Options

Dumb Girl with a problem

Unknown
edited November 2004 in Spyware & Virus Removal
I have a problem trying to get this program off of my comp, it has to do with a websiteviewer. I cant just delete it of course. and it keeps kicking me offline... 124495.dlr.... what the hell is it?

thank you ahead of time for your replies :confused:

Comments

  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited November 2004
    Please post a full HiJackThis log.
  • Craven83
    edited November 2004
    lol...if you tell me what it is I can
  • Gadgetman53Gadgetman53 Alabama, U.S.
    edited November 2004
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip

    d/l it here.........and run it and paste the log in the forums where someone.......not me.....can help u.....i am waiting on a reply on my post
  • Gadgetman53Gadgetman53 Alabama, U.S.
    edited November 2004
    http://www.short-media.com/review.php?r=132
    This may help u some
  • Craven83
    edited November 2004
    Logfile of HijackThis v1.98.2
    Scan saved at 3:03:37 PM, on 11/21/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\WINDOWS\System32\cisvc.exe
    C:\WINDOWS\System32\navp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\System32\cidaemon.exe
    C:\Documents and Settings\Scooby\Local Settings\Temporary Internet Files\Content.IE5\8TAB0P2R\hijackthis[1]\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=127.0.0.1:1080
    O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com
    O1 - Hosts: 127.0.0.3 x.full-tgp.net
    O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
    O1 - Hosts: 127.0.0.3 autoescrowpay.com
    O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
    O1 - Hosts: 127.0.0.3 www.awmdabest.com
    O1 - Hosts: 127.0.0.3 www.sexfiles.nu
    O1 - Hosts: 127.0.0.3 awmdabest.com
    O1 - Hosts: 127.0.0.3 sexfiles.nu
    O1 - Hosts: 127.0.0.3 allforadult.com
    O1 - Hosts: 127.0.0.3 www.allforadult.com
    O1 - Hosts: 127.0.0.3 www.iframe.biz
    O1 - Hosts: 127.0.0.3 iframe.biz
    O1 - Hosts: 127.0.0.3 www.newiframe.biz
    O1 - Hosts: 127.0.0.3 newiframe.biz
    O1 - Hosts: 127.0.0.3 www.vesbiz.biz
    O1 - Hosts: 127.0.0.3 vesbiz.biz
    O1 - Hosts: 127.0.0.3 www.pizdato.biz
    O1 - Hosts: 127.0.0.3 pizdato.biz
    O1 - Hosts: 127.0.0.3 www.aaasexypics.com
    O1 - Hosts: 127.0.0.3 aaasexypics.com
    O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
    O1 - Hosts: 127.0.0.3 virgin-tgp.net
    O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll
    O2 - BHO: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll
    O2 - BHO: BHO Class - {CBEFB350-ED5B-4115-B846-C1041676B388} - C:\WINDOWS\System32\CustIE32.dll
    O3 - Toolbar: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
    O4 - HKLM\..\Run: [cvmonitor.exe] cvmonitor.exe
    O4 - HKLM\..\Run: [navp.exe] navp.exe
    O4 - HKLM\..\Run: [Microsoft System Checkup] wnetlogin.exe
    O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
    O4 - HKLM\..\Run: [MsnServices] svcsp.exe
    O4 - HKLM\..\Run: [spolsv] spolsv.exe
    O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
    O4 - HKLM\..\Run: [MSOffice] C:\WINDOWS\System32\MSOffice\services.exe
    O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
    O4 - HKLM\..\RunServices: [cvmonitor.exe] cvmonitor.exe
    O4 - HKLM\..\RunServices: [navp.exe] navp.exe
    O4 - HKLM\..\RunServices: [Microsoft System Checkup] wnetlogin.exe
    O4 - HKLM\..\RunServices: [MsnServices] svcsp.exe
    O4 - HKLM\..\RunServices: [spolsv] spolsv.exe
    O4 - HKCU\..\Run: [SysTime] C:\WINDOWS\System32\systime.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9CF88962-ADE8-49B1-B73E-31FA725B25AC}: NameServer = 205.188.146.146



    I dont know what the heck this stuff is!!! looks like prono crapola!!! help me please! :bawling:
  • Omatic810Omatic810 Gainesville, FL
    edited November 2004
    Put a checkmark next to all of the following, then hit "Fix Checked". Then re-scan afterward, and post the new log here, or on a new thread.

    Note: You really don't have to tell us if you're smart, dumb, male, female, homosexual, mutant, or Republican. We're here trying to kill spyware, not judge people, you dumb girl. =P

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = socks=127.0.0.1:1080
    O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com
    O1 - Hosts: 127.0.0.3 x.full-tgp.net
    O1 - Hosts: 127.0.0.3 counter.sexmaniack.com
    O1 - Hosts: 127.0.0.3 autoescrowpay.com
    O1 - Hosts: 127.0.0.3 www.autoescrowpay.com
    O1 - Hosts: 127.0.0.3 www.awmdabest.com
    O1 - Hosts: 127.0.0.3 www.sexfiles.nu
    O1 - Hosts: 127.0.0.3 awmdabest.com
    O1 - Hosts: 127.0.0.3 sexfiles.nu
    O1 - Hosts: 127.0.0.3 allforadult.com
    O1 - Hosts: 127.0.0.3 www.allforadult.com
    O1 - Hosts: 127.0.0.3 www.iframe.biz
    O1 - Hosts: 127.0.0.3 iframe.biz
    O1 - Hosts: 127.0.0.3 www.newiframe.biz
    O1 - Hosts: 127.0.0.3 newiframe.biz
    O1 - Hosts: 127.0.0.3 www.vesbiz.biz
    O1 - Hosts: 127.0.0.3 vesbiz.biz
    O1 - Hosts: 127.0.0.3 www.pizdato.biz
    O1 - Hosts: 127.0.0.3 pizdato.biz
    O1 - Hosts: 127.0.0.3 www.aaasexypics.com
    O1 - Hosts: 127.0.0.3 aaasexypics.com
    O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
    O1 - Hosts: 127.0.0.3 virgin-tgp.net
    O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll
    O2 - BHO: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll
    O2 - BHO: BHO Class - {CBEFB350-ED5B-4115-B846-C1041676B388} - C:\WINDOWS\System32\CustIE32.dll
    O3 - Toolbar: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar3_28.dll
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9CF88962-ADE8-49B1-B73E-31FA725B25AC}: NameServer = 205.188.146.146
  • Omatic810Omatic810 Gainesville, FL
    edited November 2004
    Also, one more thing. STOP USING INTERNET EXPLORER, and use either Opera, or Mozilla Firefox (<-- Better!). You can avoid some future frustration that way.

    Opera is found @ www.opera.com

    Firefox is found @ http://www.mozilla.org/products/firefox/

    Download one (or both) of them, and use them as your default browser.
  • Gadgetman53Gadgetman53 Alabama, U.S.
    edited November 2004
    yes love firefox........no security risks compared to IE and NO POPUPS!!!!!!!1
  • Craven83
    edited November 2004
    when i downloaded hijackthis the program wont stay in front it keeps hiding itself and wont show long enough for me to click on scan.... Ill click the icon, itll show for like 1:100 of a second and disappear....
  • Craven83
    edited November 2004
    Okay I can run hijackthis in safe mode, I erased some things that needed to be erased, but the thing is, is that I cant copy it and paste my new hijackthis log on here in safe mode, or even to notepad or anything..... but even after I did this, I still am having problems....


    dont give up on me.
  • Omatic810Omatic810 Gainesville, FL
    edited November 2004
    Your problems may expand beyond spyware (although it started that way). I don't know how to help you out (unless you can give me technical data) without personally looking at the system. The clean-cut and surefire easy way to do it is to do the following:

    1) Make a startup disk, or just insert the Windows CD and boot from there
    2) Go the the command prompt (where it has "C:\WINDOWS>")
    3) Type these in exactly as they are here: (without quotes)
    "cd .."
    "RD C:\WINDOWS\system32"

    - if that doesnt work, do this:

    "cd .."
    "del C:\WINDOWS\system32"

    4) Reinstall Windows

    *NOTE: READ THIS*
    This WILL delete your system32 folder, meaning Windows WILL NOT WORK until you reinstall the entire operating system. However, there is a good chance that the problem is in that System32 folder, so deleting it may give you a second chance.

