1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

IE6 Online support Hijacked by Earthlink

Discussion in 'Security and Privacy' started by rudymill, 2004/08/18.

Thread Status:
Not open for further replies.
  1. 2004/08/18
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    I've found Earthlink installed on my system after use by my kids.

    I've gone through the uninstall procedure using their unistaller; I've also used their instructions for a manual uninstall.

    Got it off I thought, but parts keep coming back: specificallyk when I click on the "Online Support" under the "Help" menu in IE6, I am sent to earthlink.

    Any suggestions?

    Thanks.
     
    rudymill,
    #1
  2. 2004/08/18
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    rudymill

    Which OS are you running? XP, Me, 98 ....
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2004/08/18
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    XP pro P4 2.5Ghz, 1.0Gb ram
     
    rudymill,
    #3
  5. 2004/08/18
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Get a copy of Hijackthis (quicklinks in my signature) and put it in a folder of it's own. c:\hjt works well but NOT a temp folder and NOT directly to the desktop).

    Run it and create a scan log then post that log to this thread.

    Moving this to security since we are trying to keep all the HJT activity in that section.
     
    Newt,
    #4
  6. 2004/08/18
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    hijack this log

    Logfile of HijackThis v1.97.7
    Scan saved at 10:55:51 PM, on 8/18/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    ........

    Edit note: remainder of log deleted.

    Interesting but with the older version of HJT you are running, not nearly as useful as it should be.

    Download 1.98.2 and try another log. Newt
     
    rudymill,
    #5
  7. 2004/08/19
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    see edit note
     
    Newt,
    #6
  8. 2004/08/19
    steelwool

    steelwool Inactive

    Joined:
    2003/03/12
    Messages:
    37
    Likes Received:
    0
    Is there something wrong with Earthlink ? I have it installed on my computer as well, but no idea why or what it is. I don't have any problem with it in IE6. Should it be removed ? I've also gone to an internet site called EarthLink Spy Audit which supposedly automatically checks computer for spyware, but is this site perhaps known to download spyware itself ?
     
    steelwool,
    #7
  9. 2004/08/19
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    HJT 1.98.2 log file

    OK, here's the new logfile. I can see a bunch of Earthlink links, but I will wait for more informed advice before starting.


    FYI to Steel Wool: Earthlink is a national ISP; I tried their dial-up service for less than a month years ago, but how it came back I don't know.



    Logfile of HijackThis v1.98.2
    Scan saved at 3:48:51 PM, on 8/19/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\NetScreen\NetScreen-Remote\IreIKE.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\NetScreen\NetScreen-Remote\IPSecMon.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\Program Files\WinFax\WFXMOD32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\PROGRA~1\WinFax\WFXSWTCH.exe
    C:\WINDOWS\System32\wfxsnt40.exe
    C:\WINDOWS\MMKeybd.exe
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
    C:\Program Files\Netropa\OSD.exe
    C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
    C:\WINDOWS\System32\hpoipm07.exe
    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Rudolph 2002 Miller\My Documents\Downloaded Programs\tp Hijack This\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
    R3 - Default URLSearchHook is missing
    N1 - Netscape 4: user_pref( "browser.startup.homepage ", "http://www.google.com/ "); (C:\Program Files\Netscape\Users\miller_kids\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Synapse BHO - {33414365-E6C7-460d-880A-A163BD69E84D} - C:\WINDOWS\Downloaded Program Files\FujiFld.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe "
    O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
    O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
    O16 - DPF: {1FBD11EF-1260-11D1-87A7-444553540001} (Synapse Medical Imaging Workstation) - http://synapse.com/osd/synapseWorkstation.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://diagnostics.support.hp.com/motivedocs/ces/ishield/isetup.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
    O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/MaxisSimCityScapeTeleX.cab
    O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
    O16 - DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} (SynapseInstallHelper Class) - http://synapse.com/osd/x86/win95/FujiInst.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O16 - DPF: {FE1A240F-B247-4E06-A600-30E28F5AF3A0} - file://C:\install.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0DACE6BC-5288-44EA-AB60-E26AAC0D6E94}: NameServer = 151.164.1.8 151.164.11.201
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0DACE6BC-5288-44EA-AB60-E26AAC0D6E94}: NameServer = 151.164.1.8 151.164.11.201
     
    rudymill,
    #8
  10. 2004/08/19
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    These are all things you do not need and Hijackthis can remove the entries. However, there are a couple I'm not so sure about how to do complete removal so were it me, I'd wait on one of the security pros to respond. Probably need some file/folder removals as well.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mo...ton/search.html
    R3 - Default URLSearchHook is missing
    O2 - BHO: Synapse BHO - {33414365-E6C7-460d-880A-A163BD69E84D} - C:\WINDOWS\Downloaded Program Files\FujiFld.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - Global Startup: Digital Line Detect.lnk = ?
    O16 - DPF: {FE1A240F-B247-4E06-A600-30E28F5AF3A0} - file://C:\install.cab

    Additional notes:

    Green is optional. Not a baddie per se but system sludge that offers no benefit when run at system startup.

    O2 - BHO: Synapse BHO - {33414365-E6C7-460d-880A-A163BD69E84D} - C:\WINDOWS\Downloaded Program Files\FujiFld.dll
    Via-Christi.org and spywareblaster blocks it so I'd get rid of it and strongly consider loading spywareblaster and letting it immumize your system and I'm guessing the recommendation will be to remove that .dll.

    O16 - DPF: {FE1A240F-B247-4E06-A600-30E28F5AF3A0} - file://C:\install.cab
    W32.Friendgreet.worm with removal instructions.

    There may be others I've misses so as I said, if this were my PC I'd wait for another response before removing anything although I would go to the W32.Friendgreet.worm link and do what Symantec recommends.
     
    Newt,
    #9
  11. 2004/08/23
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    Earthlink is still there

    1. I ran HJT and eliminated the links as suggested. Rebooted. Opened IE and lo and behold: I still get Earthlink when I go to Help/Online Support. :mad:

    Reran HJT, but I don't see earthlink; now what :confused:

    2. Newt's post suggested eliminating the following:

    O16 - DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} (SynapseInstallHelper Class) - http://synapse.com/osd/x86/win95/FujiInst.cab

    I use an medical image transmission program called Synapse which is from the Fuji company; I'm reluctant to eliminate this thing.


    Anyway, here's the latest log:

    Logfile of HijackThis v1.98.2
    Scan saved at 8:24:19 PM, on 8/23/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\NetScreen\NetScreen-Remote\IreIKE.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\NetScreen\NetScreen-Remote\IPSecMon.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\System32\WFXSVC.EXE
    C:\Program Files\WinFax\WFXMOD32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\PROGRA~1\WinFax\WFXSWTCH.exe
    C:\WINDOWS\System32\wfxsnt40.exe
    C:\WINDOWS\MMKeybd.exe
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Netropa\OSD.exe
    C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
    C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
    C:\WINDOWS\System32\hpoipm07.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
    C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
    C:\Program Files\Microsoft Money\System\urlmap.exe
    C:\Documents and Settings\Rudolph 2002 Miller\My Documents\Downloaded Programs\tp Hijack This\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
    N1 - Netscape 4: user_pref( "browser.startup.homepage ", "http://www.google.com/ "); (C:\Program Files\Netscape\Users\miller_kids\prefs.js)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Synapse BHO - {33414365-E6C7-460d-880A-A163BD69E84D} - C:\WINDOWS\Downloaded Program Files\FujiFld.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe "
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe "
    O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\WinFax\WFXSWTCH.exe
    O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
    O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\MMKeybd.exe
    O4 - HKLM\..\Run: [Ad-watch] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\Netscape\Communicator\Program\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
    O16 - DPF: {1FBD11EF-1260-11D1-87A7-444553540001} (Synapse Medical Imaging Workstation) - http://synapse.com/osd/synapseWorkstation.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://diagnostics.support.hp.com/motivedocs/ces/ishield/isetup.cab
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
    O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/MaxisSimCityScapeTeleX.cab
    O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
    O16 - DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} (SynapseInstallHelper Class) - http://synapse.com/osd/x86/win95/FujiInst.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0DACE6BC-5288-44EA-AB60-E26AAC0D6E94}: NameServer = 151.164.1.8 151.164.11.201
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0DACE6BC-5288-44EA-AB60-E26AAC0D6E94}: NameServer = 151.164.1.8 151.164.11.201
     
    rudymill,
    #10
  12. 2004/08/23
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    The Fuji items are probably OK. I did some further checking and the various sites have them flagged as "open to question" rather than as known bad or known legit items.

    A look at the Via-Christi.org privacy statement Here looks reasonable and you would certainly expect a large hospital system to be OK. Chances are that removal of the items would have been harmless but since you do work with the company, you are correct that it's best to leave them alone.

    The only remaining thing I can think of since the new HJT log looks clean (except for O4 - Global Startup: Digital Line Detect.lnk = ? and that was my goof for the way I posted it but almost certainly harmless anyway - just junk) would be some sort of redirect from a hosts file. I would have expected to see that in the HJT log but maybe not.

    Look in c:\windows\system32\drivers\etc for a file named hosts (no extension). Open it in notepad (it's a text file) and copy the contents here.

    Meanwhile, maybe one of the security guys has some additional ideas? Anyone?
     
    Newt,
    #11
  13. 2004/08/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    If listed in add/remove programs, I recommend you uninstall FunWebProducts.

    Scan agin with HijackThis and fix the following entry.

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...etup1.0.0.8.cab

    Reboot. Open C:\program Files and delete the FunWeb folder if present. Copy/paste the following command into your Internet Explorer address window and hit enter.

    javascript:navigator.userAgent

    Copy the text of the resulting window and paste it here with your next reply.



    I would also recommend running a registry cleaner, such as RegSeeker (or similar), using the clean registry function. When scan is complete, verify the backup box in lower left corner is checked and click the select all button. Then right click within the search results and select delete. I have never had problems deleting everything it finds. Reboot after running. Check help again. If still doing it, use the find in registry function to search for Earthlink entries, click select all below the search results, right click the results window and select export. Navigate to the folder that RegSeeker was installed to, open the backup folder, locate the last file made, right click and choose 'Open With'>notepad. Select all from edit and copy/paste it here.


    BTW, you could delete every 016 entry in your log without harming anything (not that I'm suggesting to). They represent activeX controls installed by various programs through Internet Explorer (Shockwave, FlashPlayer, Windows Update, etc.). They will be re-installed the next time you visit the site/use the program.
     
    noahdfear,
    #12
  14. 2004/08/23
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    thanks

    Thanks for the quick replys. I'll get to work on the suggestions. :p
     
    rudymill,
    #13
  15. 2004/08/24
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    replies to newt and noahdfear

    Newt: here's the text of "hosts "

    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
    10.1.0.10 synapse.com



    Noahdfear:

    Here's the results from pasting in the browser:

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)
     
    rudymill,
    #14
  16. 2004/08/24
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    Regseeker file for finding "earthlink "

    I used the find function for "earthlink" and had it search the entire registry: I got a huge file, and everytime I try to submit it, I get the following error form the BBS:

    Fatal error: Maximum execution time of 30 seconds exceeded in /var/www/windowsbbs.com/html/includes/functions.php on line 1507


    If I use the default search (leaves out users and current config), I get a smaller file, but still get an error "

    Fatal error: Maximum execution time of 30 seconds exceeded in /var/www/windowsbbs.com/html/includes/functions.php on line 1507
     
    rudymill,
    #15
  17. 2004/08/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Well, I've sure never seen that error message before. :confused: Use the search for files and delete any found. Reboot and run it in clean mode. Delete all and run again. Do this until it comes up clean. Reboot and run one more time, then do another search. Should be safe deleting any key named Earthlink immediately under HKCU\Software, HKCU\Software\Microsoft, HKCU\Software\Microsoft\Windows\CurrentVersion, and the same locations in HKLM. Then run the cleaner again. Reboot, do another search and try exporting and posting the log.
     
    noahdfear,
    #16
  18. 2004/08/24
    rudymill Lifetime Subscription

    rudymill Inactive Thread Starter

    Joined:
    2002/01/08
    Messages:
    83
    Likes Received:
    0
    Success

    I used Regseeker to eliminate all references to Earthlink, and had success.

    Thanks to all who have helped.

    Rudy :D
     
    rudymill,
    #17
  19. 2004/08/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Happy to hear you got it all worked out. You're most welcome, and thanks for posting back. :)
     
    noahdfear,
    #18
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...