mysearchnow www.afl.com.au

www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
edited October 2004 in Spyware & Virus Removal
hey ive had this for some time now, along with the other ones, lop, and searchweb2

Ive done everything the guidlines have told me, updated spybot search and destroy 1.3, and adaware se edition. And i have installed the program cws shredder, and hijack this. I then put hijack this into its own folder.

here is the log

much appreciated guys :)


Logfile of HijackThis v1.98.2
Scan saved at 3:38:06 PM, on 10/16/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\avgserv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Messenger Plus! 3\MsgPlus.exe
D:\Dont Delete\AVGNT.EXE
C:\WINDOWS\system32\rundll32.exe
D:\avgcc32.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
d:\PROGRA~1\GoGoData.com\GOGODA~1\ADBUST~1.EXE
d:\Program Files\GoGoData.com\GoGoData AdBuster\GoGoTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
d:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Bradley\LOCALS~1\Temp\Rar$EX00.750\HijackThis.exe
C:\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nukezone.nu/
O2 - BHO: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "d:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Dont Delete\AVGNT.EXE /min
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [AVG_CC] D:\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [MessengerPlus3] "d:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [delete error] C:\DOCUME~1\Bradley\APPLIC~1\SETUPN~1\Uploadpokefive.exe
O9 - Extra button: (no name) - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O9 - Extra 'Tools' menuitem: GoGoData AdBuster - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097409648565
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D892ED9E-A3BE-4AB2-A7BE-4D30D109CE68}: NameServer = 203.134.17.90 211.26.25.90



Whoever made this little thing, is an absolute genius i think!! If only theyd use their computer knowledge in a constructive way!

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    You have 2 instances of hijackthis running. One from a temp folder & the other from a permanent one. Make sure you do any fixing using the one in the permanent folder :).

    Uninstall New.net from add remove programs first of all. If you cannot do that, go here; http://www.newdotnet.com/#remove & scroll down to the uninstall tool.

    Uninstall Messenger Plus as it comes bundled with LOP. You can re-install it without the sponsor.
    Click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:
    http://members.rogers.com/rjmac/new_uninstall.exe
    Let me know how you go.

    Carn the Eagles!!

    Would you believe I'm just South of you :).
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    lol wicked

    whereabouts?

    thanks for ya help man bout to reboot ill post the new log after
    cheers
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    Mandurah.
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    Logfile of HijackThis v1.98.2
    Scan saved at 5:23:47 PM, on 10/16/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\avgserv.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    D:\Dont Delete\AVGNT.EXE
    D:\avgcc32.exe
    C:\Program Files\Messenger\msmsgs.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Hijack This\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nukezone.nu/
    O2 - BHO: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: GoGoData AdBuster - {3EB9C349-7473-48AC-A59B-42F31751974B} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVGCtrl] D:\Dont Delete\AVGNT.EXE /min
    O4 - HKLM\..\Run: [AVG_CC] D:\avgcc32.exe /STARTUP
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [delete error] C:\DOCUME~1\Bradley\APPLIC~1\SETUPN~1\Uploadpokefive.exe
    O9 - Extra button: (no name) - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
    O9 - Extra 'Tools' menuitem: GoGoData AdBuster - {7B6E4BB4-8464-47CF-9A5B-F82F6B408A6E} - d:\PROGRA~1\GoGoData.com\GOGODA~1\TOMAHA~1.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097409648565
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D892ED9E-A3BE-4AB2-A7BE-4D30D109CE68}: NameServer = 203.134.17.90 211.26.25.90



    im up in port kennedy
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    Was there last Saturday attending a wedding :). Nice area.
    This looks like a LOP entry;
    O4 - HKCU\..\Run: [delete error] C:\DOCUME~1\Bradley\APPLIC~1\SETUPN~1\Uploadpokefi ve.exe
    What is the name of the folder that Uploadpokefive.exe is in?
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    C:/documents and settings/bradley/application data/setupnewfilm
    C:/documents and settings/danny/application data/setupnewfilm
    C:/documents and settings/kristy/application data/setupnewfilm
    C:/windows/prefetch

    yeh port kennedys alright, all the low lifes startin to make it look bad, grafitti and stuff
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    If Uploadpokefi ve.exe is the only file there, delete the folder(s) after first fixing the file with hijackthis. You will have to reboot (possibly into safe mode) after the hijackthis fix, to delete the folder.
    Also, do all of the above on each user account to be certain it's gone.
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    aite thanks alot for your help man much appreciated
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    No worries :).
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    hey does this look alright now?

    cheers

    Logfile of HijackThis v1.98.2
    Scan saved at 12:30:15 AM, on 10/17/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\avgserv.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    D:\Dont Delete\AVGNT.EXE
    D:\avgcc32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\mozilla.org\Mozilla\mozilla.exe
    C:\Hijack This\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nukezone.nu/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVGCtrl] D:\Dont Delete\AVGNT.EXE /min
    O4 - HKLM\..\Run: [AVG_CC] D:\avgcc32.exe /STARTUP
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097409648565
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D892ED9E-A3BE-4AB2-A7BE-4D30D109CE68}: NameServer = 203.134.17.90 211.26.25.90
  • www-afl-com-auwww-afl-com-au Rockingham, Perth, WA, Australia
    edited October 2004
    whoa i just saw that o17 goddam theyre sneaky aye
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    Log is good. The 017 refers to your ISP. Guess you are on with Bigpond?
Sign In or Register to comment.