Computing.Net > Forums > Security and Virus > what to fix with hijack

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

what to fix with hijack

Reply to Message Icon

Name: kity
Date: April 18, 2004 at 19:18:23 Pacific
OS: 98
CPU/Ram: 384
Comment:

I need permission to post my hijack list so i know what to fix

Please Help

Thanx



Sponsored Link
Ads by Google

Response Number 1
Name: Dog
Date: April 18, 2004 at 22:25:36 Pacific
Reply:

If you have done everything mentioned here A Good Place To Start and searched the forum for similar problems and solutions, by all means post it here, in this posting.

It works for me

D4


0

Response Number 2
Name: kity
Date: April 20, 2004 at 08:38:33 Pacific
Reply:

Ive Tried Ad-Aware and Spybot First

ok I updated my Ad-Aware and Spybot.. and Spybot said i was free Congradualations.. Ad-Aware found 17 more. And Took them out..

So I hope Im doing this right.. Here is my Hijack List..

Sorry If Im Stating this wrong..

Can Someone Tell me what to remove

Thanx!!

Logfile of HijackThis v1.97.7
Scan saved at 8:33:57 AM, on 4/20/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.exe
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.exe
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.exe
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.exe
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\WINDOWS\SYSTEM\SPOOL32.exe
C:\WINDOWS\DESKTOP\DOWNLOADS\ALL FROM COMPUTING NET\HIJACK THIS\HIJACKTHIS.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
O2 - BHO: (no name) - {121f3c20-fb3e-11d7-9664-00c0f074b3b3} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\PROGRAM FILES\CLEARSEARCH\IE_CLRSCH.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [vptray] C:\Program Files\Norton AntiVirus\vptray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\RunServices: [rtvscn95] C:\Program Files\Norton AntiVirus\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\Program Files\Norton AntiVirus\defwatch.exe
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Control Pad (HKLM)
O9 - Extra 'Tools' menuitem: Control Pad (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37915.3021064815
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

The Ones That Im Concerned with is the ones that have something missing stated at the end. (file Missing, No name, No File) Are these just left overs? of Something

Thanx


0

Response Number 3
Name: Dog
Date: April 20, 2004 at 20:13:59 Pacific
Reply:

These should be safe to delete

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
O2 - BHO: (no name) - {121f3c20-fb3e-11d7-9664-00c0f074b3b3} - (no file)
O2 - BHO: Clear Search - {00000000-0000-0000-0000-000000000240} - C:\PROGRAM FILES\CLEARSEARCH\IE_CLRSCH.DLL (file missing)

Apart from these it looks pretty good.
BTW what was the initial problem?

Dog's Security Ideas

D4


0

Response Number 4
Name: Derek2
Date: April 21, 2004 at 11:07:26 Pacific
Reply:

You also appear to be running two antivirus programs simultaneously, this will cause you problems. Disable AVG from running at start-up and just use it when you right-click a file or folder. Keep Norton as your main on-access scanner.
The no name/no file entries are hamless as their are no files using them, but please wait for someone more knowledgable than me to confirm this.
Regards, Derek.


0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: what to fix with hijack

Unsure what to do with virus www.computing.net/answers/security/unsure-what-to-do-with-virus/8786.html

HOTBAR nightmare www.computing.net/answers/security/hotbar-nightmare/10498.html

What to do about hacker attacks www.computing.net/answers/security/what-to-do-about-hacker-attacks/5993.html