|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
|
|
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
|
|
#1
|
|||
|
|||
|
hijacked...log included...dont want the kids to see
Hi all,
I need some help. My homepage keeps changing and porn sites keep appearing in favorites. My children use this computer. I do not want them exposed to this. Do you think you can help? Thank you in advance. Melissa ogfile of HijackThis v1.98.0 Scan saved at 3:06:27 PM, on 7/16/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\MDM.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PROMON.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\VISIONEER ONETOUCH\ONETOUCHMON.EXE C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE C:\VISIONEER\PAPERPORT\PPWEBCAP.EXE C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER SOFTWARE\PTS.EXE C:\WINDOWS\TOPPOP.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAM FILES\WINZIP\WINZIP32.EXE C:\WINDOWS\TEMP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = URL R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = URL O1 - Hosts: 64.237.45.18 ad.doubleclick.net O1 - Hosts: 64.237.45.18 aff.weatherbug.com O1 - Hosts: 64.237.45.18 URL O1 - Hosts: 64.237.45.18 oz.valueclick.com O1 - Hosts: 64.237.45.18 a.tribalfusion.com O1 - Hosts: 64.237.45.18 servedby.advertising.com O1 - Hosts: 64.237.45.18 my.search O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com O1 - Hosts: 209.87.155.230 date.com O1 - Hosts: 209.87.155.230 dating.com O1 - Hosts: 209.87.155.230 freedating.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Promon.exe] Promon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE O4 - HKLM\..\Run: [Dcfssvc] c:\windows\System32\Drivers\dcfssvc.exe O4 - HKLM\..\Run: [b0lcr653ek] C:\SYMANTEC\R4TDUC3941.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE O4 - HKCU\..\Run: [PPWebCap] C:\VISIONEER\PAPERPORT\PPWebCap.exe O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [\IEService.exe] C:\WINDOWS\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe O4 - Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O4 - User Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - URL O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - URL O16 - DPF: Yahoo! Chess - URL |
|
#2
|
|||
|
|||
|
moved file
Hi,
I moved hijack this to a different place. I know i need to remove the ro and r1..plus some of the things under it. But in reading replies ..they always say not to do anything until it can be checked out. So i guess i will leave it be. Here is the log ... Thanks in advance, mcdwitt Logfile of HijackThis v1.98.0 Scan saved at 4:10:51 PM, on 7/16/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\MDM.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PROMON.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\VISIONEER ONETOUCH\ONETOUCHMON.EXE C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE C:\VISIONEER\PAPERPORT\PPWEBCAP.EXE C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER SOFTWARE\PTS.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\TOPPOP.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = URL R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = URL O1 - Hosts: 64.237.45.18 ad.doubleclick.net O1 - Hosts: 64.237.45.18 aff.weatherbug.com O1 - Hosts: 64.237.45.18 URL O1 - Hosts: 64.237.45.18 oz.valueclick.com O1 - Hosts: 64.237.45.18 a.tribalfusion.com O1 - Hosts: 64.237.45.18 servedby.advertising.com O1 - Hosts: 64.237.45.18 my.search O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com O1 - Hosts: 209.87.155.230 date.com O1 - Hosts: 209.87.155.230 dating.com O1 - Hosts: 209.87.155.230 freedating.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Promon.exe] Promon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE O4 - HKLM\..\Run: [Dcfssvc] c:\windows\System32\Drivers\dcfssvc.exe O4 - HKLM\..\Run: [y4t9j3e6v6] C:\SYMANTEC\R4TDUC3941.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE O4 - HKCU\..\Run: [PPWebCap] C:\VISIONEER\PAPERPORT\PPWebCap.exe O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [\IEService.exe] C:\WINDOWS\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe O4 - Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O4 - User Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - URL O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - URL O16 - DPF: Yahoo! Chess - URL |
|
#3
|
|||
|
|||
|
Hi mcdwitt,
