| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 62702 | 2005-10-16 11:14:00 | Spyware headache... | russell108 (7499) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 396793 | 2005-10-16 18:26:00 | betcha you end up using nod32 theres just nothign else that will work.........I've been there i know........oh btw.........dump IE and install firefox....... | drcspy (146) | ||
| 396794 | 2005-10-16 18:31:00 | Couldnt find these C:\WINDOWS\System32\mssearchnet.exe C:\WINDOWS\System32\nvctrl.ex downloading ccleaner...asap (56k connection) btw kcc.exe is just a wee app i use for auto disconnecting from the net when my time is up ;) but the log file now looks like this... Logfile of HijackThis v1.99.1 Scan saved at 19:29:21, on 16/10/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\mssearchnet.exe C:\WINDOWS\System32\nvctrl.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\kc34839002\kcc.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\intell32.exe C:\Documents and Settings\Russell\Local Settings\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp7A50.tmp O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DUNCO11] C:\WINDOWS\System32\kc34839002\kcc.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4 O4 - Global Startup: Adobe Gamma Loader.lnk = ? O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - messenger.zone.msn.com O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - messenger.zone.msn.com O17 - HKLM\System\CCS\Services\Tcpip\..\{BBAA967B-57FE-4293-B3D4-5D89D0B4EA19}: NameServer = 217.145.64.66 212.111.32.7 O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
russell108 (7499) | ||
| 396795 | 2005-10-16 18:41:00 | OK. It looks a bit cleaner. Ok leave kcc there, now that we know what it is ! Tick these entries. Close browser/s. Reboot. Then post another log. Might be a good idea to disable system restore this time. Before u do the following, then enable it again after. C:\WINDOWS\System32\intell32.exe O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe (Use ccleaner to remove this entry from the startup tab, if ticking it in HJT doesnt work). O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp7A50.tmp O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll See if C:\WINDOWS\System32\mssearchnet.exe C:\WINDOWS\System32\nvctrl.ex Are running in task manager... If they are kill them. |
Speedy Gonzales (78) | ||
| 396796 | 2005-10-16 19:27:00 | Sorry but where is task manager located ? latest log... Logfile of HijackThis v1.99.1 Scan saved at 20:13:12, on 16/10/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\mssearchnet.exe C:\WINDOWS\System32\nvctrl.exe C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\kc34839002\kcc.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Documents and Settings\Russell\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe C:\WINDOWS\System32\wuauclt.exe O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp79D3.tmp O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DUNCO11] C:\WINDOWS\System32\kc34839002\kcc.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4 O4 - Global Startup: Adobe Gamma Loader.lnk = ? O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - messenger.zone.msn.com O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - messenger.zone.msn.com O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - messenger.zone.msn.com O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
russell108 (7499) | ||
| 396797 | 2005-10-16 19:34:00 | I'm sorry but I don't have an answer to your spyware question, I actually feel a little bit dumb but I don't know how to post a question of my own. I'm super computer illiterate. How do I post my own question without replying to someone else's? | Steph_C (9082) | ||
| 396798 | 2005-10-16 19:39:00 | Press Ctrl-Alt-Del for task manager . Everything looks OK besides these 3 . O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 C:\WINDOWS\System32\mssearchnet . exe C:\WINDOWS\System32\nvctrl . exe Try booting into safe mode (Press down F8 after you reboot) . Then search for the 2 files above, if found delete them . And run HJT again (in safe mode) . See if this O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 appears in the log . If it does tick it and tick fix checked . Then reboot again . Then post another log here . And try getting this . simplysup . com/tremover/" target="_blank">www . simplysup . com . filekicker . com/send/file/167872-Y3TW/trjsetup . exe" target="_blank">dl . filekicker . com This is only a 30 day trial, but may find something . Once u get this, install it, run it and click on scan . Then under the utilities menu, select the 3rd/4th/5th/6th/7th option . |
Speedy Gonzales (78) | ||
| 396799 | 2005-10-16 19:40:00 | pressf1.pcworld.co.nz go here steph |
drcspy (146) | ||
| 396800 | 2005-10-16 20:00:00 | Other ways to access Task Manager in XP are Control+Shift+Escape or by right-clicking on a blank space in the taskbar, | mark c (247) | ||
| 396801 | 2005-10-16 20:05:00 | Another thing C:\WINDOWS\System32\mssearchnet . exe C:\WINDOWS\System32\nvctrl . exe Maybe hidden . Run My computer . Go to tools menu / folder options / view . Select Show hidden files and folders . Then see if these files are on the hdd, if they are, then delete them . |
Speedy Gonzales (78) | ||
| 396802 | 2005-10-16 20:10:00 | ewido will remove it www.ewido.net Make sure you update the definitions after installing |
bartsdadhomer (80) | ||
| 1 2 3 4 5 6 | |||||