| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 53975 | 2005-02-01 06:42:00 | hotsearch | rawcuss (7093) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 320197 | 2005-02-01 06:42:00 | How do i get rid of it off my computer??????? spybot and adaware do not get rid of it |
rawcuss (7093) | ||
| 320198 | 2005-02-01 06:50:00 | Are both spybot and adaware up to date?? Are you using adaware 1.05 se?? Not version 6 of adaware?? |
Speedy Gonzales (78) | ||
| 320199 | 2005-02-01 06:54:00 | hells bells I whacked hotsearch into google to see if it was part of CoolWebSearch & guess what I got I'll have another look now |
bartsdadhomer (80) | ||
| 320200 | 2005-02-01 07:16:00 | Download and run CWShredder www.majorgeeks.com Also do an online virus scan. http://housecall.trendmicro.com/ |
Safari (3993) | ||
| 320201 | 2005-02-01 08:44:00 | tryed alsorts but no go all up dated but still there....i'm running win 98se if any help | rawcuss (7093) | ||
| 320202 | 2005-02-01 09:12:00 | firstly how do you know you have hotsearch? what files do adaware/spybot find? use hijackthis and post the list here. |
tweak'e (69) | ||
| 320203 | 2005-02-01 09:45:00 | Have aread of the PF1 Security FAQ's (pressf1.pcworld.co.nz), then head off to read up on and download Hijacjthis as per tweak'es advice. Don't attempt to fix anything Hijackthis finds without first getting advice, unless you like toasted PC :D |
Murray P (44) | ||
| 320204 | 2005-02-01 10:53:00 | Here is a solution forums.maddoktor2.com |
pheonix (36) | ||
| 320205 | 2005-02-01 23:59:00 | Ok here is the hijackthis scan file: Logfile of HijackThis v1.99.0 Scan saved at 1:07:49 PM, on 2/2/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\USBMONIT.EXE C:\PROGRAM FILES\CACHEMAN\CACHEMAN.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAM FILES\FINEPIXVIEWER\QUICKDCF.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\TEMP\RAR$EX00.080\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: (no name) - {6B2DC4A1-7444-11D9-BFDA-00E0C63BFE38} - C:\WINDOWS\SYSTEM\FNKD.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\CACHEMAN\Cacheman.exe O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background O4 - Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O9 - Extra button: (no name) - {44EFB53C-C965-43CF-9F45-52242D134187} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - c.ancestry.com O18 - Filter: text/html - {8FB41AA0-7493-11D9-BFDA-00E0D5B8CEA8} - C:\WINDOWS\SYSTEM\FNKD.DLL O18 - Filter: text/plain - {8FB41AA0-7493-11D9-BFDA-00E0D5B8CEA8} - C:\WINDOWS\SYSTEM\FNKD.DLL please give me feed back thanks Rawcuss |
rawcuss (7093) | ||
| 320206 | 2005-02-02 01:27:00 | R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: (no name) - {6B2DC4A1-7444-11D9-BFDA-00E0C63BFE38} - C:\WINDOWS\SYSTEM\FNKD.DLL O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O9 - Extra button: (no name) - {44EFB53C-C965-43CF-9F45-52242D134187} - (no file) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O18 - Filter: text/html - {8FB41AA0-7493-11D9-BFDA-00E0D5B8CEA8} - C:\WINDOWS\SYSTEM\FNKD.DLL O18 - Filter: text/plain - {8FB41AA0-7493-11D9-BFDA-00E0D5B8CEA8} - C:\WINDOWS\SYSTEM\FNKD.DLL looks like you have the about:blank hijacker. have a look here (www.majorgeeks.com) |
tweak'e (69) | ||
| 1 2 | |||||