You might want to print these instructions. You have a coolwebsearch infection, among other things. Please download CWShredder written by Merijn Bellekom from Here Press "Check for Update" and download any new updates available. Close ALL browser windows or it may not work! Unzip it to a convenient location such as your Desktop and select "Fix" (do not just Scan). It will automatically remove the infections. Logoff your internet connection. Run HijackThis, close all browsers and any other windows, place a checkmark next to the following items. Click "fix checked". O1 - Hosts: 64.237.45.18 ad.doubleclick.net O1 - Hosts: 64.237.45.18 aff.weatherbug.com O1 - Hosts: 64.237.45.18 www.burstnet.com O1 - Hosts: 64.237.45.18 oz.valueclick.com O1 - Hosts: 64.237.45.18 a.tribalfusion.com O1 - Hosts: 64.237.45.18 servedby.advertising.com O1 - Hosts: 64.237.45.18 my.search O1 - Hosts: 64.237.45.18 pagead2.googlesyndication.com O1 - Hosts: 209.87.155.230 date.com O1 - Hosts: 209.87.155.230 dating.com O1 - Hosts: 209.87.155.230 freedating.com O4 - HKLM\..\Run: [y4t9j3e6v6] C:\SYMANTEC\R4TDUC3941.EXE Does this seem familiar to you? If not, can you browse to the file, right click it and post any version info on it? O4 - HKCU\..\Run: [\IEService.exe] C:\WINDOWS\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe Boot into Safe Mode. Reboot your computer, start tapping F8 when it first starts booting, select Safe Mode. Delete the following file: R4TDUC3941.EXE Reboot normally and post a fresh log. Tom
__________________
HijackThis Ad-aware Spybot Search & Destroy SpywareBlaster SpywareGuard Housecall Online A/V Scan Please read the stickys at the top of the forum before posting! Last edited by Tom Myboy : July 16th, 2004 at 04:27 PM. |
|
#4
|
|||
|
|||
|
getting there
Hi again,
Thank you for helping. I did the first part of what u asked. (getting and using CWShredder and fixing those O1) but the O4 Hklm\..\Run:[y4t9j3e6v6}...was not there to put a check mark by..... Also you asked if this:O4 - HKCU\..\Run: [\IEService.exe] C:\WINDOWS\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe looked familiar and if not to give u info......how do i find it to give u info? Thank you again Melissa (mcdwitt) |
|
#5
|
|||
|
|||
|
Hi,
I went ahead with the rest of the things you had told me to do. Everything appears to be ok. The reason i couldnt find this O4 - HKLM\..\Run: [y4t9j3e6v6 C:\SYMANTEC\R4TDUC3941.EXE was because it changed its name (the part in the brackets was different) and if u notice in the first log i posted it was different also. Here is a fresh log: Logfile of HijackThis v1.98.0 Scan saved at 7:51:09 PM, on 7/16/04 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\MDM.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\PROMON.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\VISIONEER ONETOUCH\ONETOUCHMON.EXE C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE C:\VISIONEER\PAPERPORT\PPWEBCAP.EXE C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER SOFTWARE\PTS.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = URL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Promon.exe] Promon.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~2\ONETOU~2.EXE O4 - HKLM\..\Run: [Dcfssvc] c:\windows\System32\Drivers\dcfssvc.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE O4 - HKCU\..\Run: [PPWebCap] C:\VISIONEER\PAPERPORT\PPWebCap.exe O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [\IEService.exe] C:\WINDOWS\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe O4 - Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O4 - User Startup: KODAK Picture Transfer Software.lnk = C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - URL O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - URL O16 - DPF: Yahoo! Chess - URL Thank you so much for all of your help. mcdwitt ![]() |
|
#6
|
|||
|
|||
|
Glad to hear things are looking better!
You can do a search for the file: Start > Find > Files or Folders > enter "IEService.exe" without the quotes. When you find the file, right-click on it and see if there is any version information (company name, etc). You can also go to: http://www.kaspersky.com/scanforvirus and browse to the file in question and submit it for anti virus scanning. I dont see an anti virus program running on your system. There is a free AVG antivirus scanner at: www.grisoft.com These are tools that will help help you from getting infected again: SpywareBlaster will block bad ActiveX and malevolent cookies. http://www.javacoolsoftware.com/spywareblaster.html SpywareGuard is a real-time spyware scanner. http://www.wilderssecurity.net/spywareguard.html IE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD All are very small free programs. Occasionally check for updates. Adjust your security settings for ActiveX: Go to Internet Options/Security/Internet, press 'default level', then OK. Now press "Custom Level." In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'. Check for updates for Windows and Internet Explorer every week or so. Download each critical update one by one, rebooting when necessary.. Repeat this until you get the message "no critical updates available" http://v4.windowsupdate.microsoft.com/ Tom |
![]() |
| Viewing: Dev Shed Forums > System Administration > Antivirus Protection > hijacked...log included...dont want the kids to see |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|