Solved: Help - IE loads on start up ????

[craigtuplin]

just installed a new hard drive. i have installed windows xp home. updated it and all seems fine. but... each time i turn my pc on internet explorer opens, and it trys to load a page at www.mynbx247.info. i have also noticed that 3 programs keep installing them selfs. i have removed them in control pannel, but they come back on start up.
these programs are media access, 180search and select cash back.
i have scanned and cleared any viruses. and im now clean.
i have ran ad aware and cleared these
i have run Registry Optimizer
i have run Spybot - Search & Destroy
all seems fine but i still have these three programs and the ie issue.
having read some post on this site i have run hijackthis and its shows the following
Logfile of HijackThis v1.98.2
Scan saved at 12:02:33, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\seoyztv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Craig Tuplin\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [REGRUN] C:\WINDOWS\System32\seoyztv.exe
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccess/ie/bridge-c5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119797794627
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4519/mcfscan.cab

i really hope someone can help.

thanks

 

[Flrman1]

Hi craigtuplin

Welcome to TSG!

A new version of Hijack This has been released so get rid of the old one and Click here to download the new one, come back here and post the log from it.

Before you post the new log, run ActiveScan online virus scan here

When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
- Save the results from the scan!

Post a new HiJackThis log along with the results from ActiveScan

 

[craigtuplin]

thanks for helping me

maybe i was not as clean as i thought.
ran panda virus scan and it found 50+ viruses see log below
i had to load windows in safe mode to delete all these files. which i have now done.

Incident Status Location

Adware:Adware/MediaTickets No disinfected C:\WINDOWS\System32\seoyztv.exe
Spyware:Spyware/Dyfuca No disinfected Windows Registry
Adware:Adware/XPlugin No disinfected C:\WINDOWS\system32\xplugin.dll
Spyware:Spyware/ISTbar No disinfected C:\DOCUME~1\CRAIGT~1\LOCALS~1\Temp\iinstall.exe
Adware:Adware/SAHAgent No disinfected Windows Registry
Adware:Adware/Apropos No disinfected C:\DOCUME~1\CRAIGT~1\LOCALS~1\Temp\cfout.txt
Adware:Adware/MediaTickets No disinfected Windows Registry
Adware:Adware/BlazeFind No disinfected C:\DOCUME~1\CRAIGT~1\LOCALS~1\Temp\Installer?.exe
Adware:Adware/WUpd No disinfected Windows Registry
Adware:Adware/Admess No disinfected C:\WINDOWS\system32\tmp3.txt
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\180sainstallernusalm.exe
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del1C.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del29.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del3.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del36.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del4.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del5.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del53.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del6.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del7.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del7B.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del8.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\Del9.tmp
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\hghhf.exe
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\iinstall.exe
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\nsz2.tmp\remover.dll
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res4.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res5.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res6.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res7.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res8.tmp
Adware:Adware/nCase No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\res9.tmp
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\temp.frB6C9\MediaAccC.dll
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temp\temp.frB827\MediaAccC.dll
Virus:Exploit/IEPageSpoof Disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\134X0B5Z\crackz[1].htm
Spyware:Spyware/XXXToolbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\134X0B5Z\prompt[2].php
Spyware:Spyware/XXXToolbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\45UJO1YF\CAFZYO3O.HTM
Spyware:Spyware/Dyfuca No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\HW16I8MU\EULA[1].ctxt[EULA[1].ctxt]
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\HW16I8MU\index3[1].htm
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\HW16I8MU\istdownload[1].exe
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\HW16I8MU\protect_regular[1].cab
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\HW16I8MU\protect_regular[1].cab[ISTprotect.dll]
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\UFANILAV\bridge-c5[1].cab[MediaAccX.dll]
Adware:Adware/WUpd No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\UFANILAV\MediaAccC[1].dll
Spyware:Spyware/Dyfuca No disinfected C:\Documents and Settings\Craig Tuplin\Local Settings\Temporary Internet Files\Content.IE5\VZ57BHGS\nem220[1].dll
Adware:Adware/PurityScan No disinfected C:\Documents and Settings\Craig Tuplin\mt-uninstaller.exe
Adware:Adware/nCase No disinfected C:\RECYCLER\S-1-5-21-2025429265-1303643608-1417001333-1004\Dc3\backup-20050628-103203-693.dll
Spyware:Spyware/ISTbar No disinfected C:\RECYCLER\S-1-5-21-2025429265-1303643608-1417001333-1004\Dc3\backup-20050628-103538-330.dll
Adware:Adware/WUpd No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaAccX.dll
Spyware:Spyware/Dyfuca No disinfected C:\WINDOWS\nem220.dll_tobedeleted
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\system32\520lr7om.dll
Adware:Adware/MediaTickets No disinfected C:\WINDOWS\system32\seoyztv.exe
Adware:Adware/XPlugin No disinfected C:\WINDOWS\system32\tksrv99.exe
Adware:Adware/Admess No disinfected C:\WINDOWS\system32\tmp3.txt
Adware:Adware/Admess No disinfected C:\WINDOWS\system32\uc1362.exe
Adware:Adware/Admess No disinfected C:\WINDOWS\system32\ucsl.exe
Adware:Adware/XPlugin No disinfected C:\WINDOWS\system32\xplugin.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\uenvhdgd.exe


when i restarted the ie window did not come (we are gettting somewhere). so i ran virus scan again.this was the log.


