HiJack This Log

[Lloyd45]

Yes, another one to feat your eyes over...

OK, I ran this on a friend's PC who couldn't connect to the internet so I thought lets check for spyware, and by looking at the results I can see some dodgy ones - but I aint too sure on many.

Also, Im sorry but I was unable to run any programs like Adaware before this as her net was down, and I didn't have them on my USB Drive, only HiJack this, so...

Logfile of HijackThis v1.97.7 Scan saved at 15:19:12, on 10/09/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\WINDOWS\system32\HPConfig.exe C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe C:\Program Files\VoyagerTest\fts.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\AOL 9.0\aoltray.exe C:\WINDOWS\System32\wuauclt.exe C:\PROGRA~1\VOYAGE~1\fts.exe C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-gb\msnappau.exe C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe C:\Program Files\AOL 9.0\waol.exe C:\Program Files\AOL 9.0\shellmon.exe E:\Apps\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-gb8l.hpwis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web-entrance.com/main.cgi?ID=215 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gb8l.hpwis.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://gb8l.hpwis.com/ R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\ATPART~1.DLL O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: (no name) - {08DBDE36-DF28-11D5-8CA5-0050DA44A764} - C:\WINDOWS\System32\msvri.dll O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_30.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0002.1001\en-xu\stmain.dll O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\en-gb\msntb.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Winsey - {AC3AEF75-0A6B-4AB8-82B5-2C9BA8396644} - C:\WINDOWS\System32\Winsey\FrdParis.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.2001.0001\en-gb\msntb.dll O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe" O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm325 O8 - Extra context menu item: Winsey.co.uk - http://www.winsey.co.uk/application/...sey.co.uk.html O8 - Extra context menu item: www.winsey.co.uk Advanced search - http://www.winsey.co.uk/application/...ed_search.html O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Winsey (HKLM) O9 - Extra 'Tools' menuitem: Toolbar Icon (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O10 - Hijacked Internet access by New.Net O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll O14 - IERESET.INF: START_PAGE_URL=http://gb8l.hpwis.com O16 - DPF: {1B3E3251-658E-4F03-8881-68302FE3CE9E} - http://www.winsey.co.uk/friend/Winsey-e.xms O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{ABD07F57-4A53-436B-AA1D-5D1C423E2861}: NameServer = 194.72.9.39 194.74.65.68

[glc]

http://www.pestpatrol.com/pestinfo/f/friend_msvrl.asp

Add/remove programs - uninstall new.net and MyWebSearch if found.

This should restore Internet connectivity:

http://www.snapfiles.com/get/winsockxpfix.html

Load up your USB key before you return. It will need a Spybot S&D and Ad-Aware run. Check the hosts file.