Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

IE has been hijacked and i cant sort it!!

Discuss IE has been hijacked and i cant sort it!! in the Antivirus Protection forum on Dev Shed.
IE has been hijacked and i cant sort it!! Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Page 1 of 2 1 2 >
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
  #1  
Old September 27th, 2004, 05:06 PM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
IE has been hijacked and i cant sort it!!
hey all...

IE (although i don't use it much) is driving me mad! it has been hijacked at it takes me to mysearchnow or an equivalent and puts a bar at the top of the page and at the bottom of the screen is a blue bar with links to makemoney, music, casino etc

i thought i got rid of it but no...

i run avg regularly and i have run the housecall but nothing was picked up.

i run adaware and spybot regularly too...

here is my HJT log..

Logfile of HijackThis v1.97.7
Scan saved at 23:02:50, on 27/09/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\phpdev5\apache\Apache.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\iFtpSvc\iftpsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\mgabg.exe
C:\phpdev5\apache\Apache.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\tomcat50\bin\tomcat.exe
C:\Program Files\Java\j2re1.4.2_01\bin\java.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Telegraph Sports Update\skinkers.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zatudbljworutkeprjfn.net/FPIz0Q9XIc7g9GVwW9a6vP2T3yFjTlOPbUqYT_PwWht7fMK4Ei6BRzkCD8ryC2TF.html
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Grae\Application Data\Mozilla\Profiles\default\dpgiuj78.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Grae\Application Data\Mozilla\Profiles\default\dpgiuj78.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [userbalm] C:\PROGRA~1\ANTEME~1\Manager Readme Defy.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [TelegraphCluster] C:\Program Files\Telegraph Sports Update\skinkers.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Fabhols (HKLM)
O9 - Extra 'Tools' menuitem: Fabhols (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .tcl: C:\Program Files\Internet Explorer\PLUGINS\nptcl32.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {A5C76BEB-C8A9-4F59-BB90-52A821EAB9C9} (Desktop Object) - http://sib1.od2.com/common/cman/cman.dll



any thoughts would be great. i have tried deleting things and i thought it worked but they came back

thanks in advanced

RF
Reply With Quote
  #2  
Old September 27th, 2004, 05:24 PM
Tom Myboy Tom Myboy is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Aug 2003
Posts: 2,491 Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 3 Days 20 h 13 m 41 sec
Reputation Power: 13
Hi RF,

You might want to print these instructions for reference, as you will be off the internet while using HijackThis.

Logoff your internet connection. Run HijackThis, close all browsers and any other windows, click scan, place a checkmark next to the following items. Click "fix checked". It is OK if some of these items are no longer listed.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.zatudbljworutkeprjfn.net/FPIz0Q9XIc7g9GVwW9a6vP2T3yFjTlOPbUqYT_PwWht7fMK4Ei6BRzkCD8ryC2TF.html
O4 - HKLM\..\Run: [userbalm] C:\PROGRA~1\ANTEME~1\Manager Readme Defy.exe

Then....

Boot into Safe Mode. Reboot your computer, start tapping F8 when it first starts booting, select Safe Mode.

Make sure your computer is configured to show all files and folders.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden Files and Folders heading select Show Hidden Files and Folders.
Uncheck the Hide Protected Operating System Files (recommended) option.
Click Yes to confirm.
Click OK.

Delete the following folders:

C:\PROGRA~1\ANTEME~1\

Reboot normally.

Then...

Please update HijackThis, you are using an outdated version:

Open HijackThis, click Config > Misc Tools > Check for Update online

Or download a copy of version 1.98 at: http://www.majorgeeks.com/download3155.html

Post a fresh log with this new version.

Tom
__________________
HijackThis
Ad-aware
Spybot Search & Destroy
SpywareBlaster
SpywareGuard
Housecall Online A/V Scan
Please read the stickys at the top of the forum before posting!
Reply With Quote
  #3  
Old September 27th, 2004, 05:59 PM
StartUpMan StartUpMan is offline
Banned
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Feb 2004
Posts: 275 StartUpMan User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
RadioactiveFrog - What's the point in fixing what was done through IE, if you don't replace IE? All that's gonna happen is it will happen again and again.

If you want to stop these issues, download FireFox - it looks and acts identical to IE, except with maximum security.
Reply With Quote
  #4  
Old September 28th, 2004, 02:59 AM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
Thanks very much as always Tom, i will print those and try them now.

StartUpMan: to quote myself
Quote:
IE (although i don't use it much) is driving me mad!

would this suggest i dont use ie that often i am a very happy FF user however some sites dont check their CSS in Moz FF and so i have to use IE .... unfortunatly

anyway must get on with fixing

thanks

RF
Last edited by RadioactiveFrog : September 28th, 2004 at 03:34 AM.
Reply With Quote
  #5  
Old September 28th, 2004, 03:31 AM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
ok all done . . . . .
here is the new log after reboot. i haven't tried running IE yet but i will after posting this

Logfile of HijackThis v1.98.2
Scan saved at 09:16:29, on 28/09/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\phpdev5\apache\Apache.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\iFtpSvc\iftpsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\mgabg.exe
C:\phpdev5\apache\Apache.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\tomcat50\bin\tomcat.exe
C:\Program Files\Java\j2re1.4.2_01\bin\java.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\PDesk\PDesk.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Common Files\Nokia\Services\ServiceLayer.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Telegraph Sports Update\skinkers.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Grae\Application Data\Mozilla\Profiles\default\dpgiuj78.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Grae\Application Data\Mozilla\Profiles\default\dpgiuj78.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\System32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [TelegraphCluster] C:\Program Files\Telegraph Sports Update\skinkers.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Fabhols - {9B091649-ABCD-3586-DCAB-40E290343737} - www.fabhols.com (file missing)
O9 - Extra 'Tools' menuitem: Fabhols - {9B091649-ABCD-3586-DCAB-40E290343737} - www.fabhols.com (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .tcl: C:\Program Files\Internet Explorer\PLUGINS\nptcl32.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {A5C76BEB-C8A9-4F59-BB90-52A821EAB9C9} (Desktop Object) - http://sib1.od2.com/common/cman/cman.dll

Thanks

Graham
Reply With Quote
  #6  
Old September 28th, 2004, 03:37 AM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
ok, thanks IE looks to be fine!!

Are there ways i can prevent this from happening? I dothe the following already

Keep XP updated
run adaware and spybot regularly
run AVG regularly and having it running
Have Zone Alarm Running...

i need to use ie for sites that don't work with Moz FF and for testing websites i create but it is such a pain!!!!

any thoughts would be great..thanks

RF
Reply With Quote
  #7  
Old September 28th, 2004, 01:10 PM
Tom Myboy Tom Myboy is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Aug 2003
Posts: 2,491 Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 3 Days 20 h 13 m 41 sec
Reputation Power: 13
Graham,

The log looks great!

It sounds like you are doing all the right things

You have Messenger Plus installed. It contain's the LOP infection (it's what you were infected with now) and it's best to uninstall the program. Trillian is a safer alternative:

http://www.trillian.cc/

These are tools that will help keep you from getting infected again:

SpywareBlaster will block bad ActiveX and malevolent cookies. http://www.javacoolsoftware.com/spywareblaster.html

SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method. http://www.wilderssecurity.net/spywareguard.html

IE-SPYAD puts over 4000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
http://www.staff.uiuc.edu/~ehowes/resource.htm#IESPYAD

All are very small free programs. Occasionally check for updates.

Check for updates for Windows and Internet Explorer every week or so. Download each critical update one by one, rebooting when necessary.. Repeat this until you get the message "no critical updates available" http://v4.windowsupdate.microsoft.com/

Please take a minute to read: So how did I get infected in the first place?
http://computercops.biz/postlite7736-.html

Tom
Reply With Quote
  #8  
Old September 28th, 2004, 05:04 PM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
Tom, thanks for that, i will look into those things. i hav ejust installed trillian but to be honest to too sure.. maybe the paid one is better but $25 is a lot to find out :s is there any other alternatives i could try? i use msn a lot so am happy to try alternatives if it is gunna be better !!

thanks
Reply With Quote
  #9  
Old September 29th, 2004, 03:25 AM
Tom Myboy Tom Myboy is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Aug 2003
Posts: 2,491 Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 3 Days 20 h 13 m 41 sec
Reputation Power: 13
I use the free version. It is setup for multi-networks so you just need one client for MSN, Yahoo, etc.

Trillian .74 is completely free, with no spyware and no ads.

Tom
Reply With Quote
  #10  
Old September 29th, 2004, 03:51 AM
RadioactiveFrog's Avatar
RadioactiveFrog RadioactiveFrog is offline
sleeping guru
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Feb 2003
Location: under the stars
Posts: 2,444 RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)RadioactiveFrog User rank is First Lieutenant (10000 - 20000 Reputation Level)  Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1Folding Points: 155419 Folding Title: Super Ultimate Folder - Level 1
Time spent in forums: 6 Days 6 h 18 m 28 sec
Reputation Power: 171
Send a message via MSN to RadioactiveFrog
yeah i downloaded it and installed it and had a play but wasnt too keen. not very clear for me. i have asked in the lounge if anyone else has any recommendations...i also tried integrity messenger but didn't like that either !!

thanks anyway
Reply With Quote
  #11  
Old September 29th, 2004, 05:22 PM
Tom Myboy Tom Myboy is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date