Clon.biz and Error#317

Unknown
edited April 2005 in Spyware & Virus Removal
Hey guys, I'm new to this and seem to have a problem that I can't get rid of. Whenever I boot up Internet Explorer my homepage defaults to some Russian site, Clon.biz and I get an Error #317 message saying that my machine is infected with adware. Even if I reset my homepage to be yahoo, and hit the home button in Explorer I always go back to Clon.biz. I've run Spybot and Norton and both scans come up clean.

I've also deleted sysinit32m.exe from my machine as suggested by other but now when my machine boots up I get a message saying that the file sysinit32m.exe can't be found. I guess that there's something in the registry that is requested the file but I don't have a clue where to look.

Any help that could be given is much appreciated

(Added 19th April)
In addition I have run Ad-Aware and have managed to remove the sysinit32m.exe problem, or so it would appear. And I have had chance to run HijackThis, below is the log file that was created. Once again any help would be greatly appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 19:08:07, on 19/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Washer\washer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.co.uk
R3 - Default URLSearchHook is missing
O1 - Hosts: 209.123.181.91 ad0.bigmir.net
O1 - Hosts: 209.123.181.91 ad7.bigmir.net
O1 - Hosts: 209.123.181.91 ad4.bigmir.net
O1 - Hosts: 209.123.181.91 ad2.bigmir.net
O1 - Hosts: 209.123.181.91 b468.abn.com.ua
O1 - Hosts: 209.123.181.91 b100.abn.com.ua
O1 - Hosts: 209.123.181.91 b120.abn.com.ua
O1 - Hosts: 209.123.181.91 b160.abn.com.ua
O1 - Hosts: 209.123.181.91 b600.abn.com.ua
O1 - Hosts: 209.123.181.91 banner.kiev.ua
O1 - Hosts: 209.123.181.91 ab.adpro.com.ua
O1 - Hosts: 209.123.181.91 bs.yandex.ru
O1 - Hosts: 209.123.181.91 ad2.rambler.ru
O1 - Hosts: 209.123.181.91 ad.rambler.ru
O1 - Hosts: 209.123.181.91 ad1.rambler.ru
O1 - Hosts: 209.123.181.91 global.msads.net
O1 - Hosts: 209.123.181.91 ad.adriver.ru
O1 - Hosts: 209.123.181.91 ad.gen.tbn.ru
O1 - Hosts: 209.123.181.91 ad.100-gen.tbn.ru
O1 - Hosts: 209.123.181.91 ad.tbn.ru
O1 - Hosts: 209.123.181.91 ad.clickhere.ru
O1 - Hosts: 209.123.181.91 rb2.design.ru
O1 - Hosts: 209.123.181.91 ad.strict.tbn.ru
O1 - Hosts: 209.123.181.91 ad.bannerbank.ru
O1 - Hosts: 209.123.181.91 ad.100.tbn.ru
O1 - Hosts: 209.123.181.91 ad4.lbn.ru
O1 - Hosts: 209.123.181.91 ad.text.tbn.ru
O1 - Hosts: 209.123.181.91 ad2.bannerbank.ru
O1 - Hosts: 209.123.181.91 ad4.bannerbank.ru
O1 - Hosts: 209.123.181.91 r.mail.ru
O1 - Hosts: 209.123.181.91 ad100.prbn.ru
O1 - Hosts: 209.123.181.91 ushki.caricatura.ru
O1 - Hosts: 209.123.181.91 d.clx.ru
O1 - Hosts: 209.123.181.91 link.link.ru
O1 - Hosts: 209.123.181.91 s1.adward.ru
O1 - Hosts: 209.123.181.91 s.clx.ru
O1 - Hosts: 209.123.181.91 adv.aport.ru
O1 - Hosts: 209.123.181.91 softbn.ru
O1 - Hosts: 209.123.181.91 ad6.bannerbank.ru
O1 - Hosts: 209.123.181.91 ar.atwola.com
O1 - Hosts: 0
O1 - Hosts: 69.50.173.4 lycos.com
O1 - Hosts: 69.50.173.4 amazon.com
O1 - Hosts: 69.50.173.4 www.amazon.com
O1 - Hosts: 69.50.173.4 aol.com
O1 - Hosts: 69.50.173.4 www.aol.com
O1 - Hosts: 69.50.173.4 earthlink.net
O1 - Hosts: 69.50.173.4 www.earthlink.net
O1 - Hosts: 69.50.173.4 ebay.com
O1 - Hosts: 69.50.173.4 www.ebay.com
O1 - Hosts: 69.50.173.4 go.com
O1 - Hosts: 69.50.173.4 www.go.com
O1 - Hosts: 69.50.173.4 icq.com
O1 - Hosts: 69.50.173.4 www.icq.com
O1 - Hosts: 69.50.173.4 lycos.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please download CWShredder but don't run it yet.
    http://cwshredder.net/bin/CWSInstall.exe


    Download Ad-aware SE 1.05 from: http://www.majorgeeks.com/download506.html
    Install the program and launch it. First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files. Exit Adaware for now.


    Make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
    R3 - Default URLSearchHook is missing
    O1 - Hosts: 209.123.181.91 ad0.bigmir.net
    O1 - Hosts: 209.123.181.91 ad7.bigmir.net
    O1 - Hosts: 209.123.181.91 ad4.bigmir.net
    O1 - Hosts: 209.123.181.91 ad2.bigmir.net
    O1 - Hosts: 209.123.181.91 b468.abn.com.ua
    O1 - Hosts: 209.123.181.91 b100.abn.com.ua
    O1 - Hosts: 209.123.181.91 b120.abn.com.ua
    O1 - Hosts: 209.123.181.91 b160.abn.com.ua
    O1 - Hosts: 209.123.181.91 b600.abn.com.ua
    O1 - Hosts: 209.123.181.91 banner.kiev.ua
    O1 - Hosts: 209.123.181.91 ab.adpro.com.ua
    O1 - Hosts: 209.123.181.91 bs.yandex.ru
    O1 - Hosts: 209.123.181.91 ad2.rambler.ru
    O1 - Hosts: 209.123.181.91 ad.rambler.ru
    O1 - Hosts: 209.123.181.91 ad1.rambler.ru
    O1 - Hosts: 209.123.181.91 global.msads.net
    O1 - Hosts: 209.123.181.91 ad.adriver.ru
    O1 - Hosts: 209.123.181.91 ad.gen.tbn.ru
    O1 - Hosts: 209.123.181.91 ad.100-gen.tbn.ru
    O1 - Hosts: 209.123.181.91 ad.tbn.ru
    O1 - Hosts: 209.123.181.91 ad.clickhere.ru
    O1 - Hosts: 209.123.181.91 rb2.design.ru
    O1 - Hosts: 209.123.181.91 ad.strict.tbn.ru
    O1 - Hosts: 209.123.181.91 ad.bannerbank.ru
    O1 - Hosts: 209.123.181.91 ad.100.tbn.ru
    O1 - Hosts: 209.123.181.91 ad4.lbn.ru
    O1 - Hosts: 209.123.181.91 ad.text.tbn.ru
    O1 - Hosts: 209.123.181.91 ad2.bannerbank.ru
    O1 - Hosts: 209.123.181.91 ad4.bannerbank.ru
    O1 - Hosts: 209.123.181.91 r.mail.ru
    O1 - Hosts: 209.123.181.91 ad100.prbn.ru
    O1 - Hosts: 209.123.181.91 ushki.caricatura.ru
    O1 - Hosts: 209.123.181.91 d.clx.ru
    O1 - Hosts: 209.123.181.91 link.link.ru
    O1 - Hosts: 209.123.181.91 s1.adward.ru
    O1 - Hosts: 209.123.181.91 s.clx.ru
    O1 - Hosts: 209.123.181.91 adv.aport.ru
    O1 - Hosts: 209.123.181.91 softbn.ru
    O1 - Hosts: 209.123.181.91 ad6.bannerbank.ru
    O1 - Hosts: 209.123.181.91 ar.atwola.com
    O1 - Hosts: 0
    O1 - Hosts: 69.50.173.4 lycos.com
    O1 - Hosts: 69.50.173.4 amazon.com
    O1 - Hosts: 69.50.173.4 www.amazon.com
    O1 - Hosts: 69.50.173.4 aol.com
    O1 - Hosts: 69.50.173.4 www.aol.com
    O1 - Hosts: 69.50.173.4 earthlink.net
    O1 - Hosts: 69.50.173.4 www.earthlink.net
    O1 - Hosts: 69.50.173.4 ebay.com
    O1 - Hosts: 69.50.173.4 www.ebay.com
    O1 - Hosts: 69.50.173.4 go.com
    O1 - Hosts: 69.50.173.4 www.go.com
    O1 - Hosts: 69.50.173.4 icq.com
    O1 - Hosts: 69.50.173.4 www.icq.com
    O1 - Hosts: 69.50.173.4 lycos.com
    O15 - Trusted Zone: *.crazywinnings.com
    O15 - Trusted Zone: *.slotchbar.com
    O15 - Trusted Zone: *.windupdates.com
    O15 - Trusted Zone: *.crazywinnings.com (HKLM)
    O15 - Trusted Zone: *.skoobidoo.com (HKLM)
    O15 - Trusted Zone: *.slotchbar.com (HKLM)
    O15 - Trusted Zone: *.windupdates.com (HKLM)


