Hijack Report 1

[rklalli]

Hello All,

I have this Hijack Report, can anyone let me know the next steps I need to take??

Logfile of HijackThis v1.97.7
Scan saved at 21:13:01, on 26/01/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINDOWS\netconfig{5}.xtr
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\WINDOWS\System32\TPWRTRAY.EXE
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\NetDevSw\NetDevSW.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\PROGRA~1\YAHOO!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Toshiba\Toshiba Controls\TFncKy.exe
C:\Program Files\Apoint2K\EzCapt.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Windows Media Player\WMPLAYER.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\Documents and Settings\Rinku Lalli\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://search-click.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://search-click.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://search-click.com/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://search-click.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://search-click.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch =

http://www.search-1.net/search.html

R3 - URLSearchHook: ViewSource Class - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Rinku Lalli\Application Data\winshow\winshow.dll
R3 - URLSearchHook: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,netconfig{5}.xtr,
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Rinku Lalli\Application Data\winshow\winshow.dll
O2 - BHO: winlink module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C:\Documents and Settings\Rinku Lalli\Application Data\winlink\winlink.dll
O2 - BHO: NavErrRedir Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [mediadriver{5}] netconfig{5}.xtr
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 10
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - Global Startup: Network Device Switch.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O8 - Extra context menu item: Ebates - file://c:\Program Files\topMoxie\TEMP\ebates_script.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Researcher (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Ebates (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat -

http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab

O16 - DPF: Yahoo! Pool 2 -

http://download.games.yahoo.com/games/clients/y/potb_x.cab

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -

http://www.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {4C2C81B4-91DA-494D-8DBF-A7846BA07073} -

http://www.ask.co.uk/toolbar/download/MiniJv-inst.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -

http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37849.2433680556

O16 - DPF: {A1DC3241-B122-195F-B21A-000000000000} -

http://dload.ipbill.com/del/210000.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4317/mcfscan.cab

 

[Xemus]

First go here and follow the winshow uninstallation instructions.

http://www.doxdesk.com/parasite/Winshow.html

Then remove these:
R3 - URLSearchHook: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: NavErrRedir Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O16 - DPF: {4C2C81B4-91DA-494D-8DBF-A7846BA07073} -

http://www.ask.co.uk/toolbar/download/MiniJv-inst.cab

http://www.closedsocket.com

 

[Xemus]

Oops, wasn't done yet.
Get CWShredder

http://www.merijn.org

and make sure it cleans these entries:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://search-click.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://search-click.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://search-click.com/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://search-click.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://search-click.com/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant =

http://www.search-1.net/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch =

http://www.search-1.net/search.html

http://www.closedsocket.com

 

[carrr]

Just a note...rklalli can probably look to some of this coming back around if system restore is not disabled before removal.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[rklalli]

I ran the Hijack report, removed the O2's, etc. Ran CW shredder and removed all the nasties. Now my IE opens in a second (whereas before it took 10-15).

Well Done!!!!!

Many Thanks!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!