Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log (about:blank)


  • This topic is locked This topic is locked
1 reply to this topic

#1 CoreyUF

CoreyUF

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:43 AM

Posted 06 October 2004 - 09:12 AM

Hi all,

Here is my Hijack log. Can't seem to get rid of a pesky program that resets the homepage to about:blank. Can you help?

Thanks a million!

Corey

Logfile of HijackThis v1.98.2
Scan saved at 10:06:36 AM, on 10/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MNMSRVC.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSIB32.EXE
C:\WINDOWS\IEKQ32.EXE
C:\WINDOWS\SYSTEM\APIAQ32.EXE
C:\WINDOWS\SYSTEM\ATLVE32.EXE
C:\WINDOWS\SYSTEM\D3NY32.EXE
C:\WINDOWS\SYSTEM\CRTP32.EXE
C:\WINDOWS\WINPE.EXE
C:\WINDOWS\NETHS.EXE
C:\WINDOWS\IPOA.EXE
C:\WINDOWS\SYSTEM\NETVX.EXE
C:\WINDOWS\SYSTEM\SYSVX32.EXE
C:\WINDOWS\SYSTEM\IPQG.EXE
C:\WINDOWS\SYSTEM\APIWS32.EXE
C:\WINDOWS\SDKTH.EXE
C:\WINDOWS\APPAB.EXE
C:\WINDOWS\MSOK32.EXE
C:\WINDOWS\APIKC.EXE
C:\WINDOWS\SYSTEM\NTKY.EXE
C:\WINDOWS\SYSTEM\NETAN.EXE
C:\WINDOWS\SYSTEM\JAVAUH.EXE
C:\WINDOWS\SYSTEM\ATLJN32.EXE
C:\WINDOWS\NETSX32.EXE
C:\WINDOWS\SYSTEM\SDKBM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\D3XS32.EXE
C:\WINDOWS\WINYP.EXE
C:\WINDOWS\D3LJ.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PROMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\D3LJ.EXE
C:\WINDOWS\IEHA.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\D3LJ.EXE
C:\WINDOWS\SYSTEM\IPSN.EXE
C:\WINDOWS\IEHA.EXE
C:\PROGRAM FILES\HIJJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\iojjm.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {2CC5AB6B-5C39-9AA2-A266-DD794C882565} - C:\WINDOWS\NETBD.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Fpx] C:\WINDOWS\SYSTEM\mnmsrvc.exe
O4 - HKLM\..\RunServices: [IEKQ32.EXE] C:\WINDOWS\IEKQ32.EXE
O4 - HKLM\..\RunServices: [IPOA.EXE] C:\WINDOWS\IPOA.EXE
O4 - HKLM\..\RunServices: [CRTP32.EXE] C:\WINDOWS\SYSTEM\CRTP32.EXE
O4 - HKLM\..\RunServices: [D3NY32.EXE] C:\WINDOWS\SYSTEM\D3NY32.EXE
O4 - HKLM\..\RunServices: [SYSIB32.EXE] C:\WINDOWS\SYSIB32.EXE
O4 - HKLM\..\RunServices: [APIAQ32.EXE] C:\WINDOWS\SYSTEM\APIAQ32.EXE
O4 - HKLM\..\RunServices: [NETHS.EXE] C:\WINDOWS\NETHS.EXE
O4 - HKLM\..\RunServices: [WINPE.EXE] C:\WINDOWS\WINPE.EXE
O4 - HKLM\..\RunServices: [NETVX.EXE] C:\WINDOWS\SYSTEM\NETVX.EXE
O4 - HKLM\..\RunServices: [ATLVE32.EXE] C:\WINDOWS\SYSTEM\ATLVE32.EXE
O4 - HKLM\..\RunServices: [SYSVX32.EXE] C:\WINDOWS\SYSTEM\SYSVX32.EXE
O4 - HKLM\..\RunServices: [IPQG.EXE] C:\WINDOWS\SYSTEM\IPQG.EXE
O4 - HKLM\..\RunServices: [APIWS32.EXE] C:\WINDOWS\SYSTEM\APIWS32.EXE
O4 - HKLM\..\RunServices: [SDKTH.EXE] C:\WINDOWS\SDKTH.EXE
O4 - HKLM\..\RunServices: [APPAB.EXE] C:\WINDOWS\APPAB.EXE
O4 - HKLM\..\RunServices: [MSOK32.EXE] C:\WINDOWS\MSOK32.EXE
O4 - HKLM\..\RunServices: [APIKC.EXE] C:\WINDOWS\APIKC.EXE
O4 - HKLM\..\RunServices: [NTKY.EXE] C:\WINDOWS\SYSTEM\NTKY.EXE
O4 - HKLM\..\RunServices: [NETAN.EXE] C:\WINDOWS\SYSTEM\NETAN.EXE
O4 - HKLM\..\RunServices: [JAVAUH.EXE] C:\WINDOWS\SYSTEM\JAVAUH.EXE
O4 - HKLM\..\RunServices: [NETSX32.EXE] C:\WINDOWS\NETSX32.EXE
O4 - HKLM\..\RunServices: [ATLJN32.EXE] C:\WINDOWS\SYSTEM\ATLJN32.EXE
O4 - HKLM\..\RunServices: [SDKBM.EXE] C:\WINDOWS\SYSTEM\SDKBM.EXE
O4 - HKLM\..\RunServices: [D3XS32.EXE] C:\WINDOWS\D3XS32.EXE
O4 - HKLM\..\RunServices: [WINYP.EXE] C:\WINDOWS\WINYP.EXE
O4 - HKLM\..\RunServices: [D3LJ.EXE] C:\WINDOWS\D3LJ.EXE
O4 - HKLM\..\RunServices: [IEHA.EXE] C:\WINDOWS\IEHA.EXE
O4 - HKLM\..\RunServices: [IPSN.EXE] C:\WINDOWS\SYSTEM\IPSN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/apop/default/popcaploader_v5.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/09b04b0fae7091...ip/RdxIE601.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab30149.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = workgroup
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 206.74.254.2,204.116.57.2

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,675 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:03:43 AM

Posted 06 October 2004 - 04:33 PM

Please down About:Buster from here: http://www.bleepingcomputer.com/files/aboutbuster.php and extract it to the c:\ drive

Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.

Then post a new log




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users