    Reboot your computer into Safe Mode


    Now run CWShredder, making sure to click "Fix".


    Delete temp files

    Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Navigate to the C:\Windows\Prefetch folder. Open the Prefetch folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Prefetch folder.

    Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.

    Empty the Recycle Bin.



    Run a full scan with Adaware.

    Reboot your computer to go back to normal mode and post a new log.
  • Nobby
    edited April 2005
    Sam, thanks for the info. I've carried out the tasks that you have suggested and attached is the new HijackThis log file. clon.biz is still my home page! What's the next move? Thanks again for all your help

    Logfile of HijackThis v1.99.1
    Scan saved at 19:14:06, on 20/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\mHotkey.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Washer\washer.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.co.uk
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
    O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Ok, let's take a closer look with a couple of new log files.

    Please download DLLCompare from here (unless you have downloaded it previously) http://downloads.subratam.org/DllCompare.exe

    *Save it to your desktop and run it.
    *Click 'Run Locate.com'to scan.
    *When the scan has completed, click 'Compare'.
    *When completed, click "Make a Log of What Was Found".
    *Please Copy/Paste the entire contents of the logfile to this thread.

    Note: If you get an error after pressing Run Locate.com:
    copy autoexec.nt from c:\windows\repair\ folder to c:\windows\system32\ folder.



    Download rkfiles.zip
    http://skads.org/special/rkfiles.zip
    Unzip the contents to a permanent folder.

    Reboot your computer into Safe Mode


    Doubleclick rkfiles.bat
    It will scan for a while, so please be patient.
    Wait till the DOS window closes and reboot back to normal mode.

    Post the contents of C:\log.txt in your next reply.
  • Nobby
    edited April 2005
    Sam, once again thanks for the help. I don't know if it makes any difference but after a couple of minutes of my computer being logged on, but not dialed in to the internet, an IE window automatically opens and tries to load clon.biz. I don't know if this makes any difference to what we are doing!

    Anyway, here are the three log files that have been created, I ran HijackThis and have included that log file as well - not sure if you need that!

