[Resolved]Hijack This Log

4:52 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01 4:52 PM: c:\documents and settings\andy\cookies\andy@mediaplex[1].txt (ID = 6442) 4:52 PM: Found Spy Cookie: mediaplex cookie 4:52 PM: c:\documents and settings\andy\cookies\andy@atdmt[2].txt (ID = 2253) 4:52 PM: Found Spy Cookie: atlas dmt cookie 4:52 PM: Starting Cookie Sweep 4:52 PM: Registry Sweep Complete, Elapsed Time:00:00:34 4:52 PM: HKLM\software\classes\clsid\{7621f6d4-b28a-422e-d153-1855c15d59db}\ (ID = 2448960) 4:52 PM: Found Trojan Horse: trojan-backdoor-czp 4:52 PM: Starting Registry Sweep 4:52 PM: Memory Sweep Complete, Elapsed Time: 00:07:30 spy sweeper still detects something

These changes to the registry that we are trying to make are being hampered by the number of Shields/Guards that you are running. By the way, more than one is too many as they interfere with each other.

A. Please disable AVG AntiSpyware by opening the program and on the Status page - beside "Resident Shield" click on "change status" so that it says "inactive" for it may interfere with our HJT fix.

• Remember to reactivate this feature when all our work is finished.

B. Please Disable Spyware Doctor

1. From within Spyware Doctor, click the "OnGuard" button on the left side.
2. Uncheck "Activate OnGuard"


C. To disable SpySweeper Shields

• Open SpySweeper.
• Click Shield Settings on the right
  (or Shields on the left, depending what screen you're on).
• Click Internet Explorer and uncheck all items.
• Click Windows System and uncheck all items.
• Click Hosts File and uncheck all items.
• Click Startup Programs and uncheck all items.
• Close SpySweeper.

D. Download and run the most current version of Ad-Aware from here: http://www.lavasoftusa.com/products/ad_aware_free.php

Please copy and paste the log into your next reply.

Scan mode: Full
Scan time: 01:45:27
Number of objects scanned: 193503
Number of infections found: 5
Critical: 1
Privacy Objects: 4
Infections deleted: 5
Total infections quarantined: 1
Total infections ignored by scanner: 0

20070719 19-31-18 : Tried to Quarantine an infection.
20070719 19-31-24 : Successfully Quarantined Browser: Firefox Bookmark URL: http://www.google.ca/pagead/iclk?sa=l&…oid%3D%26aid%3D belonging to Possible Browser Hijack attempt

20070719 19-31-25 : Quarantine succeeded.

Delete the content of the Ad-Aware Quarantine and perform another SpySweeper search for the presence of that registry entry. Trevuren

11:42 PM: Registry Sweep Complete, Elapsed Time:00:00:37 11:41 PM: HKLM\software\classes\clsid\{7621f6d4-b28a-422e-d153-1855c15d59db}\ (ID = 2448960) 11:41 PM: Found Trojan Horse: trojan-backdoor-czp 11:41 PM: Starting Registry Sweep

1. Please download RegASSASSIN

• Download the file to your Desktop.
• Click on RegASSASSIN.zip to open the file.
• Extract RegASSASSIN.exe to your desktop
• Click on the copy of RegASSASSIN.exe on your desktop to run the tool.
• Now Copy/Paste the following registry key into the white data box: (Note: Use the Long Hive Name)
  
  

  HKEY_LOCAL_MACHINE\software\classes\clsid\{7621f6d4-b28a-422e-d153-1855c15d59db}

• Leave the default options checked.

2. Click on the DELETE button

• A popup box will prompt you to confirm your intention to delete the key. Click OK
• A new popup box will appear to confirm the deletion of the registry key. Click OK
• Now EXIT the program

3. Then please scan again with SpySweeper.

SpySweeper scan came up clean. Thanks for helping me Trevuren

My pleasure, Set a new restore point then clean out the others as described in a previous post.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php