#1
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
[InActive] Pls. help with the problem of spyware/IE add-on
Hello,Firefox redirect me each time when I search in Google, Yahoo etc. Can somebody help me??? SP3 (WinNT 5.01.2600)SP3 (6.00.2900.5512)http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab http://www.lizardtech.com/download/f...trol_en_US.cab http://go.microsoft.com/fwlink/?linkid=39204 http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://by135fd.bay135.hotmail.msn.co...s/MsnPUpld.cab http://update.microsoft.com/windowsu...?1139154817482 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://go.divx.com/plugin/DivXBrowserPlugin.cab RDP Client Control (redist)) - http://217.21.249.12/msrdp.cab http://messenger.msn.com/download/Ms...Downloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://robocam.eindhoven.nl/activex/AMC.cab
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
I gues I solve the problem. I have deleted all coockies, application data of all users including myself, temporary files and all kind of that stuff. After this I get problem with dissapeard quick launch icon but it was no problem to solve this.
#3
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
****, my pc is still infected. Yesterday was everything good, but now I get Google redirects again. I believ I need help of somebody with experiance.
Last edited by noahdfear; 27th October 2008 at 04:52 .
Reason: link disabled
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Welcome to WindowsBBS Kar123 Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool.
At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please post the contents of log.txt here in your next reply.
#5
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
I think I have solve the problem... again
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
I would still recommend you follow through with my recommendation. It's likely there is a bit more to cleanup.
#7
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
Then would you please look at it:RAM : 511 MB (29% free)SP3 (WinNT 5.01.2600)SP3 (6.00.2900.5512)http://www.google.nl/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab http://www.lizardtech.com/download/f...trol_en_US.cab http://go.microsoft.com/fwlink/?linkid=39204 http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://by135fd.bay135.hotmail.msn.co...s/MsnPUpld.cab http://update.microsoft.com/windowsu...?1139154817482 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://go.divx.com/plugin/DivXBrowserPlugin.cab RDP Client Control (redist)) - http://217.21.249.12/msrdp.cab http://messenger.msn.com/download/Ms...Downloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://robocam.eindhoven.nl/activex/AMC.cab FTP Server"=2js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"HD ---- C:\Program Files\InstallShield Installation InformationHD ---- C:\WINDOWS\infHD ---- C:\Config.MsiHD ---- C:\WINDOWS\$hf_mig$SMTP (Simple Mail Transfer Protocol); C:\WINDOWS\System32\inetsrv\inetinfo.exe [2008-04-14 15360]FTP Server;Xlight FTP Server; c:\windows\spoolsvc.exe -runservice []
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Please post the log from ComboFix located at C:\ComboFix.txt
#9
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
Yes I have ComboFix, but when I started it faild to update. So I used the vesion that I have. WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Code:
<pre>
----a-w 6,586,904 2008-10-25 12:41:34 C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
</pre> FTP Server"=2 (0x2)TCP "= 3389:TCP :*TCP "= 26675:TCP :169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceFTP Server;Xlight FTP Server;c:\windows\spoolsvc.exe [ ]http://www.gmer.net
#10
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
You have a flash drive infection. Please download Flash_Disinfector by sUBs and save it to your desktop:Plug in your USB flash drive.
Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.
this link for instructions for doing so. contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
KillAll::
File::
C:\WINDOWS\windllreg1c.sys
RenV::
C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{593994f4-cf23-11db-842f-001422dbd85c}] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#11
Member
Profile: Join Date: Oct 2008
Posts: 7
Computer Experience:
Bellow the log.txt file:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
Code:
<pre>
----a-w 6,586,904 2008-10-25 12:41:34 C:\Documents and Settings\Admin\Mijn documenten\Downloads\SUPERAntiSpywarePro v4.21.1004 .exe
</pre> FTP Server"=2 (0x2)TCP "= 3389:TCP :*TCP "= 26675:TCP :169.254.2.0/255.255.255.0:Enabled:ActiveSync ServiceFTP Server;Xlight FTP Server;c:\windows\spoolsvc.exe [ ]http://www.gmer.net
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Hmmm ..... something prevented ComboFix from fixing one thing. Recommend you delete the following file, and all others similarly named if present. They are likely infected.SUPERAntiSpywarePro v4.21.1004 .exe Kaspersky Online Scanner Accept , when prompted to download and install the program files and database of malware definitions.Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note** Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
All times are GMT +1. The time now is 09:07 .
isabled:@xpsp2res.dll,-22009
