same item returning to hijack!

toxicgreentoxicgreen
edited February 2005 in Spyware & Virus Removal
hi there and thanks for reading my post. I've run adaware, all is good. Ran spybot, all is good, then i ran hijack and found this:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;imlive.com;www.weirdlinks.com;<local>
i keep fixing it and it keeps coming back! Is it a registry problem? :(

thank you for lookin at my log.
Toxicgreen :crazy:

Logfile of HijackThis v1.99.1
Scan saved at 10:11:32 AM, on 2/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ltmsg.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\MSN\MSNIA\msniasvc.exe
C:\Program Files\MSN\MSNIA\WA\ClientSideProxy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_director.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = http://msnmember.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;imlive.com;www.weirdlinks.com;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4FFB-8758-209B6AD74ACC} - C:\PROGRA~1\MICAC0~1\System\MNYVIE~1.DLL
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: View Original Image - C:\program files\msn\msnia\wa\getoriginal.htm
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://sc.communities.msn.com/controls/chat/msnchat42.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/r/neutral/controls/MsnPUpld.cab?5,0,1730,0
O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.logitech.com/companion/logitech/ver1.3.1.2083/bin/imvid.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A46FF49E-1C7A-4529-B97B-FE9132EAB2D7}: NameServer = 209.244.0.3 209.244.0.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{A46FF49E-1C7A-4529-B97B-FE9132EAB2D7}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

Comments

  • reelbigfishreelbigfish Boston, MA Member
    edited February 2005
    Spybot and adaware might not be enought. Are you doing all your scans in safemode with your system restore turned off? Also, try using Microsoft Anti-spyware and download a trial version of spysweeper from webroot. Just remember that MS Anti-spyware needs to be installed in regular mode. I use all 4 programs when a system continues to have problems. also scan with a second anti-virus like trendmicros housecall. that should remove anything that is sticking around.
  • toxicgreentoxicgreen
    edited February 2005
    hi again! Ok, i did all that you said, and ultimately the thing that worked is the spysweeper from webroot. It got rid of that pesky item and many more.
    Thanks Reel!!
    Gratefully,
    Toxic:zombie:
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited February 2005
    Is your problem then resolved?
  • toxicgreentoxicgreen
    edited February 2005
    <sigh> no, it's not resolved, i thought it was, but i did hijack again, and this:
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;imlive.com;www.weirdlinks.com;<local>
    keeps showing up on my Hijack log. When i go into safe mode, it does not show up on Hijack this.
    :(
    Dunno what to do now..
    thanks for any help Honey,
    Toxicgreen :tongue2:
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited February 2005
    Have you tried this?

    Place a checkmark next to these entries, close all browsers and windows, and have HijackThis fix them by clicking Fix Checked:

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = ;127.0.0.1;imlive.com;www.weirdlinks.com;<local>


    Reboot and post a new hijackthis log.
  • toxicgreentoxicgreen
    edited February 2005
    Hi there!
    Ok, i have used HJT numerous times and it keeps coming back. I have noticed something though doing what you said, After i close my browser, the item doesnt even show up, but when i go online, it shows up. :scratch:
    So i put a check and fixed it while online, ran a log, no sign of it, signed off, rebooted, went back online, there it was again!
    Ive run sooo many different programs....sheesh!
    Thanks for takin time with me,
    Toxic
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited February 2005
    Open Internet Explorer.

    Select Tools
    Select Internet Options...
    Select Connections
    Select LAN settings

    Do you see something like this in one of the boxes?

    127.0.0.1;imlive.com;www.weirdlinks.com;

    Uncheck the small box next to it and delete it from the box. Click Ok twice.

    Reboot and post a new hijackthis log.
  • toxicgreentoxicgreen
    edited February 2005
    Hi,
    I went to the Lan Settings and see nothing about Weirdlinks.com. But there is something that says: 127.0.0.1 Port 9022.
    Toxic
    Ok, im editing this post, because i went back to Lan settings, and clicked advanced and saw the item on the Proxy settings, under exceptions. Says Do not use proxy server for addresses beginning with: and then i see -;127.0.0.1;imlive.com;www.weirdlinks.com
    Above this, it says SERVERS. Then under PROXY ADDRESS TO USE, it says 127.0.01 Then under Port it says 9022. is this normal? I deleted the ;127.0.0.1;imlive.com;www.weirdlinks.com, fixed it from HJT, rebooted, and it was right back.
    The first gray box i see after clicking Lan Settings says: AUTOMATIC CONFIG or PROXY SERVER. Which is clicked on this menu? On mine, the Proxy server is clicked, also the bypass proxy for local address is clicked.
    Eagerly waiting to hear from you!!
    Toxic
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited February 2005
    That doesn't seem right, but you should check with your ISP to see if they require certain settings for your connection. They should be able to advise you of what should be there and what should not.
  • toxicgreentoxicgreen
    edited February 2005
    ok thank you,
    toxic
This discussion has been closed.