unknown HJT line

+1

Derek June 3, 2004 at 19:29:21 Pacific

... sorry, rephrase that - not 2nd posting but any link in the Hijack Logs. Derek.W

+1

Allen Maples June 4, 2004 at 14:38:05 Pacific

Abnormal, what do you mean by the clsid stays the same? I found the file sysstartup.exe in my system folder. Just to be sure, is he saying that I should delete it?

+1

Abnormal June 4, 2004 at 17:00:28 Pacific

-drops sysstartup.exe in the system/system32 folder -accompanied with a randomly named BHO dll but STATIC clsid! : Always the same letters and numbers. {A9A674BF-771F-42E5-A440-D20DDA85A862} The (BHO) Browser helper object should come with your problem. Do you have that in your hijackthis log? This is new, I only know what I can find in a search. Post your log, lets see what you have.

+1

Allen Maples June 5, 2004 at 11:32:19 Pacific

I can't post the HFT log. Tried a few times and kept getting an illegal operation message. What's going on?

+1

Abnormal June 5, 2004 at 22:26:50 Pacific

I do not know, see if you can get anything from this. Blind helping to a problem I have never seen is not easy. http://www.computing.net/security/wwwboard/forum/12126.html

+1

Allen Maples June 6, 2004 at 17:07:04 Pacific

Thanks for the link. I tried running CWShredder and Window Washer in safe mode but the problem is still there. I fixed the start page hijack, the only problem now is that I'm still getting the CoolWebSearch page when I go to a particular website. Could it be the website that's the problem instead of my computer? It's a site for the Sims game.

+1

Abnormal June 6, 2004 at 19:17:06 Pacific

"Could it be the website that's the problem instead of my computer?" You need to update to prevent it. http://www.microsoft.com/technet/security/bulletin/MS03-011.mspx The Microsoft VM is a virtual machine for the Win32operating environment. The Microsoft VM is shipped in most versions of Windows and in most versions of Microsoft Internet Explorer. A new security vulnerability has been reported that affects the ByteCode Verifier component of the Microsoft VM. It occurs because the ByteCode verifier does not correctly look for certain malicious code when a Java applet is being loaded. The attack vector for this new security issue would likely involve an attacker creating a malicious Java applet and inserting it into a Web page that would exploit this vulnerability when it was opened. An attacker could then host this malicious Web page on a Web site or could send it to a user in e-mail. The present Microsoft VM has been updated to include a fix for this newly reported security vulnerability. This version of VM includes all previously released fixes to the VM. To download the patch to update existing installations of the Microsoft VM, visit the Microsoft Windows Update Web site. Windows Update detects what version of Windows you are running and offers the appropriate patch. To locate the update, visit the "Critical Updates" section of the Microsoft Windows Update Web site: http://windowsupdate.microsoft.com

+1

Allen Maples June 7, 2004 at 13:28:34 Pacific

When I tried the second link, all I got was a blank page.

+1

Derek June 7, 2004 at 17:07:04 Pacific

I understand MS have ceased support for W95. I cannot be sure but perhaps that's the reason for the blank page. I downloaded mine (W98) from the corporate update page. I've just checked and they don't give the option of W95 OS. This post is getting a bit ancient now. Maybe you would get more attention if you posted it again (on the S&V forum I would have thought). A few fresh ideas might help. Derek.W