Home Search Spyware

It is solved. Thanks all.
Helpout

Comments

  • SpywareShooterSpywareShooter 127.0.0.1
    edited November 2004
    Upgrade to Hijackthis version 1.98.2 and post a new log. Also don't reboot or use Internet Explorer (use Mozilla or Firefox instead) until I say your log is OK.
  • SpywareShooterSpywareShooter 127.0.0.1
    edited November 2004
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\uxsor.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://seek.3721.com/srchcust.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {DCDD6F23-07CA-0397-1202-16E43F6FA514} - C:\WINDOWS\apiph.dll
    O4 - HKLM\..\Run: [windows auto update] msblast.exe
    O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
    O4 - HKLM\..\Run: [xioblk] C:\WINDOWS\System32\hckugx.exe
    O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
    O4 - HKLM\..\Run: [sysal32.exe] C:\WINDOWS\system32\sysal32.exe
    O4 - HKCU\..\Run: [Ncao] C:\Documents and Settings\Default\Application Data\urpo.exe
    O4 - HKCU\..\Run: [Xwmexxi] C:\WINDOWS\System32\d?dplay.exe
    O15 - Trusted Zone: *.05p.com
    O15 - Trusted Zone: *.clickspring.net
    O15 - Trusted Zone: *.mt-download.com
    O15 - Trusted Zone: *.my-internet.info
    O15 - Trusted Zone: *.scoobidoo.com
    O15 - Trusted Zone: *.searchbarcash.com
    O15 - Trusted Zone: *.searchmiracle.com

    Fix those entries then find and delete the following files:
    C:\WINDOWS\system32\uxsor.dll
    C:\WINDOWS\apiph.dll
    msblast.exe
    C:\Program Files\Windows AdControl\
    C:\WINDOWS\System32\hckugx.exe
    C:\PROGRA~1\3721\helper.dll
    C:\WINDOWS\system32\sysal32.exe
    C:\Documents and Settings\Default\Application Data\urpo.exe
    C:\WINDOWS\System32\d?dplay.exe
    C:\WINDOWS\system32\atlzd32.exe

    Then pull the plug on your computer and post a new log.
  • edited November 2004
    Hello all,
    I followed the instruction given in the link below step by step. And I think I fixed the problem. Thank you guys so much. I strongly support this forum.
    http://www.short-media.com/forum/showthread.php?t=18846

    Helpout
This discussion has been closed.