Guest<glenn>
Topic Starter
can you help me with this problem, thanks
Spyware / Malware / Virus Removal
Help With Hijackthis
2 min read
Guest
Logfile of HijackThis v1.97.6
Scan saved at 10:09:28 AM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SVCPACK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\WNAD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE
C:\PROGRAM FILES\COMMON FILES\TOTEM SHARED\UNINSTALL0001\UPD.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\COMMON FILES\GMT\GMT.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\system32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.com/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
F1 - win.ini: run=C:\WINDOWS\svcpack.exe
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 worldsex.com #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.worldsex.com #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O2 - BHO: HTML Source Editor - {086AE192-23A6-48D6-96EC-715F53797E85} - C:\WINDOWS\SYSTEM\DREPLACE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [sp] regedit -s C:\WINDOWS\sp.reg
O4 - HKLM\..\Run: [WNAD] C:\WINDOWS\WNAD.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.stripsaver.com!StatsStripSaver
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcpack.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O13 - WWW Prefix: http://www.sexyque.com/cgi-bin/proliv/proliv.cgi?
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://www.greatplugin.com/diallerfiles/016144.exe
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Scan saved at 10:09:28 AM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SVCPACK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\WNAD.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE
C:\PROGRAM FILES\COMMON FILES\TOTEM SHARED\UNINSTALL0001\UPD.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\COMMON FILES\GMT\GMT.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.jethomepage.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\system32\search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cool-homepage.com/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://cool-homepage.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jethomepage.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://cool-search.net/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\system32\searchbar.html
F1 - win.ini: run=C:\WINDOWS\svcpack.exe
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 worldsex.com #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.worldsex.com #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O2 - BHO: HTML Source Editor - {086AE192-23A6-48D6-96EC-715F53797E85} - C:\WINDOWS\SYSTEM\DREPLACE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [sp] regedit -s C:\WINDOWS\sp.reg
O4 - HKLM\..\Run: [WNAD] C:\WINDOWS\WNAD.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"
O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.stripsaver.com!StatsStripSaver
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcpack.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O13 - WWW Prefix: http://www.sexyque.com/cgi-bin/proliv/proliv.cgi?
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://www.greatplugin.com/diallerfiles/016144.exe
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Daemon
You have a CWS infection but I haven't seen it do that to a log before - gonna get a second opinion before I advise you to use shredder (you're using Win 98).
In the meantime, download Spybot Search & Destroy - install, update, scan and fix all RED items it finds. Reboot when done.
http://tomcoyote.org/SPYBOT/
edit: having now discussed your situation further could you also download cwshredder and run it.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Finally, rescan with HJT and post a new log here so that any remnants can be removed manually.
In the meantime, download Spybot Search & Destroy - install, update, scan and fix all RED items it finds. Reboot when done.
http://tomcoyote.org/SPYBOT/
edit: having now discussed your situation further could you also download cwshredder and run it.
http://www.spywareinfo.com/~merijn/files/cwshredder.zip
Finally, rescan with HJT and post a new log here so that any remnants can be removed manually.
Guest<glenn>
Logfile of HijackThis v1.97.6
Scan saved at 3:13:49 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Scan saved at 3:13:49 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Daemon
That doesn't look any different - when using CWShredder, you did hit the 'next' button and not the 'scan only' button?
edit: on closer inspection it is different.
First thing: could you find the following file and submit it to [removed] wiyh a link back to this thread:
C:\WINDOWS\sb.dll
Then with only HJT running, have it fix:
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
All the O1 entries
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
reboot when done, find this again C:\WINDOWS\sb.dll and delete it.
Then rescan with HJT and post a final log to check I didn't miss anything.
edit: on closer inspection it is different.
First thing: could you find the following file and submit it to [removed] wiyh a link back to this thread:
C:\WINDOWS\sb.dll
Then with only HJT running, have it fix:
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
All the O1 entries
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
reboot when done, find this again C:\WINDOWS\sb.dll and delete it.
Then rescan with HJT and post a final log to check I didn't miss anything.
Guest<glenn>
This is the new scan!
Logfile of HijackThis v1.97.6
Scan saved at 3:37:14 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Logfile of HijackThis v1.97.6
Scan saved at 3:37:14 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\EXPLORER.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.puh.ru/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://66.250.57.28/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://66.250.57.28/
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.puh.ru/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O1 - Hosts: 64.237.57.170 www.fomenko.ru #n?À?N@ ?N@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 fomenko.ru #EDivByZero?ØN@ØN@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.qwe.ru #ERangeError$O@ $O@ . N@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 qwe.ru # .EIntOverflow?@ tO@tO@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 killer.ru #EMathError?ÀO@ ÀO@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.girlfriend.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 girlfriend.ru #EZeroDivideXP@ XP@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 www.lovers.ru #EOverflow?À¤P@ ¤P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 lovers.ru #EUnderflow?ðP@ ðP@ . .M@
O1 - Hosts: 64.237.57.170 www.bum.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.170 bum.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 pupsik.ru #EPrivilege??R@ ?R@ . .M@ 4)@ <)@ t(@ ?(@ °(@ .EStackOverflow?ÐR@
O1 - Hosts: 64.237.57.170 www.devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 devil.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EControlC?À.S@
O1 - Hosts: 64.237.57.170 www.persik.ru #ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 persik.ru # ÐR@ . .M@ 4)@ <)@ t(@ ?(@ °(@EControlC?À.S@
O1 - Hosts: 64.237.57.171 www.etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 etop.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.171 omen.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.omen.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 uxi.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 pornushka.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 isex.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 sexymafia.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 erotica.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 www.porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.171 porno.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.seksfoto.net #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.erophoto.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 www.adult-top.ru #.M@ 4)@ <)@ t(@ ?(@ °(@EInOutError@N@@N@ . .M@ 4)@ <)@ t(@ ?(@ °(@ EIntEr
O1 - Hosts: 64.237.57.172 maxtop.ru #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.maxtop.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 www.teens-trade.com #EConvertError?ÀàQ@ àQ@ . .M@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 64.237.57.172 teens-trade.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O1 - Hosts: 207.176.39.177 www.mail.ru #EInvalidOp?.P@ .P@ . 4O@ 4)@ <)@ t(@ ?(@ °(@
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\SYSTEM\BTIEIN.DLL
O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\PROGRAM FILES\E2G\IEBHOS.DLL
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1} - C:\WINDOWS\MSBCCH.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [sb] regedit -s C:\WINDOWS\sb.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Daemon
Our posts crossed in the ether - I was editing when you reposted 
Have a look up to my previous post - that should really help you out.
Have a look up to my previous post - that should really help you out.
Guest
I would be happy to submit that file with link back if you tell me how to do it.
Daemon
OK, first of all do you have Winzip or similar.
Find C:\WINDOWS\sb.dll and save it as sb-dll.zip using the above. Then email it to [removed], in the title put sb.dll and in the body refer to: http://tomcoyote.org/forums/index.php?act=…E=02&f=27&t=703, which is this thread.
Good luck with the clean up.
Find C:\WINDOWS\sb.dll and save it as sb-dll.zip using the above. Then email it to [removed], in the title put sb.dll and in the body refer to: http://tomcoyote.org/forums/index.php?act=…E=02&f=27&t=703, which is this thread.
Good luck with the clean up.
Guest
Here is the last log.
Logfile of HijackThis v1.97.6
Scan saved at 4:45:18 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Logfile of HijackThis v1.97.6
Scan saved at 4:45:18 PM, on 11/12/03
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\WINDOWS\SYSTEM\ATITASK.EXE
C:\WINDOWS\LOADQM.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = ,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiKey] Atitask.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O15 - Trusted Zone: *.greatplugin.com
O16 - DPF: {29B2C103-AB53-4971-B765-FC1CE5D8B2D1} - http://www.silvercrk.com/downloaders/hweuchre.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50037/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
Mike
New log looks fine.
The sb file is just a Tinybar hijacker registry export. Make sure you deleted it.
Guest<glenn>
I really appreciate all the help. I will tell all my friends about your site. Glenn
Daemon
You're welcome - glad to help 
cnm
Glad we could help. 
If you need this topic reopened, please request this by sending
Email to Zero or
Email to cnm or
Email to Coyote
Choose only one of the above
Include your post user name and detail why you need it reopened with a valid link to your post, any bad links or emails that are not from the original poster will be deleted without response.
Others please start a New Topic.
If you need this topic reopened, please request this by sending
Email to Zero or
Email to cnm or
Email to Coyote
Choose only one of the above
Include your post user name and detail why you need it reopened with a valid link to your post, any bad links or emails that are not from the original poster will be deleted without response.
Others please start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI