Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
14-Mar-2005, 06:58 AM
#2 | |||||
| Welcome to TSG. Can you please place Hijackthis in its own folder,preferably C:\Program files....thas where the backups will be stored. ========================================= You have the latest version of VX2. Download L2mfix from one of these two locations: http://www.downloads.subratam.org/l2mfix.exe Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread. IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so! 
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals Microsoft MVP Security |
14-Mar-2005, 11:40 AM
#5 | |||||
|
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals Microsoft MVP Security Last edited by $teve : 14-Mar-2005 11:47 AM. |
14-Mar-2005, 01:02 PM
#9 | |||||
|
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals Microsoft MVP Security |
14-Mar-2005, 01:22 PM
#11 | |||||
| Thats fine..............it must be something new Norton is adding,we have to watch these sneaky b`stards....they name their crapware files as legit items to disguise them. ========================================= Download LSPfix here: www.spychecker.com/program/lspfix.html Launch the application, and click the "I know what I'm doing" checkbox. This is the dll in question, ''aklsp.dll'' and dolsp.dll move them both to the right hand pane and hit "finish" ======================================= Uninstall VirtualBouncer and AdDestroyer in Add/Remove Programs. Also,if theres an entry for "180 Solutions" uninstall that too. ======================================= Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT...rc=sec_doc_nam You should still have hidden files showing. ======================================= YOU MAY FIND IT EASIER TO PRINT THESE INSTRUCTIONS OUT. ====================================================== Run hijackthis again and put a checkmark against these entries....double check in case you miss anything.... .....then,close all browser and outlook windows INCLUDING THIS ONE and "fix checked" R3 - URLSearchHook: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS1\system32\toolbar.dll O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file) O3 - Toolbar: iSearch Toolbar - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - C:\WINDOWS1\system32\toolbar.dll O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS1\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS1\isrvs\ffisearch.exe O4 - HKLM\..\Run: [180ax] c:\windows1\180ax.exe O4 - HKLM\..\Run: [hkv] C:\WINDOWS\hkv.exe O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS1\system32\n20050308.exe O4 - HKLM\..\Run: [Dvx] C:\WINDOWS1\system32\wsxsvc\wsxsvc.exe O4 - HKLM\..\Run: [vmss] C:\WINDOWS1\system32\vmss\vmss.exe O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS1\system32\winupdt.exe O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe O4 - Startup: AdDestroyer.lnk = C:\Program Files\AdDestroyer\AdDestroyer.exe O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS1\system32\toolbar.dll/SEARCH.HTML O10 - Unknown file in Winsock LSP: c:\windows1\system32\aklsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\aklsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\aklsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\dolsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\dolsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\dolsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\dolsp.dll O10 - Unknown file in Winsock LSP: c:\windows1\system32\aklsp.dll O15 - Trusted Zone: *.media-motor.net O15 - Trusted Zone: *.popuppers.com O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} (iSearch Toolbar) - http://toolbar.isearch.com/general/initial.cab O16 - DPF: {539DA0E0-74A7-11D9-9669-0800200C9A66} - http://www.ouchvideo.com/mmviewer_ic13.cab O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50252/QDow_AS2.cab O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.media-motor.net/cabs/diamond.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS1\isrvs\mfiltis.dll O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS1\system32\fpjs0317e.dll Locate and delete the following: C:\WINDOWS1\system32\yuqwrv.exe C:\WINDOWS1\isrvs [FOLDER] C:\WINDOWS1\system32\wsxsvc [FOLDER] C:\WINDOWS1\system32\vmss [FOLDER] C:\WINDOWS1\system32\winupdt.exe C:\WINDOWS1\system\ambbehnqe.exe c:\windows1\180ax.exe :\PROGRAM FILES\VBouncer [FOLDER] C:\PROGRAM FILES\ADDESTROYER [FOLDER] C:\WINDOWS1\system32\n20050308.exe C:\WINDOWS\hkv.exe ============================== Empty the Recycle Bin. ============================== Go to Start > Run and type %temp% in the Run box, press OK . The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of that Temp folder. Then go to C:\windows\temp and select EVERYTHING except temporary internet files, cookies and history folders and delete all that and then do the same for C:\temp 1) Open Control Panel 2) Click on Internet Options 3) On the General Tab, in the middle of the screen, click on Delete Files 4) Check the box "Delete all offline content" 5) Click on OK.....wait for the hourglass icon to stop after it deletes the temporary internet files 6) You can now click on "Delete Cookies" and click OK to delete cookies that websites have placed on your hard drive. Re-boot normally and post another H/T log.
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals Microsoft MVP Security |
