What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Redirection of start page

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi
When trying to open my opening page on the internet I kept getting redirected. Also I am unable to access my modem page 10.1.1.1.

Its a big problem for me because I am having problems with connecting to the internet - keep dropping and my service provider wont help because I have been hijacked they say.

Whilst I think I may have fixed "something" ie the home page seems correct I still get redirected when trying 10.1.1.1
Logfile of HijackThis v1.99.1
Scan saved at 6:20:58 AM, on 26/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\myob15\Myob.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whitepages.com.au/wp/initBusSearch.do
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whitepages.com.au/wp/index.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Link
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_B…on.cab40641.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MediaMax XL Service (MediaMaxXLService) - Streamload - C:\Program Files\Streamload\MediaMax XL\MediaMaxXLService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hello minga and Welcome to TomCoyote,

Please do the following:

STEP 1.
======
CWShredder

Please download and run CWShredder
Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

STEP 2.
======
Hoster

Please download hoster.
  • Unzip Hoster.zip
  • Open Hoster.exe.
  • Then click on "Restore Original Hosts"
  • Close program when complete.
  • Empty Recycle Bin

STEP 3.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)
  • If you are taken to the internet page, just close the page.
  • You will be prompted to check for updated definitions, please do so.
    (This may take several minutes)
  • Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
  • Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!
  • When the sweep has finished, click Remove. Click Select All and then Next
  • From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
STEP 4.
======
The Ewido program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan.
Please post the results from SpySweeper, ewido and a new hijackthis log.
Post #3
Copies of new reports as follows.

Logfile of HijackThis v1.99.1
Scan saved at 5:54:54 PM, on 1/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whitepages.com.au/wp/busSearch.do
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.whitepages.com.au/wp/index.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Link
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Omnipage] "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) - http://zone.msn.com/bingame/zpagames/ZPA_B…on.cab40641.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MediaMax XL Service (MediaMaxXLService) - Streamload - C:\Program Files\Streamload\MediaMax XL\MediaMaxXLService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
3:56 PM: Traces Found: 11
3:56 PM: Full Sweep has completed. Elapsed time 00:27:04
3:56 PM: File Sweep Complete, Elapsed Time: 00:24:19
3:56 PM: Warning: Failed to access drive E:
3:56 PM: Warning: Failed to access drive D:
3:53 PM: Warning: Failed to open file "c:\documents and settings\administrator\cookies\administrator@live[1].txt". The operation completed successfully
3:32 PM: Starting File Sweep
3:32 PM: Warning: Failed to access drive A:
3:32 PM: Cookie Sweep Complete, Elapsed Time: 00:00:02
3:32 PM: c:\documents and settings\administrator\cookies\[removed][1].txt (ID = 2530)
3:32 PM: Found Spy Cookie: dl cookie
3:32 PM: c:\documents and settings\administrator\cookies\[removed][1].txt (ID = 2506)
3:32 PM: c:\documents and settings\administrator\cookies\administrator@videodome[1].txt (ID = 3638)
3:32 PM: Found Spy Cookie: videodome cookie
3:32 PM: c:\documents and settings\administrator\cookies\[removed][2].txt (ID = 2506)
3:32 PM: c:\documents and settings\administrator\cookies\[removed][2].txt (ID = 2729)
3:32 PM: c:\documents and settings\administrator\cookies\administrator@go[2].txt (ID = 2728)
3:32 PM: Found Spy Cookie: go.com cookie
3:32 PM: c:\documents and settings\administrator\cookies\administrator@dealtime[1].txt (ID = 2505)
3:32 PM: Found Spy Cookie: dealtime cookie
3:32 PM: c:\documents and settings\administrator\cookies\administrator@ct.360i[2].txt (ID = 1962)
3:32 PM: Found Spy Cookie: 360i cookie
3:32 PM: c:\documents and settings\administrator\cookies\administrator@bizrate[2].txt (ID = 2308)
3:32 PM: Found Spy Cookie: bizrate cookie
3:32 PM: c:\documents and settings\administrator\cookies\administrator@azjmp[2].txt (ID = 2270)
3:32 PM: Found Spy Cookie: azjmp cookie
3:32 PM: c:\documents and settings\administrator\cookies\administrator@adultfriendfinder[2].txt (ID = 2165)
3:32 PM: Found Spy Cookie: adultfriendfinder cookie
3:32 PM: Starting Cookie Sweep
3:32 PM: Registry Sweep Complete, Elapsed Time:00:00:37
3:31 PM: Starting Registry Sweep
3:31 PM: Memory Sweep Complete, Elapsed Time: 00:01:59
3:29 PM: Starting Memory Sweep
3:29 PM: Sweep initiated using definitions version 769
3:29 PM: Spy Sweeper 5.0.7.1608 started
3:29 PM: | Start of Session, Wednesday, 27 September 2006 |
********
3:29 PM: | End of Session, Wednesday, 27 September 2006 |
3:26 PM: Access to Hosts file allowed for C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\DESKTOP\HOSTER\HOSTER.EXE
3:25 PM: Access to Hosts file allowed for C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\MY DOCUMENTS\MY DOWNLOADS\HOSTER\HOSTER\HOSTER.EXE
12:16 PM: Your spyware definitions have been updated.
12:15 PM: Automated check for program update in progress.
9:21 AM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
9:20 AM: Shield States
9:20 AM: Spyware Definitions: 734
9:20 AM: Spy Sweeper 5.0.7.1608 started
4:49 AM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
4:48 AM: Shield States
4:48 AM: Spyware Definitions: 734
4:47 AM: Spy Sweeper 5.0.7.1608 started
Operation: Terminate
Target: C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPERUI.EXE
Source: C:\WINDOWS\SYSTEM32\CSRSS.EXE
11:00 PM: Tamper Detection
Operation: Terminate
Target: C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPERUI.EXE
Source: C:\WINDOWS\SYSTEM32\CSRSS.EXE
11:00 PM: Tamper Detection
9:50 PM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
9:49 PM: Shield States
9:48 PM: Spyware Definitions: 734
9:48 PM: Spy Sweeper 5.0.7.1608 started
Operation: Terminate
Target: C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPERUI.EXE
Source: C:\WINDOWS\SYSTEM32\CSRSS.EXE
9:40 PM: Tamper Detection
Operation: Terminate
Target: C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPERUI.EXE
Source: C:\WINDOWS\SYSTEM32\CSRSS.EXE
9:40 PM: Tamper Detection
Operation: File Access
Target:
Source: C:\PROGRAM FILES\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE
8:47 PM: Tamper Detection
8:08 PM: The Spy Communication shield has blocked access to: WWW.V61.COM
8:08 PM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
8:07 PM: Shield States
8:07 PM: Spyware Definitions: 734
8:07 PM: Spy Sweeper 5.0.7.1608 started
7:39 PM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
7:38 PM: Shield States
7:38 PM: Spyware Definitions: 734
7:38 PM: Spy Sweeper 5.0.7.1608 started
12:21 PM: | End of Session, Tuesday, 26 September 2006 |
12:19 PM: The Spy Communication shield has blocked access to: WWW.V61.COM
Keylogger Shield: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites Shield: Off
Hosts File Shield: On
Spy Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
12:18 PM: Shield States
12:18 PM: Spyware Definitions: 734
12:17 PM: Spy Sweeper 5.0.7.1608 started
12:17 PM: Spy Sweeper 5.0.7.1608 started
12:17 PM: | Start of Session, Tuesday, 26 September 2006 |
********
12:53 PM: BHO Shield: found: – BHO installation allowed at user request
12:53 PM: BHO Shield: found: – BHO installation denied at user request
12:53 PM: BHO Shield: found: – BHO installation denied at user request
12:46 PM: Traces Found: 16
12:46 PM: Full Sweep has completed. Elapsed time 00:25:24
12:46 PM: File Sweep Complete, Elapsed Time: 00:20:38
12:45 PM: Warning: Failed to access drive E:
12:45 PM: Warning: Failed to access drive D:
12:44 PM: Warning: Failed to open file "c:\windows\softwaredistribution\eventcache\{9e2072b2-d6ea-4112-9e68-d2819878da45}.bin". The operation completed successfully
12:44 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\zbnn7k5t\whitepages-helpful-js[2].css". The operation completed successfully
12:44 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\w51sct3a\whitepages2[2].css". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\m_tp[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\m_in[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\w51sct3a\m_wp[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\05mnc1uj\n_wi[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\m_cs[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\g5ez4pa3\m_tile[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\9lxnye3m\m_bor_t[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\05mnc1uj\n_tp[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\9lxnye3m\n_cs[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\05mnc1uj\m_jl[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\zbnn7k5t\m_lm[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\8f5rayj9\n_ms[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\g5ez4pa3\n_tile[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\0tyj8pqf\n_bpa[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\cookies\[removed][1].txt". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\trans[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\bullet_news[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\g5ez4pa3\back-main800-lines[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\8f5rayj9\logo_weather[2].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\0tyj8pqf\button_go[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\9lxnye3m\heading-quickfinder[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\b88k59v2\button_go[1].gif". The operation completed successfully
12:43 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\9lxnye3m\schedule[1].js". The operation completed successfully
12:42 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\zbnn7k5t\large_text[1].css". The operation completed successfully
12:42 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\0tyj8pqf\whitepages[2].css". The operation completed successfully
12:42 PM: Warning: Failed to open file "c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\05mnc1uj\whitepages-compliant800[1].css". The operation completed successfully
12:39 PM: IE Hijack Shield: Resetting Home Page value.
12:33 PM: C:\Program Files\Common Files\WinSoftware\PCheck.dll (ID = 119204)
12:26 PM: C:\Program Files\Common Files\WinSoftware (1 subtraces) (ID = 2147490614)
12:26 PM: Found Adware: winantispyware 2005
12:25 PM: Starting File Sweep
12:25 PM: Warning: Failed to access drive A:
12:25 PM: Cookie Sweep Complete, Elapsed Time: 00:00:03
12:25 PM: c:\documents and settings\administrator\cookies\[removed][1].txt (ID = 2530)
12:25 PM: Found Spy Cookie: dl cookie
12:25 PM: c:\documents and settings\administrator\cookies\[removed][1].txt (ID = 2506)
12:25 PM: c:\documents and settings\administrator\cookies\administrator@videodome[1].txt (ID = 3638)
12:25 PM: Found Spy Cookie: videodome cookie
12:25 PM: c:\documents and settings\administrator\cookies\[removed][2].txt (ID = 2506)
12:25 PM: c:\documents and settings\administrator\cookies\[removed][2].txt (ID = 2729)
12:25 PM: c:\documents and settings\administrator\cookies\administrator@go[2].txt (ID = 2728)
12:25 PM: Found Spy Cookie: go.com cookie
12:25 PM: c:\documents and settings\administrator\cookies\administrator@dealtime[1].txt (ID = 2505)
12:25 PM: Found Spy Cookie: dealtime cookie
12:25 PM: c:\documents and settings\administrator\cookies\[removed][2].txt (ID = 2413)
12:25 PM: Found Spy Cookie: clickzs cookie
12:25 PM: c:\documents and settings\administrator\cookies\administrator@ct.360i[2].txt (ID = 1962)
12:25 PM: Found Spy Cookie: 360i cookie
12:25 PM: c:\documents and settings\administrator\cookies\administrator@bizrate[2].txt (ID = 2308)
12:25 PM: Found Spy Cookie: bizrate cookie
12:25 PM: c:\documents and settings\administrator\cookies\administrator@azjmp[2].txt (ID = 2270)
12:25 PM: Found Spy Cookie: azjmp cookie
12:25 PM: c:\documents and settings\administrator\cookies\[removed][1].txt (ID = 6445)
12:25 PM: Found Spy Cookie: tacoda cookie
12:25 PM: c:\documents and settings\administrator\cookies\administrator@adultfriendfinder[2].txt (ID = 2165)
12:25 PM: Found Spy Cookie: adultfriendfinder cookie
12:25 PM: Starting Cookie Sweep
12:25 PM: Registry Sweep Complete, Elapsed Time:00:00:44
12:25 PM: Starting Registry Sweep
12:25 PM: Memory Sweep Complete, Elapsed Time: 00:03:48
12:21 PM: Starting Memory Sweep
12:21 PM: Sweep initiated using definitions version 734
12:21 PM: Spy Sweeper 5.0.7.1608 started
12:21 PM: | Start of Session, Tuesday, 26 September 2006 |
********
———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 9:39:35 PM 26/09/2006

