1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

can someone please check my BIG HijackThis log.

Discussion in 'Virus & Other Malware Removal' started by valkje, Aug 21, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. valkje

    valkje Thread Starter

    Joined:
    Aug 21, 2003
    Messages:
    4
    I have made a log with HijackThis
    I dont realy have any problems with my computer but the log is a little bit full of crap. :(

    Can someone please analize my log and tell me what i can remove??

    thanx

    Greetz Valkje


    -----------------------------------------------------------------------------------
    Logfile of HijackThis v1.96.1
    Scan saved at 19:51:48, on 21-8-2003
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\NMapWin\bin\nmapserv.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\CTHELPER.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\ICQ\ICQ.exe
    C:\Program Files\Kazaa Lite\kazaalite.kpp
    C:\Program Files\Kazaa Lite\speed up.exe
    H:\ie6setup.exe
    C:\DOCUME~1\MVALKE~1\LOCALS~1\Temp\IXP000.TMP\ie6wzd.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    H:\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ok-search.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.findthewebsiteyouneed.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ok-search.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O1 - Hosts: 66.159.20.80 www1.ndhosting.com
    O1 - Hosts: 66.159.20.80 www3.ndhosting.com
    O1 - Hosts: 66.159.20.80 www2.ndhosting.com
    O1 - Hosts: 66.159.20.80 www.ndhosting.com
    O1 - Hosts: 66.159.20.80 www.kinghost.com
    O1 - Hosts: 66.159.20.80 kinghost.com
    O1 - Hosts: 66.159.20.80 www1.kinghost.com
    O1 - Hosts: 66.159.20.80 www2.kinghost.com
    O1 - Hosts: 66.159.20.80 www3.kinghost.com
    O1 - Hosts: 66.159.20.80 www4.kinghost.com
    O1 - Hosts: 66.159.20.80 www5.kinghost.com
    O1 - Hosts: 66.159.20.80 www6.kinghost.com
    O1 - Hosts: 66.159.20.80 www7.kinghost.com
    O1 - Hosts: 66.159.20.80 www8.kinghost.com
    O1 - Hosts: 66.159.20.80 www9.kinghost.com
    O1 - Hosts: 66.159.20.80 www10.kinghost.com
    O1 - Hosts: 66.159.20.80 www.smutserver.com
    O1 - Hosts: 66.159.20.80 smutserver.com
    O1 - Hosts: 66.159.20.80 www1.smutserver.com
    O1 - Hosts: 66.159.20.80 www2.smutserver.com
    O1 - Hosts: 66.159.20.80 www16.smutserver.com
    O1 - Hosts: 66.159.20.80 www3.smutserver.com
    O1 - Hosts: 66.159.20.80 www4.smutserver.com
    O1 - Hosts: 66.159.20.80 www5.smutserver.com
    O1 - Hosts: 66.159.20.80 www6.smutserver.com
    O1 - Hosts: 66.159.20.80 www7.smutserver.com
    O1 - Hosts: 66.159.20.80 www8.smutserver.com
    O1 - Hosts: 66.159.20.80 www9.smutserver.com
    O1 - Hosts: 66.159.20.80 www10.smutserver.com
    O1 - Hosts: 66.159.20.80 www11.smutserver.com
    O1 - Hosts: 66.159.20.80 www12.smutserver.com
    O1 - Hosts: 66.159.20.80 www13.smutserver.com
    O1 - Hosts: 66.159.20.80 www14.smutserver.com
    O1 - Hosts: 66.159.20.80 www15.smutserver.com
    O1 - Hosts: 66.159.20.80 www17.smutserver.com
    O1 - Hosts: 66.159.20.80 www18.smutserver.com
    O1 - Hosts: 66.159.20.80 www19.smutserver.com
    O1 - Hosts: 66.159.20.80 www20.smutserver.com
    O1 - Hosts: 66.159.20.80 www21.smutserver.com
    O1 - Hosts: 66.159.20.80 www22.smutserver.com
    O1 - Hosts: 66.159.20.80 www23.smutserver.com
    O1 - Hosts: 66.159.20.80 www24.smutserver.com
    O1 - Hosts: 66.159.20.80 www25.smutserver.com
    O1 - Hosts: 66.159.20.80 www26.smutserver.com
    O1 - Hosts: 66.159.20.80 www27.smutserver.com
    O1 - Hosts: 66.159.20.80 www28.smutserver.com
    O1 - Hosts: 66.159.20.80 www29.smutserver.com
    O1 - Hosts: 66.159.20.80 www30.smutserver.com
    O1 - Hosts: 66.159.20.80 www31.smutserver.com
    O1 - Hosts: 66.159.20.80 www32.smutserver.com
    O1 - Hosts: 66.159.20.80 agreathost.net
    O1 - Hosts: 66.159.20.80 www.agreathost.net
    O1 - Hosts: 66.159.20.80 hotfreehost.com
    O1 - Hosts: 66.159.20.80 www.hotfreehost.com
    O1 - Hosts: 66.159.20.80 greatfreehost.com
    O1 - Hosts: 66.159.20.80 www.greatfreehost.com
    O1 - Hosts: 66.159.20.80 freesmutpages.com
    O1 - Hosts: 66.159.20.80 www.freesmutpages.com
    O1 - Hosts: 66.159.20.80 apornhost.com
    O1 - Hosts: 66.159.20.80 www.apornhost.com
    O1 - Hosts: 66.159.20.80 nasty-pages.com
    O1 - Hosts: 66.159.20.80 www.nasty-pages.com
    O1 - Hosts: 66.159.20.80 sexyfreehost.com
    O1 - Hosts: 66.159.20.80 www.sexyfreehost.com
    O1 - Hosts: 66.159.20.80 x4web.com
    O1 - Hosts: 66.159.20.80 www.x4web.com
    O1 - Hosts: 66.159.20.80 sexplanets.com
    O1 - Hosts: 66.159.20.80 www.sexplanets.com
    O1 - Hosts: 66.159.20.80 maxismut.com
    O1 - Hosts: 66.159.20.80 www.maxismut.com
    O1 - Hosts: 66.159.20.80 tgpfriendly.com
    O1 - Hosts: 66.159.20.80 www.tgpfriendly.com
    O1 - Hosts: 66.159.20.80 tgp-server.com
    O1 - Hosts: 66.159.20.80 www.tgp-server.com
    O1 - Hosts: 66.159.20.80 magnaplza.com
    O1 - Hosts: 66.159.20.80 www.magnaplza.com
    O1 - Hosts: 66.159.20.80 free-xxx-server.com
    O1 - Hosts: 66.159.20.80 www.free-xxx-server.com
    O1 - Hosts: 66.159.20.80 libereco.net
    O1 - Hosts: 66.159.20.80 www.libereco.net
    O1 - Hosts: 66.159.20.80 0190-dialer.com
    O1 - Hosts: 66.159.20.80 www.0190-dialer.com
    O1 - Hosts: 66.159.20.80 xxxod.net
    O1 - Hosts: 66.159.20.80 www.xxxod.net
    O1 - Hosts: 66.159.20.80 altsights.com
    O1 - Hosts: 66.159.20.80 www.altsights.com
    O1 - Hosts: 66.159.20.80 adulthosting.com
    O1 - Hosts: 66.159.20.80 www.adulthosting.com
    O1 - Hosts: 66.159.20.80 superhova.com
    O1 - Hosts: 66.159.20.80 www.superhova.com
    O1 - Hosts: 66.159.20.80 bestpornhost.com
    O1 - Hosts: 66.159.20.80 www.bestpornhost.com
    O1 - Hosts: 66.159.20.80 hostingfree.com
    O1 - Hosts: 66.159.20.80 www.hostingfree.com
    O1 - Hosts: 66.159.20.80 xfreehosting.com
    O1 - Hosts: 66.159.20.80 www.xfreehosting.com
    O1 - Hosts: 66.159.20.80 blinghosting.com
    O1 - Hosts: 66.159.20.80 www.blinghosting.com
    O1 - Hosts: 66.159.20.80 x-x-x-hosting.com
    O1 - Hosts: 66.159.20.80 www.x-x-x-hosting.com
    O1 - Hosts: 66.159.20.80 pornparks.com
    O2 - BHO: (no name) - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - (no file)
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Go!Zilla\GoIEHlp.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MS7531] "C:\WINDOWS\System32\ms7531.exe"
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [NetPumper] "C:\Program Files\NetPumper\NetPumperIEProxy.exe"
    O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
    O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [WeatherCast] C:\PROGRA~1\WEATHE~1\Weather.exe /q
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
    O8 - Extra context menu item: Download with NetPumper - C:\Program Files\NetPumper\AddUrl.htm
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=www.viewpoint.com
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {1B2EA84A-E365-46BC-883A-F7872DA015CE} (ConEd) - http://localhost/test/contenteditor/coned.cab
    O16 - DPF: {214868A8-F71B-473E-8ECF-6EE1DE6B91D8} - http://pms.localscripts.nl/plugins/2/ms7531_nl.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/sikes/nl/win/QuickTimeInstaller.exe
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) -
    O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1C668BCA-B0A6-4CCB-BBF3-327A010F53E6}: NameServer = 194.134.5.5 194.134.0.97
    -----------------------------------------------------------------------------------
     
  2. jm100dm

    jm100dm

    Joined:
    May 26, 1999
    Messages:
    994
  3. jm100dm

    jm100dm

    Joined:
    May 26, 1999
    Messages:
    994
  4. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,220
    First Name:
    Derek
    Do this:

    Download Spybot - Search & Destroy from http://security.kolla.de

    After installing, first press Online, and search for, put a check mark at, and install all updates.
    Next, close all Internet Explorer and OE windows, hit 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    That ought to get rid of most of your spyware.
    then download & run adaware, from http://www.lavasoft.de

    open adaware & check for updates first then run it.

    then post a new hijackthis log so we can see if anything is left
     
  5. jm100dm

    jm100dm

    Joined:
    May 26, 1999
    Messages:
    994
    I would also recommend removing this one.

    O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Go!Zilla\GoIEHlp.dll

    Go'Zilla is a download manager. It contains spyware/adware. Alternatives are available with the same functionality (and more) that do not contain spyware/adware.

    Run highjackthis and check all the 01 host items and have them fixed.

    Download spybot and update. Run it to remove any that I may have missed. Any red ones can be fixed. You can get the link for it below.

    http://forums.techguy.org/t110854/s.html
     
  6. valkje

    valkje Thread Starter

    Joined:
    Aug 21, 2003
    Messages:
    4
    thanx !!!
    to all of you !
     
  7. jm100dm

    jm100dm

    Joined:
    May 26, 1999
    Messages:
    994
    Thanks for jumping in Derek. I did not want to leave him hanging but must be going.
     
  8. Die Hard

    Die Hard

    Joined:
    Apr 5, 2003
    Messages:
    267
    valkje :)

    Close all open IE and Explorer windows plus all running apps and put a checkmark to the left of those items,make sure you get them all . Then reboot.

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ok-search.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.findthewebsiteyouneed.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ok-search.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
    O1 - Hosts: 66.159.20.80 www1.ndhosting.com
    O1 - Hosts: 66.159.20.80 www3.ndhosting.com
    O1 - Hosts: 66.159.20.80 www2.ndhosting.com
    O1 - Hosts: 66.159.20.80 www.ndhosting.com
    O1 - Hosts: 66.159.20.80 www.kinghost.com
    O1 - Hosts: 66.159.20.80 kinghost.com
    O1 - Hosts: 66.159.20.80 www1.kinghost.com
    O1 - Hosts: 66.159.20.80 www2.kinghost.com
    O1 - Hosts: 66.159.20.80 www3.kinghost.com
    O1 - Hosts: 66.159.20.80 www4.kinghost.com
    O1 - Hosts: 66.159.20.80 www5.kinghost.com
    O1 - Hosts: 66.159.20.80 www6.kinghost.com
    O1 - Hosts: 66.159.20.80 www7.kinghost.com
    O1 - Hosts: 66.159.20.80 www8.kinghost.com
    O1 - Hosts: 66.159.20.80 www9.kinghost.com
    O1 - Hosts: 66.159.20.80 www10.kinghost.com
    O1 - Hosts: 66.159.20.80 www.smutserver.com
    O1 - Hosts: 66.159.20.80 smutserver.com
    O1 - Hosts: 66.159.20.80 www1.smutserver.com
    O1 - Hosts: 66.159.20.80 www2.smutserver.com
    O1 - Hosts: 66.159.20.80 www16.smutserver.com
    O1 - Hosts: 66.159.20.80 www3.smutserver.com
    O1 - Hosts: 66.159.20.80 www4.smutserver.com
    O1 - Hosts: 66.159.20.80 www5.smutserver.com
    O1 - Hosts: 66.159.20.80 www6.smutserver.com
    O1 - Hosts: 66.159.20.80 www7.smutserver.com
    O1 - Hosts: 66.159.20.80 www8.smutserver.com
    O1 - Hosts: 66.159.20.80 www9.smutserver.com
    O1 - Hosts: 66.159.20.80 www10.smutserver.com
    O1 - Hosts: 66.159.20.80 www11.smutserver.com
    O1 - Hosts: 66.159.20.80 www12.smutserver.com
    O1 - Hosts: 66.159.20.80 www13.smutserver.com
    O1 - Hosts: 66.159.20.80 www14.smutserver.com
    O1 - Hosts: 66.159.20.80 www15.smutserver.com
    O1 - Hosts: 66.159.20.80 www17.smutserver.com
    O1 - Hosts: 66.159.20.80 www18.smutserver.com
    O1 - Hosts: 66.159.20.80 www19.smutserver.com
    O1 - Hosts: 66.159.20.80 www20.smutserver.com
    O1 - Hosts: 66.159.20.80 www21.smutserver.com
    O1 - Hosts: 66.159.20.80 www22.smutserver.com
    O1 - Hosts: 66.159.20.80 www23.smutserver.com
    O1 - Hosts: 66.159.20.80 www24.smutserver.com
    O1 - Hosts: 66.159.20.80 www25.smutserver.com
    O1 - Hosts: 66.159.20.80 www26.smutserver.com
    O1 - Hosts: 66.159.20.80 www27.smutserver.com
    O1 - Hosts: 66.159.20.80 www28.smutserver.com
    O1 - Hosts: 66.159.20.80 www29.smutserver.com
    O1 - Hosts: 66.159.20.80 www30.smutserver.com
    O1 - Hosts: 66.159.20.80 www31.smutserver.com
    O1 - Hosts: 66.159.20.80 www32.smutserver.com
    O1 - Hosts: 66.159.20.80 agreathost.net
    O1 - Hosts: 66.159.20.80 www.agreathost.net
    O1 - Hosts: 66.159.20.80 hotfreehost.com
    O1 - Hosts: 66.159.20.80 www.hotfreehost.com
