Forum Index

It appears you have not yet registered with our community which limits what you can do & see. It's Free To register, please click here.





Spyware / Virus Removal Spyware, virus, browser hijack and other malware removal.

Reply
 
Thread Tools Display Modes
  #1  
Old 10-16-2004, 04:05 PM
savedtheday89 savedtheday89 is offline
Member
 
Join Date: Oct 2004
Posts: 39
Send a message via AIM to savedtheday89 Send a message via MSN to savedtheday89
i'm actually neitzsche but it wouldn't let me on that?

i had to create this in order to get on but whatever doesn't matter.. lot of pop ups.. can you check my hjt log?

Logfile of HijackThis v1.98.2
Scan saved at 5:03:50 PM, on 10/16/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOW***plorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSSystem32
__________________
--Kelly
Reply With Quote
Posted


  #2  
Old 10-16-2004, 05:25 PM
Mobo's Avatar
Mobo Mobo is offline
Thinking outside the box
 
Join Date: Sep 2004
Location: Cape Breton
Posts: 4,574
Send a message via ICQ to Mobo Send a message via AIM to Mobo Send a message via MSN to Mobo Send a message via Yahoo to Mobo Send a message via Skype™ to Mobo
Re: i'm actually neitzsche but it wouldn't let me on that?

Ok so lets begin by rescanning and putting a check next to each of the following then close all browser windows and clicking "fix checked"

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.myway.com/

R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:Program FilesTV MediaTvmBho.dll

O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:WINDOWSbxxs5.dll

O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:WINDOWSmultimpp.dll

O2 - BHO: SDWin32 Class - {D7FFE79F-0BC4-4AD7-8BD5-7788A179B118} - C:WINDOWSSystem32esjof.dll

O2 - BHO: Band Class - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - C:WINDOWSdealhlpr.dll

O4 - HKLM..Run: [stcloader] C:WINDOWSSystem32stcloader.exe

O4 - HKLM..Run: [WebRebates0] "C:Program FilesWeb_RebatesWebRebates0.exe"

O4 - HKLM..Run: [bxxs5] RunDLL32.EXE C:WINDOWSbxxs5.dll,DllRun

O4 - HKLM..Run: [**agik] C:WINDOWSMeruoq.exe

O4 - HKLM..Run: [TV Media] C:Program FilesTV MediaTvm.exe

O4 - HKLM..Run: [Wjzlhcx] C:WINDOWS***************.exe

O4 - HKLM..Run: [saie] c:windowssystem32saie.exe

O4 - HKLM..Run: [rsz] C:WINDOWSrsz.exe

O4 - HKLM..Run: [esjofc] C:WINDOWSSystem32esjofc.exe

O4 - HKLM..Run: [DealHelperUpdate] C:WINDOWSDHUpdt.exe

O4 - HKLM..Run: [DealHelperBrwsr] C:WINDOWSdhbrwsr.exe

O4 - HKLM..Run: [qampdvuuzuje] C:WINDOWSSystem32laesbpfl.exe

O4 - HKLM..RunOnce: [djtopr1150.exe] "COCUME~1UserLOCALS~1Tempdjtopr1150.exe"

O4 - HKCU..Run: [TV Media] C:Program FilesTV MediaTvm.exe
O
O8 - Extra context menu item: Web Rebates - file://C:Program FilesWeb_RebatesSy1150Tp1150scri1150a.htm


then reboot into safe mode, open windows explorer, find then delete:
C:Program FilesTV Media
C:WINDOWSSystem32stcloader.exe
C:Program FilesWeb_Rebates
C:WINDOWSMeruoq.exe
C:WINDOWS***************.exe
c:windowssystem32saie.exe
C:WINDOWSrsz.exe
C:WINDOWSSystem32esjofc.exe
C:WINDOWSDHUpdt.exe
C:WINDOWSdhbrwsr.exe
C:WINDOWSSystem32laesbpfl.exe
COCUME~1UserLOCALS~1Tempdjtopr1150.exe


Reboot, rescan and post a fresh log next..
Reply With Quote
Reply

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump



All times are GMT -5. The time now is 06:01 PM.


Firefox 2