What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

New Browser Hijacker

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Here is how you fix it with hihack this:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.windowws.cc/sp.htm?id=9
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.windowws.cc/sp.htm?id=9
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - (no file)
O4 - HKCU\..\Run: [Windows Control] C:\WINDOWS\CONTROL.EXE

Then restore CONTROL.EXE from Windows Setup CD - the CWS trojan has overwritten control.exe file
Post #18
Check, and have Hijack This fix the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lookfor.cc/index.php?p=37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.lookfor.cc/sp.php?p=37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lookfor.cc/index.php?p=37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.lookfor.cc/sp.php?p=37049

O4 - HKLM\..\Run: [SpyHunter] D:\Program Files\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE

And I strongly advise you to get rid of SpyKiller. In addition to producing loads of False Positives, it won't detect much of anything at all, and it charges you $29.95 if you actually want to have it remove what it found…

Both Ad-Aware and SpyBot S&D do a far better job, and they're freeware!

Cheers,
Post #19 last edited
Whoops, that was me; I keep having to log in here… :oops: Abd I said SpyKiller, but I meant SpyHunter. Same difference really…
Post #20
Hi I have a question, how do i restore my CONTROL.EXE, becuase I have the same problem as the other person, but I do not have my windows setup cd ???????
Post #21
i hope this isnt a dead topic - i think it shouldnt be - i think ive found a slight variant of this trojan…i think. :unsure: so here's the deal that I've been able to find so far: a file called "new.exe" in WINNT/ is dropping executables with random, six-letter names in my WINNT dir (sorry, i dont know the contents of the files - filalyzer couldnt read it). the random executables were named, for instance (fron HJT log): – O4 - HKCU\..\Run: [PMFOPLX] D:\WINNT\OAQSPK.exe – O4 - HKCU\..\Run: [PWHXBBF] D:\WINNT\PTKEEA.exe So, I shift-deleted new.exe, the six-letter execs and another file i cant seem to remember right now (sorry), but the problem seems to persist. So, i find this OTHER file - ironically a variant of this thread's "CONTROL.EXE" - called "PRECONTROL.EXE" and inside it contains the following text: ————— %s\new.exe..http://www.greg-search.com/G7/new.exe ————— it also seems to ulitize the following import table: ————— urlmon.dll (imports URLDownlodToFileA) kernel32.dll (imports HeapAlloc, CloseHandle, CreateProcessA, GetWindowsDirectoryA, ExitProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA and GetProcessHeap) user32.dll (imports wvsprintfA) ole32.dll (imports CoInitialize and CoUninitialize) ————— So, I check out www.greg-search.com and its got some funky sanskrit encoding or something with no leads and the G7 directory doesnt allow browsing, so I quit since Im not about to infect myself again. wait…perhaps I will try it so I can learn more about this thing, later though. The first thing I did was to include www.greg-search.com into my hosts file *whew* no more worries. anyway, I'm still working on this thing, I thought I'd let everyonw know what I found so far to see if anyone had any other leads. if you want any of my files, just ask (email [removed]). -gkd (happy new year!) :D
Post #22
i hope this isnt a dead topic - i think it shouldnt be - i think ive found a slight variant of this trojan…i think. :unsure: so here's the deal that I've been able to find so far: a file called "new.exe" in WINNT/ is dropping executables with random, six-letter names in my WINNT dir (sorry, i dont know the contents of the files - filalyzer couldnt read it). the random executables were named, for instance (fron HJT log): – O4 - HKCU\..\Run: [PMFOPLX] D:\WINNT\OAQSPK.exe – O4 - HKCU\..\Run: [PWHXBBF] D:\WINNT\PTKEEA.exe So, I shift-deleted new.exe, the six-letter execs and another file i cant seem to remember right now (sorry), but the problem seems to persist. So, i find this OTHER file - ironically a variant of this thread's "CONTROL.EXE" - called "PRECONTROL.EXE" and inside it contains the following text: ————— %s\new.exe..http://www.greg-search.com/G7/new.exe ————— it also seems to ulitize the following import table: ————— urlmon.dll (imports URLDownlodToFileA) kernel32.dll (imports HeapAlloc, CloseHandle, CreateProcessA, GetWindowsDirectoryA, ExitProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA and GetProcessHeap) user32.dll (imports wvsprintfA) ole32.dll (imports CoInitialize and CoUninitialize) ————— So, I check out www.greg-search.com and its got some funky sanskrit encoding or something with no leads and the G7 directory doesnt allow browsing, so I quit since Im not about to infect myself again. wait…perhaps I will try it so I can learn more about this thing, later though. The first thing I did was to include www.greg-search.com into my hosts file *whew* no more worries. anyway, I'm still working on this thing, I thought I'd let everyonw know what I found so far to see if anyone had any other leads. if you want any of my files, just ask (email [removed]). -gkd (happy new year!) :D
Post #23
i hope this isnt a dead topic - i think it shouldnt be - i think ive found a slight variant of this trojan…i think. :unsure: so here's the deal that I've been able to find so far: a file called "new.exe" in WINNT/ is dropping executables with random, six-letter names in my WINNT dir (sorry, i dont know the contents of the files). the random executables were named, for instance (fron HJT log): – O4 - HKCU\..\Run: [PMFOPLX] D:\WINNT\OAQSPK.exe – O4 - HKCU\..\Run: [PWHXBBF] D:\WINNT\PTKEEA.exe So, I shift-deleted new.exe, the six-letter execs and another file i cant seem to remember right now (sorry), but the problem seems to persist. So, i find this OTHER file - ironically a variant of this thread's "CONTROL.EXE" - called "PRECONTROL.EXE" and inside it contains the following text: ————— %s\new.exe..http://www.greg-search.com/G7/new.exe ————— it also seems to ulitize the following import table: ————— urlmon.dll (imports URLDownlodToFileA) kernel32.dll (imports HeapAlloc, CloseHandle, CreateProcessA, GetWindowsDirectoryA, ExitProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA and GetProcessHeap) user32.dll (imports wvsprintfA) ole32.dll (imports CoInitialize and CoUninitialize) ————— So, I check out www.greg-search.com and its got some funky sanskrit encoding or something with no leads and the G7 directory doesnt allow browsing, so I quit since Im not about to infect myself again. wait…perhaps I will try it so I can learn more about this thing, later though. The first thing I did was to include www.greg-search.com into my hosts file *whew* no more worries. anyway, I'm still working on this thing, I thought I'd let everyonw know what I found so far to see if anyone had any other leads. if you want any of my files, just ask (email [removed]). -gkd (happy new year!) :D
Post #25
er, um…me again. I found a reference to the files on my PC through a site prmoting Pest Patrol which said that Pest Partol would ID and secure this particular trojan. it IDs the file "PRECONTROL.EXE" as: Adware Windows Media Exploit, reg entry: — HKEY_USERS\.default\software\microsoft\mediaplayer\player\settings: client id and — HKEY_CURRENT_USER\software\microsoft\mediaplayer\player\settings: client id Lavasoft's most current update (1/1/04) recognizes and fixes it. okay - im going to bed befire i require a thread all to myself. -gkd
Post #26
Hi… I have had the very same problem! (computer running xp btw) grr… I found an entry in my HijackThis log: 04 - HKCU\..\run: [Windows Control] C:\Windows\tatuuev.exe This file is indeed in in the windows directory, but a search on google revealed no information as to what it might be. So I deleted all the "Main,Default_Page" etc entries which were of the value www.windows.cc or www.search2004.net (so my browser pointed back to the correct homepage) and then ran the tatuuev.exe. Guess what? Did another Hijack scan, and also opened my browser and..oooh..www.search2004.net as my homepage! Fixed? so I thort! But this jack is just trying to be funny..because after removing the said 04 entry..it decideds to make another one (including creating another .exe of some other random name, which does exactly the same thing). OK..gonna try fix for good but if anyone has any suggestions in the mean time..I would be grateful. xTIMMYx
Post #27
OK! I got the b*gger Well..this is what I did to stop it on Windows XP. Firstly..before deleting anything in HijackThis click start and goto run, then type msconfig and press enter. (on windows 98 I BELIEVE you type sysconfig but don't hold me to that) When the system config box appears, click the startup tab. Now uncheck the entry of the aforementioned aliased startup program (like for example I said in the last post NUUEV.exe). This disables it instead of deleting it. Now run HijackThis and delete all the reg entries (start page etc) and also delete the 04 - HKCU\..\run: [Windows Control] C:\Windows\xxxxx.exe (whatever the xxxxx happens to be). Finally delete the .exe in the C:\WINDOWS folder, reboot, and all should be fine! xTIMMYx :D
Post #28
yup. that sounds very much like what ive got going on.

there's more:

check if WINNT/ contains the file "hello3.exe" this file is similar to the precontrol.exe file in that they contain much of the same data and string args. hello3.exe also contains the text/data link to this address:

http://64.124.210.124/submit.exe – similar to www.gregsearch.com/G7/new.exe in precontrol.exe found also in WINNT/

what else I found this morning is that the random, six-lettered executable that gets dropped in WINNT by "new.exe" is that either new.exe or precontrol.exe writes the line "WINNT/xxxxxx.exe" to system.bat (again, where "xxxxxx" is any random set of letters)

anything else?
-gkd
Post #29
Hi!

This is what I have. Thanks for all your help!


Logfile of HijackThis v1.97.7
Scan saved at 12:46:39 PM, on 1/2/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NOVELL\CLIENT32\NWRECMSG.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\NOVELL\CLIENT32\WM95.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\DIGSTREAM\DIGSTREAM.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\INTEL\INTEL PSNCU\CPUNUMBER.EXE
C:\NOVELL\GROUPWISE\NOTIFY.EXE
C:\PROGRAM FILES\MSAC-FD1\MSSTAT.EXE
C:\SMARTDSK\FLASH\SDSTAT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\NOVELL\GROUPWISE\GRPWISE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.windowws.cc/sp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.windowws.cc/sp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.windowws.cc/sp.htm?id=106
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowws.cc/hp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acc.count-all.com/-/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://acc.count-all.com/–/?ydtfs (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.windowws.cc/sp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://acc.count-all.com/–/?ydtfs (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://t.rack.cc/s.php?aid=35
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://t.rack.cc/h.php?aid=35
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://acc.count-all.com/–/?ydtfs (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://acc.count-all.com/–/?ydtfs (obfuscated)
F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSINFO\info32.exe
O1 - Hosts: 3510794918 auto.search.msn.com
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\PROGRAM FILES\SUBMIT\SUBMITHOOK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~1\rtvscn95.exe
O4 - HKLM\..\RunServices: [Workstation Scheduler] C:\novell\client32\wm95.exe
O4 - HKCU\..\Run: [IntelProcNumUtility] "C:\Program Files\Intel\Intel PSNCU\CpuNumber.exe" /nosplash
O4 - HKCU\..\Run: [QPAILAOB] C:\WINDOWS\SBSPBQE.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: GroupWise Notify.lnk = C:\NOVELL\GroupWise\Notify.exe
O4 - Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSstat.exe
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O4 - Startup: FlashPath Status.lnk = C:\SMARTDSK\FLASH\SDSTAT.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {F72A7B0E-0DD8-11D1-BD6E-00AA00B92AF1} (IE Active Setup Control) - http://www.microsoft.com/windows/ie/ie40/d…df/setupctl.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…/swdir8d205.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://205.158.58.128/31b39feef0d7ede98618/netzip/RdxIE.cab
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowse….1.1/Hiwire.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} (MSN Chat Control 4.2) - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {80F1B906-D066-11D3-AD70-009027B8ADBC} (WebPlayer Class) - http://content.hiwirenetworks.net/inbrowse…5.30/Hiwire.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7985.6240740741
O19 - User stylesheet: C:\WINDOWS\Web\win.def (file missing)
O19 - User stylesheet: C:\WINDOWS\default.css (file missing) (HKLM)
Post #30
Can someone please a little frog totally ignorant about computers. I have my Hijack file below but I do not know what to get rid of. Could someone help me?

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://super-spider.com/greg/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://super-spider.com/greg/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://super-spider.com/greg/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://super-spider.com/greg/hp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://super-spider.com/greg/sp.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.bip.net
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_1_4_0.DLL
O2 - BHO: (no name) - {2E9CAFF6-30C7-4208-8807-E79D4EC6F806} - C:\PROGRAM FILES\SUBMIT\SUBMITHOOK.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_1_4_0.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MICROS~1\POINT32.EXE
O4 - HKLM\..\Run: [TIPS] C:\PROGRA~1\MICROS~1\TIPS\MOUSE\TIPS.EXE
O4 - HKLM\..\Run: [3dfx Tools] rundll32.exe 3dfxCmn.dll,UpdateRegSettings
O4 - HKLM\..\Run: [Norton AV Preload] C:\PROGRA~1\NORTON~1\PREMEND.EXE -F
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SNSHotKey] RUNDLL32.exe C:\PROGRA~1\GDS\sns.dll,SetHotKey
O4 - HKLM\..\Run: [SNSMon] C:\PROGRAM FILES\GDS\NSYSMON.EXE
O4 - HKLM\..\Run: [SpyHunter] C:\PROGRAM FILES\SPYHUNTER\SPYHUNTER.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start
O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "c:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES\MICROSOFT ACTIVESYNC\WCESCOMM.EXE"
O4 - HKCU\..\Run: [XXDMGPFMFGUBIFP] C:\WINDOWS\KXOYSAOAYNESAS.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\Microsoft Home Publishing\MHPRMIND.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\SBPCI\FINDFAST.EXE
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… (HKLM)
O12 - Plugin for .MID: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .pif: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .scr: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/…/yiebio4025.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://kit.carpediem.fr/15239/dialogue-fr.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash/cabs/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7983.0584837963

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI