Spyware / Malware / Virus Removal

[Closed] Need Help Quick

2 min read

Looking for the outcome? Ask AI

Tameilau Topic Starter

Post #1September 28, 2007, 1:00 AM UTC

HI i need real quick help
when ever im on my ie i go to a web site and the page apears normal then 3 secs later white boxes apear every were with ads in them and i can bearly see this fourm cause of them
This is my high jack log
Logfile of HijackThis v1.99.1
Scan saved at 12:39:22 p.m., on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\SQ931STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.156\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 208.113.138.25 blogs.photopreneur.com
O1 - Hosts: 207.126.123.20 menshealth.about.com
O1 - Hosts: 208.185.127.35 z.about.com
O1 - Hosts: 209.62.176.56 n479ad.doubleclick.net
O1 - Hosts: 209.62.176.152 ad.doubleclick.net
O1 - Hosts: 70.84.50.114 www.qfac.com
O1 - Hosts: 216.73.125.89 www.4-men.org
O1 - Hosts: 72.14.253.166 pagead2.googlesyndication.com
O1 - Hosts: 216.235.79.13 ezinearticles.com
O1 - Hosts: 8.14.147.111 www.crackserialkeygen.com
O1 - Hosts: 8.14.147.186 0dayaccess.com
O1 - Hosts: 66.112.209.103 www.firstddl.com
O1 - Hosts: 66.112.209.103 www.sexas.us
O1 - Hosts: 84.15.56.27 www.sdownloads.net
O1 - Hosts: 84.15.56.26 www.krutas.com
O1 - Hosts: 84.15.56.27 exchange.spaceddl.com
O1 - Hosts: 66.245.188.128 www.winaso.com
O1 - Hosts: 85.17.52.9 www.serials.ws
O1 - Hosts: 66.151.147.230 adtology.com
O1 - Hosts: 216.239.113.172 www.gamespot.com
O1 - Hosts: 208.72.193.66 www.bittorrent.com
O1 - Hosts: 203.167.223.236 c5.zedo.com
O1 - Hosts: 216.205.149.2 media.adrevolver.com
O1 - Hosts: 208.72.193.66 208.72.193.66
O1 - Hosts: 69.41.171.139 forum.mininova.org
O1 - Hosts: 75.126.210.232 www.emule.com
O1 - Hosts: 75.126.210.232 www.finderg.com
O1 - Hosts: 75.126.210.232 www.descer.com
O1 - Hosts: 72.14.253.104 www.google.com
O1 - Hosts: 213.161.81.186 forums.computers.toshiba-europe.com
O1 - Hosts: 202.27.222.252 www.swiminfo.co.nz
O1 - Hosts: 203.167.250.125 www.swimmingnz.org.nz
O1 - Hosts: 203.190.122.233 ad.hk.doubleclick.net
O1 - Hosts: 69.31.17.4 www.xanga.com
O1 - Hosts: 203.82.8.24 bet.hkjc.com
O1 - Hosts: 203.82.8.94 xsell.hkjc.com
O1 - Hosts: 202.153.105.62 special.hkjc.com
O1 - Hosts: 203.82.11.35 txn01.hkjc.com
O1 - Hosts: 65.54.179.203 login.live.com
O1 - Hosts: 65.55.153.124 by142fd.bay142.hotmail.msn.com
O1 - Hosts: 207.68.178.12 rad.msn.com
O1 - Hosts: 202.43.220.41 hk.finance.yahoo.com
O1 - Hosts: 124.108.94.160 hk.myblog.yahoo.com
O1 - Hosts: 192.217.199.214 www.editgrid.com
O1 - Hosts: 218.188.80.138 www.hkjc.com
O1 - Hosts: 203.82.10.35 txn02.hkjc.com
O1 - Hosts: 203.167.223.242 search.live.com
O1 - Hosts: 203.144.36.163 www.whitcoulls.co.nz
O1 - Hosts: 72.14.253.96 www.googleadservices.com
O1 - Hosts: 64.14.39.200 www.beyonceonline.com
O1 - Hosts: 64.14.12.51 www.askmen.com
O1 - Hosts: 216.35.123.100 images.askmen.com
O1 - Hosts: 208.112.85.115 www.icanmodels.com
O1 - Hosts: 203.167.223.242 www.theage.com.au
O1 - Hosts: 67.15.145.3 k43.pbase.com
O1 - Hosts: 66.179.240.29 www.pbase.com
O1 - Hosts: 207.150.180.28 www.worth1000.com
O1 - Hosts: 202.49.173.63 www.therock.net.nz
O1 - Hosts: 210.48.79.119 www.unlockme.co.nz
O1 - Hosts: 202.27.252.35 www.superliquor.co.nz
O1 - Hosts: 66.118.188.212 www.capecodwines.com
O1 - Hosts: 203.82.12.33 bet.hongkongjockeyclub.com
O1 - Hosts: 203.215.253.234 analysis.hkjc.com
O1 - Hosts: 208.75.184.160 www.bebo.com
O1 - Hosts: 63.121.29.7 ads.monster.com
O1 - Hosts: 208.67.65.27 ad.yieldmanager.com
O1 - Hosts: 203.167.223.236 as.casalemedia.com
O1 - Hosts: 208.75.184.160 beboframe.com
O1 - Hosts: 208.67.65.19 ad.directaclick.com
O1 - Hosts: 198.65.10.225 www.ashoppingspree.com
O1 - Hosts: 202.27.184.155 yahooxtra.net.nz
O1 - Hosts: 203.84.217.27 nz.adserver.yahoo.com
O1 - Hosts: 64.14.48.154 www.freelotto.com
O1 - Hosts: 207.159.120.153 smiley.smileycentral.com
O1 - Hosts: 64.38.63.37 www.yourdestinyrevealed.co.nz
O1 - Hosts: 203.129.71.189 www.aastock.com
O1 - Hosts: 203.129.71.189 www.aastocks.com
O1 - Hosts: 202.43.220.99 hk.yahoo.com
O1 - Hosts: 203.84.223.57 hist1.ac.search.vip.hki.yahoo.com
O1 - Hosts: 208.65.153.238 www.youtube.com
O1 - Hosts: 77.73.36.99 www.miniclip.com
O1 - Hosts: 75.126.76.32 www.metrolyrics.com
O1 - Hosts: 204.11.109.61 a.tribalfusion.com
O1 - Hosts: 83.231.156.14 www.rugbyworldcup.com
O1 - Hosts: 66.37.153.81 www.tech-faq.com
O1 - Hosts: 216.180.238.237 forums.spywareinfo.com
O1 - Hosts: 72.14.253.104 images.google.co.nz
O1 - Hosts: 72.14.253.104 www.google.co.nz
O1 - Hosts: 203.167.223.237 content.yieldmanager.edgesuite.net
O1 - Hosts: 207.46.236.188 forums.microsoft.com
O1 - Hosts: 208.67.65.19 ad.iconadserver.com
O1 - Hosts: 202.21.128.2 www.trademe.co.nz
O1 - Hosts: 198.63.208.96 www.adscleaner.com
O1 - Hosts: 216.239.122.225 www.download.com
O1 - Hosts: 210.50.7.243 ad.au.doubleclick.net
O1 - Hosts: 216.194.87.254 www.softcows.com
O1 - Hosts: 216.180.233.162 www.spywareinfo.com
O1 - Hosts: 203.167.223.237 i.d.com.com
O1 - Hosts: 203.167.223.237 c7.zedo.com
O1 - Hosts: 216.239.116.65 bwp.download.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {31CBB13B-244D-4C44-AED5-DCAD70F66281} - C:\WINDOWS\mscore.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SQ931STI] C:\WINDOWS\SQ931STI.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Startup Music.lnk = C:\Documents and Settings\Owner\My Documents\My Music\My Playlists\Startup.wpl
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {7AA32FC7-133B-4AE7-998E-CED0D9829B12} - http://axcab.wrs.mcboo.com/website.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Tameilau

Post #2September 28, 2007, 10:41 AM UTC

HI i need real quick help
when ever im on my ie i go to a web site and the page apears normal then 3 secs later white boxes apear every were with ads in them and i can bearly see this fourm cause of them
This is my high jack log
Logfile of HijackThis v1.99.1
Scan saved at 12:39:22 p.m., on 28/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\SQ931STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.156\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 208.113.138.25 blogs.photopreneur.com
O1 - Hosts: 207.126.123.20 menshealth.about.com
O1 - Hosts: 208.185.127.35 z.about.com
O1 - Hosts: 209.62.176.56 n479ad.doubleclick.net
O1 - Hosts: 209.62.176.152 ad.doubleclick.net
O1 - Hosts: 70.84.50.114 www.qfac.com
O1 - Hosts: 216.73.125.89 www.4-men.org
O1 - Hosts: 72.14.253.166 pagead2.googlesyndication.com
O1 - Hosts: 216.235.79.13 ezinearticles.com
O1 - Hosts: 8.14.147.111 www.crackserialkeygen.com
O1 - Hosts: 8.14.147.186 0dayaccess.com
O1 - Hosts: 66.112.209.103 www.firstddl.com
O1 - Hosts: 66.112.209.103 www.sexas.us
O1 - Hosts: 84.15.56.27 www.sdownloads.net
O1 - Hosts: 84.15.56.26 www.krutas.com
O1 - Hosts: 84.15.56.27 exchange.spaceddl.com
O1 - Hosts: 66.245.188.128 www.winaso.com
O1 - Hosts: 85.17.52.9 www.serials.ws
O1 - Hosts: 66.151.147.230 adtology.com
O1 - Hosts: 216.239.113.172 www.gamespot.com
O1 - Hosts: 208.72.193.66 www.bittorrent.com
O1 - Hosts: 203.167.223.236 c5.zedo.com
O1 - Hosts: 216.205.149.2 media.adrevolver.com
O1 - Hosts: 208.72.193.66 208.72.193.66
O1 - Hosts: 69.41.171.139 forum.mininova.org
O1 - Hosts: 75.126.210.232 www.emule.com
O1 - Hosts: 75.126.210.232 www.finderg.com
O1 - Hosts: 75.126.210.232 www.descer.com
O1 - Hosts: 72.14.253.104 www.google.com
O1 - Hosts: 213.161.81.186 forums.computers.toshiba-europe.com
O1 - Hosts: 202.27.222.252 www.swiminfo.co.nz
O1 - Hosts: 203.167.250.125 www.swimmingnz.org.nz
O1 - Hosts: 203.190.122.233 ad.hk.doubleclick.net
O1 - Hosts: 69.31.17.4 www.xanga.com
O1 - Hosts: 203.82.8.24 bet.hkjc.com
O1 - Hosts: 203.82.8.94 xsell.hkjc.com
O1 - Hosts: 202.153.105.62 special.hkjc.com
O1 - Hosts: 203.82.11.35 txn01.hkjc.com
O1 - Hosts: 65.54.179.203 login.live.com
O1 - Hosts: 65.55.153.124 by142fd.bay142.hotmail.msn.com
O1 - Hosts: 207.68.178.12 rad.msn.com
O1 - Hosts: 202.43.220.41 hk.finance.yahoo.com
O1 - Hosts: 124.108.94.160 hk.myblog.yahoo.com
O1 - Hosts: 192.217.199.214 www.editgrid.com
O1 - Hosts: 218.188.80.138 www.hkjc.com
O1 - Hosts: 203.82.10.35 txn02.hkjc.com
O1 - Hosts: 203.167.223.242 search.live.com
O1 - Hosts: 203.144.36.163 www.whitcoulls.co.nz
O1 - Hosts: 72.14.253.96 www.googleadservices.com
O1 - Hosts: 64.14.39.200 www.beyonceonline.com
O1 - Hosts: 64.14.12.51 www.askmen.com
O1 - Hosts: 216.35.123.100 images.askmen.com
O1 - Hosts: 208.112.85.115 www.icanmodels.com
O1 - Hosts: 203.167.223.242 www.theage.com.au
O1 - Hosts: 67.15.145.3 k43.pbase.com
O1 - Hosts: 66.179.240.29 www.pbase.com
O1 - Hosts: 207.150.180.28 www.worth1000.com
O1 - Hosts: 202.49.173.63 www.therock.net.nz
O1 - Hosts: 210.48.79.119 www.unlockme.co.nz
O1 - Hosts: 202.27.252.35 www.superliquor.co.nz
O1 - Hosts: 66.118.188.212 www.capecodwines.com
O1 - Hosts: 203.82.12.33 bet.hongkongjockeyclub.com
O1 - Hosts: 203.215.253.234 analysis.hkjc.com
O1 - Hosts: 208.75.184.160 www.bebo.com
O1 - Hosts: 63.121.29.7 ads.monster.com
O1 - Hosts: 208.67.65.27 ad.yieldmanager.com
O1 - Hosts: 203.167.223.236 as.casalemedia.com
O1 - Hosts: 208.75.184.160 beboframe.com
O1 - Hosts: 208.67.65.19 ad.directaclick.com
O1 - Hosts: 198.65.10.225 www.ashoppingspree.com
O1 - Hosts: 202.27.184.155 yahooxtra.net.nz
O1 - Hosts: 203.84.217.27 nz.adserver.yahoo.com
O1 - Hosts: 64.14.48.154 www.freelotto.com
O1 - Hosts: 207.159.120.153 smiley.smileycentral.com
O1 - Hosts: 64.38.63.37 www.yourdestinyrevealed.co.nz
O1 - Hosts: 203.129.71.189 www.aastock.com
O1 - Hosts: 203.129.71.189 www.aastocks.com
O1 - Hosts: 202.43.220.99 hk.yahoo.com
O1 - Hosts: 203.84.223.57 hist1.ac.search.vip.hki.yahoo.com
O1 - Hosts: 208.65.153.238 www.youtube.com
O1 - Hosts: 77.73.36.99 www.miniclip.com
O1 - Hosts: 75.126.76.32 www.metrolyrics.com
O1 - Hosts: 204.11.109.61 a.tribalfusion.com
O1 - Hosts: 83.231.156.14 www.rugbyworldcup.com
O1 - Hosts: 66.37.153.81 www.tech-faq.com
O1 - Hosts: 216.180.238.237 forums.spywareinfo.com
O1 - Hosts: 72.14.253.104 images.google.co.nz
O1 - Hosts: 72.14.253.104 www.google.co.nz
O1 - Hosts: 203.167.223.237 content.yieldmanager.edgesuite.net
O1 - Hosts: 207.46.236.188 forums.microsoft.com
O1 - Hosts: 208.67.65.19 ad.iconadserver.com
O1 - Hosts: 202.21.128.2 www.trademe.co.nz
O1 - Hosts: 198.63.208.96 www.adscleaner.com
O1 - Hosts: 216.239.122.225 www.download.com
O1 - Hosts: 210.50.7.243 ad.au.doubleclick.net
O1 - Hosts: 216.194.87.254 www.softcows.com
O1 - Hosts: 216.180.233.162 www.spywareinfo.com
O1 - Hosts: 203.167.223.237 i.d.com.com
O1 - Hosts: 203.167.223.237 c7.zedo.com
O1 - Hosts: 216.239.116.65 bwp.download.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSVPS System - {31CBB13B-244D-4C44-AED5-DCAD70F66281} - C:\WINDOWS\mscore.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SQ931STI] C:\WINDOWS\SQ931STI.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Startup Music.lnk = C:\Documents and Settings\Owner\My Documents\My Music\My Playlists\Startup.wpl
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {7AA32FC7-133B-4AE7-998E-CED0D9829B12} - http://axcab.wrs.mcboo.com/website.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/Windows…ggPublisher.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

im not having problems with this now

LDTate

Post #3September 30, 2007, 2:58 AM UTC

Only for Windows XP and Windows 2000

Hello and welcome to the Forums.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe
Double Click SmitfraudFix.exe on your Desktop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________
Next:

Download the trial version of AVG Anti-Spyware from here and install it. When the program has been installed, and you click the Finish button, AVG Anti-Spyware will open.

If the program does not automatically update itself during installation, or you are unsure whether it has done so, please do the following:

Click the Update icon at the top and under Manual Update click the Start update button.
The program will either update or inform you that no update was available.
It is essential that you get the update - keep trying until successful. (Note: If you have problems getting the update, you can download an installer for the full database from here (save it on your desktop). Once you have downloaded the installer, make sure that AVG Anti-Spyware is closed and then double-click on avgas-signatures-full-current.exe to install the database).

Please set up the program as follows:

Click the Shield icon at the top and under Resident shield is… click active. This should now
change to inactive.
Click the Update icon and untick the automatic update option.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act? - make sure that Quarantine is selected.
Under How to scan? - All checkboxes should be ticked.
Under Possibly unwanted software - All checkboxes should be ticked.
Under Reports - Select Do not automatically generate reports.
Under What to scan? - Select Scan every file.

Close all open windows.
Do not run a scan yet.

______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. It will create a file named:
c:\rapport.txt

IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt

LDTate

Post #4October 17, 2007, 11:39 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Need Help Quick

✨ Ask AI

Ask AI