    DLLCompare log:
    * DLLCompare Log version(1.0.0.127)
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    O^E says: "There were no files found :)"
    ________________________________________________

    1,315 items found: 1,315 files, 0 directories.
    Total of file sizes: 282,989,929 bytes 269.88 M

    Administrator Account = True
    End log

    rkfiles log:
    C:\Documents and Settings\Steve Robinson\My Documents\Misc\New Stuff

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Files Found in system Folder............
    C:\WINDOWS\system32\ole32vbs.exe: FSG!
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\oembios.bin: peC2"y)Q

    Files Found in all users startup Folder............
    Files Found in all users windows Folder............
    C:\WINDOWS\msxmidi.exe: UPX!
    C:\WINDOWS\unwash.exe: UPX!
    Finished
    bye

    And finally the HJT log:
    Logfile of HijackThis v1.99.1
    Scan saved at 18:14:22, on 21/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\mHotkey.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Washer\washer.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.co.uk
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
    O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Download Killbox from here.
    http://www.downloads.subratam.org/KillBox.zip

    Run KillBox, select the option: Replace on Reboot
    Then, in the Full Path of File to Delete box, copy and paste this entry:

    C:\WINDOWS\system32\ole32vbs.exe

    Select the option: Use Dummy
    Press the button with a red circle and a white X (Delete File button)
    Click Yes at the Replace on Reboot confirmation prompt.
    Click No at the request to reboot.

    Finally, in the Full Path of File to Delete, copy and paste the following:

    C:\WINDOWS\msxmidi.exe

    Press the button with a red circle and a white X.
    Click Yes at the Replace on Reboot prompt.
    Click Yes at the request to reboot.

    On this last file, close KillBox and Notepad, and Reboot the computer!!


    Please post a new rfiles log and hijackthis log. Let me know if you notice any difference in how things are working.
  • Nobby
    edited April 2005
    OK, I've run the killbox scan, although I just want to clarify that I set it up right. I put the file name into the Full Path of File to Delete box and then selected the Replace on Reboot option which allowed me to select the Use Dummy option. The first prompt was did I want to delete the file, I selected Yes for both files and then No on the first reboot prompt and Yes on the second Reboot prompt.

    There doesn't appear to be any change in the way thinks are working. Thanks for all your help.

    Here are the two log files as requested, first from rkfiles:
    C:\Documents and Settings\Steve Robinson\My Documents\Misc\New Stuff

    PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
    Files Found in system Folder............
    C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
    C:\WINDOWS\system32\oembios.bin: peC2"y)Q

    Files Found in all users startup Folder............
    Files Found in all users windows Folder............
    C:\WINDOWS\unwash.exe: UPX!
    Finished
    bye


    And from HJT:
    Logfile of HijackThis v1.99.1
    Scan saved at 18:25:12, on 22/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\mHotkey.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Washer\washer.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.co.uk
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
    O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Fix this line with Hijackthis.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz


    Get an online virus scan from this site and post the report when it completes.

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm


    Reboot and post a new hijackthis log.
  • Nobby
    edited April 2005
    Right, I've run the online scan and it found 4 problems, I've attached the log file. Also attached is the new HJT log file. Unfortunately nothing appears to have changed. If it helps any, when the IE window automatically boots up a DOS window opens briefly as well, but too quick for me to catch the file name.

    Thanks again for your help thus far!

    The PandaSoftware log:

    Incident Status Location

    Virus:Trj/Downloader.BCK Disinfected C:\WINDOWS\system32\guninst.exe
    Virus:Trj/StartPage.AG Disinfected C:\WINDOWS\system32\intlmain.dll
    Adware:Adware/GloboSearch No disinfected C:\WINDOWS\system32\systr.dll
    Adware:Adware/IGuard No disinfected C:\WINDOWS\system32\wldr.dll and the new HJT log:
    Logfile of HijackThis v1.99.1
    Scan saved at 16:19:42, on 23/04/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\mHotkey.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Washer\washer.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clon.biz/search?idz
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.yahoo.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.yahoo.co.uk
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKCU\..\Run: [Washer] C:\Program Files\Washer\washer.exe /0
    O4 - HKCU\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (file missing)
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {02D8BC4D-DB21-46F1-967B-76E3FA8FCB1F} - (no file) (HKCU)
    O9 - Extra button: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C700221C-C446-4D73-945E-3DC92B9CCA9D} - C:\WINDOWS\System32\intlmain.dll (file missing) (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Delete these two files.