    O1 - Hosts: 66.159.20.80 greatfreehost.com
    O1 - Hosts: 66.159.20.80 www.greatfreehost.com
    O1 - Hosts: 66.159.20.80 freesmutpages.com
    O1 - Hosts: 66.159.20.80 www.freesmutpages.com
    O1 - Hosts: 66.159.20.80 apornhost.com
    O1 - Hosts: 66.159.20.80 www.apornhost.com
    O1 - Hosts: 66.159.20.80 nasty-pages.com
    O1 - Hosts: 66.159.20.80 www.nasty-pages.com
    O1 - Hosts: 66.159.20.80 sexyfreehost.com
    O1 - Hosts: 66.159.20.80 www.sexyfreehost.com
    O1 - Hosts: 66.159.20.80 x4web.com
    O1 - Hosts: 66.159.20.80 www.x4web.com
    O1 - Hosts: 66.159.20.80 sexplanets.com
    O1 - Hosts: 66.159.20.80 www.sexplanets.com
    O1 - Hosts: 66.159.20.80 maxismut.com
    O1 - Hosts: 66.159.20.80 www.maxismut.com
    O1 - Hosts: 66.159.20.80 tgpfriendly.com
    O1 - Hosts: 66.159.20.80 www.tgpfriendly.com
    O1 - Hosts: 66.159.20.80 tgp-server.com
    O1 - Hosts: 66.159.20.80 www.tgp-server.com
    O1 - Hosts: 66.159.20.80 magnaplza.com
    O1 - Hosts: 66.159.20.80 www.magnaplza.com
    O1 - Hosts: 66.159.20.80 free-xxx-server.com
    O1 - Hosts: 66.159.20.80 www.free-xxx-server.com
    O1 - Hosts: 66.159.20.80 libereco.net
    O1 - Hosts: 66.159.20.80 www.libereco.net
    O1 - Hosts: 66.159.20.80 0190-dialer.com
    O1 - Hosts: 66.159.20.80 www.0190-dialer.com
    O1 - Hosts: 66.159.20.80 xxxod.net
    O1 - Hosts: 66.159.20.80 www.xxxod.net
    O1 - Hosts: 66.159.20.80 altsights.com
    O1 - Hosts: 66.159.20.80 www.altsights.com
    O1 - Hosts: 66.159.20.80 adulthosting.com
    O1 - Hosts: 66.159.20.80 www.adulthosting.com
    O1 - Hosts: 66.159.20.80 superhova.com
    O1 - Hosts: 66.159.20.80 www.superhova.com
    O1 - Hosts: 66.159.20.80 bestpornhost.com
    O1 - Hosts: 66.159.20.80 www.bestpornhost.com
    O1 - Hosts: 66.159.20.80 hostingfree.com
    O1 - Hosts: 66.159.20.80 www.hostingfree.com
    O1 - Hosts: 66.159.20.80 xfreehosting.com
    O1 - Hosts: 66.159.20.80 www.xfreehosting.com
    O1 - Hosts: 66.159.20.80 blinghosting.com
    O1 - Hosts: 66.159.20.80 www.blinghosting.com
    O1 - Hosts: 66.159.20.80 x-x-x-hosting.com
    O1 - Hosts: 66.159.20.80 www.x-x-x-hosting.com
    O1 - Hosts: 66.159.20.80 pornparks.com
    O2 - BHO: (no name) - {B930BA63-9E5A-11D3-A288-0000E80E2EDE- (no file)
    O2 - BHO: (no name) - {CD4C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Go!Zilla\GoIEHlp.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [MS7531] "C:\WINDOWS\System32\ms7531.exe"
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
    O4 - HKCU\..\Run: [WeatherCast] C:\PROGRA~1\WEATHE~1\Weather.exe /q
    O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) -https://components.viewpoint.com/MT...w.viewpoint.com
    O16 - DPF: {1B2EA84A-E365-46BC-883A-F7872DA015CE} (ConEd) - http://localhost/test/contenteditor/coned.cab
    O16 - DPF: {214868A8-F71B-473E-8ECF-6EE1DE6B91D8} - http://pms.localscripts.nl/plugins/2/ms7531_nl.cab

