
  O1 - Hosts: 127.0.0.63 www.ct7support.com
  O1 - Hosts: 127.0.0.64 www.doxdesk.com
  O1 - Hosts: 127.0.0.65 www.eblocs.com
  O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com
  O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com
  O1 - Hosts: 127.0.0.68 www.free-web-browsers.com
  O1 - Hosts: 127.0.0.69 www.grc.com
  O1 - Hosts: 127.0.0.70 www.grisoft.com
  O1 - Hosts: 127.0.0.71 www.hackfaq.org
  O1 - Hosts: 127.0.0.72 www.hazeleger.net
  O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com
  O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com
  O1 - Hosts: 127.0.0.75 www.kephyr.com
  O1 - Hosts: 127.0.0.76 www.lavasoft.de
  O1 - Hosts: 127.0.0.77 www.lavasoftusa.com
  O1 - Hosts: 127.0.0.78 www.lurkhere.com
  O1 - Hosts: 127.0.0.79 www.majorgeeks.com
  O1 - Hosts: 127.0.0.80 www.merijn.org
  O1 - Hosts: 127.0.0.81 www.mjc1.com
  O1 - Hosts: 127.0.0.82 www.moosoft.com
  O1 - Hosts: 127.0.0.83 www.mvps.org
  O1 - Hosts: 127.0.0.84 www.net-integration.net
  O1 - Hosts: 127.0.0.85 www.noadware.net
  O1 - Hosts: 127.0.0.86 www.no-spybot.com
  O1 - Hosts: 127.0.0.87 www.onlinepcfix.com
  O1 - Hosts: 127.0.0.88 www.pchell.com
  O1 - Hosts: 127.0.0.89 www.pestpatrol.com
  O1 - Hosts: 127.0.0.90 www.safer-networking.org
  O1 - Hosts: 127.0.0.91 www.secureie.com
  O1 - Hosts: 127.0.0.92 www.security.kolla.de
  O1 - Hosts: 127.0.0.93 www.spybot.info
  O1 - Hosts: 127.0.0.94 www.spychecker.com
  O1 - Hosts: 127.0.0.95 www.spychecker.com
  O1 - Hosts: 127.0.0.96 www.spycop.com
  O1 - Hosts: 127.0.0.97 www.spyguard.com
  O1 - Hosts: 127.0.0.98 www.spykiller.com
  O1 - Hosts: 127.0.0.99 www.spyware.co.uk
  O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\1.bin\MWSSRCAS.DLL (file missing)
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
  O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL (file missing)
  O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
  O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_6_0.dll
  O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
  O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\ICQNet.exe
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
  O4 - HKLM\..\Run: [DM_Server] C:\PROGRA~1\COMETS~1\DM\bin\dmserver.exe /onreboot
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\RunOnce: [ICQ] C:\Program Files\ICQ\ICQ.exe -trayboot
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
  O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: ICQ Pro (HKLM)
  O9 - Extra 'Tools' menuitem: ICQ (HKLM)
  O16 - DPF: Yahoo! MLB StatTracker - http://aud1.sports.sc5.yahoo.com/java/y/mlbst8408_x.cab
  O16 - DPF: {0873478E-E67A-4876-B0A9-9A36D3AB3602} (vviewer control) - http://www.thepaymentcentre.com/build/vviewer.cab
  O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
  O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.comp...bio5_1_6_0.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{325CB958-4E12-4F94-83EF-BFF7DA97D2B4}: NameServer = 203.143.252.30,61.8.0.113
• Keywords:

  web, email, search engines, domain, hijack, required, cheers, networking

• http://www.itags.org/networking/246944/«« Prior Post - Next Post »»

• 1. Download Spybot http://www.spybot.us/spybotsd13.exe
     This is a new version, if you have been using 1.2 you can install right over it. If you downloaded and used 1.3 beta it is suggested you remove it and reboot prior to installing.
     Make sure to check for updates prior to running the scan.
     Click on "Search For updates" when prompted.
     Scan, click on fix problems.
     Reboot.
     Next:
     Download AdAware http://www.lavasoftusa.com/support/download/
     Before you scan with AdAware, check for updates of the reference file by clicking
     on "Check for updates now", connect.
     Click on Start, Use custom scanning options, Customize.
     Make sure the following settings are made and on --"ON=GREEN"
     "Scan within archives"
     "Scan active processes"
     "Scan registry"
     "Deep scan registry"
     "Scan my IE Favorites for banned URL"
     "Scan my host-file"
     Click on Tweak,
     Select scanning engine and click on "Unload recognized processes during scanning"
     Select cleaning engine and click on "Automatically try to unregister objects prior to deletion" and "Let windows remove files in use at next reboot"
     Then click "proceed" to save your settings.
     Click on Next
     Run the scan and fix everything.
     Reboot and post another HJT log for review.

     cybertech | Sat, 1 Mar 2008 18:31:28 GMT |