|
|||||||
 |
|
|
LinkBack | Thread Tools | Search this Thread | Rate Thread | Display Modes |
05-21-2004, 01:24 AM
|
#1 |
|
Member (8 bit)
Join Date: May 2004
Location: Sydney, Australia
Posts: 152
|
cant acces websites
still haveing problems accesing lots of websites and general slowdown of internet.Ive run spybot,adawere,bullguard and avast but nothing helps and no viruses found. Still getting different homepages and and websites i dont want to go to and also getting a casino page that pops up even when im not on the internet and deleting it. Ive got a adsl connection by the way
Any help thanks 
__________________
JonrO E6750 Core 2 Duo Gigabyte P35-DS3 GeIL 2G (2X1GB) DDRII 667 (PC-5300) CoolerMaster EXTREME POWER 550W V2 ECS 8800GTS 320MB Seagate SATA 250GB Barracuda |
|
|
|
05-21-2004, 01:28 AM
|
#2 |
|
Member
Join Date: Apr 2001
Location: Na Pali Haven
Posts: 2,812
|
Setup Adaware to check your hosts file and make sure you don't have the messenger service running. Do you have Kaaza or any P2P software? Google ad blocker works wonders.
__________________
*The command line, an elegant weapon for a more civilized age* |
|
|
|
|
05-21-2004, 01:55 AM
|
#3 |
|
Member (8 bit)
Join Date: May 2004
Location: Sydney, Australia
Posts: 152
|
What is my host file and what is a messenger survice.By the way i have imesh and the google toolbar
|
|
|
|
|
05-21-2004, 01:59 AM
|
#4 |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
Please do this. Click here to download Hijack This. Save it to it’s own folder (not temporary files or the desktop).
Close all open windows and open HIJACK THIS. Click “Scan” . When the scan is finished (it only takes a second), the scan button will change to“Save Log”. Click on“Save Log” and save it to NotePad. Copy the entire log and paste it here. DO NOT FIX ANYTHING YET , most items that appear in the log are harmless or even needed. Wait for someone to analyze the scan and advise. Last edited by Lobos; 05-21-2004 at 02:03 AM. |
|
|
|
|
05-21-2004, 02:10 AM
|
#5 |
|
Member (8 bit)
Join Date: May 2004
Location: Sydney, Australia
Posts: 152
|
how do i cut and peste my log here?
|
|
|
|
|
05-21-2004, 02:16 AM
|
#6 |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
highlight the whole log then right click hit copy
come back here hit post reply right click hit paste |
|
|
|
|
05-21-2004, 02:21 AM
|
#7 |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
or
ctrl + A ctrl + C come back here hit post reply ctrl - P |
|
|
|
|
05-21-2004, 02:29 AM
|
#8 |
|
Member (8 bit)
Join Date: May 2004
Location: Sydney, Australia
Posts: 152
|
Logfile of HijackThis v1.97.7
Scan saved at 5:32:38 PM, on 21/05/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE d:\avast4\aswUpdSv.exe d:\avast4\ashServ.exe C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\bdss.exe D:\bullguard\vsserv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ABIT\ABIT uGuru\uGuru.exe C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE C:\PROGRA~1\MediaKey\MMKeybd.EXE C:\Program Files\Internet Explorer\Iesearch.exe D:\avast4\ashDisp.exe D:\avast4\ashmaisv.exe D:\bullguard\bdmcon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe D:\bullguard\bgnewsag.exe C:\Program Files\SpyBlocker Software\spyblocker.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\johno\Application Data\hmol.exe C:\WINDOWS\runwin32.exe C:\WINDOWS\wininet32.exe C:\WINDOWS\System32\wtscc.exe C:\Program Files\NetMeter\NetMeter.exe C:\Program Files\iMesh\Client\iMeshClient.exe C:\My Downloads\AntiVirus 2004 Norton Full.exe C:\My Downloads\AntiVirus 2004 Norton Full.exe C:\Documents and Settings\johno\Local Settings\Temporary Internet Files\Content.IE5\S1MFKLER\icq4_setup[1].exe C:\WINDOWS\runwin32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\johno\Local Settings\Temporary Internet Files\Content.IE5\EHF01WR6\HijackThis[1].exe C:\WINDOWS\system32\NOTEPAD.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://easy-search.biz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://awebfind.biz/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://awebfind.biz/sp.htm R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://awebfind.biz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://easy-search.biz R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://easy-search.biz R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome R3 - Default URLSearchHook is missing O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {7C7C494B-7EAF-4B4B-9C27-48EB94907040} - C:\WINDOWS\System32\dbephi.dll (file missing) O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll (file missing) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MMKeybd.EXE O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe O4 - HKLM\..\Run: [Iesearch.exe] C:\Program Files\Internet Explorer\Iesearch.exe O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set O4 - HKLM\..\Run: [avast!] d:\avast4\ashDisp.exe O4 - HKLM\..\Run: [ashMaiSv] d:\avast4\ashmaisv.exe O4 - HKLM\..\Run: [BDMCon] D:\bullguard\\bdmcon.exe O4 - HKLM\..\Run: [BGNewsAgent] D:\bullguard\bgnewsag.exe O4 - HKLM\..\Run: [SpyBlocker] C:\Program Files\SpyBlocker Software\spyblocker.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [olehelp] C:\Program Files\Common Files\svchost.exe O4 - HKCU\..\Run: [Erst] C:\Documents and Settings\johno\Application Data\hmol.exe O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe O4 - HKCU\..\Run: [wininet32] C:\WINDOWS\wininet32.exe O4 - HKCU\..\Run: [WAPI] C:\WINDOWS\System32\wtscc.exe O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe O4 - Startup: PowerReg Scheduler.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Web Search - C:\WINDOWS\ex.htm O9 - Extra button: ICQ 4.0 (HKLM) O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Common Files\svchost.exe O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/t...x.chm::/ad.exe O16 - DPF: {11111111-1111-1111-1111-111111111171} - ms-its:mhtml:file://c:\\nosuch.mht!http://line-plus.com/newhelp.chm::/newhelp.exe O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemp...veSecurity.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://vscan.exp.net/scan/Msie/bitdefender.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} - http://akamai.downloadv3.com/binarie...pe32_EN_XP.cab |