+ Scan result:



C:\Documents and Settings\Administrator\Cookies\administrator@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jeaicacj.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jeaicacj.default\cookies.txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Administrator\Cookies\administrator@com[2].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.


::Report end
Post #4 last edited
Hi minga,

Please do the following:

If you did not intend to install Party Poker
Go to Add/Remove Programs via the control panel and uninstall Party Poker.

Disable SpySweeper:
You have SpySweeper installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.
Right click on the SpySweeper icon in your System Tray (near the clock).
From the pop up menu, left click on Shields, this will open the program at the same time.
Click the "Internet Explorer" tab and uncheck the following:
  • IE Favorites Shield
  • IE Security Shield
  • Broswer Helper Object (BHO) Shield
  • IE Hijack Shield
Click the "Windows System Shields" and uncheck the following:
  • Memory Shield
  • Spy Installation Shield
Click the "Startup Programs" tab and uncheck the Startup Items Shield


Updating Java
  • Download the latest version of Java Runtime Environment (JRE) 5.0 Update 9.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version.
Scan with HijackThis. Place a check against each of the following:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
If you uninstalled Party Poker then check the following:
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.


If you uninstalled Party Poker then using Windows Explorer, locate the following files/folders, and delete them:
C:\Program Files\PartyGaming\PartyPoker\<=folder
Exit Explorer.
Enable SpySweeper again.

Post back a fresh HijackThis log and we will take another look. How is your computer running?
Post #5
Hi Susan
New copy of Hijackthis.
Logfile of HijackThis v1.99.1
Scan saved at 6:25:11 PM, on 3/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program

Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.whitepages.com.au/wp/busSearch.do
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.whitepages.com.au/wp/index.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Link
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program

Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD

Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Omnipage] "C:\Program Files\ScanSoft\OmniPageSE\opware32.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone

Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash

/minimized
O4 - HKCU\..\Run: [swg] "C:\Program

Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe"
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program

Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -

C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com -

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program

Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) -

http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) -

http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage

Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) -

http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) -

http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -

http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) -

http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) -

http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} (ZPA_Backgammon Object) -

http://zone.msn.com/bingame/zpagames/ZPA_B…on.cab40641.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner -

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. -

C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. -

C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: MediaMax XL Service (MediaMaxXLService) - Streamload - C:\Program

Files\Streamload\MediaMax XL\MediaMaxXLService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot

Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Having heaps of trouble getting onto the internet. Just changed over to ADSL2+ and keeps dropping out. Cant get any help from service provider because I cant get into the modem site ie 10.1.1.1 keep getting redirected or just hangs.

Anyway - thanks a lot for your help so far. Sorry I take so long to reply but just cant get onto the net.

Cheers.
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI