Options
Can you help me? my HJT file
Hi,
ive spend hours trying to fix this. I guess im infected by the home assistent and webshopper stuff. Ive tried it all, removing the lines in safe modus,deleting the corrup dll files but it keeps coming back with all the pop-ups. I hope that someone wants to help me on this one. Here is mij log:
ogfile of HijackThis v1.98.2
Scan saved at 17:52:54, on 22-10-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\EUSEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\IPVP.EXE
C:\WINDOWS\APILS32.EXE
C:\WINDOWS\SYSTEM\SDKSO32.EXE
C:\WINDOWS\JAVAUF32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\NETBZ.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\SMC\EZ CONNECT WIRELESS USB\WLANMONITOR.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\SYSLT.EXE
C:\WINDOWS\DESKTOP\JELLE\CWSHREDDER.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\IPLJ32.EXE
C:\WINDOWS\SYSTEM\SDKSO32.EXE
C:\WINDOWS\SYSTEM\IPER32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\IPLJ32.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\DESKTOP\JELLE\HIJACKTHIS.EXE
C:\WINDOWS\SDKKT.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\acirh.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\acirh.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {653BCE2A-C674-B057-4F70-C72D99D52E04} - C:\WINDOWS\SYSHA32.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ICH Synth] eusexe.exe
O4 - HKLM\..\RunServices: [IPVP.EXE] C:\WINDOWS\IPVP.EXE
O4 - HKLM\..\RunServices: [APILS32.EXE] C:\WINDOWS\APILS32.EXE
O4 - HKLM\..\RunServices: [JAVAUF32.EXE] C:\WINDOWS\JAVAUF32.EXE
O4 - HKLM\..\RunServices: [NETBZ.EXE] C:\WINDOWS\NETBZ.EXE
O4 - HKLM\..\RunServices: [SDKSO32.EXE] C:\WINDOWS\SYSTEM\SDKSO32.EXE
O4 - HKLM\..\RunServices: [NETXE.EXE] C:\WINDOWS\SYSTEM\NETXE.EXE
O4 - HKLM\..\RunServices: [SYSLT.EXE] C:\WINDOWS\SYSTEM\SYSLT.EXE
O4 - HKLM\..\RunServices: [IPLJ32.EXE] C:\WINDOWS\SYSTEM\IPLJ32.EXE
O4 - HKLM\..\RunServices: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\RunServices: [SDKKT.EXE] C:\WINDOWS\SDKKT.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: EZ Connect Wireless USB Utility.lnk = C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
So thats it, i tried fixing the corrupt lines with search toolbar in it, in safe modus but it doesnt work. I hope someone know the solution to this nightmare.
Greetz Jan
ive spend hours trying to fix this. I guess im infected by the home assistent and webshopper stuff. Ive tried it all, removing the lines in safe modus,deleting the corrup dll files but it keeps coming back with all the pop-ups. I hope that someone wants to help me on this one. Here is mij log:
ogfile of HijackThis v1.98.2
Scan saved at 17:52:54, on 22-10-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\EUSEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\IPVP.EXE
C:\WINDOWS\APILS32.EXE
C:\WINDOWS\SYSTEM\SDKSO32.EXE
C:\WINDOWS\JAVAUF32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\NETBZ.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\SMC\EZ CONNECT WIRELESS USB\WLANMONITOR.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\SYSLT.EXE
C:\WINDOWS\DESKTOP\JELLE\CWSHREDDER.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\SYSTEM\IPLJ32.EXE
C:\WINDOWS\SYSTEM\SDKSO32.EXE
C:\WINDOWS\SYSTEM\IPER32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\IPLJ32.EXE
C:\WINDOWS\SYSTEM\NETXE.EXE
C:\WINDOWS\DESKTOP\JELLE\HIJACKTHIS.EXE
C:\WINDOWS\SDKKT.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\acirh.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\acirh.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\acirh.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {653BCE2A-C674-B057-4F70-C72D99D52E04} - C:\WINDOWS\SYSHA32.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ICH Synth] eusexe.exe
O4 - HKLM\..\RunServices: [IPVP.EXE] C:\WINDOWS\IPVP.EXE
O4 - HKLM\..\RunServices: [APILS32.EXE] C:\WINDOWS\APILS32.EXE
O4 - HKLM\..\RunServices: [JAVAUF32.EXE] C:\WINDOWS\JAVAUF32.EXE
O4 - HKLM\..\RunServices: [NETBZ.EXE] C:\WINDOWS\NETBZ.EXE
O4 - HKLM\..\RunServices: [SDKSO32.EXE] C:\WINDOWS\SYSTEM\SDKSO32.EXE
O4 - HKLM\..\RunServices: [NETXE.EXE] C:\WINDOWS\SYSTEM\NETXE.EXE
O4 - HKLM\..\RunServices: [SYSLT.EXE] C:\WINDOWS\SYSTEM\SYSLT.EXE
O4 - HKLM\..\RunServices: [IPLJ32.EXE] C:\WINDOWS\SYSTEM\IPLJ32.EXE
O4 - HKLM\..\RunServices: [IPER32.EXE] C:\WINDOWS\SYSTEM\IPER32.EXE
O4 - HKLM\..\RunServices: [SDKKT.EXE] C:\WINDOWS\SDKKT.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: EZ Connect Wireless USB Utility.lnk = C:\Program Files\SMC\EZ Connect Wireless USB\WlanMonitor.exe
O4 - Startup: Office Opstarten.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office Snelzoeken.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
So thats it, i tried fixing the corrupt lines with search toolbar in it, in safe modus but it doesnt work. I hope someone know the solution to this nightmare.
Greetz Jan
0