1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Connect to - dialog box - Internet Explorer [global.msads.net, etc - HJT log]

Discussion in 'Malware and Virus Removal Archive' started by et_phone_home, 2005/07/20.

Thread Status:
Not open for further replies.
  1. 2005/07/20
    et_phone_home

    et_phone_home Inactive Thread Starter

    Joined:
    2005/07/20
    Messages:
    4
    Likes Received:
    0
    Connect to - dialog box - Internet Explorer

    Hi,

    I have seen several posts regarding a similar issue, but haven't found a solution. I keep getting the "Connect to...." dialog box when accessing most web pages, prompting me for a user name and password. Popular addresses for connect to are global.msads.net, servedby.advertising.com and more. When I press cancel, e.g. www.msn.com displays all ads with no images (just the red 'x' and "Click here! ")

    I have run SpyBot, MS antispy, AdAware, Trend AntiSpyWare, HiJack this and some more I believe but nothing gets rid of this.

    I have checked my dialup preferences for my network connections and disabled all autodials.

    I uninstalled my McAfee Antivirus and autocheck, I ran through Avast which is enabled now.

    Does anybody have any ideas on what to try next? I would really not want to reinstall this machine, but it seems to be the only option left :-(

    Thank you
    ET
     
  2. 2005/07/21
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    et_phone_home - Welcome to the Board :)

    Looks like your browser has been hijacked .

    Download HijackThis through Quicklinks in my signature, save it to a folder on your hard drive, say C:\HJT - do not save it to the desktop or a temporary location. Run it and post the log here - fix nothing until advised to do so.

    Our experts are swamped with logs so it may take a day or so for one of them to analyse your log.

    Thread moved to Removing Spyware & Viruses forum with title edit.
     

  3. to hide this advert.

  4. 2005/07/21
    et_phone_home

    et_phone_home Inactive Thread Starter

    Joined:
    2005/07/20
    Messages:
    4
    Likes Received:
    0
    Hi Pete

    thanks for your reply. Here's my HiJackThis log:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:40:27, on 21.7.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\ibmpmsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\atiptaxx.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\Tmas\Tmas.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\System32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Precise Software Solutions\Precise Indepth for SQL Server 1.1\bin\pss_listener.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\cmd.exe
    C:\hjt\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
    O1 - Hosts: 193.4.32.181 removed
    O1 - Hosts: 193.4.32.75 removed
    O1 - Hosts: 193.4.27.2 removed
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
    O23 - Service: Microsoft Search (MSSEARCH) - Unknown owner - C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe (file missing)
    O23 - Service: Precise MS SQL Batch Controller (PssMSBatchController) - Unknown owner - C:\Program Files\Precise Software Solutions\Precise Indepth for SQL Server 1.1\bin\pss_batch.exe
    O23 - Service: Precise MS SQL Listener (PssMSListener) - Unknown owner - C:\Program Files\Precise Software Solutions\Precise Indepth for SQL Server 1.1\bin\pss_listener.exe

    Thanks in advance,
    ET
     
  5. 2005/07/21
    et_phone_home

    et_phone_home Inactive Thread Starter

    Joined:
    2005/07/20
    Messages:
    4
    Likes Received:
    0
    Hi,

    I decided to reinstall XP on the machine, so you don't have to analyze the log for me.

    Thanks anyway,
    ET
     
  6. 2005/07/21
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    OK - a bit drastic, but if you're happy doing it that way :)

    Thanks for posting back.
     
  7. 2005/07/21
    et_phone_home

    et_phone_home Inactive Thread Starter

    Joined:
    2005/07/20
    Messages:
    4
    Likes Received:
    0
    Grrr :mad: not happy actually, but was on a deadline. I have tried everything I could think of, including re-installing Internet Explorer (which I did not find to be very easy), installed Opera which acted the same way, so the problem lay elsewhere, ran all the antispyware stuff I could find, antivirus, uninstalls of any suspicious applications, startup programs. All in all, much much faster to reinstall :rolleyes:

    Thanks for your responses,
    ET
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.