What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Hijacked & Pop Ups

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi Lethal, :)

1) Notepad opened without a problem so I think that's okay.

2) I can't save the log as a word doc because the trogan (MhtRedir.gen) interfears. The Mcafee virus protector I have deletes the trogan right away.

3) I ran stinger and found nothing.

I do have a word doc with screen prints of the scan but don't know how to get a word doc to you. You mentioned "uploading" but I don't know how to do that. If you could detail step by step instructions maybe that would help.

Thanks
Jim :unsure:
Post #17
i checked with the admins on the site and found out that the uploading option is not available for normal members sorry about that. I was told to get you to check whether your file extensions for files are correct could you try the following: Open Windows Explorer Click on the Tools option on the top menu bar Select Folder Options then click on the File Types tab Scroll down the file types and see if there is an entry for LOG file If there is, click on the entry to highlight it then click on the Edit button Let me know what is in the actions box at the bottom Then click on the Edit button at the bottom and let me know what is in the Application used to perform action box.
Post #18
Hello lethal,

I did as you asked and didn't find an entry for "LOG file". I did find a "Dr Watson Log" with "OPEN" and "Print" below that in the actions box. The application indicated c:/windows\drwatson.exe"%1". What next?

Jim :unsure:
Post #19
seems like your file extension got corrupted can you create a new file extension for .log files and set it to open with notepad then run hijacthis and see if it works another method run hijackthis save log as 'Hijackthislog.hjt' then click on this new Hijackthislog.hjt that is created and run it choosing notepad as the program to open it do not set notepad as the program to 'open always' (Hijackthislog.hjt is just an example. the main thing is to use a file extension that has no programs assign to open)
Post #22
Take a look — Process list saved on 6:09:44 PM, on 1/12/05 Platform: Win9x 4.10.2222 A [full path to filename] [file version] [company name] C:\WINDOWS\SYSTEM\KERNEL32.DLL 4.10.0.2222 Microsoft Corporation C:\WINDOWS\SYSTEM\MSGSRV32.EXE 4.10.0.2222 Microsoft Corporation C:\WINDOWS\SYSTEM\MPREXE.EXE 4.10.0.1998 Microsoft Corporation C:\WINDOWS\SYSTEM\MSTASK.EXE 4.71.1972.1 Microsoft Corporation C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE 2.0.20.1 America Online, Inc. C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE 9.0.0.10 Networks Associates Technology, Inc C:\WINDOWS\SYSTEM\HIDSERV.EXE 4.10.0.2222 Microsoft Corporation C:\WINDOWS\SYSTEM\mmtask.tsk 4.3.0.1998 Microsoft Corporation C:\WINDOWS\EXPLORER.EXE 4.72.3110.1 Microsoft Corporation C:\WINDOWS\TASKMON.EXE 4.10.0.1998 Microsoft Corporation C:\WINDOWS\SYSTEM\SYSTRAY.EXE 4.10.0.2222 Microsoft Corporation C:\WINDOWS\SYSTEM\HPSYSDRV.EXE 1.7.0.0 Hewlett-Packard Company C:\WINDOWS\SYSTEM\USBMMKBD.EXE 1.0.1.4 Hewlett-Packard Company C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE 1.0.0.0 Netropa Corp. C:\WINDOWS\SYSTEM\STIMON.EXE 4.10.0.2222 Microsoft Corporation C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE 1.0.0.1 Netropa Corp. C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE 5.0.0.2 McAfee, Inc C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLDIAL.EXE 2.0.20.1 America Online, Inc C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE 6.0.9.584 RealNetworks, Inc. C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE 1.0.0.0 Netropa Corp. C:\WINDOWS\SYSTEM\QTTASK.EXE 6.5.0.48 Apple Computer, Inc. C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE 1.0.0.74 C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE 9.0.0.7 Networks Associates Technology, Inc C:\WINDOWS\RunDLL.exe 4.10.0.1998 Microsoft Corporation C:\PROGRAM FILES\AIM95\AIM.EXE 5.9.3690.0 America Online, Inc. C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE 9.0.0.8 Networks Associates Technology, Inc C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE 1.3.0.12 Safer Networking Limited C:\PROGRAM FILES\AMERICA ONLINE 9.0A\AOLTRAY.EXE 9.0.0.1 America Online, Inc. C:\PROGRAM FILES\REALITY FUSION\REALITY FUSION GAMECAM SE\PROGRAM\RFTRAY.EXE 1.0.0.1 C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE 1.0.6224.0 WinZip Computing, Inc. C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE 1.1.0.0 Netropa Corporation C:\WINDOWS\SYSTEM\DDHELP.EXE 4.7.0.700 Microsoft Corporation C:\WINDOWS\SYSTEM\WMIEXE.EXE 5.0.1755.1 Microsoft Corporation C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSFTSN.EXE 9.0.0.0 Networks Associates Technology, Inc C:\WINDOWS\SYSTEM\SPOOL32.EXE 4.10.0.1998 Microsoft Corporation C:\WINDOWS\SYSTEM\TAPISRV.EXE 4.10.0.2222 Microsoft Corporation C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 6.0.2800.1106 Microsoft Corporation C:\WINDOWS\SYSTEM\PSTORES.EXE 5.0.1877.3 Microsoft Corporation C:\PROGRAM FILES\WINZIP\WINZIP32.EXE 18.0.6224.0 WinZip Computing, Inc. C:\WINDOWS\TEMP\IBPROCMAN.EXE 1.1.0.1 Soeperman Enterprises Ltd.
Post #24
I can save a log in safe mode but when I go back to normal mode to access the internet as soon as I touch the file same trojan(MhtRedir.gen) interupts and Mcafee deletes the file and the trojan - so it says. Is there a way to access internet in safe mode? :scratch: I will run through the virus scans tonight and let you know the results. Thanks for hanging in there with me. Jim P.S. I installed Zone Alarm fire wall last night but maybe I should disarm it until we get the bugs out of the machine - please advise.
Post #25
do it this way save the log in safe mode but in the save as section give it a name like asdasd (any name is ok, just not hijackthis) then go back into normal mode double click on it and choose notepad to open(or try using ms word to open) should be ok for you to get zonealarm now firewalls seldom affect the fix
Post #26
Ran two of the scans from the list on the link. The first one "trojan scan" was clean the second one "symantec" stopped - something about an OE error problem, ran again but same error. I saved the log in safe mode with a new name once with notepad and once with word but when I try to open in reqular mode same trojan comes up for both. I will run the other scans tonight. sorry it has taken so long but these scans take a long time - hopfully we'll get there eventually Jim
Post #27
Hi Lethal, been running the scans and not finding much I have attached one of scan records that found two problems Incident Status Location Virus:Trj/Downloader.CM Disinfected C:\Program Files\Spybot - Search & Destroy 1.1\Recovery\eAcceleration14.zip[download.exe] Virus:Trj/Downloader.KF Disinfected C:\wupdate.exe My browser isn't getting changed anymore but I still get pop-ups. What next?
Post #29
Can't find the windows update button - Win 98 is what I'm using.

When I open the cleaner file I get a message about missing patten file "LPT$VPN" but when I try to open the zipped lpt$vpn file I get the message "no viewers registered for this type of file. would you like to try the default viewers? Yes gets an unreadable quickview screen of letters & #'s. I ran the scan anyway and here's what I got…


————————————————————–\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\————————————————————–/


2005-01-16, 12:48:47, Auto-clean mode specified.
2005-01-16, 12:48:47, Running scanner "C:\CLEANER\TSC.BIN"…
2005-01-16, 12:50:21, Scanner "C:\CLEANER\TSC.BIN" has finished running.
2005-01-16, 12:50:21, TSC Log:

Damage Cleanup Engine (DCE) 3.8(Build 1019)
Windows 98

Start time : Sun Jan 16 2005 12:48:47

Load Damage Cleanup Template (DCT) "C:\CLEANER\tsc.ptn" (version 483) [success]

Complete time : Sun Jan 16 2005 12:50:20
Execute pattern count(1709), Virus found count(0), Virus clean count(0), Clean failed count(0)

2005-01-16, 12:50:35, An error occurred while scanning file "C:\WINDOWS\WIN386.SWP": Access is denied.
2005-01-16, 13:28:03, Running scanner "C:\CLEANER\VSCANTM.BIN"…
2005-01-16, 13:28:04, Files Detected:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 1/16/2005 13:28:04
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Command Line: C:\CLEANER\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

2005-01-16, 13:28:04, Files Clean:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 1/16/2005 13:28:04
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Command Line: C:\CLEANER\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

2005-01-16, 13:28:04, Clean Fail:
Copyright © 1990 - 2004 Trend Micro Inc.
Report Date : 1/16/2005 13:28:04
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Command Line: C:\CLEANER\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.*

2005-01-16, 13:28:04, Scanner "C:\CLEANER\VSCANTM.BIN" has finished running.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI