What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

2nd Post

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I seem to have gotten rid of iwantsearch, but now I have about:blank. My hijackthis log is below. How do I get rid of this!! Thanks.

Logfile of HijackThis v1.98.2
Scan saved at 11:32:28 PM, on 9/14/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\WMP54GS Wireless Network Monitor\WLService.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\WMP54GS Wireless Network Monitor\WMP54G.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Promon.exe
C:\WINNT\system32\PELMICED.EXE
C:\Program Files\WinPortrait\wpctrl.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\FileFreedom\wtm.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\WINNT\System32\SCardSvr.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - Default URLSearchHook is missing
O1 - Hosts: 100.2.40.11 mthm-hp1
O1 - Hosts: 100.2.40.13 mthm-hp2
O1 - Hosts: 100.2.40.48 citrix2
O1 - Hosts: 100.2.40.66 css
O1 - Hosts: 100.2.40.63 libraryny
O1 - Hosts: 100.2.40.33 sqlny1
O1 - Hosts: 100.2.40.47 sqlny2
O1 - Hosts: 100.2.40.68 sqlny3
O1 - Hosts: 100.2.40.32 docsarc
O1 - Hosts: 100.2.40.89 docsarc2
O1 - Hosts: 100.2.40.38 docsny1
O1 - Hosts: 100.2.40.46 docsny2
O1 - Hosts: 100.2.40.67 docsny3
O1 - Hosts: 100.2.40.91 docsbkup2
O1 - Hosts: 100.2.40.45 faxny
O1 - Hosts: 100.2.40.64 ldny
O1 - Hosts: 100.2.40.42 appsny1
O1 - Hosts: 100.2.40.56 appsny2
O1 - Hosts: 100.2.40.40 printny1
O1 - Hosts: 100.2.40.52 printny45_46
O1 - Hosts: 100.2.40.58 printny47_48
O1 - Hosts: 100.2.40.59 printny49_50
O1 - Hosts: 100.2.40.65 printny54_55
O1 - Hosts: 100.2.40.57 printny56
O1 - Hosts: 100.2.40.34 intranetny1
O1 - Hosts: 100.2.40.36 pdcny
O1 - Hosts: 100.2.40.35 notesny1
O1 - Hosts: 100.2.40.93 exch1
O1 - Hosts: 100.2.40.61 exch2
O1 - Hosts: 100.2.40.90 exch4
O1 - Hosts: 100.2.40.76 exch6
O1 - Hosts: 100.2.40.77 exch7
O1 - Hosts: 100.2.40.78 exch8
O1 - Hosts: 100.2.40.23 exch10
O1 - Hosts: 100.2.40.5 exch12
O1 - Hosts: 100.2.40.114 exch14
O1 - Hosts: 100.2.40.86 imageny2
O1 - Hosts: 100.2.40.88 nydns
O1 - Hosts: 100.2.40.70 tracker3
O1 - Hosts: 100.2.40.71 tracker4
O1 - Hosts: 100.2.40.82 faxny_bdsv
O1 - Hosts: 100.2.40.80 faxny_bdsv2
O1 - Hosts: 100.2.40.83 docsbkup1
O1 - Hosts: 100.2.40.84 cognetny
O1 - Hosts: 100.2.40.34 intranet
O1 - Hosts: 100.2.40.49 termsrv1
O1 - Hosts: 100.2.40.50 nthome
O1 - Hosts: 100.2.40.60 interaction
O1 - Hosts: 100.51.40.2 printmidtown
O1 - Hosts: 100.210.40.252 london1
O1 - Hosts: 100.210.40.80 london2
O1 - Hosts: 100.210.40.251 println
O1 - Hosts: 100.200.40.85 recordsla1
O1 - Hosts: 100.200.40.250 printla1
O1 - Hosts: 100.200.40.240 docsla1
O1 - Hosts: 100.200.40.235 appsla1
O1 - Hosts: 100.200.40.220 faxla
O1 - Hosts: 100.200.40.245 citrixla
O1 - Hosts: 100.200.40.70 exchla1
O1 - Hosts: 100.200.40.72 cdla
O1 - Hosts: 100.200.40.225 notesla1
O1 - Hosts: 100.230.40.10 exchdc
O1 - Hosts: 100.230.40.23 exchdc1
O1 - Hosts: 100.230.40.11 ntdc1
O1 - Hosts: 100.230.40.13 docsdc1
O1 - Hosts: 100.230.40.14 citrixdc
O1 - Hosts: 100.230.40.16 faxdc
O1 - Hosts: 100.230.40.17 faxdc_remote
O1 - Hosts: 100.230.40.18 imagedc2
O1 - Hosts: 100.230.40.19 printdc1
O1 - Hosts: 100.230.40.30 notesdc1
O1 - Hosts: 100.211.40.80 tokyo1
O1 - Hosts: 100.211.40.81 printtk
O1 - Hosts: 100.213.40.80 hongkong1
O1 - Hosts: 100.213.40.81 printhk
O1 - Hosts: 100.212.40.80 singapore1
O1 - Hosts: 100.212.40.81 printsg
O1 - Hosts: 100.214.40.80 moscow1
O1 - Hosts: 100.214.40.81 printmw
O1 - Hosts: 100.21.40.81 printpenn
O1 - Hosts: 204.151.61.132 www.workspace.chase.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: (no name) - {C3646F57-6763-47EC-8D53-2099D6FD3B32} - C:\WINNT\system32\aedcpb.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINNT\System32\nzdd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [My Search Bar Eq] "C:\Program Files\MySearch\bar\s4bareq.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VvTO] c:\documents and settings\mmeza\local settings\temp\VvTO.exe
O4 - HKCU\..\Run: [FileFreedom_Plugin] C:\Program Files\FileFreedom\wtm.exe
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - https://www-3.ibm.com/pc/support/access/sdc…ad/tgctlins.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www-3.ibm.com/pc/support/access/sdc…ad/IbmEgath.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9/ticker.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
O18 - Filter: text/html - {A4790693-3CAC-4811-AC33-FB461BF5A32D} - C:\WINNT\system32\aedcpb.dll
Post #2
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

http://www.zerosrealm.com/downloads.php
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT/tsgen…001052409420406

Then post another log.
Post #3
I downloaded cwshredder and ran it in safe mode. set forth below is my hijackthis log. it seems to have worked–i have restored my homepage. please let me know if ther is anyting I should delete. many thanks.



Logfile of HijackThis v1.98.2
Scan saved at 11:14:44 AM, on 9/25/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\WMP54GS Wireless Network Monitor\WLService.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\WMP54GS Wireless Network Monitor\WMP54G.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Promon.exe
C:\WINNT\system32\PELMICED.EXE
C:\Program Files\WinPortrait\wpctrl.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\FileFreedom\wtm.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O1 - Hosts: 100.2.40.11 mthm-hp1
O1 - Hosts: 100.2.40.13 mthm-hp2
O1 - Hosts: 100.2.40.48 citrix2
O1 - Hosts: 100.2.40.66 css
O1 - Hosts: 100.2.40.63 libraryny
O1 - Hosts: 100.2.40.33 sqlny1
O1 - Hosts: 100.2.40.47 sqlny2
O1 - Hosts: 100.2.40.68 sqlny3
O1 - Hosts: 100.2.40.32 docsarc
O1 - Hosts: 100.2.40.89 docsarc2
O1 - Hosts: 100.2.40.38 docsny1
O1 - Hosts: 100.2.40.46 docsny2
O1 - Hosts: 100.2.40.67 docsny3
O1 - Hosts: 100.2.40.91 docsbkup2
O1 - Hosts: 100.2.40.45 faxny
O1 - Hosts: 100.2.40.64 ldny
O1 - Hosts: 100.2.40.42 appsny1
O1 - Hosts: 100.2.40.56 appsny2
O1 - Hosts: 100.2.40.40 printny1
O1 - Hosts: 100.2.40.52 printny45_46
O1 - Hosts: 100.2.40.58 printny47_48
O1 - Hosts: 100.2.40.59 printny49_50
O1 - Hosts: 100.2.40.65 printny54_55
O1 - Hosts: 100.2.40.57 printny56
O1 - Hosts: 100.2.40.34 intranetny1
O1 - Hosts: 100.2.40.36 pdcny
O1 - Hosts: 100.2.40.35 notesny1
O1 - Hosts: 100.2.40.93 exch1
O1 - Hosts: 100.2.40.61 exch2
O1 - Hosts: 100.2.40.90 exch4
O1 - Hosts: 100.2.40.76 exch6
O1 - Hosts: 100.2.40.77 exch7
O1 - Hosts: 100.2.40.78 exch8
O1 - Hosts: 100.2.40.23 exch10
O1 - Hosts: 100.2.40.5 exch12
O1 - Hosts: 100.2.40.114 exch14
O1 - Hosts: 100.2.40.86 imageny2
O1 - Hosts: 100.2.40.88 nydns
O1 - Hosts: 100.2.40.70 tracker3
O1 - Hosts: 100.2.40.71 tracker4
O1 - Hosts: 100.2.40.82 faxny_bdsv
O1 - Hosts: 100.2.40.80 faxny_bdsv2
O1 - Hosts: 100.2.40.83 docsbkup1
O1 - Hosts: 100.2.40.84 cognetny
O1 - Hosts: 100.2.40.34 intranet
O1 - Hosts: 100.2.40.49 termsrv1
O1 - Hosts: 100.2.40.50 nthome
O1 - Hosts: 100.2.40.60 interaction
O1 - Hosts: 100.51.40.2 printmidtown
O1 - Hosts: 100.210.40.252 london1
O1 - Hosts: 100.210.40.80 london2
O1 - Hosts: 100.210.40.251 println
O1 - Hosts: 100.200.40.85 recordsla1
O1 - Hosts: 100.200.40.250 printla1
O1 - Hosts: 100.200.40.240 docsla1
O1 - Hosts: 100.200.40.235 appsla1
O1 - Hosts: 100.200.40.220 faxla
O1 - Hosts: 100.200.40.245 citrixla
O1 - Hosts: 100.200.40.70 exchla1
O1 - Hosts: 100.200.40.72 cdla
O1 - Hosts: 100.200.40.225 notesla1
O1 - Hosts: 100.230.40.10 exchdc
O1 - Hosts: 100.230.40.23 exchdc1
O1 - Hosts: 100.230.40.11 ntdc1
O1 - Hosts: 100.230.40.13 docsdc1
O1 - Hosts: 100.230.40.14 citrixdc
O1 - Hosts: 100.230.40.16 faxdc
O1 - Hosts: 100.230.40.17 faxdc_remote
O1 - Hosts: 100.230.40.18 imagedc2
O1 - Hosts: 100.230.40.19 printdc1
O1 - Hosts: 100.230.40.30 notesdc1
O1 - Hosts: 100.211.40.80 tokyo1
O1 - Hosts: 100.211.40.81 printtk
O1 - Hosts: 100.213.40.80 hongkong1
O1 - Hosts: 100.213.40.81 printhk
O1 - Hosts: 100.212.40.80 singapore1
O1 - Hosts: 100.212.40.81 printsg
O1 - Hosts: 100.214.40.80 moscow1
O1 - Hosts: 100.214.40.81 printmw
O1 - Hosts: 100.21.40.81 printpenn
O1 - Hosts: 204.151.61.132 www.workspace.chase.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINNT\System32\nzdd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\realplay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [My Search Bar Eq] "C:\Program Files\MySearch\bar\s4bareq.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VvTO] c:\documents and settings\mmeza\local settings\temp\VvTO.exe
O4 - HKCU\..\Run: [FileFreedom_Plugin] C:\Program Files\FileFreedom\wtm.exe
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - https://www-3.ibm.com/pc/support/access/sdc…ad/tgctlins.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - https://www-3.ibm.com/pc/support/access/sdc…ad/IbmEgath.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9/ticker.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab
Post #4
Hello msmeza

Please go to add and remove programs and remove,
MySearch

Close all Browser and Program Windows and have HijackThis fix the following by checking the box beside each and then clicking on Fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O1 - Hosts: 100.2.40.11 mthm-hp1
O1 - Hosts: 100.2.40.13 mthm-hp2
O1 - Hosts: 100.2.40.48 citrix2
O1 - Hosts: 100.2.40.66 css
O1 - Hosts: 100.2.40.63 libraryny
O1 - Hosts: 100.2.40.33 sqlny1
O1 - Hosts: 100.2.40.47 sqlny2
O1 - Hosts: 100.2.40.68 sqlny3
O1 - Hosts: 100.2.40.32 docsarc
O1 - Hosts: 100.2.40.89 docsarc2
O1 - Hosts: 100.2.40.38 docsny1
O1 - Hosts: 100.2.40.46 docsny2
O1 - Hosts: 100.2.40.67 docsny3
O1 - Hosts: 100.2.40.91 docsbkup2
O1 - Hosts: 100.2.40.45 faxny
O1 - Hosts: 100.2.40.64 ldny
O1 - Hosts: 100.2.40.42 appsny1
O1 - Hosts: 100.2.40.56 appsny2
O1 - Hosts: 100.2.40.40 printny1
O1 - Hosts: 100.2.40.52 printny45_46
O1 - Hosts: 100.2.40.58 printny47_48
O1 - Hosts: 100.2.40.59 printny49_50
O1 - Hosts: 100.2.40.65 printny54_55
O1 - Hosts: 100.2.40.57 printny56
O1 - Hosts: 100.2.40.34 intranetny1
O1 - Hosts: 100.2.40.36 pdcny
O1 - Hosts: 100.2.40.35 notesny1
O1 - Hosts: 100.2.40.93 exch1
O1 - Hosts: 100.2.40.61 exch2
O1 - Hosts: 100.2.40.90 exch4
O1 - Hosts: 100.2.40.76 exch6
O1 - Hosts: 100.2.40.77 exch7
O1 - Hosts: 100.2.40.78 exch8
O1 - Hosts: 100.2.40.23 exch10
O1 - Hosts: 100.2.40.5 exch12
O1 - Hosts: 100.2.40.114 exch14
O1 - Hosts: 100.2.40.86 imageny2
O1 - Hosts: 100.2.40.88 nydns
O1 - Hosts: 100.2.40.70 tracker3
O1 - Hosts: 100.2.40.71 tracker4
O1 - Hosts: 100.2.40.82 faxny_bdsv
O1 - Hosts: 100.2.40.80 faxny_bdsv2
O1 - Hosts: 100.2.40.83 docsbkup1
O1 - Hosts: 100.2.40.84 cognetny
O1 - Hosts: 100.2.40.34 intranet
O1 - Hosts: 100.2.40.49 termsrv1
O1 - Hosts: 100.2.40.50 nthome
O1 - Hosts: 100.2.40.60 interaction
O1 - Hosts: 100.51.40.2 printmidtown
O1 - Hosts: 100.210.40.252 london1
O1 - Hosts: 100.210.40.80 london2
O1 - Hosts: 100.210.40.251 println
O1 - Hosts: 100.200.40.85 recordsla1
O1 - Hosts: 100.200.40.250 printla1
O1 - Hosts: 100.200.40.240 docsla1
O1 - Hosts: 100.200.40.235 appsla1
O1 - Hosts: 100.200.40.220 faxla
O1 - Hosts: 100.200.40.245 citrixla
O1 - Hosts: 100.200.40.70 exchla1
O1 - Hosts: 100.200.40.72 cdla
O1 - Hosts: 100.200.40.225 notesla1
O1 - Hosts: 100.230.40.10 exchdc
O1 - Hosts: 100.230.40.23 exchdc1
O1 - Hosts: 100.230.40.11 ntdc1
O1 - Hosts: 100.230.40.13 docsdc1
O1 - Hosts: 100.230.40.14 citrixdc
O1 - Hosts: 100.230.40.16 faxdc
O1 - Hosts: 100.230.40.17 faxdc_remote
O1 - Hosts: 100.230.40.18 imagedc2
O1 - Hosts: 100.230.40.19 printdc1
O1 - Hosts: 100.230.40.30 notesdc1
O1 - Hosts: 100.211.40.80 tokyo1
O1 - Hosts: 100.211.40.81 printtk
O1 - Hosts: 100.213.40.80 hongkong1
O1 - Hosts: 100.213.40.81 printhk
O1 - Hosts: 100.212.40.80 singapore1
O1 - Hosts: 100.212.40.81 printsg
O1 - Hosts: 100.214.40.80 moscow1
O1 - Hosts: 100.214.40.81 printmw
O1 - Hosts: 100.21.40.81 printpenn
O1 - Hosts: 204.151.61.132 www.workspace.chase.com
O4 - HKLM\..\Run: [My Search Bar Eq] "C:\Program Files\MySearch\bar\s4bareq.exe" /r

Reboot afterwards in SAFE MODE. If you don't know how click here
Delete the following files and folder listed

C:\Program Files\MySearch


Some of these files and folders might have the hidden atribute
How to show hidden files and folders in Windows Instructions here

Then Download System Security Suite. Extract it from the zip file into a folder.
http://www.igorshpak.net/software/3ssetup104.zip
Under "items to clear" click all. Then click "clear selected items"

Reboot and Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.
Post #5
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI