Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

seach extender shopping wizard home search assistante


  • Please log in to reply
1 reply to this topic

#1 charly7210

charly7210

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:03 PM

Posted 08 December 2004 - 02:13 PM

Logfile of HijackThis v1.97.7
Scan saved at 11:13:48 AM, on 12/8/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\IPBO.EXE
C:\WINDOWS\SYSTEM\SYSEO.EXE
C:\WINDOWS\ADDQL.EXE
C:\WINDOWS\JAVAKX.EXE
C:\WINDOWS\SYSTEM\APPBQ.EXE
C:\WINDOWS\JAVAOW.EXE
C:\WINDOWS\SYSTEM\CRNJ.EXE
C:\WINDOWS\SYSTEM\NETOH.EXE
C:\WINDOWS\SYSTEM\MFCUQ.EXE
C:\WINDOWS\SYSTEM\CREU.EXE
C:\WINDOWS\CRYZ.EXE
C:\WINDOWS\SYSTEM\IECC.EXE
C:\WINDOWS\JAVATU.EXE
C:\WINDOWS\MSEH.EXE
C:\WINDOWS\SYSTEM\NTJY.EXE
C:\WINDOWS\ATLSG.EXE
C:\WINDOWS\MSOJ32.EXE
C:\WINDOWS\SYSTEM\SDKJY32.EXE
C:\WINDOWS\APPQK.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\APPBQ.EXE
C:\WINDOWS\ADDQL.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimhome.netscape.com/aimhome.adp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {8DEA933C-293A-D793-35C1-7408736BFBE2} - C:\WINDOWS\SYSTEM\CRUT.DLL
O2 - BHO: (no name) - {4E2D6015-15E8-2CC0-BDB1-FA231611A30E} - C:\WINDOWS\APPQY.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [IECF.EXE] C:\WINDOWS\SYSTEM\IECF.EXE
O4 - HKLM\..\Run: [CSV7P70] \Progra~1\CSBB\CSV7P070.EXE
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe
O4 - HKLM\..\Run: [lqtbnfgwmzq] C:\WINDOWS\SYSTEM\prqsasu.exe
O4 - HKLM\..\Run: [hqtgbc] C:\WINDOWS\SYSTEM\hqtgbc.exe
O4 - HKLM\..\Run: [t89i36j] ACTHI32.EXE
O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\SYSTEM\SahAgent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [CRNJ.EXE] C:\WINDOWS\SYSTEM\CRNJ.EXE
O4 - HKLM\..\RunServices: [IPBO.EXE] C:\WINDOWS\IPBO.EXE
O4 - HKLM\..\RunServices: [JAVAOW.EXE] C:\WINDOWS\JAVAOW.EXE
O4 - HKLM\..\RunServices: [NTJY.EXE] C:\WINDOWS\SYSTEM\NTJY.EXE
O4 - HKLM\..\RunServices: [MFCUQ.EXE] C:\WINDOWS\SYSTEM\MFCUQ.EXE
O4 - HKLM\..\RunServices: [NETOH.EXE] C:\WINDOWS\SYSTEM\NETOH.EXE
O4 - HKLM\..\RunServices: [CREU.EXE] C:\WINDOWS\SYSTEM\CREU.EXE
O4 - HKLM\..\RunServices: [SYSEO.EXE] C:\WINDOWS\SYSTEM\SYSEO.EXE
O4 - HKLM\..\RunServices: [MSEH.EXE] C:\WINDOWS\MSEH.EXE
O4 - HKLM\..\RunServices: [CRYZ.EXE] C:\WINDOWS\CRYZ.EXE
O4 - HKLM\..\RunServices: [JAVAKX.EXE] C:\WINDOWS\JAVAKX.EXE
O4 - HKLM\..\RunServices: [APPBQ.EXE] C:\WINDOWS\SYSTEM\APPBQ.EXE
O4 - HKLM\..\RunServices: [ADDQL.EXE] C:\WINDOWS\ADDQL.EXE
O4 - HKLM\..\RunServices: [IECC.EXE] C:\WINDOWS\SYSTEM\IECC.EXE
O4 - HKLM\..\RunServices: [APPQK.EXE] C:\WINDOWS\APPQK.EXE
O4 - HKLM\..\RunServices: [JAVATU.EXE] C:\WINDOWS\JAVATU.EXE
O4 - HKLM\..\RunServices: [MSOJ32.EXE] C:\WINDOWS\MSOJ32.EXE
O4 - HKLM\..\RunServices: [ATLSG.EXE] C:\WINDOWS\ATLSG.EXE
O4 - HKLM\..\RunServices: [SDKJY32.EXE] C:\WINDOWS\SYSTEM\SDKJY32.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [czqsRWH7Q] ZDUIS32.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: hhypgh.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...B?1099639750050
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10fd2445d66a66...ip/RdxIE601.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

BC AdBot (Login to Remove)

 


#2 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:08:03 PM

Posted 08 December 2004 - 07:19 PM

Download the latest version of HijackThis (HJT), from here.

Put HijackThis in a Permanent folder:
Click My Computer / C: / File / New / Folder / name the folder; HijackThis
Put HijackThis.exe, in this folder.
This is a mandatory step, for the backup and restore functions, of HijackThis, to be able to work.

Read the pinned post in the HJT forum, here

Then, run a log, and post it in the HJT forum, here. Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
Please, be patient, these people are volunteers. They will help you out, as soon as possible.
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users