    You may want to hold off on doing that, and make it your last resort. I'm not a Windows Guru, so I can't tell you what files exactly to delete. Maybe someone else here can do that for ya.
  • DexterDexter Vancouver, BC Canada
    edited November 2004
    Do not reinstall Windows yet. You have been given some good advice, but also some bad advice in this thread, some of the items you have been told to remove were actually good items (the HOSTS entries.)


    Please post a new HJT log for review. I am subscribing to your thread so I will know when you reply, and will get back to you more quickly than you have been so far. Sorry for the wait, it has been busy in this area.

    Dexter...

    Moderator,
    Short-Media Security Forums
  • Craven83
    edited November 2004
    Okay dexter, Ill do it, I still have to go into sleep mode to make hijackthis work. plus Im still getting kicked offline a lot.
  • TroganTrogan London, UK
    edited November 2004
    Sleep mode? You mean Safe Mode!? :)

    Just wondering, have you used Ad-Aware SE and Spybot Search & Destroy 1.3? If not, you can download them from here here. See if HijackThis works in normal after scaning.

    If it doesn't, go into safe mode, scan and save the HJT log on your desktop, reboot into normal mode and then post the Log.

    :)
  • Craven83
    edited November 2004
    yes I meant safe sorry. and yes Ive ran ad aware but dont have the money to buy the program, so I guess Im stuck. heres my new log


    Logfile of HijackThis v1.98.2
    Scan saved at 3:43:55 PM, on 11/28/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\Tan\Desktop\hijackthis\HijackThis.exe

    O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
    O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
    O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9CF88962-ADE8-49B1-B73E-31FA725B25AC}: NameServer = 198.81.16.134
  • SpywareShooterSpywareShooter 127.0.0.1
    edited November 2004
    O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
    O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe

    Fix those entries then find and delete syslog32.exe and libsysmgr.exe, reboot and post a new log.
  • DexterDexter Vancouver, BC Canada
    edited November 2004
    Spybot S&D and Ad-Aware are FREE, just download them from our download site (link is in my signature, install and use as per the instructions in the link above titled Steps To Take Before Posting a Hijack This Log.


    Now, the fixes SpywareShooter just mentioned are good, but there are a couple more, plus a few other things I want you to do to ensure this gets cleaned. You may want to print these instructions out for easy reference. Start with this....


    Go to our Security Downloads section and download LSP-Fix.



    Please make sure that HijackThis.exe is in its own folder, as explained here.

    When you have done that, I want you to put LSP-Fix into the same folder.

    Set your system to Show Hidden Files and folders.

    For Windows XP or ME, Disable System Restore.

    Reboot into Safe Mode.


    Run Hijack This. FIX THE FOLLOWING:

    **************



    O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)

    O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
    O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
    O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe

    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by New.Net


    Exit HJT, stay in Safe mode, manually locate the exe and dll files:

    libsysmgr.exe
    syslog32.exe

    You should be able to view their full location from HJT, if not, do a search for them. When you find each one, quarantine them.

    Next, still in Safe Mode, run the program LSP-Fix. Fix any entries that say "New.Net."


    Reboot normally, check things out, and come back to let us know how it turned out. See if you can run HJT in Normal Mode. If you can, we have made progress. Then, run Spybot S&D and Ad Aware as per the instructions in the link I mentioned above. Then post a fresh HJT log for review. If things looks clean, re-enable your system restore and set a new restore point.

    Dexter...
Sign In or Register to comment.