Incident Status Location

Spyware:Spyware/Dyfuca No disinfected Windows Registry
Adware:Adware/WUpd No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaAccX.dll

dont know what dto do with the windows registry one and i cant find the conflict.1 folder at all. so i search for mediaaccx.dll. not found.

then ran the new hjackthis program, results below.

Logfile of HijackThis v1.99.1
Scan saved at 14:42:26, on 28/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Craig Tuplin\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [REGRUN] C:\WINDOWS\System32\seoyztv.exe
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab



please advise me as what to do next.

what pop up blocker and firewall would you recomend, if any?

 

[Flrman1]

* Go here to download CCleaner.

• Install CCleaner
• Launch CCleaner and look in the upper right corner and click on the "Options" button.
• Click "Advanced" and remove the check by "Only delete files in Windows temp folders older than 48 hours".
• Click OK
• Do not run CCleaner yet. You will run it later in safe mode.

* Click Here and download Killbox and save it to your desktop.


* Click here for info on how to boot to safe mode if you don't already know how.


* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to.


* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe

O4 - HKLM\..\Run: [REGRUN] C:\WINDOWS\System32\seoyztv.exe

O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe

O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe


* Restart your computer into safe mode now. Perform the following steps in safe mode:


* Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

C:\WINDOWS\System32\syslog32.exe

C:\WINDOWS\syslog32.exe

C:\WINDOWS\System32\libsysmgr.exe

C:\WINDOWS\libsysmgr.exe

C:\WINDOWS\System32\seoyztv.exe

C:\WINDOWS\system32\xplugin.dll

C:\WINDOWS\system32\tmp3.txt

C:\Documents and Settings\Craig Tuplin\mt-uninstaller.exe

C:\WINDOWS\Downloaded Program Files\CONFLICT.1\MediaAccX.dll

C:\WINDOWS\nem220.dll_tobedeleted

C:\WINDOWS\system32\520lr7om.dll

C:\WINDOWS\system32\tksrv99.exe

C:\WINDOWS\system32\uc1362.exe

C:\WINDOWS\system32\ucsl.exe

C:\WINDOWS\system32\xplugin.dll

C:\WINDOWS\uenvhdgd.exe

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

Exit the Killbox.


* Start Ccleaner and click Run Cleaner


* Go to Control Panel > Internet Options. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


* Restart back into Windows normally now.


* Go here and do an online virus scan. Choose "Complete Scan" and select all drives to scan.

When the scan is finished, anything that it cannot clean have it delete it. Click "Print Report". The report will open in your browser. Go to File > Save As and save the file to your desktop. Under "Save as type" click the dropdown menu and choose "Text file (*.txt) and save it as a text file.

Post a new HiJackThis log along with the report from the Housecall scan

 

[craigtuplin]

here we go

Trend Micro Housecall Virus ScanNo virus detected


Results:
We have detected 0 infected file(s) with 0 virus(es) on your
computer. Only 0 out of 0 infected files are displayed.
Detected FileAssociated Virus Name




Trojan/Worm CheckNo worm/Trojan horse detected

What we checked:
Malicious activity by a Trojan horse program. Although a
Trojan seems like a harmless program, it contains malicious
code and once installed can cause damage to your computer.
Results:
We have detected 0 Trojan horse program(s) and worm(s) on your
computer. Only 0 out of 0 Trojan horse programs and worms are
displayed.
Trojan/Worm NameTrojan/Worm Type




Spyware CheckNo spyware program detected

What we checked:
Whether personal information was tracked and reported by
spyware. Spyware is often installed secretly with legitimate
programs downloaded from the Internet.
Results:
We have detected 0 spyware(s) on your computer. Only 0 out of
0 spywares are displayed.
Spyware NameSpyware Type




Microsoft Vulnerability CheckNo vulnerability detected

What we checked:
Microsoft known security vulnerabilities. These are issues
Microsoft has identified and released Critical Updates to fix.

Results:
We have detected 0 vulnerability/vulnerabilities on your
computer. Only 0 out of 0 vulnerabilities are displayed.
Risk LevelIssueHow to Fix




Logfile of HijackThis v1.99.1
Scan saved at 10:25:28, on 29/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Craig Tuplin\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

am i now sorted???

thnaks for ur help.

 

[Flrman1]

am i now sorted???

You're clean, but I see that you do not have an antivirus running or a firewall. If I may so this without being rude, with the net as it is these days it is quite foolish to be without an antivirus and a firewall. By all means get both ASAP!. See this thread for some good free ones.


Now turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a restore point:

Single-click Start and point to All Programs.
Mouse over Accessories, then System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done.

Check this out for info on how to tighten your security settings and some good free tools to help prevent this from happening again.

 

[Flrman1]

Since this problem has been solved, I'm closing this thread. If you need it reopened please PM me or one of the other mods.

Anyone else with a similar problem please start a "New Thread".