Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

seach extender shopping wizard home search assistante


  • Please log in to reply
1 reply to this topic

#1 charly7210

charly7210

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:00 PM

Posted 08 December 2004 - 02:22 PM

Logfile of HijackThis v1.97.7
Scan saved at 11:22:46 AM, on 12/8/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\IPBO.EXE
C:\WINDOWS\SYSTEM\SYSEO.EXE
C:\WINDOWS\ADDQL.EXE
C:\WINDOWS\JAVAKX.EXE
C:\WINDOWS\SYSTEM\APPBQ.EXE
C:\WINDOWS\JAVAOW.EXE
C:\WINDOWS\SYSTEM\CRNJ.EXE
C:\WINDOWS\SYSTEM\NETOH.EXE
C:\WINDOWS\SYSTEM\MFCUQ.EXE
C:\WINDOWS\SYSTEM\CREU.EXE
C:\WINDOWS\CRYZ.EXE
C:\WINDOWS\SYSTEM\IECC.EXE
C:\WINDOWS\JAVATU.EXE
C:\WINDOWS\MSEH.EXE
C:\WINDOWS\SYSTEM\NTJY.EXE
C:\WINDOWS\ATLSG.EXE
C:\WINDOWS\MSOJ32.EXE
C:\WINDOWS\SYSTEM\SDKJY32.EXE
C:\WINDOWS\APPQK.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\APPBQ.EXE
C:\WINDOWS\ADDQL.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimhome.netscape.com/aimhome.adp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
O2 - BHO: (no name) - {F7644B24-79D2-12FF-C53D-18B819AC448F} - C:\WINDOWS\SYSTEM\JAVATH32.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [IECF.EXE] C:\WINDOWS\SYSTEM\IECF.EXE
O4 - HKLM\..\Run: [CSV7P70] \Progra~1\CSBB\CSV7P070.EXE
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\SYSTEM\winupdtl.exe
O4 - HKLM\..\Run: [lqtbnfgwmzq] C:\WINDOWS\SYSTEM\prqsasu.exe
O4 - HKLM\..\Run: [hqtgbc] C:\WINDOWS\SYSTEM\hqtgbc.exe
O4 - HKLM\..\Run: [t89i36j] ACTHI32.EXE
O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\SYSTEM\SahAgent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [CRNJ.EXE] C:\WINDOWS\SYSTEM\CRNJ.EXE
O4 - HKLM\..\RunServices: [IPBO.EXE] C:\WINDOWS\IPBO.EXE
O4 - HKLM\..\RunServices: [JAVAOW.EXE] C:\WINDOWS\JAVAOW.EXE
O4 - HKLM\..\RunServices: [NTJY.EXE] C:\WINDOWS\SYSTEM\NTJY.EXE
O4 - HKLM\..\RunServices: [MFCUQ.EXE] C:\WINDOWS\SYSTEM\MFCUQ.EXE
O4 - HKLM\..\RunServices: [NETOH.EXE] C:\WINDOWS\SYSTEM\NETOH.EXE
O4 - HKLM\..\RunServices: [CREU.EXE] C:\WINDOWS\SYSTEM\CREU.EXE
O4 - HKLM\..\RunServices: [SYSEO.EXE] C:\WINDOWS\SYSTEM\SYSEO.EXE
O4 - HKLM\..\RunServices: [MSEH.EXE] C:\WINDOWS\MSEH.EXE
O4 - HKLM\..\RunServices: [CRYZ.EXE] C:\WINDOWS\CRYZ.EXE
O4 - HKLM\..\RunServices: [JAVAKX.EXE] C:\WINDOWS\JAVAKX.EXE
O4 - HKLM\..\RunServices: [APPBQ.EXE] C:\WINDOWS\SYSTEM\APPBQ.EXE
O4 - HKLM\..\RunServices: [ADDQL.EXE] C:\WINDOWS\ADDQL.EXE
O4 - HKLM\..\RunServices: [IECC.EXE] C:\WINDOWS\SYSTEM\IECC.EXE
O4 - HKLM\..\RunServices: [APPQK.EXE] C:\WINDOWS\APPQK.EXE
O4 - HKLM\..\RunServices: [JAVATU.EXE] C:\WINDOWS\JAVATU.EXE
O4 - HKLM\..\RunServices: [MSOJ32.EXE] C:\WINDOWS\MSOJ32.EXE
O4 - HKLM\..\RunServices: [ATLSG.EXE] C:\WINDOWS\ATLSG.EXE
O4 - HKLM\..\RunServices: [SDKJY32.EXE] C:\WINDOWS\SYSTEM\SDKJY32.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [czqsRWH7Q] ZDUIS32.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM\aim.exe -cnetwait.odl
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: hhypgh.exe
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O8 - Extra context menu item: &AIM Search - res://C:\PROGRAM FILES\AIM TOOLBAR\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\aklsp.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...B?1099639750050
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10fd2445d66a66...ip/RdxIE601.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

BC AdBot (Login to Remove)

 


#2 Daisuke

Daisuke

    Cleaner on Duty


  • Members
  • 5,575 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Romania
  • Local time:03:00 PM

Posted 12 December 2004 - 09:50 AM

Hi

Sorry for this delay.

If you still have problems post please a new hijackthis log.

You are running an outdated version of HijackThis.. Delete the copy you have and download the latest version of HijackThis!: Download here HJT 1.98.2. Save it on your Desktop. You will need now to unzip hijackthis.exe to a permanent folder, such as c:\hjt . This has to be done as HijackThis creates backups. You may need to use these backups.

First create a new folder:
A. Click My Computer icon on your desktop
B. Click C: drive
C. Click the File menu --> New --> Folder, a folder "New folder" will be created.
D. Rename it HJT

Unzip hijackthis.exe to the c:\HJT folder.
Everyday is virus day. Do you know where your recovery CDs are ?
Did you create them yet ?

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users