Computer Problems? Computing.Net has over
1,000,000 posts about all things technology related!
Click here to start participating now! Also, check out the
New User Guide .
hijackthis log...trojan
Name: LisaD
Date: December 31, 2003 at 17:29:22 Pacific
OS: Windows 98se
CPU/Ram: Intel Pentium III 192mb r
Comment: This is the third time I have posted here and my messages have all been deleted...I have been to several forums and have tried to follow the instructions to delete the peper trojan to no avail. I am not very computer literate but any help would be great. Here is the log to hijack this:
Logfile of HijackThis v1.97.7
Running processes:MSGSRV32.exe SPOOL32.exe MPREXE.exe S24EVMON.exe CCEVTMGR.exe MSTASK.exe ACCSTAT.exe EXPLORER.exe TASKMON.exe SYSTRAY.exe LOADQM.exe NICTT.exe WINAMPA.exe CCAPP.exe STIMON.exe SLMSS.exe MWSVM.exe AUTOUPDATE.exe KEYHOST.exe AIM.exe YPAGER.exe MSNMSGR.exe WZQKPICK.exe WKCALREM.exe WMIEXE.exe REMIND32.exe EBAYTBAR.exe BRMFRSMG.exe DDHELP.exe IEXPLORE.exe IEXPLORE.exe PSTORES.exe WINHOST32.exe WINZIP32.exe HIJACKTHIS.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ezcybersearch.com/search/index.phpscanregw.exe /autoruntaskmon.exe SysTray.exe loadqm.exe SetDefPrt.exe NicTT.exe WINAMPa.exe "ccApp.exe "ccRegVfy.exe "STIMON.exe Rundll32.exe powrprof.dll,LoadCurrentPwrSchemestarter.exe slmss.exe mwsvm.exe mwsvm.exe stcloader.exe AUTOUP~1.exe VERSION.exe KEYHOST.exe EZSB.exe S24EvMon.exe ccEvtMgr.exe "SBServ.exe " -regRundll32.exe powrprof.dll,LoadCurrentPwrSchememstask.exe aim.exe -cnetwait.odlypager.exe -quietMsnMsgr.exe " /backgroundEMREMIND.exe WZQKPICK.exe OSA9.exe wkcalrem.exe REMIND32.exe SmartUI.exe V3.exe EBAYTBAR.exe
thank you so much for helping in advance!!!
Sponsored Link
Response Number 1
Reply: You DO NOT have pepper but you have at least 3 other trojans I can see so far.
Takes these steps first...
Run cwshredder and let it help ya...
Then go and get TDS-3 Radius File file and follow the directions for updating it....
Do that, and post back when done.
KTTD
0
Response Number 2
Name: Abnormal
Date: December 31, 2003 at 18:01:20 Pacific
Reply: Do the above and this also, we will do
Download Ad-Aware and update it.http://www.lavasoftusa.com/support/download/
From lavasoft faqs.
Also.... make sure that you activate IN-DEPTH scanning before you proceed.
Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
Online scan, remove what it finds.http://www.ravantivirus.com/scan/
0
Response Number 3
Name: LisaD
Date: December 31, 2003 at 19:14:27 Pacific
Reply: OK...I did the first part of running the shredder and the TDS-3...here is my updated hijack this...also upon reboot of my machine norton antivirus quarantined some file slmss??? I wish I were more computer literate. I am so sorry!
Logfile of HijackThis v1.97.7
Running processes:MSGSRV32.exe MPREXE.exe ACCSTAT.exe S24EVMON.exe CCEVTMGR.exe MSTASK.exe EXPLORER.exe TASKMON.exe SYSTRAY.exe LOADQM.exe NICTT.exe WINAMPA.exe SPOOL32.exe CCAPP.exe STIMON.exe WMIEXE.exe WUPDATER.exe MWSVM.exe AUTOUPDATE.exe KEYHOST.exe AIM.exe YPAGER.exe MSNMSGR.exe WZQKPICK.exe WKCALREM.exe REMIND32.exe SMARTUI.exe EBAYTBAR.exe BRMFRSMG.exe PPLINKS.exe IEXPLORE.exe TDS-3.exe AGENTSVR.exe DDHELP.exe WINZIP32.exe HIJACKTHIS.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ezcybersearch.com/search/index.phpscanregw.exe /autoruntaskmon.exe SysTray.exe loadqm.exe SetDefPrt.exe NicTT.exe WINAMPa.exe "ccApp.exe "ccRegVfy.exe "STIMON.exe Rundll32.exe powrprof.dll,LoadCurrentPwrSchemestarter.exe slmss.exe mwsvm.exe mwsvm.exe stcloader.exe AUTOUP~1.exe VERSION.exe KEYHOST.exe EZSB.exe wupdater.exe S24EvMon.exe ccEvtMgr.exe "SBServ.exe " -regRundll32.exe powrprof.dll,LoadCurrentPwrSchememstask.exe aim.exe -cnetwait.odlypager.exe -quietMsnMsgr.exe " /backgroundEMREMIND.exe WZQKPICK.exe OSA9.exe wkcalrem.exe REMIND32.exe SmartUI.exe V3.exe EBAYTBAR.exe
0
Response Number 4
Name: FZWG
Date: December 31, 2003 at 19:41:52 Pacific
Reply: On the O10 entries, would download LSPfix Here
Launch the application, and click the "I know what I'm doing" checkbox.
Check all instances of: inetadapt.dll, and move them to the "Remove" pane.
0
Response Number 5
Name: Abnormal
Date: December 31, 2003 at 19:46:23 Pacific
Reply: FZWG,
Now download run Ad-Aware, it will remove
We will get it fixed.
0
Related Posts
Response Number 6
Name: FZWG
Date: December 31, 2003 at 20:14:07 Pacific
Reply: Abnormal,
I think you are right...
Nobody has suggested running Spybot Search and Destroy Here
There is plenty of guidance on that one.
It picks up undesirables that AdAware might not.
0
Response Number 7
Name: LisaD
Date: December 31, 2003 at 21:25:22 Pacific
Reply: ok I installed and ran ad-aware 6...now do I delete or quarantine ALL of the things that it found? Is it possible I am going to delete something I really need?
0
Response Number 8
Name: Abnormal
Date: December 31, 2003 at 21:31:49 Pacific
Reply: Quarintine everything, and post another log.
0
Response Number 9
Name: LisaD
Date: December 31, 2003 at 21:42:49 Pacific
Reply: OK I quarantined everything but didn't remove all items...I figured I better not do that until I heard from you. But anyway, here is the new log. Please let me know how I am doing. I am so sorry for being so naive about these things I appreciate your help so very much:
Logfile of HijackThis v1.97.7
Running processes:MSGSRV32.exe MPREXE.exe ACCSTAT.exe S24EVMON.exe CCEVTMGR.exe MSTASK.exe EXPLORER.exe TASKMON.exe SYSTRAY.exe LOADQM.exe NICTT.exe WINAMPA.exe SPOOL32.exe CCAPP.exe STIMON.exe WMIEXE.exe WUPDATER.exe AUTOUPDATE.exe KEYHOST.exe AIM.exe YPAGER.exe MSNMSGR.exe WZQKPICK.exe WKCALREM.exe REMIND32.exe EBAYTBAR.exe BRMFRSMG.exe DDHELP.exe AD-AWARE.exe PSTORES.exe HIJACKTHIS.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ezcybersearch.com/search/index.phpscanregw.exe /autoruntaskmon.exe SysTray.exe loadqm.exe SetDefPrt.exe NicTT.exe WINAMPa.exe "ccApp.exe "ccRegVfy.exe "STIMON.exe Rundll32.exe powrprof.dll,LoadCurrentPwrSchemestarter.exe slmss.exe mwsvm.exe mwsvm.exe stcloader.exe AUTOUP~1.exe VERSION.exe KEYHOST.exe EZSB.exe wupdater.exe S24EvMon.exe ccEvtMgr.exe "SBServ.exe " -regRundll32.exe powrprof.dll,LoadCurrentPwrSchememstask.exe aim.exe -cnetwait.odlypager.exe -quietMsnMsgr.exe " /backgroundEMREMIND.exe WZQKPICK.exe OSA9.exe wkcalrem.exe REMIND32.exe SmartUI.exe V3.exe EBAYTBAR.exe
0
Response Number 10
Name: Abnormal
Date: December 31, 2003 at 22:05:42 Pacific
Reply: Let Ad-Aware delete everything, here are
Put a check mark next to these, click fix
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.ezcybersearch.com/search/index.php
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: (no name) - {5074851C-F67A-488E-A9C9-C244573F4068} - C:\WINDOWS\IEASST.DLLslmss.exe mwsvm.exe mwsvm.exe stcloader.exe AUTOUP~1.exe VERSION.exe KEYHOST.exe EZSB.exe wupdater.exe
Lisa I will stay with you till we get it fixed.
0
Response Number 11
Name: LisaD
Date: December 31, 2003 at 22:59:17 Pacific
Reply: OK...I did what you said and here is the latest hijackthis log...let's keep our fingers crossed and hope for the best!
Logfile of HijackThis v1.97.7
Running processes:MSGSRV32.exe MPREXE.exe ACCSTAT.exe S24EVMON.exe CCEVTMGR.exe MSTASK.exe EXPLORER.exe TASKMON.exe SYSTRAY.exe LOADQM.exe NICTT.exe WINAMPA.exe SPOOL32.exe CCAPP.exe STIMON.exe AIM.exe MSNMSGR.exe WZQKPICK.exe WKCALREM.exe REMIND32.exe SMARTUI.exe WMIEXE.exe EBAYTBAR.exe BRMFRSMG.exe PPLINKS.exe YMSGR_TRAY.exe WINZIP32.exe HIJACKTHIS.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080scanregw.exe /autoruntaskmon.exe SysTray.exe loadqm.exe SetDefPrt.exe NicTT.exe WINAMPa.exe "ccApp.exe "ccRegVfy.exe "STIMON.exe Rundll32.exe powrprof.dll,LoadCurrentPwrSchemestarter.exe S24EvMon.exe ccEvtMgr.exe "SBServ.exe " -regRundll32.exe powrprof.dll,LoadCurrentPwrSchememstask.exe aim.exe -cnetwait.odlypager.exe -quietMsnMsgr.exe " /backgroundEMREMIND.exe WZQKPICK.exe OSA9.exe wkcalrem.exe REMIND32.exe SmartUI.exe V3.exe EBAYTBAR.exe
It is after 2:00 am here in New York...going to bed now and I will check back in the later a.m. Thanks for all your help with this and happy happy new year
0
Response Number 12
Name: Abnormal
Date: December 31, 2003 at 23:04:46 Pacific
Reply: Hi Lisa, I will look at your new log, see
a b n o r m a l
0
Response Number 13
Name: iceblue
Date: January 1, 2004 at 06:22:21 Pacific
Reply: LisaD,
Ab,
0
Response Number 14
Name: LisaD
Date: January 1, 2004 at 06:36:22 Pacific
Reply: Gee thanks Iceblue!
0
Response Number 15
Name: Abnormal
Date: January 1, 2004 at 07:19:04 Pacific
Reply: Good morning Lisa, now download lsp fix.Lsp fix
2. Fix the O10's with HijackThis.
3. Run the LspFix you downloaded. Tell it to remove inetadpt.dll .
In order to be able to select inetadpt.dll , you need to click the "I know what I'm doing" checkbox.
Then check all instances of inetadpt.dll (and nothing else) , and move them to the "Remove" pane.
Reboot.
Delete c: inetadpt.dll
Good luck
Learning myself here, hope it works.
0
Response Number 16
Name: LisaD
Date: January 1, 2004 at 17:56:18 Pacific
Reply: ok here is my latest hijack this. I did as you said and here are the results. Do I have to manually go into my files and delete inetadpt.dll from my hard drive or did that program do that for me?
Logfile of HijackThis v1.97.7
Running processes:MSGSRV32.exe SPOOL32.exe MPREXE.exe S24EVMON.exe CCEVTMGR.exe MSTASK.exe ACCSTAT.exe EXPLORER.exe TASKMON.exe SYSTRAY.exe LOADQM.exe NICTT.exe WINAMPA.exe CCAPP.exe STIMON.exe AIM.exe YPAGER.exe MSNMSGR.exe WZQKPICK.exe WKCALREM.exe REMIND32.exe SMARTUI.exe WMIEXE.exe EBAYTBAR.exe BRMFRSMG.exe PPLINKS.exe IEXPLORE.exe DDHELP.exe PSTORES.exe WINZIP32.exe HIJACKTHIS.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://203.199.200.61/ads/ad-spy_hdc.php?id=start1scanregw.exe /autoruntaskmon.exe SysTray.exe loadqm.exe SetDefPrt.exe NicTT.exe WINAMPa.exe "ccApp.exe "ccRegVfy.exe "STIMON.exe Rundll32.exe powrprof.dll,LoadCurrentPwrSchemestarter.exe regwiqz.exe S24EvMon.exe ccEvtMgr.exe "SBServ.exe " -regRundll32.exe powrprof.dll,LoadCurrentPwrSchememstask.exe aim.exe -cnetwait.odlypager.exe -quietMsnMsgr.exe " /backgroundEMREMIND.exe WZQKPICK.exe OSA9.exe wkcalrem.exe REMIND32.exe SmartUI.exe V3.exe EBAYTBAR.exe
What comes next???Thanks so much for all of your help!!!
0
Response Number 17
Name: Abnormal
Date: January 1, 2004 at 19:55:43 Pacific
Reply: Here are new ones, the my search is flagged as bad.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://203.199.200.61/ads/ad-spy_hdc.php?id=start1
I don't know what this is, was not there last night.regwiqz.exe
Not sure about this, it's a proxy server.
http://www.webopedia.com/TERM/P/proxy_server.html
And delete this: regwiqz.exe How to show hidden files
Get spywareblaster, and look at the link
Good luck
0
Response Number 18
Name: FZWG
Date: January 1, 2004 at 20:02:26 Pacific
Reply: LisaD,
Still recommend you download and run Spybot Search and Destroy, found Here
There are some entries that Spybot S&D could get rid of for you. AdAware removed a group of stuff, Spybot goes along the same lines, but sometimes picks up on stuff that AdAware misses, and vice-versa. I always run both of these programs. They are worth the effort.
0
Response Number 19
Name: Abnormal
Date: January 1, 2004 at 20:17:37 Pacific
Reply: I agree, you can use the the tools
0
Response Number 20
Name: sxshep
Date: January 1, 2004 at 20:24:17 Pacific
Reply: Lisa,
You are in good hands with abnormal
He's a tiger and won't let you down.
Great job to both of you so far.
S h e p
0
Response Number 21
Name: LisaD
Date: January 2, 2004 at 08:14:41 Pacific
Reply: I did delete that one inetadpt.dll manually also so that is gone. I didn't find anything for regwiqz.exe . The problem seems much better now and now that I have the adware and the spybot search and destroy I can scan and kind of know which items should go. I want to take a minute to thank all of you who helped me get through this! I could have never fixed all of this without you guys. You are awesome. I have bookmarked this site and hopefully I won't have to be back, but I am sure at some point I will!!! Thanks again for everything. You guys are AWESOME!
0
Response Number 22
Name: Abnormal
Date: January 2, 2004 at 08:46:02 Pacific
Reply: Glad we could help, it took
There are too many tips I picked upTake care, because we care.
a b n o r m a l
0
Response Number 23
Name: LisaD
Date: January 2, 2004 at 08:50:22 Pacific
Reply: I had a firewall program installed last year or so but my husband uses an assigning program called the Arbiter for assigning umpires and their schedules are emailed out from that program and the firewall caused huge problems!!!! We don't exactly know why, but we decided to just do away with it for now. Thanks again for everything. You especially had lots of patience and stayed up with me on New Years eve to help me fix this! Thanks...you are a GEM!!!!!!
0
Sponsored Link
Post Locked
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
Go to Security and Virus Forum Home
Sponsored links
Results for: hijackthis log...trojan
Help with Hijackthis log Summary : Hello team I have been having all sorts of problems with my computer. Some of these include: Trojans in every AVG scan (some items listed included mousepad9.exe. keyboard.exe.,among others, does mean ... www.computing.net/answers/security/help-with-hijackthis-log/18159.html
HijackThis Log annoyance Summary : I am a computer professional and I am concerned at the growing trend for people to post there HijackThis logs on these forums. My concern is that searching for a running process in google for example ... www.computing.net/answers/security/hijackthis-log-annoyance/8973.html
Help with Hijackthis log Summary : Ok, I have just done the online scan and hijackthis and here are ther results ... Thanks for your help. Kaspersky Scan. --------------------- KASPERSKY ON-LINE SCANNER REPORT Wednesday, April 12, 20... www.computing.net/answers/security/help-with-hijackthis-log/18173.html