    Euronet/Backbone----is that your ISP ? O17 - HKLM\System\CCS\Services\Tcpip\..\{1C668BCA-B0A6-4CCB-BBF3-327A010F53E6}: NameServer = 194.134.5.5 194.134.0.97
    Then leave it.

    The ones in bold are optional.

    Also download AdAware6 181 fromHERE
    When installed use "webupdate" to download the latest reference file.

    Then........

    Make sure the following settings are made and on -------"ON=GREEN"
    From main window :Click "Start" then " Activate in-depth scan"

    then......

    click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

    then.........

    go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and tick "Automaticly try to unregister objects prior to deletion" and "Let windows remove files in use at next reboot"

    then...... click "proceed" to save your settings.

    Now to scan it´s just to click the "Scan" button.

    When scan is finished, copy your log-file and post it here and let´s have a look at it or mark everything found for removal.

    Die Hard :)
     
  9. IMM

    IMM

    Joined:
    Feb 1, 2002
    Messages:
    3,257
    If you can remove WhenUSave or SaveNow or Save! or GoZilla using Add/Remove programs - do so.

    Run HijackThis again and check the following items. Doublecheck so as to be sure not to miss one.
    Next, close all browser Windows, and have HT fix all checked.

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://ok-search.com/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.findthewebsiteyouneed.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ok-search.com/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
    All the O1 ewntries (should be gone if you deleted the HOSTS file)
    O4 - HKLM\..\Run: [MS7531] "C:\WINDOWS\System32\ms7531.exe"
    O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
    O4 - HKCU\..\Run: [WeatherCast] C:\PROGRA~1\WEATHE~1\Weather.exe /q
    O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
    O16 - DPF: {214868A8-F71B-473E-8ECF-6EE1DE6B91D8} - http://pms.localscripts.nl/plugins/2/ms7531_nl.cab


    Reboot when you've done this.

    Delete
    C:\WINDOWS\System32\ms7531.exe {file)
    C:\PROGRA~1\Save\ {folder)
    C:\Program Files\Go!Zilla {folder)

    Notes:
    If you've uninstalled Mass downloader - then remove this one as well
    O2 - BHO: (no name) - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - (no file)

    MS7531 is a homepage hijacker

    I've no idea what
    O16 - DPF: {1B2EA84A-E365-46BC-883A-F7872DA015CE} (ConEd) - http://localhost/test/contenteditor/coned.cab
    is.

    Do you know anything about your

    References:
    GoZilla - http://www.oit.duke.edu/ats/support/spyware/gozilla.html
    http://www.doxdesk.com/parasite/SaveNow.html

    Finally, download Spybot - Search and Destroy

    Use the beta updates - after installing, press Settings, and Settings again.
    Go to the Webupdate section, and check "Display also available beta versions".
    After installing, first press Online, and search for, put a check mark at, and install all updates.

    Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all it finds.
     
  10. IMM

    IMM

    Joined:
    Feb 1, 2002
    Messages:
    3,257
    I'm getting way too slow :D
     
  11. valkje

    valkje Thread Starter

    Joined:
    Aug 21, 2003
    Messages:
    4
    Thanx !
    REALY THANX !!!!
    if made a new log file, can you please check this out.
    i hope i got all the crap out of it !

    -----------------------------------------------------------------------------------
    Logfile of HijackThis v1.96.1
    Scan saved at 21:34:48, on 21-8-2003
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\NMapWin\bin\nmapserv.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\CTHELPER.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\ICQ\ICQ.exe
    C:\Program Files\Messenger Plus! 2\MsgPlus.exe
    C:\Program Files\Kazaa Lite\kazaalite.kpp
    C:\WINDOWS\system32\NOTEPAD.EXE
    H:\hijackthis\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/sikes/nl/win/QuickTimeInstaller.exe
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_01) -
    O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
  12. $teve

    $teve

    Joined:
    Oct 9, 2001
    Messages:
    9,396
    its squeeky clean now.......try and keep it so.

    take a trip here and download "spywaregard" and spywareblaster" keep them updated and they will help tremendously in protecting your computer from all that rubbish.:)

    http://www.javacoolsoftware.com/spywareblaster.html
     
  13. valkje

    valkje Thread Starter

    Joined:
    Aug 21, 2003
    Messages:
    4
    i want to thank you all for helping me out !!!

    greetz Valkje
     
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/158067

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice