What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Problems

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 8.55.28, on 10/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAMMI\FILE COMUNI\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAMMI\OFFICESCAN 95\OFCDOG.EXE
C:\PROGRAMMI\OFFICESCAN 95\POP3TRAP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAMMI\MSWORKS\CALENDARIO\WKCALREM.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\WINDOWS\DESKTOP\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {62278FA4-913E-11D9-9AD6-4445098BE22E} - C:\WINDOWS\SYSTEM\BGBG.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAMMI\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAMMI\OFFICESCAN 95\Pccwin97.exe"
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - Startup: Promemoria del Calendario.lnk = C:\Programmi\MSWorks\Calendario\WKCALREM.EXE
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{00010410-78E1-11D2-B60F-006097C998E7}\misc.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://servernt/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://servernt/officescan/clientinstall/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://servernt/officescan/clientinstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://10.0.0.100/officescan/console/html/AtxEnc.cab
O16 - DPF: {A050E865-64E3-431B-8079-F0DFCEA90A2D} (PieChart Class) - http://10.0.0.100/officescan/console/html/AtxPie.cab
O16 - DPF: {69B502DF-D12F-4FD7-9892-D8DFA2D96474} (OfficeScan Management Console) - http://10.0.0.100/officescan/console/html/AtxConsole.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = magi.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.0.0.100,151.99.125.2
O18 - Filter: text/html - {62278FA3-913E-11D9-9AD6-444586627A5A} - C:\WINDOWS\SYSTEM\BGBG.DLL
O18 - Filter: text/plain - {62278FA3-913E-11D9-9AD6-444586627A5A} - C:\WINDOWS\SYSTEM\BGBG.DLL
Post #3
StartDreck (build 2.1.7 public stable) - 2005-03-14 @ 09.03.20 (GMT +01:00) Platform: Windows 98 SE (Win 4.10.2222 A) Internet Explorer: 5.50.4522.1800 Logged in as MAGI 2 at MAGI2 »Registry »Run Keys »Current User »Run »RunOnce »Default User »Run »RunOnce »Local Machine »Run *TaskMonitor=C:\WINDOWS\taskmon.exe *OfficeScan95="C:\PROGRAMMI\OFFICESCAN 95\pccwin97.exe" -HideWindow *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *ScanRegistry=C:\WINDOWS\scanregw.exe /autorun *SystemTray=SysTray.Exe *CriticalUpdate=C:\WINDOWS\SYSTEM\wucrtupd.exe -startup *sp=rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall +OptionalComponents +IMAIL *Installed=1 +MAPI *NoChange=1 *Installed=1 +MAPI *NoChange=1 *Installed=1 »RunOnce »RunServices *SchedulingAgent=mstask.exe *OfficeScan95="C:\PROGRAMMI\OFFICESCAN 95\Pccwin97.exe" *Machine Debug Manager=C:\WINDOWS\SYSTEM\MDM.EXE *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *SAgent2ExePath=C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe *KB891711=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE »RunServicesOnce **kukd=rundll32 C:\WINDOWS\HLPSTEH1.GIF,DllGetClassObject »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\WINDOWS\DESKTOP\SPYBOT~1\SDHELPER.DLL *{C93DC2A4-9205-11D9-9AD6-444547870C8C} `InprocServer32=C:\WINDOWS\SYSTEM\FNBGBAA.DLL »Files »System/Drivers »Running Processes +FFEF7D9F=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFFBE7F=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFFB3EF=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFFEEFF=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFE21BF=C:\WINDOWS\SYSTEM\MSTASK.EXE +FFFE0CD7=C:\PROGRAMMI\OFFICESCAN 95\PCCWIN97.EXE +FFFE540B=C:\WINDOWS\SYSTEM\MDM.EXE +FFFFE00F=C:\PROGRAMMI\FILE COMUNI\EPSON\EBAPI\SAGENT2.EXE +FFFEF367=C:\WINDOWS\RUNDLL32.EXE +FFFFE263=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE +FFFE8333=C:\WINDOWS\SYSTEM\RPCSS.EXE +FFFDF1F3=C:\PROGRAMMI\OFFICESCAN 95\OFCDOG.EXE +FFFDDBAB=C:\WINDOWS\EXPLORER.EXE +FFFC85EF=C:\WINDOWS\TASKMON.EXE +FFFCFF73=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFFB017B=C:\WINDOWS\RUNDLL32.EXE +FFFB4377=C:\PROGRAMMI\MSWORKS\CALENDARIO\WKCALREM.EXE +FFFA2F73=C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE +FFFA7C73=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFFA106B=C:\WINDOWS\SYSTEM\WMIEXE.EXE +FFFA9073=C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE +FFFAC8B7=C:\WINDOWS\SYSTEM\PSTORES.EXE +FFFAE653=C:\PROGRAMMI\OFFICESCAN 95\POP3TRAP.EXE +FFF7A1E3=C:\WINDOWS\SYSTEM\DDHELP.EXE +FFF8F9EF=C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE +FFF67F23=C:\WINDOWS\TEMP\STARTDRECK.EXE »Application specific
Post #4
OK, here's the main file that's responsible for the hijacker (in red).

The one in blue is what it installs along with the se.dll

It looks like the one in blue has changed to a different file now from your original hjt log.

*SAgent2ExePath=C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
*KB891711=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
»RunServicesOnce
**kukd=rundll32 C:\WINDOWS\HLPSTEH1.GIF,DllGetClassObject
»RunOnceEx
»RunServicesOnceEx
»Browser Helper Objects (LM)
*{53707962-6F74-2D53-2644-206D7942484F}
`InprocServer32=C:\WINDOWS\DESKTOP\SPYBOT~1\SDHELPER.DLL
*{C93DC2A4-9205-11D9-9AD6-444547870C8C}
`InprocServer32=C:\WINDOWS\SYSTEM\FNBGBAA.DLL
»Files


First please move HJT into its own permanent folder so backups can be made, suggest:
C:\MyHJT\HJT.exe or C:\MyDocuments\MyHJT\HJT.exe

Download CW-Shredder at the link below, don't run it yet:
http://cwshredder.net/bin/CWShredder.exe

You should print these instruction out.

Restart your computer and hold down the control key (ctrl) as the bios loads.
(you could also keep tapping the F8 key to get to the Startup Menu, which ever works)
You will end up at Startup Menu
Choose #5 command prompt only
At the flashing C:\
Type cd C:\Windows and press Enter
Type attrib -s -h -r HLPSTEH1.GIF and press Enter
Type del HLPSTEH1.GIF and press enter
Repeat the step above and you should get a 'file can't be found' message if the file was deleted
Press enter should get you back to C:\Windows if you're not already there

Type attrib -s -h -r SYSTEM\FNBGBAA.DLL and press Enter
Type del SYSTEM\FNBGBAA.DLL and press enter
Repeat the step above and you should get a 'file can't be found' message if the file was deleted
Press enter should get you back to C:\Windows if you're not already there

Type attrib -s -h -r TEMP\se.dll and press Enter
Type del TEMP\se.dll and press enter
Repeat the step above and you should get a 'file can't be found' message if the file was deleted
Press enter should get you back to C:\Windows if you're not already there

Type win or exit and press enter and this should get you back to Windows, if not use Ctrl, Alt, Del to restart the computer.

You may get an error message when you do about loading the file you just deleted, don't worry about it.

Back to normal mode

Close all programs down, leaving only HijackThis running.
Place a check against the following items:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {62278FA4-913E-11D9-9AD6-4445098BE22E} - C:\WINDOWS\SYSTEM\BGBG.DLL or FNBGBAA.DLL
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Filter: text/html - {62278FA3-913E-11D9-9AD6-444586627A5A} - C:\WINDOWS\SYSTEM\BGBG.DLL or FNBGBAA.DLL
O18 - Filter: text/plain - {62278FA3-913E-11D9-9AD6-444586627A5A} - C:\WINDOWS\SYSTEM\BGBG.DLL or FNBGBAA.DLL

Click on Fix Checked and exit HijackThis.

Now run CW-Shredder (hit the FIX button)

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Reboot and run another HJT scan and make sure all of the entries you fixed in the step above are gone, if not have HJT fix them reboot and see how the computer is.

Then post a fresh HJT log and a new StartDreck, Thanks, MrC
Post #5
I THINK NOW IS ALL OK!


StartDreck (build 2.1.7 public stable) - 2005-03-15 @ 10.00.34 (GMT +01:00)
Platform: Windows 98 SE (Win 4.10.2222 A)
Internet Explorer: 5.50.4522.1800
Logged in as MAGI 2 at MAGI2

