Hijack This Log---Need Help! - Free Antivirus Forum

Hijack This Log---Need Help!

BullGuard Antivirus Forum > General Security > Spyware > Hijack This Log---Need Help!

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

meb1963
New Member

Date Joined Oct 2004
Total Posts : 3

Posted 10-24-2004 1:34 (GMT +1)

I am sorry if this post comes up for a second time, but when I checked, it was not posted so I am reposting it. Below is my latest Hijack This log--How do I know what is good and what is not? Please help! Thank You in advance.

Meb1963.

Logfile of HijackThis v1.98.2
Scan saved at 8:33:29 PM, on 10/23/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRA~1\NETROPA\ONSCRE~1\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\ISAFE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/chsi.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/ext/hp/search.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bullguard.com/forum/?r=ca&ui=cbf98896-e3ea-4ae3-8446-a209d63aa9e5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [XoftSpy] C:\PROGRAM FILES\XOFTSPY\XOFTSPY.EXE -s
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: ComcastHSI - {8AF44D60-DD9D-11D8-A856-0000E89A9F3D} - http://www.comcast.net/ (file missing) (HKCU)
O9 - Extra button: Help - {8AF44D61-DD9D-11D8-A856-0000E89A9F3D} - http://online.comcast.net/help/ (file missing) (HKCU)
O9 - Extra button: Support - {8AF44D62-DD9D-11D8-A856-0000E89A9F3D} - http://www.comcastsupport.com/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13599

Posted 10-24-2004 9:43 (GMT +1)

Hey med1963 smilewinkgrin

Scan with Hijacktis, close all other windows, put a checkmark to these, and fix:
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.bullguard.com/forum/?r=ca&ui=cbf98896-e3ea-4ae3-8446-a209d63aa9e5

And your log is clean

Have you any problems?

Touch

Member of - Alliance of Security Analysis Professionals

meb1963
New Member

Date Joined Oct 2004
Total Posts : 3

Posted 10-24-2004 10:29 (GMT +1)

Thank You for the Help!

I was having a problem--every time I would restart my computer my IE would open to about blank. I ran xoftspy and removed everything that it said I had, but everytime I restarted my PC it would be back. I then downloaded CWShredder and that seemed to do the trick. I just wanted to know now if there was something that these two programs had missed. Once again Thank You for the Help!

meb1963

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13599

Posted 10-25-2004 9:50 (GMT +1)

They search and fix for different things

If you like to be sure it´s gone, do this:

Start-run, type:regedit
Find- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
check for a key called-HOMEOldsp, if present- delete it.
And if you have some files in searchpage/searchbar which end with …\sp delete them
Go to Edit in registry and type - HOMEOldsp. Click-Find Next, delete it-if present.
Use F3 for search more, if you find more- delete them.
Same procedure with-About:blank
Close Registry.

Touch

Member of - Alliance of Security Analysis Professionals

Forum Information

Currently it is Friday, November 21, 2008 1:07 AM (GMT +1)
There are a total of 63.950 posts in 15.824 threads.
In the last 3 days there were 33 new threads and 166 reply posts. View Active Threads