1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

New here...can you look at my LOG for probs?

Discussion in 'Virus & Other Malware Removal' started by inkster218, Apr 20, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. inkster218

    inkster218 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    Hiya,

    Was hoping someone could look at my log file and tell what they might see.

    I ran CWSSHREDDER, Adaware, hijackthis, spybot.

    Thanks ahead of time!
    Curt
    --------------------------------------------
    Logfile of HijackThis v1.97.7
    Scan saved at 11:08:45 PM, on 4/19/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\CurtW\My Documents\My Received Files\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.yahoo.com
    R3 - Default URLSearchHook is missing
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 ieautosearch
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 1 08.185.87.174.liveadvert.com
    O1 - Hosts: 5.87.49.liveadvert.com
    O1 - Hosts: 207.36.196.189 ieautosearch
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: ert.com
    O1 - Hosts: 08.185.87.73.liveadvert.com
    O1 - Hosts: 207.36.196.189 ieautosearch
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: ert.com
    O1 - Hosts: 207.36.196.189 auto.search.msn.com
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: entries inserted by Spybot - Search & Destroy
    O1 - Hosts: 207.36.196.189 #earch.netscape.com
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: 207.36.196.189 #eautosearch
    O1 - Hosts: ert.com
    O1 - Hosts: 207.36.196.189 search.netscape.com
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe
    O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe
    O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/164b48f673e9f14f4818/netzip/RdxIE601.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37993.9118981482
    O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.webcamnow.com/voice/voice.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
     
    inkster218, Apr 20, 2004
    #1
  2. inkster218

    inkster218 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    anyone?
     
    inkster218, Apr 26, 2004
    #2
  3. mjack547

    mjack547 Malware Specialist

    Joined:
    Sep 1, 2003
    Messages:
    3,181
    Welcome to TSG

    un an online antivirus check from at least one and preferably 2 of the following sites
    http://security.symantec.com/default.asp?
    http://housecall.trendmicro.com/
    http://www.pandasoftware.com/activescan/
    http://www.ravantivirus.com/scan/
    http://www.anti-trojan.net/en/onlinecheck.aspx
    make sure autoclean is enabled on the scans

    Than

    Run hijackthis and fix the following items. Be sure all windows are closed except for hijackthis

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = res://C:\WINDOWS\System32\foed.dll/sp.html (obfuscated)

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    R3 - Default URLSearchHook is missing

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 ieautosearch


    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 1 08.185.87.174.liveadvert.com

    O1 - Hosts: 5.87.49.liveadvert.com

    O1 - Hosts: 207.36.196.189 ieautosearch

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: ert.com

    O1 - Hosts: 08.185.87.73.liveadvert.com

    O1 - Hosts: 207.36.196.189 ieautosearch

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: ert.com

    O1 - Hosts: 207.36.196.189 auto.search.msn.com

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: entries inserted by Spybot - Search & Destroy

    O1 - Hosts: 207.36.196.189 #earch.netscape.com

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: 207.36.196.189 #eautosearch

    O1 - Hosts: ert.com

    O1 - Hosts: 207.36.196.189 search.netscape.com

    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/164b48f...ip/RdxIE601.cab

    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab


    Reboot and post a new hijackthis log
     
    mjack547, Apr 26, 2004
    #3
  4. inkster218

    inkster218 Thread Starter

    Joined:
    Apr 20, 2004
    Messages:
    3
    Logfile of HijackThis v1.97.7
    Scan saved at 1:18:00 AM, on 4/27/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Yahoo!\Messenger\ypager.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\CurtW\My Documents\My Received Files\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.yahoo.com
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe
    O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe
    O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {4169B5A0-9048-11D6-BDFF-00C0F024AF20} (ActiveXTester.TesterControl) - http://www.jasons-toolbox.com/BrowserSecurity/ActiveXTester/ActiveXTester.ocx
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://www.webcamnow.com/broadcast/ActiveXWebCam.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37993.9118981482
    O16 - DPF: {BB95299D-B65B-47E0-8DDB-697A66298C3A} (UniVoiceX Control) - http://www.webcamnow.com/voice/voice.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
     
    inkster218, Apr 27, 2004
    #4
  5. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"

    O4 - HKLM\..\Run: [GQWRL] C:\WINDOWS\GQWRL.exe

    O4 - HKLM\..\Run: [FIPVC] C:\WINDOWS\FIPVC.exe

    O4 - HKLM\..\Run: [DJQXAHN] C:\WINDOWS\DJQXAHN.exe

    Restart to safe mode.

    How to start your computer in safe mode

    First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Now find and delete:

    The C:\WINDOWS\GQWRL.exe file
    The C:\WINDOWS\FIPVC.exe file
    The C:\WINDOWS\DJQXAHN.exe file
     
    Flrman1, Apr 27, 2004
    #5

  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - here probs
  1. dnnspnglnn

    In Progress Where to store files before doing a full format on laptop

    dnnspnglnn, Jan 19, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    341
    iMacg3
    Jan 19, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/222141

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice