|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
I've been having problems with IE closing after 3-4 minutes and sending me back to the desktop. I know I am infected w/ incredifind adware so I ran a Hijackthis.log. I need help in what items I need to delete to get rid of this annoyance!
Logfile of HijackThis v1.97.7 Scan saved at 11:06:06 AM, on 6/13/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Logitech\iTouch\iTouch.exe C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\pcs\pcsvc.exe C:\Program Files\Common Files\Dpi\dpi.exe C:\WINDOWS\dhbrwsr.exe C:\WINDOWS\TimeSynchronize.exe C:\WINDOWS\System32\ifkmuu.exe C:\WINDOWS\lilgficw.exe C:\PROGRA~1\AWS\WEATHE~1\Weather.exe C:\Program Files\Microsoft Money\System\Money Express.exe C:\Program Files\SETI@home\SETI@home.exe C:\Documents and Settings\KEITH M BROWN\Application Data\rncr.exe C:\WINDOWS\System32\wtssvit.exe C:\Program Files\AdSubtract\adsub.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\CyberPower\PowerPanel\PowPanel.exe C:\Program Files\Microsoft Reference\Bookshelf 98\qshelf98.exe C:\WINDOWS\System32\bdruk.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\System32\Poc8kci.exe C:\WINDOWS\System32\Poc8kci.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\dhsvr.exe C:\Program Files\Microsoft Money\System\urlmap.exe C:\Documents and Settings\KEITH M BROWN\My Documents\hij\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = URL R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=AdSubtract:4444 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file) R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll O1 - Hosts: 66.230.146.42 gator.com #cooklop O1 - Hosts: 66.230.146.42 doubleclick.net #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 tripod.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 geocities.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 adultfriendfinder.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 cj.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 paypopup.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 worldsex.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O1 - Hosts: 66.230.146.42 free6.com #cooklop O1 - Hosts: 66.230.146.42 trafficmp.com #cooklop O1 - Hosts: 66.230.146.42 URL #cooklop O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {0E1698A7-D817-409A-B204-C9F7D31BD939} - C:\WINDOWS\vrafa.dll O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~2.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - C:\WINDOWS\dealhlpr.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O3 - Toolbar: Band Class - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - C:\WINDOWS\dealhlpr.dll O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [HOUBIO] C:\WINDOWS\HOUBIO.exe O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe O4 - HKLM\..\Run: [KI5ZfS] C:\docume~1\keithm~1\locals~1\temp\KI5ZfS.exe O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun O4 - HKLM\..\Run: [2N85L533MR#GJT] C:\WINDOWS\System32\Pdo77j0i.exe O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe O4 - HKLM\..\Run: [DealHelperUpdate] C:\WINDOWS\DHUpdt.exe O4 - HKLM\..\Run: [DealHelperBrwsr] C:\WINDOWS\dhbrwsr.exe O4 - HKLM\..\Run: [TimeSyncApp] C:\WINDOWS\TimeSynchronize.exe O4 - HKLM\..\Run: [VTPreset] VTPreset.exe O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKLM\..\Run: [xpqjtxde] C:\WINDOWS\System32\ifkmuu.exe O4 - HKLM\..\Run: [lcyofbrag] C:\WINDOWS\lilgficw.exe O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe" O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe O4 - HKLM\..\Run: [bdruk] C:\WINDOWS\System32\bdruk.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1 O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\SETI@home.exe -min O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\KEITH M BROWN\Application Data\rncr.exe O4 - HKCU\..\Run: [WAPI] C:\WINDOWS\System32\wtssvit.exe O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - HKCU\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: PowerPanel.lnk = C:\Program Files\CyberPower\PowerPanel\PowPanel.exe O4 - Global Startup: Qshelf.lnk = C:\Program Files\Microsoft Reference\Bookshelf 98\qshelf98.exe O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM) O9 - Extra button: ICQ (HKLM) O9 - Extra 'Tools' menuitem: ICQ (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: MoneySide (HKLM) O12 - Plugin for .mp4: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - URL O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - URL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - URL |
|
#2
|
|||
|
|||
|
Might Need to Reinstall Java
May need to reinstall Sun Java.
Go to Sun Microsystems Java Plugin (http://www.java.com/en/download/windows_automatic.jsp) Click the "Manual Download" if it doesnt autostart . Reboot after install........... Then go to Control Panel -- JavaPlugin . Click the "Browser" tab and allow IE and FireFox . Then Click the "Cache" tab, and choose "Empty". In IE, check in Tools > Internet Options > Advanced tab, scroll down to "Java(Sun)" and make sure box is checked for "Use Java....." In FireFox, check in Tools > Options > Web Features and make sure box is checked for "Enable Java". Also, make sure cookies and Javascript support is enabled for both browsers. You should then be able to connect to this site and to any other site that requires Java at the browser. |
![]() |
| Viewing: Dev Shed Forums > System Administration > Antivirus Protection > IE shuts down |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|