yeah I tried for almost a full week to get rid of it but then my Server got hacked and I just didnt have the time to clean both systems.
I accepted my Windows defeat and just rebooted my bow
| Avian Gamers Network http://www.avian-gamers.net/forums/ |
|
| major spyware issues http://www.avian-gamers.net/forums/viewtopic.php?f=1&t=13752 |
Page 1 of 1 |
| Author: | iJasonT [ Tue Dec 21, 2004 10:14 pm ] |
| Post subject: | major spyware issues |
I got some real nasty spyware the other day and I just cannot get rid of it. I have run Ad-ware, Norton, SpywareBlaster and others and I just cannot git rid of 3 Internet Explorer Script Errors. 2 from top-banners and 1 from searchingbooth. I ran Hijackthis but do not know how to read it. My computer is totally dead until I fix this as the Script Error warnings kick me out of whatever I am doing. I do not even have IE installed on my comp. I actually tried to reinstall it but I cannot even manage to get the installer to load. any advice? |
|
| Author: | iJasonT [ Tue Dec 21, 2004 10:14 pm ] |
| Post subject: | |
Logfile of HijackThis v1.99.0 Scan saved at 6:52:41 PM, on 12/21/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe C:\WINDOWS\System32\zcybxicp.exe C:\WINDOWS\system32\yvueqjq.exe C:\WINDOWS\ovktbj.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Documents and Settings\jason\Application Data\cece.exe C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe C:\WINDOWS\System32\??rss.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\jason\My Documents\My Pictures\HijackThis.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R3 - Default URLSearchHook is missing O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\dllcache\imscinst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\dllcache\tintsetp.exe /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\dllcache\tintsetp.exe /IMEName O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [itz.exe] C:\documents and settings\jason\local settings\temp\itz.exe O4 - HKLM\..\Run: [koK4fRxt.exe] C:\documents and settings\jason\local settings\temp\koK4fRxt.exe O4 - HKLM\..\Run: [EV.exe] C:\documents and settings\jason\local settings\temp\EV.exe O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe O4 - HKLM\..\Run: [xscvqkxkkwgva] C:\WINDOWS\System32\zcybxicp.exe O4 - HKLM\..\Run: [vytebc] C:\WINDOWS\System32\vytebc.exe O4 - HKLM\..\Run: [yvueqjq] C:\WINDOWS\system32\yvueqjq.exe O4 - HKLM\..\Run: [elrhbc] C:\WINDOWS\System32\elrhbc.exe O4 - HKLM\..\Run: [C:\WINDOWS\ovktbj.exe] C:\WINDOWS\ovktbj.exe O4 - HKLM\..\Run: [SStb.exe] SStb.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Usea] C:\Documents and Settings\jason\Application Data\cece.exe O4 - HKCU\..\Run: [Xkxj] C:\WINDOWS\System32\??rss.exe O4 - HKCU\..\Run: [spywatch] C:\Program Files\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP O4 - HKCU\..\Run: [POPUPWATCH] C:\Program Files\BulletProofSoft.com\SpywareRemover\popup-watch\PopUpWatch.exe /STARTUP O4 - Startup: Norton System Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\calsp.dll O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/ ... 0_0_44.cab O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://swgbetareg.station.sony.com/soesysinfo.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.c ... mplete.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.7.20.20/tukati.cab O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE O23 - Service: Intel(R) Active Monitor - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe O23 - Service: ISEXEng - Unknown - C:\WINDOWS\System32\angelex.exe O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
|
| Author: | iJasonT [ Tue Dec 21, 2004 10:15 pm ] |
| Post subject: | |
uhg. even my Mozilla has auto forwards on it. This is killing me. |
|
| Author: | Rocklar [ Tue Dec 21, 2004 10:22 pm ] |
| Post subject: | |
That's terrible! I absolutely detest any form of spyware. I went through a similar experience about 4 months ago and the only way I was eventually able to take care of the problem was when Ad-Aware released a new version of their definition files. I would recommend you forward them any and all information you have about this problem but chances are they already have it. Best of luck, I wish I had more to tell you. |
|
| Author: | Locke_Trinmin [ Wed Dec 22, 2004 1:19 am ] |
| Post subject: | |
Try "Spyboy Search & Destroy" It's located here: http://www.safer-networking.org/en/index.html |
|
| Author: | Dragon Fire [ Wed Dec 22, 2004 10:54 am ] |
| Post subject: | |
I got some tame spyware on my machine only a pop up every now and then thats auto blocked...might try CWshredder just in case its a coolweb varient... http://cwshredder.net/cwshredder/cwschronicles.html |
|
| Author: | Kyp Darron [ Mon Dec 27, 2004 4:04 pm ] |
| Post subject: | |
Seems to be a Look2me infection. Nasty bugger to remove. |
|
| Author: | iJasonT [ Mon Dec 27, 2004 4:11 pm ] |
| Post subject: | |
yeah I tried for almost a full week to get rid of it but then my Server got hacked and I just didnt have the time to clean both systems. I accepted my Windows defeat and just rebooted my bow
|
|
| Author: | GodOfGophers [ Tue Dec 28, 2004 11:59 am ] |
| Post subject: | |
The scums that make and distribute spyware should be stoned publicly! I fought for a good year trying to make IE usable and have sinced switched to Firefox and haven't had a problem. I have to use IE at work and I hate it! Good luck sir. |
|
| Page 1 of 1 | All times are UTC - 5 hours [ DST ] |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|