    C:\WINDOWS\system32\systr.dll
    C:\WINDOWS\system32\wldr.dll



    Download Autoruns from here:

    http://www.sysinternals.com/ntw2k/freeware/autoruns.shtml

    Run it.

    Then Click FILE - SAVEAS - and save it as a txt file. Then post the text file here.
  • Nobby
    edited April 2005
    Sam, I've deleted the wldr.dll file but I am unable to delete the systr.dll file. It keeps telling me that Access is Denied!!

    I've downloaded and run Autoruns and the log file is attached. Thanks for your continued help!

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

    + C:\WINDOWS\system32\userinit.exe Userinit Logon Application Microsoft Windows Publisher c:\windows\system32\userinit.exe

    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

    + explorer.exe Windows Explorer Microsoft Windows Publisher c:\windows\explorer.exe

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    + AdaptecDirectCD DirectCD Application (Not verified) Roxio c:\program files\roxio\easy cd creator 5\directcd\directcd.exe

    + Advanced Tools Check Norton AntiVirus Advanced Tools Integrity Checker Symantec Corporation c:\program files\norton antivirus\advtools\advchk.exe

    + ccApp Common Client User Session Symantec Corporation c:\program files\common files\symantec shared\ccapp.exe

    + CHotkey Chicony Multimedia Driver (Not verified) Chicony c:\windows\mhotkey.exe

    + HPDJ Taskbar Utility Microsoft Windows Hardware Compatibility Publisher c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe

    + POINTER Cursor features application file (Not verified) Microsoft Corporation C:\Program Files\Microsoft Hardware\Mouse\point32.exe

    + Symantec NetDriver Monitor Symantec Security Drivers Install Monitor Symantec Corporation c:\program files\symnetdrv\sndmon.exe

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup

    + Microsoft Office.lnk Microsoft Office 2000 component (Not verified) Microsoft Corporation c:\program files\microsoft office\office\osa9.exe

    + WinZip Quick Pick.lnk WinZip Executable (Not verified) WinZip Computing, Inc. c:\program files\winzip\wzqkpick.exe

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

    + notepad.exe Windows Messenger Microsoft Windows XP Publisher C:\Program Files\Messenger\msmsgs.exe

    + notepad2.exe File not found: popuper.exe

    + winlogon.exe File not found: helper.exe

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run

    + Washer Window Washer (Not verified) Webroot Software, Inc. c:\program files\washer\washer.exe
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Use Killbox to delete C:\WINDOWS\system32\systr.dll

    There's a good chance that one or more of your files is actually infected. I would like you to visit this site - http://virusscan.jotti.org/
    and have each one of the following files scanned.

    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\notepad2.exe
    C:\WINDOWS\unwash.exe

    Let me know what it says about each one.


    Let me know if these files are present on your computer.

    popuper.exe
    helper.exe
  • Nobby
    edited April 2005
    Sam, I've managed to get rid of the systr.dll file using Killbox and I've checked on my machine and can't find popuper.exe or helper.exe. I've not been able to run the online scan of the four files you suggested, the site is down for maintenance.

    However, my problem appears to have gone. :D I don't get the Error 317 popup and I can reset my homepage to what ever I want and it doesn't change to Clon.biz. Woo Hoo!!!!

    Thanks for all your help you've stopped me going completely insane.

    Let me know if you want me to try the online scan anyway just to check.

    Thanks again, excellent!!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    That's good to hear! I was concerned that either notepad or your messenger file had been infected. But it sounds like the one that was causing the problems was systr.dll

    If your computer is running well and your problem is resolved then no reason to scan those files. But I will leave this thread open for you just in case it pops up again.


    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
  • Nobby
    edited April 2005
    Sam, Thanks for all of your help it has been very much appreciated. Hopefully I won't have any more problems!!
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Happy to do it! :D
This discussion has been closed.