New here...can you look at my LOG for probs?

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.
I

inkster218

Thread Starter
Joined
Apr 20, 2004
Messages
3
Hiya,

Was hoping someone could look at my log file and tell what they might see.

I ran CWSSHREDDER, Adaware, hijackthis, spybot.

Thanks ahead of time!
Curt
--------------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 11:08:45 PM, on 4/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\CurtW\My Documents\My Received Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.yahoo.com
R3 - Default URLSearchHook is missing
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 ieautosearch
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 1 08.185.87.174.liveadvert.com
O1 - Hosts: 5.87.49.liveadvert.com
O1 - Hosts: 207.36.196.189 ieautosearch
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: ert.com
O1 - Hosts: 08.185.87.73.liveadvert.com
O1 - Hosts: 207.36.196.189 ieautosearch
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: ert.com
O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: entries inserted by Spybot - Search & Destroy
O1 - Hosts: 207.36.196.189 #earch.netscape.com
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: 207.36.196.189 #eautosearch
O1 - Hosts: ert.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe
O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe
O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/164b48f673e9f14f4818/netzip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37993.9118981482
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.webcamnow.com/voice/voice.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
 
M

mjack547

Malware Specialist
Joined
Sep 1, 2003
Messages
3,181
Welcome to TSG

un an online antivirus check from at least one and preferably 2 of the following sites
http://security.symantec.com/default.asp?
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/
http://www.ravantivirus.com/scan/
http://www.anti-trojan.net/en/onlinecheck.aspx
make sure autoclean is enabled on the scans

Than

Run hijackthis and fix the following items. Be sure all windows are closed except for hijackthis

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 ieautosearch


O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 1 08.185.87.174.liveadvert.com

O1 - Hosts: 5.87.49.liveadvert.com

O1 - Hosts: 207.36.196.189 ieautosearch

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: ert.com

O1 - Hosts: 08.185.87.73.liveadvert.com

O1 - Hosts: 207.36.196.189 ieautosearch

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: ert.com

O1 - Hosts: 207.36.196.189 auto.search.msn.com

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: entries inserted by Spybot - Search & Destroy

O1 - Hosts: 207.36.196.189 #earch.netscape.com

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: 207.36.196.189 #eautosearch

O1 - Hosts: ert.com

O1 - Hosts: 207.36.196.189 search.netscape.com

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/164b48f...ip/RdxIE601.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab


Reboot and post a new hijackthis log
 
I

inkster218

Thread Starter
Joined
Apr 20, 2004
Messages
3
Logfile of HijackThis v1.97.7
Scan saved at 1:18:00 AM, on 4/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\CurtW\My Documents\My Received Files\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.yahoo.com
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe
O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe
O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4169B5A0-9048-11D6-BDFF-00C0F024AF20} (ActiveXTester.TesterControl) - http://www.jasons-toolbox.com/BrowserSecurity/ActiveXTester/ActiveXTester.ocx
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37993.9118981482
O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.webcamnow.com/voice/voice.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
 
Flrman1

Flrman1

Joined
Jul 26, 2002
Messages
46,349
Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"

O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe

O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe

O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe

Restart to safe mode.

How to start your computer in safe mode

First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Now find and delete:

The C:\WINDOWS\GQWRL.exe file
The C:\WINDOWS\FIPVC.exe file
The C:\WINDOWS\DJQXAHN.exe file
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Total: 564 (members: 10, guests: 554)
Top