Hijack Log

Hello "Unwiserchicken", Welcome to TC
I'm looking into your HJT log now.
Be back soon with our suggestions.

MARTY1946

Hello again Unwiserchicken,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. DO NOT have any open browsers when you are following the procedures below.

(1).
Make sure to close any open browsers.
Run a scan with hijackthis and put a check beside these lines and choose FIX.
(Please be careful not to miss any)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page

O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\Amanda\LOCALS~1\Temp\bundle.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)


”optional but recommended”

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart

(2).
*Restart the computer. Boot in "safe" mode FIRST.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

(3).
Please go to your Add/Remove Programs panel- Look for these programs and uninstall it if present


AD CONTROL
MSN Plus 3/Messenger Plus 3
Messenger Plus!, (a add on for Msg, could install 3rd party crap ware if you didn’t opt out during install)

(4).
Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

(5).
Then while still in safe mode delete these folders and/or files:
C:\Program Files\Windows ControlAd\WinCtlAd.exe<
“optional but recommended”
C:\Program Files\Messenger Plus! 3\MsgPlus.exe]\<<

The messenger Plus 3 is probably the install that brought you this other malware.

(6).
Remove contents of Temporary folders.
Go Here to see how: http://forums.tomcoyote.org/index.php?showtopic=13488

(7).
Reboot in regular mode when finished troubleshooting
Please run and repost a new HJT log in your reply to this post.

We will need to check your LOG again…Marty

Marty <_<

Hello again Unwiserchicken,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. DO NOT have any open browsers when you are following the procedures below.

(1).
Scan your system, these free on-line scanners (note: some spyware have been known to disable PC based AV scanners): ("Do Both, No Harm")
http://housecall.trendmicro.com or
http://www.pandasoftware.com/activescan/co…n_principal.htm
Always remember to allow the Program to "Fix", RE-BOOT, after each Scan.

(2).
Make sure to close any open browsers.
Run a scan with hijackthis and put a check beside these lines and choose FIX.(“ If this is still present”)

O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe

(3).
*Restart the computer. Boot in "safe" mode FIRST.
*as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
*Use the arrow keys to select the Safe mode menu item
*press Enter.

(4).
Please go to your Add/Remove Programs panel- Look for this program and uninstall it if present

AD CONTROL or any program that looks similar.

(5).
Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

(6).
Then while still in safe mode delete these folders and/or files:
C:\Program Files\Windows ControlAd\WinCtlAd.exe<
(7).
Remove contents of Temporary folders.
Go Here to see how: http://forums.tomcoyote.org/index.php?showtopic=13488

(8).
Create a new Restore Point. (Right Click on Control Panel, then Properties, then System Restore, Put a check in TURN OFF SYSTEM RESTORE.)
Reboot to regular mode when finished troubleshooting.
Then redo steps to create new Restore Point.

(9).
Reboot to regular mode.
Please run and repost a new HJT log in your reply to this post.

We will need to check your LOG again…Marty

Hello again unwiserchicken,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. DO NOT have any open browsers when you are following the procedures below.

(1).
Do you recognize these organizations? R1-Searchbar R0-Main Start Page
If not: Make sure to close any open browsers.
Run a scan with hijackthis and put a check beside these lines and choose FIX.
Your LOG is clean except for these?

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.cxaoicupatmhrieaqusyjxi.org/5Px…epz08wYD6zZ.cgi


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.loccxziubgm.org/5PxV2wd0XUl5OH/…uKvt6rVnhw.html

Also this 02 entry?

O2 - BHO: (no name) - {AFCD6337-37B8-07D9-458F-13B96869BA67} - C:\DOCUME~1\Amanda\APPLIC~1\INTRAS~1\movesize.exe

(2).
That AD-Ware Thing was taken care of!

(3).
Once done reboot into Normal Mode scan and post a new HijackThis log file to confirm what was removed and if it's clean or not.
Marty

Hello again unwiserchicken,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. DO NOT have any open browsers when you are following the procedures below.

(1).
Download “CWShredder” from:
http://www.intermute.com/spysubtract/cwshr…r_download.html

Tutorial can be found here:
http://www.bleepingcomputer.com/forums/tutorial47.html

(2).
Make sure to close any open browsers.
Run a scan with hijackthis and put a check beside these lines and choose FIX.(if it’s still in log)

[BR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inodppfpmgxvczykpnmxo.com/5PxV2…Opz08wYD6zZ.htm

(3).
Once done reboot into Normal Mode and scan and post a new HijackThis log file to confirm what was removed and if it's clean or not.
Marty

Hello again unwiserchicken,

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. DO NOT have any open browsers when you are following the procedures below.


You have a stubborn R1 entry that keeps changing.

(1).
Please boot to safe mode. (Tap F8 key after BIOS screen.)

(2).
Run CWShredder in safe mode.

(3).
Run HJT in safe mode.
Make sure to close any open browsers.
Run a scan with hijackthis and put a check beside these lines and choose FIX.(if it’s still in log)
Any R1 entry that resembles These;(Notice the 5PxV2……..)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wkeadbeksyorrdmta.biz/5PxV2wd0X…pz08wYD6zZ.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inodppfpmgxvczykpnmxo.com/5PxV2…Opz08wYD6zZ.htm

(4).
Please Once done reboot into Normal Mode

Go here and run LOP.COM uninstaller.
http://members.rogers.com/rjmac/new_uninstall.exe

(5).
Once done reboot into Normal Mode and scan and post a new HijackThis log file to confirm what was removed and if it's clean or not.

Marty

Hello again "unwiserchicken"

"Please don't get discouraged we will get you fixed up soon." <_<

(1.)
Please download and run Trojanhunter (Free for 30 days)Allow to “Delete” all exploits.
http://www.trojanhunter.com/trojanhunter/

(2.)
Then please update HJT to Version 1.99.

Please download this self extracting file to your My Downloads folder or My Received Files (dependent on your Operating System):
Link here:
http://www.merijn.org/files/hijackthis_sfx.exe

Click the "Save" button.

Navigate to My Documents>Chose My Downloads or My Received Files folder once inside that folder click "Save".

Now go to the folder you saved HijackThis_sfx.exe in.

Double click HijackThis_sfx.exe and select Unzip. When done click "OK".
Close the WinZip self Extractor window.

Navigate to C:\Program Files\HijackThis and double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and paste Ctrl-V its contents here [Add Reply].

Most of what it lists will be harmless or even essential, don't fix anything yet.

Please post a new HJT LOG in ADD REPLY.

Marty

Hello again "unwiserchicken"

"Please don't get discouraged we will get you fixed up soon." <_<

(1.)
Please download and run Trojanhunter (Free for 30 days)Allow to “Delete” all exploits.
http://www.trojanhunter.com/trojanhunter/

Please post a new HJT LOG in ADD REPLY.

Marty