|
|
|
|
05-21-2004, 03:01 AM
|
#9 |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
hold on im going through your log now you can start off
by uninstalling myweb bar and imesh you have a cws varient disable one of your ant virusus its not good to run two at the same time im almost done with youtr log you have alot of bad stuff here |
|
|
|
|
05-21-2004, 03:52 AM
|
#10 |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
uninstall these
imesh mywebsearch bar -------------------------------------------------------------------------- Download CWShredder by Merijn Bellekom, the creator of Hijack This Run it, press 'Fix', and allow it to fix all it finds. And remember to click "Fix" (Not "Scan only") Reboot ----------------------------------------------------------------------- next run hijack this put a check next to these close all browsers and click fix some of them might not be there dont worry just get whats left R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://easy-search.biz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://awebfind.biz/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://awebfind.biz/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://awebfind.biz/sp.htm R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://easy-search.biz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://awebfind.biz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://easy-search.biz R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://easy-search.biz R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://easy-search.biz R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.microsoft.com/isapi/redi...er=6&ar=msnhome R3 - Default URLSearchHook is missing O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {7C7C494B-7EAF-4B4B-9C27-48EB94907040} - C:\WINDOWS\System32\dbephi.dll (file missing) O2 - BHO: (no name) - {98DBBF16-CA43-4c33-BE80-99E6694468A4} - C:\WINDOWS\System32\msmk.dll (file missing) O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe O4 - HKLM\..\Run: [Iesearch.exe] C:\Program Files\Internet Explorer\Iesearch.exe O4 - HKCU\..\Run: [olehelp] C:\Program Files\Common Files\svchost.exe O4 - HKCU\..\Run: [Erst] C:\Documents and Settings\johno\Application Data\hmol.exe O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe O4 - HKCU\..\Run: [wininet32] C:\WINDOWS\wininet32.exe O4 - HKCU\..\Run: [WAPI] C:\WINDOWS\System32\wtscc.exe O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Common Files\svchost.exe O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://super-gals.com/scj/rotation/.../x.chm::/ad.exe O16 - DPF: {11111111-1111-1111-1111-111111111171} - ms-its:mhtml:file://c:\\nosuch.mht!http://line-plus.com/newhelp.chm::/newhelp.exe O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab O16 - DPF: {EEECA057-AD0F-44A7-8BE5-8634CEDBDBD1} - http://akamai.downloadv3.com/binari...tpe32_EN_XP.cab im not sure about this one O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe Next Open My Computer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files". Now click"Apply to all folders" Click "Apply" then "OK reboot into safe mode How to boot into safe mode Delete what is in Bold O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [Iesearch.exe] C:\Program Files\Internet Explorer\Iesearch.exe O4 - HKCU\..\Run: [olehelp] C:\Program Files\Common Files\svchost.exe O4 - HKCU\..\Run: [Erst] C:\Documents and Settings\johno\Application Data\hmol.exe O4 - HKCU\..\Run: [runwin32] C:\WINDOWS\runwin32.exe O4 - HKCU\..\Run: [wininet32] C:\WINDOWS\wininet32.exe O4 - HKCU\..\Run: [WAPI] C:\WINDOWS\System32\wtscc.exe O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe C:\Program Files\Common Files\svchost.exe make sure its not the one in the systems folder clear out your temp files come back and post a fresh log Last edited by Lobos; 05-21-2004 at 04:12 AM. |
|
|
|
|
05-21-2004, 05:18 AM
|
#11 |
|
Member (8 bit)
Join Date: May 2004
Location: Sydney, Australia
Posts: 152
|
when booting into safe mode how do i view the folders u want me to change in bold
|
|
|
|
|
05-21-2004, 08:38 AM
|
#12 | |
|
Member (10 bit)
Join Date: Mar 2004
Location: California
Posts: 936
|
Quote:
click on the my computer icon and goto these folder and files if stll there and delete them click on the my computer icon adn goto these files and folder Delete what is in Bold these files C:\WINDOWS\System32\bridge.dll C:\Program Files\Internet Explorer\Iesearch.exe C:\Program Files\Common Files\svchost.exe C:\Documents and Settings\johno\Application Data\hmol.exe C:\WINDOWS\runwin32.exe C:\WINDOWS\wininet32.exe C:\WINDOWS\System32\wtscc.exe C:\Program Files\Common Files\svchost.exe this folder C:\Program Files\iMesh clear out your temp files come back and post a fresh log |
|
|
|
|
|
| Bookmarks |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
Linear Mode