»Registry
»Run Keys
»Current User
»Run
»RunOnce
»Default User
»Run
»RunOnce
»Local Machine
»Run
*TaskMonitor=C:\WINDOWS\taskmon.exe
*OfficeScan95="C:\PROGRAMMI\OFFICESCAN 95\pccwin97.exe" -HideWindow
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*ScanRegistry=C:\WINDOWS\scanregw.exe /autorun
*SystemTray=SysTray.Exe
*CriticalUpdate=C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
+OptionalComponents
+IMAIL
*Installed=1
+MAPI
*NoChange=1
*Installed=1
+MAPI
*NoChange=1
*Installed=1
»RunOnce
»RunServices
*SchedulingAgent=mstask.exe
*OfficeScan95="C:\PROGRAMMI\OFFICESCAN 95\Pccwin97.exe"
*Machine Debug Manager=C:\WINDOWS\SYSTEM\MDM.EXE
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SAgent2ExePath=C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
*KB891711=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»Browser Helper Objects (LM)
*{53707962-6F74-2D53-2644-206D7942484F}
`InprocServer32=C:\WINDOWS\DESKTOP\SPYBOT~1\SDHELPER.DLL
»Files
»System/Drivers
»Running Processes
+FFEF76E7=C:\WINDOWS\SYSTEM\KERNEL32.DLL
+FFFFB507=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
+FFFFB897=C:\WINDOWS\SYSTEM\MPREXE.EXE
+FFFF99DF=C:\WINDOWS\SYSTEM\mmtask.tsk
+FFFFEA2F=C:\WINDOWS\SYSTEM\MSTASK.EXE
+FFFE2833=C:\PROGRAMMI\OFFICESCAN 95\PCCWIN97.EXE
+FFFE41BF=C:\WINDOWS\SYSTEM\MDM.EXE
+FFFE42AB=C:\PROGRAMMI\FILE COMUNI\EPSON\EBAPI\SAGENT2.EXE
+FFFE91EB=C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
+FFFDAC9B=C:\WINDOWS\SYSTEM\RPCSS.EXE
+FFFDB67F=C:\PROGRAMMI\OFFICESCAN 95\OFCDOG.EXE
+FFFDE6B3=C:\WINDOWS\EXPLORER.EXE
+FFFFAEC7=C:\WINDOWS\TASKMON.EXE
+FFFCF67B=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
+FFFB12AB=C:\PROGRAMMI\MSWORKS\CALENDARIO\WKCALREM.EXE
+FFFB9F4B=C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
+FFFBCD0F=C:\WINDOWS\SYSTEM\SPOOL32.EXE
+FFFC51FF=C:\WINDOWS\SYSTEM\WMIEXE.EXE
+FFFA4583=C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
+FFFB9BFF=C:\PROGRAMMI\OFFICESCAN 95\POP3TRAP.EXE
+FFFB4247=C:\WINDOWS\SYSTEM\PSTORES.EXE
+FFF999CF=C:\PROGRAMMI\INTERNET EXPLORER\IEXPLORE.EXE
+FFF98C8B=C:\WINDOWS\SYSTEM\DDHELP.EXE
+FFF89A6F=C:\WINDOWS\TEMP\STARTDRECK.EXE
»Application specific



Logfile of HijackThis v1.99.1
Scan saved at 9.48.06, on 15/03/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\OFFICESCAN 95\PCCWIN97.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\PROGRAMMI\FILE COMUNI\EPSON\EBAPI\SAGENT2.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAMMI\OFFICESCAN 95\OFCDOG.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMMI\MSWORKS\CALENDARIO\WKCALREM.EXE
C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SPYSUB.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\PROGRAMMI\OFFICESCAN 95\POP3TRAP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\DOCUMENTI\MYHJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\WINDOWS\DESKTOP\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [OfficeScan95] "C:\PROGRAMMI\OFFICESCAN 95\pccwin97.exe" -HideWindow
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [OfficeScan95] "C:\PROGRAMMI\OFFICESCAN 95\Pccwin97.exe"
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - Startup: Promemoria del Calendario.lnk = C:\Programmi\MSWorks\Calendario\WKCALREM.EXE
O4 - Startup: Microsoft Office.lnk = C:\WINDOWS\Application Data\Microsoft\Installer\{00010410-78E1-11D2-B60F-006097C998E7}\misc.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE
O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://servernt/officescan/clientinstall/RemoveCtrl.cab
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://servernt/officescan/clientinstall/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://servernt/officescan/clientinstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - http://10.0.0.100/officescan/console/html/AtxEnc.cab
O16 - DPF: {A050E865-64E3-431B-8079-F0DFCEA90A2D} (PieChart Class) - http://10.0.0.100/officescan/console/html/AtxPie.cab
O16 - DPF: {69B502DF-D12F-4FD7-9892-D8DFA2D96474} (OfficeScan Management Console) - http://10.0.0.100/officescan/console/html/AtxConsole.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = magi.it
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.0.0.100,151.99.125.2
Post #6
Well Done!!

You can now set your homepage to what ever you want:

Open up Internet Explorer , Tools, General Tab, reset your home page, now Programs Tab, Reset Web Settings
That will change everything back to the default settings.



I'll leave you with……..

Some preventive maintenance:

Must have or do.

Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point:
(ME and XP users only)

XP system restore

ME system restore


Visit Windows Update and install all the lastest critical updates.

Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked. Check for updates weekly.

SpywareBlaster

SpywareGuard


IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
IE-SPYAD



Need a free anti virus?
AVG*free
(check for updates - daily)

How about a firewall? The front door to your computer.
ZoneAlarm*free

———————————————————————

Free spyware removal programs:
SpyBot
AD-Aware
CW-Shredder

Free Online Trojan Scan

A SQUARED FREE TROJAN SCANNER

Trojan Hunter
TrojanHunter - free trial

Please consider using FireFox instead of Internet Explorer

Replace Java with SunJava

Pop-up stoppers:
GoogleToolBar
Pop-upStopperFree

Don't open e-mail attachments without first scanning them with an up-to-date
anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.

Good luck and thanks for using the forum - MrC
Post #7
As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Thanks, MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI