#1
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
Having problems w/programs, homepage redirected [Hijackthis log & Getlog xp listed]
I am having problems opening my antispyware software, I can't even get into Adaware to update it. I think my computer might have picked up some virus or other malicious software, because everytime I try to close down my computer I get an error that a program Win Min is not responding. Here is my Hijackthis log. SP1 (WinNT 5.01.2600)SP1 (6.00.2800.1106)IP InSight\SBC\IPClient.exeIP InSight\SBC\IPMon32.exehttp://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm IP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"UPS Status.lnk = ?http://go.microsoft.com/fwlink/?link...67&clcid=0x409 http://us.dl1.yimg.com/download.yaho...st_current.cab http://v5.windowsupdate.microsoft.co...?1114213473575 http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab http://www.180searchassistant.com/180saax.cab http://www.ravantivirus.com/scan/ravonline.cab http://download.overpro.com/WildApp.cab UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exeIP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"Ad -Aware SE Personalata
Last edited by NBAS1; 6th May 2005 at 00:25 .
Reason: Additional information to include.
Didn't find the information you thought to find?Similar Threads
#2
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
Whatever is causing my problems with my computer, has even gone so far as to change my background to what looks like a giant pop up. This is getting annoying now. Anyone have any tips ?
#3
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
I have tried to install some new antivirus software, in safe mode, but nothing I have tried has been allowed to install in safe mode. I have tried to install in standard mode and each time, I double click on the software to install, the installation wizard starts and I am able to click on the "I agree" box , and shortly after the application stops it's installation without any warning or error message, and my screen goes back to the desktop view. I am having no luck on my own with anything.
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Try running Panda ActiveScan and/or Bit-Defender to see if it can cleanup anything then post a new HijackThis log.
#5
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
I used the Panda scanner and was not allowed to transmit, 2 suspected files to them. I was prompted to check my internet connection and to press "OK" each time I did as instructed I was told to check my connection. I did both scans and here is the new Hijackthis log. SP1 (WinNT 5.01.2600)SP1 (6.00.2800.1106)IP InSight\SBC\IPClient.exeIP InSight\SBC\IPMon32.exehttp://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm IP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"http://www.bitdefender.com/scan/Msie/bitdefender.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.ravantivirus.com/scan/ravonline.cab
#6
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
After looking over the Hijackthis log, I used Hijackthis to fix these files.http://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm
Last edited by NBAS1; 10th May 2005 at 20:55 .
Reason: Forgot to add some information.
#7
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
Ignore that part about using Hijackthis to "fix" my hijacked homepage. I rebooted into safe mode and ran adaware and spybot, I then rebooted into normal mode and when I opened up internet explorer, I was back to my new hijacked homepage.
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
You have multiple infections here, and we'll attempt to get them all at once. You should print this out and/or save it to text. Saving to text will allow you to copy/paste the filepaths below when using the Killbox.HostsFileReader and unzip, then open. Click the Reset Default button. Symantec W32.Beagle@mm Removal Tool . Save it to your desktop.stand-alone CWShredder 2.14 from here . Save it to the desktop.LSPFix.exe , saving it to your desktop.SpywareBlaster . Enable all protections, check for updates and enable them too. Then download IESpyad.exe , double click to extract (it extracts to C:\IESpyad by default), open the folder, double click the ie-ads.reg file and allow it to merge into the registry.smitfraud1.zip . Save it to your desktop. If it saves as attachment.php, right click and rename to smitfraud1.zip You may need to enable viewing extensions for known file types to see the zip and php extensions. To do that, open My Computer and click Tools on the menu, then folder options. Click the view tab of the window that opens, uncheck the box to Hide extensions...... and click OK. Now right click the zip and extract the smitfraud1 folder to your desktop.http://www.downloads.subratam.org/KillBox.zip delete on reboot and click the red X to the right. Click Yes, then NO to the reboot now prompt. Copy the next filepath, paste it in the box, and repeat the above steps. When all of the below filepaths are done, allow it to reboot.http://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm msconfig , hit enter. On the boot.ini tab, check the box next to /safeboot and click OK. Click yes to restart. This will restart your computer in safe mode. Logon to your user account.Delete an NT Service button. Type in ZESOFT and click OK. Close HijackThis.RunThis.bat file to start the tool. Follow the prompts. When the tool completes, if you used msconfig, uncheck the /safeboot box and click ok to reboot. Upon reboot you will be greeted with a message window from the System Configuration Utility. Check the box not to use and don't show, then click OK. If you used F8, just reboot back into Windows.flsmngr.dll is present, make sure it is in the remove column, check the box I know what I'm doing and click finish.compress old files and click OK.MWAV . Save it to your desktop and double click to open. Check the boxes for Memory, Registry, Startup Folders, System Folders, Services, Drive, All Local Drives and Scan All Files, then click scan. When it completes, copy the lower window labled Virus Log Information and post it here.smitfraud.zip
#9
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
I followed your instructions . Here is the Hijackthis log. It looks like some of the entries are still there. I will post the virus log when it is finished running. Thanks for the help so far. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)IP InSight\SBC\IPClient.exeIP InSight\SBC\IPMon32.exehttp://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm IP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"http://69.50.182.94/1/rdgUS1882.exe http://www.bitdefender.com/scan/Msie/bitdefender.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.ravantivirus.com/scan/ravonline.cab
#10
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
Here is the virus log.
#11
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Highlight and copy the entire following list of filepaths in bold, open Killbox and check delete on reboot, then click File>copy from clipboard, then click the red X. Close all other windows then click yes to process and reboot. C:\WINDOWS\System32\thun32.dll http://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm http://69.50.182.94/1/rdgUS1882.exe Ad -aware. Scan with Spybot and remove all it finds. Run Ad -aware in full scan mode and remove all it finds. Reboot and post a new HijackThis log.
#12
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
Error when using Killbox
When I told Killbox to restart my computer I get a message stating "PendingFileRenameOperations Registry Data Has Been Removed By External Process". Should I still follow through with the remainder of task?
#13
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
I went ahead and did the hijack this scan again. I checked all items and told it to "fix" . After it was done, I rebooted and ran a hijack this scan again and some of the items were still there. Here is the new Hijackthis log. SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)IP InSight\SBC\IPClient.exeIP InSight\SBC\IPMon32.exehttp://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm IP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"http://www.bitdefender.com/scan/Msie/bitdefender.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.ravantivirus.com/scan/ravonline.cab
Last edited by NBAS1; 12th May 2005 at 01:05 .
Reason: spelling
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Copy the contents of the quote box below to a blank notepad. Close it, saving to your desktop as File name: delfiles.bat Save As Type: All Files
Quote:
attrib -h -r -s C:\WINDOWS\System32\thun32.dll
Reboot to safe mode and double click the file to run. You should be prompted to delete each file. Type a Y and hit enter for each. Make note of any errors. http://w-find.com/sp.htm http://w-find.com/index.htm http://w-find.com/index.htm http://w-find.com/sp.htm http://w-find.com/index.htm HJT , then post the log and any errors with the bat file.
#15
Inactive
Profile: Join Date: May 2005
Posts: 39
Computer Experience:
When I ran the bat file it opened up a window looking like dos and the file ran without prompting me to delete any files. I ran it twice, just to see what was being displayed, as it ran pretty fast, and after each file to be deleted it either said "can not find" or "file not found". Here is the new Hijackthis log.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)IP InSight\SBC\IPClient.exeIP InSight\SBC\IPMon32.exeIP InSight\SBC\IPClient.exe" -lIP InSight\SBC\IPMon32.exe"http://www.bitdefender.com/scan/Msie/bitdefender.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.ravantivirus.com/scan/ravonline.cab
All times are GMT +1. The time now is 12:34 .
