What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help With Hijackers

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Tony- after I have hijack this fix those items and I reboot, how (where from?) do I delete those other two things? Also, I can't access www.cexx.org 'cause of my filter. Any suggestions? Thanks, Jenney
Post #17
PLEASE READ MY NOTE FIRST - THANKS Here's my log. The same thing keeps turning up. I'm told to run HT and check 2 boxes to fix them, which I do, then reboot. BUT then I was told after I reboot to delete a couple of things, BUT I DON'T KNOW WHERE TO DELETE THEM FROM, also I know I have a broken internet connection and that I need to go to cexx.org to download the lsp repair, but my filter won't allow me on that site. Any suggestions? Logfile of HijackThis v1.97.7 Scan saved at 10:07:51 PM, on 12/14/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Nhksrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe C:\WINDOWS\System32\InetCntrl\InetCntrl.exe C:\WINDOWS\system32\winlogon.exe C:\Program Files\AIM95\aim.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\MOMDAD\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe O4 - HKLM\..\Run: [fhwxjyk] "C:\WINDOWS\System32\fhwxjyk.exe" O4 - HKLM\..\Run: [InetCntrl] C:\WINDOWS\System32\InetCntrl\InetCntrl.exe O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl O4 - Startup: M-W Link to Collegiate® Dictionary.lnk = C:\Program Files\MWED\MWLINK.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: AIM (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O10 - Broken Internet access because of LSP provider 'inetcntrl.dll' missing O17 - HKLM\System\CCS\Services\Tcpip\..\{870AACFD-75D2-455E-A93A-BB5161C129C7}: NameServer =
Post #18 last edited
It would be helpful if you could post a link to the original thread where you were given suggestions already so that we could get an idea of what has already been done and didn't work. I just found all 3 of them, it would be a good idea to keep everything in one thread, you will get more coherent responses. I will post the links below…..

I am still a novice at this, but it looks like you could have CWS, have you already used CWShredder??

For the LSPfix, please search your hard drive and find the file 'inetcntrl.dll' and check the properties to determine where the file comes from, then post that info here…

http://forums.tomcoyote.org/index.php?show…cntrl\.dll

and:

http://forums.tomcoyote.org/index.php?show…cntrl\.dll

and:

http://forums.tomcoyote.org/index.php?show…cntrl\.dll

One more thing: you are running HijackThis from a temporary location and if you need to undo any changes you make, you won't be able to. It is a good idea to install it in a permanent folder…
Post #20
Budfred, thanks for the input. I have used CWS. Also it looks like the inetcntrl.dll comes from my filter provider. DO you think my log looks OK? Also, how do I move HT to a permanent folder? Again, thanks, Jenney
Post #22 last edited
No, there is still something wrong with your log as indicated by this: O4 - HKLM\..\Run: [fhwxjyk] "C:\WINDOWS\System32\fhwxjyk.exe" and whatever it is that keeps reinstalling the garbage. I don't feel confident to advise you on what to change, but hang on and someone will be along who can. I would not run that LSPfix if the program mentioned seems to be a legitimate one. It might be a good idea to give more specific info about the filter you are referring to, but it is likely that it is legit if you recognize it. To install HijackThis to its own folder, you just extract it to a folder you choose and then run it from that folder. I put shortcut on my desktop to make it easy to do that…. Edit: It would definitely be a good idea to provide more info about that: "InetCntrl". I am beginning to suspect that could be the problem….
Post #24
If that Guest is Jenny, please provide as much detail as you can about that "InetCntrl" so we can figure out what it is and if it is a problem. I wasn't able to find any useful info in the scans and lists I checked….
Post #25 last edited
Also;once your internet connection is fixed, you should update IE to SP1 and apply all patches to bring you up to date. Start>All Programs> Windows Update.
Post #26
I was the guest, Budfred. The only info on that file is that it looks like it was created by my internet filter company, Bsafe online. I don't know if that's any help. Tashi, I have LOTS of updates to donload (11 hours worth!) I'm just waiting to see if I can ever clear up this problem. Jenney
Post #29 last edited
Based on a quick search, it looks like BSafe is legit. Does anyone else know anything about it??

It just occurred to me that tashi may be on to something. If you don't have the WinXP updates, you may be getting reinfected each time you log on again. Are you using the computer in question to log on??? If not, I would try running the Blaster and Welchia cleaners to see if that cleans things up. I had Welchia and didn't find any reference to it in the HijackThis log.

Go to Symantec for a Blaster removal tool and instructions.

And Symantec again for a Welchia removal tool.

Let us know if either finds any files….
Post #30 last edited
I did have the blaster worm a few months ago. I downloaded the removal tool and did install that patch, so it should be ok. I'll check on the other.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI