1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: Spyware pop ups & search tool bars

Discussion in 'Web & Email' started by armiger, Feb 13, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Keep getting pop up ads and search toolbars when using ie takes over the screen now

    Anyone help?

    Thanks in advance
     
  2. JSComputing

    JSComputing

    Joined:
    Jan 8, 2005
    Messages:
    31
    I would run a program like ad-aware and check for spyware on your computer.

    Regards,

    Jacob
     
  3. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    SpywareBlaster http://www.javacoolsoftware.com/spywareblaster.html
    AdAware SE 1.05 http://www.majorgeeks.com/download506.html
    SpyBot S&D 1.3 http://www.safer-networking.org/en/download/

    DL them (they are free), install them, check each for their
    definition updates
    and then run AdAware and Spybot, fixing anything
    they say.

    In SpywareBlaster - Always enable all protection after updates
    SpyBot - After an update run immunize

    Do these and reboot before the next step.

    Then get HiJack This http://209.133.47.12/~merijn/files/HijackThis.exe , put
    it in a permanent folder (C:\HJT) , run it , DO NOT fix anything, post the
    log here.
     
  4. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Thanks for replies

    Ran spybot s+d fixed all
    Adaware froze in mid scan every time (dowloaded it from 2 different locations) so not done
    Spyware blaster, could find no reference to immunize
    Now getting "run-time error '75' Path/file access error all the time
    hijack this link dead/doesn't load
     
  5. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
  6. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Imunnize is in SpyBot

    Enable all is for SPyweare blaster

    Cheese gave another link for HJT
     
  7. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Hijack this log

    Logfile of HijackThis v1.99.0
    Scan saved at 10:54:54, on 15/02/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    c:\windows\system32\explorer.exe
    c:\windows\explorer.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    c:\windows\system32\IEXPLORE.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\windows\rundll32.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\Martyn\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fhnftpepmblktksgpgebur.n...mDbtomCWuJ7zfIlS/OSrHcgCaUICK5eH70Oxq62yM.cgi
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fnxplibpvqfmpyjgokcbxcnw...mDbtomCWuJ7zfIlS/OSqzMdPPn6H3mOH70Oxq62yM.cgi
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit32.exe,
    O1 - Hosts: 222.89.98.219 www.wo365.com
    O1 - Hosts: 222.89.98.219 cmfu.com
    O1 - Hosts: 222.89.98.219 www.cmfu.com
    O1 - Hosts: 222.89.98.219 9i0.com
    O1 - Hosts: 222.89.98.219 www.9flash.com
    O1 - Hosts: 222.89.98.219 9flash.com
    O1 - Hosts: 222.89.98.219 www.nowok.net
    O1 - Hosts: 222.89.98.219 nowok.net
    O1 - Hosts: 222.89.98.219 wisa.com.cn
    O1 - Hosts: 222.89.98.219 www.sia.com.cn
    O1 - Hosts: 222.89.98.219 www.wisa.cn
    O1 - Hosts: 222.89.98.219 wisa.cn
    O1 - Hosts: 222.89.98.219 www.zhao99.com
    O1 - Hosts: 222.89.98.219 zhao99.com
    O1 - Hosts: 222.89.98.219 www.wo123.com
    O1 - Hosts: 222.89.98.219 wo123.com
    O1 - Hosts: 222.89.98.219 wo99.com
    O1 - Hosts: 222.89.98.219 www.wo99.com
    O1 - Hosts: 222.89.98.219 www.page.com.cn
    O1 - Hosts: 222.89.98.219 page.com.cn
    O1 - Hosts: 222.89.98.219 www.432.cn
    O1 - Hosts: 222.89.98.219 432.cn
    O1 - Hosts: 222.89.98.219 wysw.com
    O1 - Hosts: 222.89.98.219 14.com.cn
    O1 - Hosts: 222.89.98.219 www.14.com.cn
    O1 - Hosts: 222.89.98.219 cnww.net
    O1 - Hosts: 222.89.98.219 www.mv99.com
    O1 - Hosts: 222.89.98.219 mv99.com
    O1 - Hosts: 222.89.98.219 www.youav.com
    O1 - Hosts: 222.89.98.219 www.mtvav.com
    O1 - Hosts: 222.89.98.219 www.98983.com
    O1 - Hosts: 222.89.98.219 98983.com
    O1 - Hosts: 222.89.98.219 www.114.com.cn
    O1 - Hosts: 222.89.98.219 114.com.cn
    O1 - Hosts: 222.89.98.219 www.net114.com
    O1 - Hosts: 222.89.98.219 www.skywz.com
    O1 - Hosts: 222.89.98.219 skywz.com
    O1 - Hosts: 222.89.98.219 www.hao6.com
    O1 - Hosts: 222.89.98.219 hao6.com
    O1 - Hosts: 222.89.98.219 www.678a.com
    O1 - Hosts: 222.89.98.219 678a.com
    O1 - Hosts: 222.89.98.219 www.7510.com
    O1 - Hosts: 222.89.98.219 7510.com
    O1 - Hosts: 222.89.98.219 www.zzkan.com
    O1 - Hosts: 222.89.98.219 zzkan.com
    O1 - Hosts: 222.89.98.219 www.ca183.com
    O1 - Hosts: 222.89.98.219 ca183.com
    O1 - Hosts: 222.89.98.219 3tom.com
    O1 - Hosts: 222.89.98.219 www.yhjm.com
    O1 - Hosts: 222.89.98.219 yhjm.com
    O1 - Hosts: 222.89.98.219 www.k369.com
    O1 - Hosts: 222.89.98.219 www.xxwww.com
    O1 - Hosts: 222.89.98.219 xxwww.com
    O1 - Hosts: 222.89.98.219 www.fm1000.net
    O1 - Hosts: 222.89.98.219 fm1000.net
    O1 - Hosts: 222.89.98.219 www.ok135.com
    O1 - Hosts: 222.89.98.219 ok135.com
    O1 - Hosts: 222.89.98.219 www.link999.com
    O1 - Hosts: 222.89.98.219 link999.com
    O1 - Hosts: 222.89.98.219 www.001wz.com
    O1 - Hosts: 222.89.98.219 001wz.com
    O1 - Hosts: 222.89.98.219 www.7t7t.com
    O1 - Hosts: 222.89.98.219 7t7t.com
    O1 - Hosts: 222.89.98.219 www.7k7k.com
    O1 - Hosts: 222.89.98.219 7k7k.com
    O1 - Hosts: 222.89.98.219 www.webcool.net
    O1 - Hosts: 222.89.98.219 webcool.net
    O1 - Hosts: 222.89.98.219 www.51sobu.com
    O1 - Hosts: 222.89.98.219 51sobu.com
    O1 - Hosts: 222.89.98.219 cy.51sobu.com
    O1 - Hosts: 222.89.98.219 www.fj3721.com
    O1 - Hosts: 222.89.98.219 fj3721.com
    O1 - Hosts: 222.89.98.219 www.msncn.com
    O1 - Hosts: 222.89.98.219 msncn.com
    O1 - Hosts: 222.89.98.219 www.6235.com
    O1 - Hosts: 222.89.98.219 6235.com
    O1 - Hosts: 222.89.98.219 www.8goo.com
    O1 - Hosts: 222.89.98.219 8goo.com
    O1 - Hosts: 222.89.98.219 www.baimin.com
    O1 - Hosts: 222.89.98.219 baimin.com
    O1 - Hosts: 222.89.98.219 www.bwwz.com
    O1 - Hosts: 222.89.98.219 bwwz.com
    O1 - Hosts: 222.89.98.219 www.howow.net
    O1 - Hosts: 222.89.98.219 howow.net
    O1 - Hosts: 222.89.98.219 www.tongchi.com
    O1 - Hosts: 222.89.98.219 tongchi.com
    O1 - Hosts: 222.89.98.219 www.65658.com
    O1 - Hosts: 222.89.98.219 65658.com
    O1 - Hosts: 222.89.98.219 www.7o7o.com
    O1 - Hosts: 222.89.98.219 7o7o.com
    O1 - Hosts: 222.89.98.219 5126.net
    O1 - Hosts: 222.89.98.219 www.5126.net
    O1 - Hosts: 222.89.98.219 www.wangzhiku.com
    O1 - Hosts: 222.89.98.219 wangzhiku.com
    O1 - Hosts: 222.89.98.219 www.soyeah.com
    O1 - Hosts: 222.89.98.219 soyeah.com
    O1 - Hosts: 222.89.98.219 www.sowang.cn
    O1 - Hosts: 222.89.98.219 sowang.cn
    O1 - Hosts: 222.89.98.219 www.77177.com
    O1 - Hosts: 222.89.98.219 77177.com
    O1 - Hosts: 222.89.98.219 www.look8.net
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Betfair Bar - {1D62BD48-16F6-4004-A54A-3C41E4955A87} - C:\Program Files\Betfair\BFTool_4.dll
    O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [flag that] C:\DOCUME~1\Martyn\APPLIC~1\CHINPL~1\BoltLess.exe
    O4 - HKCU\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O8 - Extra context menu item: Betfair lay field - file://C:\Betfair Scripts\LayField.htm
    O8 - Extra context menu item: Betfair Refresh - file://C:\Betfair Scripts\BetfairRefresh.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4E6F9E15-C8E3-4E19-B987-04EF390E9824} - http://www.betfair.com/toolbar/setup.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/28bbcaa8d20e81795a05/netzip/RdxIE601.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
     
  8. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Lop Uninstaller at this link

    http://www.thespykiller.co.uk/downloads.htm

    Close all browser windows and run the uninstaller.

    Download the Hoster from here:
    http://members.aol.com/toadbee/hoster.zip
    Run Hoster and press Restore Original Hosts, OK, and Exit Program. Reboot.

    Dump Spyware Begone - http://www.spywarewarrior.com/rogue_anti-spyware.htm

    SpywareBlaster http://www.javacoolsoftware.com/spywareblaster.html
    AdAware SE 1.05 http://www.majorgeeks.com/download506.html
    SpyBot S&D 1.3 http://www.safer-networking.org/en/download/

    DL them (they are free), install them, check each for their
    definition updates
    and then run AdAware and Spybot, fixing anything
    they say.

    In SpywareBlaster - Always enable all protection after updates
    SpyBot - After an update run immunize

    Reboot

    Move HiJackThis.exe to a permanent folder like C:\hjt and not a temp folder or the desktop

    Then post a new log
     
  9. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Did all exepct adaware (froze again) the "run-time error '75' Path/file access" dissapeared after the lop uninstall or host restore but reapeared immediately after the adaware froze

    again no immunize in spyblaster


    Logfile of HijackThis v1.99.0
    Scan saved at 16:22:46, on 15/02/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    c:\windows\system32\explorer.exe
    c:\windows\explorer.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\Program Files\Messenger\msmsgs.exe
    c:\windows\system32\IEXPLORE.EXE
    c:\progra~1\intern~1\iexplore.exe
    C:\WINDOWS\System32\wuauclt.exe
    c:\windows\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Martyn\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit32.exe,
    O1 - Hosts: 222.89.98.219 www.wo365.com
    O1 - Hosts: 222.89.98.219 cmfu.com
    O1 - Hosts: 222.89.98.219 www.cmfu.com
    O1 - Hosts: 222.89.98.219 9i0.com
    O1 - Hosts: 222.89.98.219 www.9flash.com
    O1 - Hosts: 222.89.98.219 9flash.com
    O1 - Hosts: 222.89.98.219 www.nowok.net
    O1 - Hosts: 222.89.98.219 nowok.net
    O1 - Hosts: 222.89.98.219 wisa.com.cn
    O1 - Hosts: 222.89.98.219 www.sia.com.cn
    O1 - Hosts: 222.89.98.219 www.wisa.cn
    O1 - Hosts: 222.89.98.219 wisa.cn
    O1 - Hosts: 222.89.98.219 www.zhao99.com
    O1 - Hosts: 222.89.98.219 zhao99.com
    O1 - Hosts: 222.89.98.219 www.wo123.com
    O1 - Hosts: 222.89.98.219 wo123.com
    O1 - Hosts: 222.89.98.219 wo99.com
    O1 - Hosts: 222.89.98.219 www.wo99.com
    O1 - Hosts: 222.89.98.219 www.page.com.cn
    O1 - Hosts: 222.89.98.219 page.com.cn
    O1 - Hosts: 222.89.98.219 www.432.cn
    O1 - Hosts: 222.89.98.219 432.cn
    O1 - Hosts: 222.89.98.219 wysw.com
    O1 - Hosts: 222.89.98.219 14.com.cn
    O1 - Hosts: 222.89.98.219 www.14.com.cn
    O1 - Hosts: 222.89.98.219 cnww.net
    O1 - Hosts: 222.89.98.219 www.mv99.com
    O1 - Hosts: 222.89.98.219 mv99.com
    O1 - Hosts: 222.89.98.219 www.youav.com
    O1 - Hosts: 222.89.98.219 www.mtvav.com
    O1 - Hosts: 222.89.98.219 www.98983.com
    O1 - Hosts: 222.89.98.219 98983.com
    O1 - Hosts: 222.89.98.219 www.114.com.cn
    O1 - Hosts: 222.89.98.219 114.com.cn
    O1 - Hosts: 222.89.98.219 www.net114.com
    O1 - Hosts: 222.89.98.219 www.skywz.com
    O1 - Hosts: 222.89.98.219 skywz.com
    O1 - Hosts: 222.89.98.219 www.hao6.com
    O1 - Hosts: 222.89.98.219 hao6.com
    O1 - Hosts: 222.89.98.219 www.678a.com
    O1 - Hosts: 222.89.98.219 678a.com
    O1 - Hosts: 222.89.98.219 www.7510.com
    O1 - Hosts: 222.89.98.219 7510.com
    O1 - Hosts: 222.89.98.219 www.zzkan.com
    O1 - Hosts: 222.89.98.219 zzkan.com
    O1 - Hosts: 222.89.98.219 www.ca183.com
    O1 - Hosts: 222.89.98.219 ca183.com
    O1 - Hosts: 222.89.98.219 3tom.com
    O1 - Hosts: 222.89.98.219 www.yhjm.com
    O1 - Hosts: 222.89.98.219 yhjm.com
    O1 - Hosts: 222.89.98.219 www.k369.com
    O1 - Hosts: 222.89.98.219 www.xxwww.com
    O1 - Hosts: 222.89.98.219 xxwww.com
    O1 - Hosts: 222.89.98.219 www.fm1000.net
    O1 - Hosts: 222.89.98.219 fm1000.net
    O1 - Hosts: 222.89.98.219 www.ok135.com
    O1 - Hosts: 222.89.98.219 ok135.com
    O1 - Hosts: 222.89.98.219 www.link999.com
    O1 - Hosts: 222.89.98.219 link999.com
    O1 - Hosts: 222.89.98.219 www.001wz.com
    O1 - Hosts: 222.89.98.219 001wz.com
    O1 - Hosts: 222.89.98.219 www.7t7t.com
    O1 - Hosts: 222.89.98.219 7t7t.com
    O1 - Hosts: 222.89.98.219 www.7k7k.com
    O1 - Hosts: 222.89.98.219 7k7k.com
    O1 - Hosts: 222.89.98.219 www.webcool.net
    O1 - Hosts: 222.89.98.219 webcool.net
    O1 - Hosts: 222.89.98.219 www.51sobu.com
    O1 - Hosts: 222.89.98.219 51sobu.com
    O1 - Hosts: 222.89.98.219 cy.51sobu.com
    O1 - Hosts: 222.89.98.219 www.fj3721.com
    O1 - Hosts: 222.89.98.219 fj3721.com
    O1 - Hosts: 222.89.98.219 www.msncn.com
    O1 - Hosts: 222.89.98.219 msncn.com
    O1 - Hosts: 222.89.98.219 www.6235.com
    O1 - Hosts: 222.89.98.219 6235.com
    O1 - Hosts: 222.89.98.219 www.8goo.com
    O1 - Hosts: 222.89.98.219 8goo.com
    O1 - Hosts: 222.89.98.219 www.baimin.com
    O1 - Hosts: 222.89.98.219 baimin.com
    O1 - Hosts: 222.89.98.219 www.bwwz.com
    O1 - Hosts: 222.89.98.219 bwwz.com
    O1 - Hosts: 222.89.98.219 www.howow.net
    O1 - Hosts: 222.89.98.219 howow.net
    O1 - Hosts: 222.89.98.219 www.tongchi.com
    O1 - Hosts: 222.89.98.219 tongchi.com
    O1 - Hosts: 222.89.98.219 www.65658.com
    O1 - Hosts: 222.89.98.219 65658.com
    O1 - Hosts: 222.89.98.219 www.7o7o.com
    O1 - Hosts: 222.89.98.219 7o7o.com
    O1 - Hosts: 222.89.98.219 5126.net
    O1 - Hosts: 222.89.98.219 www.5126.net
    O1 - Hosts: 222.89.98.219 www.wangzhiku.com
    O1 - Hosts: 222.89.98.219 wangzhiku.com
    O1 - Hosts: 222.89.98.219 www.soyeah.com
    O1 - Hosts: 222.89.98.219 soyeah.com
    O1 - Hosts: 222.89.98.219 www.sowang.cn
    O1 - Hosts: 222.89.98.219 sowang.cn
    O1 - Hosts: 222.89.98.219 www.77177.com
    O1 - Hosts: 222.89.98.219 77177.com
    O1 - Hosts: 222.89.98.219 www.look8.net
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Betfair Bar - {1D62BD48-16F6-4004-A54A-3C41E4955A87} - C:\Program Files\Betfair\BFTool_4.dll
    O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [flag that] C:\DOCUME~1\Martyn\APPLIC~1\CHINPL~1\BoltLess.exe
    O4 - HKCU\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O8 - Extra context menu item: Betfair lay field - file://C:\Betfair Scripts\LayField.htm
    O8 - Extra context menu item: Betfair Refresh - file://C:\Betfair Scripts\BetfairRefresh.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4E6F9E15-C8E3-4E19-B987-04EF390E9824} - http://www.betfair.com/toolbar/setup.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/28bbcaa8d20e81795a05/netzip/RdxIE601.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
     
  10. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Ran host again runtime error now gone, getting no pop ups now, is there anything lurking on the hijack this log i should get rid of? thanks again
     
  11. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    You are running hijackthis from a temporary folder. The backups that hijackthis creates can be accidentally deleted when not in a permanent folder. Please do the following;

    Click My Computer, then C:\
    In the menu bar, File->New->Folder.
    That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ folder. Put your HijackThis.exe there, and double click to run it.

    Now download this new version and save it to the folder you have created.
    http://www.thespykiller.co.uk/files/HijackThis.exe
     
  12. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Immunize is in SPYBot - we can't proceed unitl you move HJT to a permanent folder!!!
     
  13. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Done that new hjt below

    Logfile of HijackThis v1.99.1
    Scan saved at 23:30:19, on 17/02/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    c:\windows\system32\explorer.exe
    c:\windows\explorer.exe
    C:\WINDOWS\System32\RunDll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\windows\rundll32.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    c:\windows\system32\IEXPLORE.EXE
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    c:\progra~1\intern~1\iexplore.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit32.exe,
    O1 - Hosts: 222.89.98.219 www.wo365.com
    O1 - Hosts: 222.89.98.219 cmfu.com
    O1 - Hosts: 222.89.98.219 www.cmfu.com
    O1 - Hosts: 222.89.98.219 9i0.com
    O1 - Hosts: 222.89.98.219 www.9flash.com
    O1 - Hosts: 222.89.98.219 9flash.com
    O1 - Hosts: 222.89.98.219 www.nowok.net
    O1 - Hosts: 222.89.98.219 nowok.net
    O1 - Hosts: 222.89.98.219 wisa.com.cn
    O1 - Hosts: 222.89.98.219 www.sia.com.cn
    O1 - Hosts: 222.89.98.219 www.wisa.cn
    O1 - Hosts: 222.89.98.219 wisa.cn
    O1 - Hosts: 222.89.98.219 www.zhao99.com
    O1 - Hosts: 222.89.98.219 zhao99.com
    O1 - Hosts: 222.89.98.219 www.wo123.com
    O1 - Hosts: 222.89.98.219 wo123.com
    O1 - Hosts: 222.89.98.219 wo99.com
    O1 - Hosts: 222.89.98.219 www.wo99.com
    O1 - Hosts: 222.89.98.219 www.page.com.cn
    O1 - Hosts: 222.89.98.219 page.com.cn
    O1 - Hosts: 222.89.98.219 www.432.cn
    O1 - Hosts: 222.89.98.219 432.cn
    O1 - Hosts: 222.89.98.219 wysw.com
    O1 - Hosts: 222.89.98.219 14.com.cn
    O1 - Hosts: 222.89.98.219 www.14.com.cn
    O1 - Hosts: 222.89.98.219 cnww.net
    O1 - Hosts: 222.89.98.219 www.mv99.com
    O1 - Hosts: 222.89.98.219 mv99.com
    O1 - Hosts: 222.89.98.219 www.youav.com
    O1 - Hosts: 222.89.98.219 www.mtvav.com
    O1 - Hosts: 222.89.98.219 www.98983.com
    O1 - Hosts: 222.89.98.219 98983.com
    O1 - Hosts: 222.89.98.219 www.114.com.cn
    O1 - Hosts: 222.89.98.219 114.com.cn
    O1 - Hosts: 222.89.98.219 www.net114.com
    O1 - Hosts: 222.89.98.219 www.skywz.com
    O1 - Hosts: 222.89.98.219 skywz.com
    O1 - Hosts: 222.89.98.219 www.hao6.com
    O1 - Hosts: 222.89.98.219 hao6.com
    O1 - Hosts: 222.89.98.219 www.678a.com
    O1 - Hosts: 222.89.98.219 678a.com
    O1 - Hosts: 222.89.98.219 www.7510.com
    O1 - Hosts: 222.89.98.219 7510.com
    O1 - Hosts: 222.89.98.219 www.zzkan.com
    O1 - Hosts: 222.89.98.219 zzkan.com
    O1 - Hosts: 222.89.98.219 www.ca183.com
    O1 - Hosts: 222.89.98.219 ca183.com
    O1 - Hosts: 222.89.98.219 3tom.com
    O1 - Hosts: 222.89.98.219 www.yhjm.com
    O1 - Hosts: 222.89.98.219 yhjm.com
    O1 - Hosts: 222.89.98.219 www.k369.com
    O1 - Hosts: 222.89.98.219 www.xxwww.com
    O1 - Hosts: 222.89.98.219 xxwww.com
    O1 - Hosts: 222.89.98.219 www.fm1000.net
    O1 - Hosts: 222.89.98.219 fm1000.net
    O1 - Hosts: 222.89.98.219 www.ok135.com
    O1 - Hosts: 222.89.98.219 ok135.com
    O1 - Hosts: 222.89.98.219 www.link999.com
    O1 - Hosts: 222.89.98.219 link999.com
    O1 - Hosts: 222.89.98.219 www.001wz.com
    O1 - Hosts: 222.89.98.219 001wz.com
    O1 - Hosts: 222.89.98.219 www.7t7t.com
    O1 - Hosts: 222.89.98.219 7t7t.com
    O1 - Hosts: 222.89.98.219 www.7k7k.com
    O1 - Hosts: 222.89.98.219 7k7k.com
    O1 - Hosts: 222.89.98.219 www.webcool.net
    O1 - Hosts: 222.89.98.219 webcool.net
    O1 - Hosts: 222.89.98.219 www.51sobu.com
    O1 - Hosts: 222.89.98.219 51sobu.com
    O1 - Hosts: 222.89.98.219 cy.51sobu.com
    O1 - Hosts: 222.89.98.219 www.fj3721.com
    O1 - Hosts: 222.89.98.219 fj3721.com
    O1 - Hosts: 222.89.98.219 www.msncn.com
    O1 - Hosts: 222.89.98.219 msncn.com
    O1 - Hosts: 222.89.98.219 www.6235.com
    O1 - Hosts: 222.89.98.219 6235.com
    O1 - Hosts: 222.89.98.219 www.8goo.com
    O1 - Hosts: 222.89.98.219 8goo.com
    O1 - Hosts: 222.89.98.219 www.baimin.com
    O1 - Hosts: 222.89.98.219 baimin.com
    O1 - Hosts: 222.89.98.219 www.bwwz.com
    O1 - Hosts: 222.89.98.219 bwwz.com
    O1 - Hosts: 222.89.98.219 www.howow.net
    O1 - Hosts: 222.89.98.219 howow.net
    O1 - Hosts: 222.89.98.219 www.tongchi.com
    O1 - Hosts: 222.89.98.219 tongchi.com
    O1 - Hosts: 222.89.98.219 www.65658.com
    O1 - Hosts: 222.89.98.219 65658.com
    O1 - Hosts: 222.89.98.219 www.7o7o.com
    O1 - Hosts: 222.89.98.219 7o7o.com
    O1 - Hosts: 222.89.98.219 5126.net
    O1 - Hosts: 222.89.98.219 www.5126.net
    O1 - Hosts: 222.89.98.219 www.wangzhiku.com
    O1 - Hosts: 222.89.98.219 wangzhiku.com
    O1 - Hosts: 222.89.98.219 www.soyeah.com
    O1 - Hosts: 222.89.98.219 soyeah.com
    O1 - Hosts: 222.89.98.219 www.sowang.cn
    O1 - Hosts: 222.89.98.219 sowang.cn
    O1 - Hosts: 222.89.98.219 www.77177.com
    O1 - Hosts: 222.89.98.219 77177.com
    O1 - Hosts: 222.89.98.219 www.look8.net
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {4824FFE1-0527-44CF-938C-6D7AB04D1EFA} - C:\DOCUME~1\Ray\APPLIC~1\CURBAU~1\File32.exe
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Betfair Bar - {1D62BD48-16F6-4004-A54A-3C41E4955A87} - C:\Program Files\Betfair\BFTool_4.dll
    O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [MMSystem] C:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [flag that] C:\DOCUME~1\Martyn\APPLIC~1\CHINPL~1\BoltLess.exe
    O4 - HKCU\..\Run: [MMSystem] C:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O8 - Extra context menu item: Betfair lay field - file://C:\Betfair Scripts\LayField.htm
    O8 - Extra context menu item: Betfair Refresh - file://C:\Betfair Scripts\BetfairRefresh.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4E6F9E15-C8E3-4E19-B987-04EF390E9824} - http://www.betfair.com/toolbar/setup.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/28bbcaa8d20e81795a05/netzip/RdxIE601.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
     
  14. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Run HJT again and put a check in the following:

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.popupsearches.com/sidesearch.html

    O1 - Hosts: --> All of those

    O2 - BHO: (no name) - {4824FFE1-0527-44CF-938C-6D7AB04D1EFA} - C:\DOCUME~1\Ray\APPLIC~1\CURBAU~1\File32.exe

    O4 - HKLM\..\Run: [OemReset] %systemroot%\OPTIONS\OEMRESET.EXE /AUDIT

    O4 - HKLM\..\Run: [MMSystem] C:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32

    O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg

    O4 - HKCU\..\Run: [flag that] C:\DOCUME~1\Martyn\APPLIC~1\CHINPL~1\BoltLess.exe

    O4 - HKCU\..\Run: [MMSystem] C:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/28bbcaa...ip/RdxIE601.cab

    Close all applications and browser windows before you click "fix checked".


    Restart in Safe Mode

    Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
    Make sure that "Show hidden files and folders" is checked.
    Also uncheck "Hide protected operating system files".
    Now click "Apply to all folders", Click "Apply" then "OK"

    Delete this file: C:\WINDOWS\System32\pc32.exe

    Reboot and post another log.
     
  15. armiger

    armiger Thread Starter

    Joined:
    Jul 3, 2004
    Messages:
    90
    Did all except the deleting of C:\WINDOWS\System32\pc32.exe could only find C:\WINDOWS\System32\pc32 (on properties file type was application) thought best not delete to be on safe side.

    New HJTLogfile of HijackThis v1.99.1
    Scan saved at 19:18:28, on 18/02/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    c:\windows\system32\explorer.exe
    c:\windows\explorer.exe
    C:\WINDOWS\System32\RunDll32.exe
    c:\windows\rundll32.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    c:\windows\system32\IEXPLORE.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJT\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit32.exe,
    O1 - Hosts: 222.89.98.219 www.wo365.com
    O1 - Hosts: 222.89.98.219 cmfu.com
    O1 - Hosts: 222.89.98.219 www.cmfu.com
    O1 - Hosts: 222.89.98.219 9i0.com
    O1 - Hosts: 222.89.98.219 www.9flash.com
    O1 - Hosts: 222.89.98.219 9flash.com
    O1 - Hosts: 222.89.98.219 www.nowok.net
    O1 - Hosts: 222.89.98.219 nowok.net
    O1 - Hosts: 222.89.98.219 wisa.com.cn
    O1 - Hosts: 222.89.98.219 www.sia.com.cn
    O1 - Hosts: 222.89.98.219 www.wisa.cn
    O1 - Hosts: 222.89.98.219 wisa.cn
    O1 - Hosts: 222.89.98.219 www.zhao99.com
    O1 - Hosts: 222.89.98.219 zhao99.com
    O1 - Hosts: 222.89.98.219 www.wo123.com
    O1 - Hosts: 222.89.98.219 wo123.com
    O1 - Hosts: 222.89.98.219 wo99.com
    O1 - Hosts: 222.89.98.219 www.wo99.com
    O1 - Hosts: 222.89.98.219 www.page.com.cn
    O1 - Hosts: 222.89.98.219 page.com.cn
    O1 - Hosts: 222.89.98.219 www.432.cn
    O1 - Hosts: 222.89.98.219 432.cn
    O1 - Hosts: 222.89.98.219 wysw.com
    O1 - Hosts: 222.89.98.219 14.com.cn
    O1 - Hosts: 222.89.98.219 www.14.com.cn
    O1 - Hosts: 222.89.98.219 cnww.net
    O1 - Hosts: 222.89.98.219 www.mv99.com
    O1 - Hosts: 222.89.98.219 mv99.com
    O1 - Hosts: 222.89.98.219 www.youav.com
    O1 - Hosts: 222.89.98.219 www.mtvav.com
    O1 - Hosts: 222.89.98.219 www.98983.com
    O1 - Hosts: 222.89.98.219 98983.com
    O1 - Hosts: 222.89.98.219 www.114.com.cn
    O1 - Hosts: 222.89.98.219 114.com.cn
    O1 - Hosts: 222.89.98.219 www.net114.com
    O1 - Hosts: 222.89.98.219 www.skywz.com
    O1 - Hosts: 222.89.98.219 skywz.com
    O1 - Hosts: 222.89.98.219 www.hao6.com
    O1 - Hosts: 222.89.98.219 hao6.com
    O1 - Hosts: 222.89.98.219 www.678a.com
    O1 - Hosts: 222.89.98.219 678a.com
    O1 - Hosts: 222.89.98.219 www.7510.com
    O1 - Hosts: 222.89.98.219 7510.com
    O1 - Hosts: 222.89.98.219 www.zzkan.com
    O1 - Hosts: 222.89.98.219 zzkan.com
    O1 - Hosts: 222.89.98.219 www.ca183.com
    O1 - Hosts: 222.89.98.219 ca183.com
    O1 - Hosts: 222.89.98.219 3tom.com
    O1 - Hosts: 222.89.98.219 www.yhjm.com
    O1 - Hosts: 222.89.98.219 yhjm.com
    O1 - Hosts: 222.89.98.219 www.k369.com
    O1 - Hosts: 222.89.98.219 www.xxwww.com
    O1 - Hosts: 222.89.98.219 xxwww.com
    O1 - Hosts: 222.89.98.219 www.fm1000.net
    O1 - Hosts: 222.89.98.219 fm1000.net
    O1 - Hosts: 222.89.98.219 www.ok135.com
    O1 - Hosts: 222.89.98.219 ok135.com
    O1 - Hosts: 222.89.98.219 www.link999.com
    O1 - Hosts: 222.89.98.219 link999.com
    O1 - Hosts: 222.89.98.219 www.001wz.com
    O1 - Hosts: 222.89.98.219 001wz.com
    O1 - Hosts: 222.89.98.219 www.7t7t.com
    O1 - Hosts: 222.89.98.219 7t7t.com
    O1 - Hosts: 222.89.98.219 www.7k7k.com
    O1 - Hosts: 222.89.98.219 7k7k.com
    O1 - Hosts: 222.89.98.219 www.webcool.net
    O1 - Hosts: 222.89.98.219 webcool.net
    O1 - Hosts: 222.89.98.219 www.51sobu.com
    O1 - Hosts: 222.89.98.219 51sobu.com
    O1 - Hosts: 222.89.98.219 cy.51sobu.com
    O1 - Hosts: 222.89.98.219 www.fj3721.com
    O1 - Hosts: 222.89.98.219 fj3721.com
    O1 - Hosts: 222.89.98.219 www.msncn.com
    O1 - Hosts: 222.89.98.219 msncn.com
    O1 - Hosts: 222.89.98.219 www.6235.com
    O1 - Hosts: 222.89.98.219 6235.com
    O1 - Hosts: 222.89.98.219 www.8goo.com
    O1 - Hosts: 222.89.98.219 8goo.com
    O1 - Hosts: 222.89.98.219 www.baimin.com
    O1 - Hosts: 222.89.98.219 baimin.com
    O1 - Hosts: 222.89.98.219 www.bwwz.com
    O1 - Hosts: 222.89.98.219 bwwz.com
    O1 - Hosts: 222.89.98.219 www.howow.net
    O1 - Hosts: 222.89.98.219 howow.net
    O1 - Hosts: 222.89.98.219 www.tongchi.com
    O1 - Hosts: 222.89.98.219 tongchi.com
    O1 - Hosts: 222.89.98.219 www.65658.com
    O1 - Hosts: 222.89.98.219 65658.com
    O1 - Hosts: 222.89.98.219 www.7o7o.com
    O1 - Hosts: 222.89.98.219 7o7o.com
    O1 - Hosts: 222.89.98.219 5126.net
    O1 - Hosts: 222.89.98.219 www.5126.net
    O1 - Hosts: 222.89.98.219 www.wangzhiku.com
    O1 - Hosts: 222.89.98.219 wangzhiku.com
    O1 - Hosts: 222.89.98.219 www.soyeah.com
    O1 - Hosts: 222.89.98.219 soyeah.com
    O1 - Hosts: 222.89.98.219 www.sowang.cn
    O1 - Hosts: 222.89.98.219 sowang.cn
    O1 - Hosts: 222.89.98.219 www.77177.com
    O1 - Hosts: 222.89.98.219 77177.com
    O1 - Hosts: 222.89.98.219 www.look8.net
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Betfair Bar - {1D62BD48-16F6-4004-A54A-3C41E4955A87} - C:\Program Files\Betfair\BFTool_4.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [MMSystem] c:\windows\rundll32.exe "c:\windows\system32\mmsystem.dll"", RunDll32
    O8 - Extra context menu item: Betfair lay field - file://C:\Betfair Scripts\LayField.htm
    O8 - Extra context menu item: Betfair Refresh - file://C:\Betfair Scripts\BetfairRefresh.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
    O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {4E6F9E15-C8E3-4E19-B987-04EF390E9824} - http://www.betfair.com/toolbar/setup.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/330192

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice