omegasearch u no the 1 can u help as it is pi0988me off

sheriffdude

Logfile of HijackThis v1.97.7...........hope you can help me cheers

Scan saved at 13:49:27, on 16/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\slserv.exe
C:\PROGRA~1\FREESE~1\BIN\WIN2K\tidslmon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\System32\hphmon04.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\PROGRA~1\64PLAT~1\Hide Spam.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
E:\CD Eject Tool\CD Eject Tool.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Documents and Settings\sheriff\My Documents\My Received Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 8http://omegasearch.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://omegasearch.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = omegasearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://omegasearch.com/searchbar.html
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\FREESE~1\BIN\WIN2K\tidslmon.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\ScanSoft\NaturallySpeaking\Program\Ereg.exe" -r "C:\Program Files\ScanSoft\NaturallySpeaking\Program\ereg.ini"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Drv Burn] C:\PROGRA~1\64PLAT~1\Hide Spam.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [IncrediMail] D:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [CD Eject Tool] E:\CD Eject Tool\CD Eject Tool.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - D:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38125.4412037037
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://F:\SuperCD\IntraLaunch.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D655C9D3-24FF-45F1-9617-9134A9EA00D0}: NameServer = 195.92.195.94 195.92.195.95

i no the first 1ns well first 4 after that ..dont no have taken a few things out with no luck system restore is off ..and have taken the stuff out in safe mode so cheers if u can help the sheriffdude

shwaip

Please refrain from posting multiple threads about the same topic. Doing so will only PISS OFF the people who are here to help you.

Some of us are not on the forums all day, and, I, myself am generally only on after 5:30 at the earliest. Please be patient. We will attend to your problem as soon as we can.

I can see that you have spybot S&D installed. Have you also run adaware. Is spybot S&D version 1.3? All of this information would be helpful.


Read this thread:
http://www.short-media.com/forum/showthread.php?t=13628

Read this thread.
http://www.short-media.com/forum/showthread.php?t=14915

sheriffdude

yes i do have spybot 1.3 and yes should have left more info i also have bps spyware remover and yes adware all of these are up to dat plus hyjacker .have done all the stuff ..ie went to safe mode and removed all the stuff but there must be somthin that i have missed .so if some 1 could Please help that would be great and i was on here yesterday helping others to remove stuff from the right click menu in ie so i am not a leach and will help other when i can all the best sheriffdude ..ps i think england will lose 1 nile

sheriffdude

ok i no your all busy so i fixed it my self but thanks to all who had a look somtimes its better to do things your self then you learn more ..so i would say to others look and see the other threads but here is my info of what i took out and i say so far is working
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 8http://omegasearch.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://omegasearch.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = omegasearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://omegasearch.com/searchbar.html
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\SPYBOT~1\SDHelper.dll
and
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
and yes i no got the score wrong as england a re winning 1.0 so far

Dexter

First of all, please put Hijack This into it's own directory, (eg: c:\hijackthis or C:\HJT). When you use HijackThis to remove unwanted items, it creates backup files. If you ever mistakenly remove an item that you later discover you need, you can recover these items from the backup file. Having HijackThis.exe in its own folder gives these backup files a safe place to reside, and reduces clutter on your Desktop or My Documents folder.

Next, reboot in SAFE MODE.

Run HJT. Fix the following:



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = 8http://omegasearch.com/searchbar.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://omegasearch.com/searchbar.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = omegasearch.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://omegasearch.com/searchbar.html

O4 - HKLM\..\Run: [Drv Burn] C:\PROGRA~1\64PLAT~1\Hide Spam.exe

(Omegasearch files.)



R3 - Default URLSearchHook is missing

(Dead entry.)



O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll

(This is related tho the Twaintec hijack.)



O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup

(This is an auto-updater for programs from a company called Handybits. Apparently you can disable their auto-updater by following a link in this thread:

http://www.winguides.com/forums/showflat.php?Cat=&Board=brdVirus&Number=48877&page=14&view=collapsed&sb=5&part=

)


O4 - HKCU\..\Run: [CD Eject Tool] E:\CD Eject Tool\CD Eject Tool.exe

(Odd sounding name, and no matches on Google. If you know what it is, keep it, if it is unknown to you, I'd delete it, it doesn't seem to me that you would need a tool to eject a CD )


O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

(Dead startup link.)


Next, take these files:

E:\CD Eject Tool\CD Eject Tool.exe

C:\PROGRAM FILES\64PLAT~1\Hide Spam.exe (look for a folder whose name starts with "64PLAT."

C:\WINDOWS\mxTarget.dll


and move them to a new directory: C:\Quarantine. Then rename the .exe extension to .XXX and the .dll extension to .DDD. This effectively stops them from being re-run on your system, but saves them safely in case they turn out to be needed for something after all.


Reboot normally, and you should be clean. Run HJT again, post a fresh log for examination.

Dexter...