Login  Search | |
| |
30-Oct-2003, 09:17 AM
#1 | |||||
| Please help with hijackthis log file |
| |
30-Oct-2003, 09:45 AM
#2 | |||||
| Hi tnpuddleduck, and welcome to TSG..  Please run a new HJT! Scan, and check to fix the following entries. Next, close all browser windows and click the Fix checked button… O1 - Hosts: 66.118.163.109 auto.search.msn.com O4 - HKLM\..\Run: [C:\WINDOWS\SYSTEM\gone.scr] C:\WINDOWS\SYSTEM\gone.scr O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot O13 - DefaultPrefix: http://ehttp.cc/? O13 - WWW Prefix: http://ehttp.cc/? O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://netcenter.ea.com/downloads/g...py/iesnoopy.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805...uditControl.cab Then please serch for and delete the following bolded file.. C:\WINDOWS\SYSTEM\gone.scr Then could you go here and run the online virus scan. Delete all it finds. Then please reboot and download Spybot - Search & Destroy, from here: if you haven't already got the program. Now press Settings, and Settings again. Go to the Webupdate section, and check "Display also available beta versions". Now press Online, and search for, put a check mark at, and install all updates. Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all it finds marked RED. After that, please reboot and post a new log. Cheers Liam
__________________ "You cannot reason someone out of a position that they did not reason themselves into in the first place." AnonGive a man a fish, and he may eat for a day; but teach a man to fish, and he can sit in a boat all day, drinking beer.  A proud member of the Alliance of Security Analysis Professionals since 2004. |
30-Oct-2003, 12:26 PM
#3 | |||||
| |
30-Oct-2003, 01:18 PM
#5 | |||||
| Hi, tnpuddleduck, As far as Spybot is concerned, that explanation is for first time users. If you already have it and keep it upto date, then your fine just running it as stated.  With the virus scan, it's actually done online, with you downloading the activex control, first. You've now got that, as can be seen in the last entry in your new log. The reason for doing this scan is that the gone.scr entry is a virus. See here for info. Running a scan with Housecall will make sure that, although it doesn't show in the log now, all references to it are deleted. Could you please go back to that page I gave the link to, select the country you're in, then press the Go button. Then on the next page shown, just click the Scan Now button (as shown in the attached image). Apart from that you have a clean log... Cheers Liam
__________________ "You cannot reason someone out of a position that they did not reason themselves into in the first place." AnonGive a man a fish, and he may eat for a day; but teach a man to fish, and he can sit in a boat all day, drinking beer. A proud member of the Alliance of Security Analysis Professionals since 2004. |
13-Nov-2003, 07:05 AM
#9 | |||||
| |
13-Nov-2003, 07:09 AM
#10 | |||||
| Hi scarlettsilk, Please post your log in your own thread, and we will take it from there: http://forums.techguy.org/t179256/s.html Regards, Pieter PS Hi TomCoyote |
08-Jul-2004, 09:42 PM
#15 | |||||
| I'm going to request that your thread's separated from this one. Attaching a new thread to an old one's a REALLY REALLY bad idea...you'll often get overlooked. No big deal, it's for your benefit.  |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Twitter! |
TechGuy.TV |
Mobile |
Advertise | You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 11:13 PM. Copyright © 1996 - 2010 TechGuy, Inc. All rights reserved. |  |
