MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Internet & Email arrow Topic: help
May 30, 2020, 09:09:29 PM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
May 30, 2020, 09:09:29 PM

Login with username, password and session length
 Featured Sites:
News
New  We now offer MyTechSupport.ca Merchandise! Every purchase goes towards maintaining our site.
Thank you for supporting MyTechSupport.ca!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: help  (Read 3243 times)
arbalo2
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« on: June 30, 2004, 05:38:24 PM »

hello, i
Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #1 on: July 01, 2004, 02:32:55 AM »

Hi arbalo, a lot of others helping with these logs all around the NET,
It's a combined effort Smiley

I see your using the latest version of Hijackthis, I haven't been around much in the last week, just realized myself that the newest version was out......

There is a tool made by RubbeR Ducky
To rid you of this problem but I've also been hearing that Ad-Aware
has been updated to help fight this problem
Why don't we go that route
See if it will tackle your 018 entries also
Download the Free version of Ad-Aware

Install it----CHECK FOR UPDATES
Disconnect from the Net

Set these for a Custom Scan
click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

RESTART your computer
Don't open a browser yet, instead access your Internet Options via Control Panel
Under the Programs tab "Reset Web Settings"
Under the General tab----Reset home page and delete files
Post back with a Fresh hijackthis log
Logged

 
arbalo2
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« Reply #2 on: July 01, 2004, 02:49:07 PM »

Hi again ! thanks a lot for your help. I did all you told me and it looks to be ok now.
Here you have the last HJT log, after all the operations ...

C:\ARCHIV~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Archivos de programa\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Archivos de programa\Apoint2K\Apntex.exe
D:\ARCHIV~1\YAHOO!\MESSEN~1\ymsgr_tray.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Documents and Settings\Alvaro\Configuraci
Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #3 on: July 01, 2004, 07:04:35 PM »

Hi again arbalo, Still looks like the problem is still there
Still not convinced Ad-Aware won't remove this
Again Check for Updates for Ad-Aware---I think there was one today

Could you follow my directions to do a Custom scan
but instead this time Uncheck
"Automatically try to unregister objects prior to deletion"

Don't scan yet, instead Restart into
RESTART your Computer in SAFE MODE

and then run the Scan
Restart your computer and run AD-Aware again until there are no more
objects identified

Then in Normal startup post back a fresh hijackthis log
Logged

 
arbalo2
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« Reply #4 on: July 03, 2004, 08:36:31 AM »

OK, followed your instructions. Here you have the log.
Aparently, it looks to run ok now, but you
Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #5 on: July 03, 2004, 08:04:06 PM »

This is IMPORTANT---Create a Permanent folder for hijackthis
EG---- Open MyDocuments----Right click an empty spot and select NEW---Folder----Name the new folder HJT ---this is where you will want to save Hijackthis too, also, backups will be stored there.
Download a new version of hijackthis----your version needs replaced
Save it to that new folder
Download from here
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
or here:
http://aumha.org/downloads/hijackthis.exe

Enter your Add/Remove Programs via Control Panel and remove any of these if found
'My Search Bar'
'MyWay Speed Bar'
'My Web Search Bar'
'Fun Web Products Easy Installer'

Download and Save to Desktop CWShredder from this link
http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
Run this later

Disconnect from the Net

Enter your task manager (Hold down CTRL+SHIFT keys and tap ESC)

End process on this
SCVHOST.EXE <---NOTICE the spelling NOT svchost.exe


Do another Scan with Hijackthis and put a check next to these entries and then FIX CHECKED when ALL other windows are closed

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\nfmbje.dll/sp.html (obfuscated)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\nfmbje.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\nfmbje.dll/sp.html (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Archivos de programa\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {2153E6B1-20B6-4DAF-B01A-7DCBF6B687FC} - c:\windows\system32\nfmbje.dll (file missing)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Archivos de programa\MyWay\myBar\1.bin\MYBAR.DLL

O4 - HKLM\..\Run: [MSStartOptimizer] C:\WINDOWS\System32\SCVHOST.EXE
O4 - HKLM\..\Run: [RegCompres] C:\WINDOWS\System32\REGCPM32.EXE

O4 - Startup: PowerReg Scheduler.exe

O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} (DialerWeb Class) - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {6986A6CF-9D58-11D6-91C2-00E02964E8E3} (IntPagomaster Class) - http://www.peterpaulxxx.com/iconos/dialer/pagomast.cab
O16 - DPF: {73F0FD85-BD47-4A95-86D1-DE38860462C1} (PremiumHTML Class) - http://213.201.69.103/data/dialercab/IberoDialerHTML.cab
O16 - DPF: {D10B5C22-DC60-430D-B548-489CB49A2367} (FreeScan Class) -

O18 - Filter: text/html - {59D1EFD3-CFF9-4516-B027-013E7C8B2680} - C:\WINDOWS\System32\nfmbje.dll
O18 - Filter: text/plain - {59D1EFD3-CFF9-4516-B027-013E7C8B2680} - C:\WINDOWS\System32\nfmbje.dll

NEXT: With only CWShredder open let it FIX all problems

RESTART your Computer in SAFE MODE

Find and delete these files or folders if they exist
They may have hidden attributes, link will explain how to show them
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

C:\WINDOWS\System32\SCVHOST.EXE <---this file DO NOT DELETE SVCHOST
C:\WINDOWS\System32\REGCPM32.EXE <---this file
C:\WINDOWS\System32\nfmbje.dll <---this file if it exists
C:\Archivos de programa\MyWay <---the MyWay folder

RESTART back in Normal Mode
Don't open a browser yet, instead access Internet Options via Control
Panel
Under the Programs tab "Reset Web Settings"
Under the General tab---Delete files + offline content---Also Reset home page
Do a Disk Cleanup--Start---Run---type in "cleanmgr" without quotes

I would also do another custom scan with Ad-Aware and RESTART your computer
Post back another fresh hijackthis log afterwards, let me know how everything is going......Remember to redownload hijackthis to that permanent folder
Logged

 
arbalo2
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 4


Bookmark and Share

View Profile
« Reply #6 on: July 04, 2004, 04:16:19 PM »

Hi again. I haven
Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #7 on: July 04, 2004, 07:24:19 PM »

Hi again arbalo,

I'll leave this topic open for a couple days to see if you have
any problems reoccur

I'm not even sure what this entry is, do you know what it is?

O4 - HKLM\..\Run: [!!!AAAA-aaaagiochimkt] C:\DOCUME~1\Alvaro\DATOSD~1\GIOCHI~1.EXE /ns

Set windows to show hidden files and folders
* Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Click Yes to confirm.
    * Click OK.

Navigate to that file
Right click on it---left click properties---version
Do you know what it's related too?
OR please submit it to Kapersky,
http://www.kaspersky.com/scanforvirus
Simply navigate to them by clicking the "browse" button
Right click then "Submit"

You can have hijackthis fix this entry

O16 - DPF: {D10B5C22-DC60-430D-B548-489CB49A2367} (FreeScan Class) -

Probably an incomplete activex control install

If you can find the time you may want to do a AV Scan at Housecall's
http://housecall.trendmicro.com/
Set to Autoclean-----Delete what it can't fix it you can
I know you have Anti-Virus software but it may have been compromised

You did have malware on your computer that  may have effected your system restore
You may also want to disable and enable System Restore to flush out
your Restore points
Once everything is running fine

Take a look at these 2 programs also
SpywareBlaster---Install----Check for Updates--Enable all protection
http://www.javacoolsoftware.com/spywareblaster.html

IE-Spyad----
Here's a tutorial and download link included
http://www.bleepingcomputer.com/forums/index.php?showtutorial=53

I recommend you install both those free apps.
« Last Edit: July 04, 2004, 07:28:44 PM by benditup » Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page June 18, 2018, 08:04:30 AM