MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: 69s*xsearch
July 20, 2019, 06:08:05 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
July 20, 2019, 06:08:05 AM

Login with username, password and session length
 
News
12th Anniversary Celebrating 12 Years! (1997 - 2009) 12th Anniversary
Thanks to ALL that make this site what it is!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: 69s*xsearch  (Read 977 times)
henriut
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 2


Bookmark and Share

View Profile
« on: January 07, 2005, 09:11:09 AM »

Hi, can any one help me get rid of 69s*xsearch?
Thanks

Logfile of HijackThis v1.99.0
Scan saved at 09:09:52, on 07/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\adslrocl.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\WINDOWS\system32\YPCSER~1.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\system32\xpsp2fw.exe
C:\WINDOWS\System32\tibs3.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Robert\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-gb\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-gb\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [D442EB6E] C:\WINDOWS\system32\adslrocl.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [905E6B5B] C:\WINDOWS\system32\akuwashle.exe
O4 - HKLM\..\Run: [FD23470B] C:\WINDOWS\system32\TLotenand.exe
O4 - HKLM\..\Run: [B838ABEE] C:\WINDOWS\system32\esrnfomp.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [C5CD268E] C:\WINDOWS\system32\xoisp.exe
O4 - HKLM\..\Run: [ED9CC60E] C:\WINDOWS\system32\cnoiewcdf.exe
O4 - HKLM\..\Run: [8F147B06] C:\WINDOWS\system32\o4ctrs7q.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\twink64.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe" +c
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exe
O4 - HKLM\..\Run: [IW ControlCenter] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [F0750266] C:\WINDOWS\system32\caaddi.exe
O4 - HKLM\..\Run: [BDA552EE] C:\WINDOWS\system32\phell32.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [8B051463] C:\WINDOWS\system32\i32vifi.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [B678326E] C:\WINDOWS\system32\ioview.exe
O4 - HKLM\..\Run: [1A5E6F7E] C:\WINDOWS\system32\dsldadvp.exe
O4 - HKLM\..\Run: [F9EFAEF3] C:\WINDOWS\system32\momssfs.exe
O4 - HKLM\..\Run: [1B4FCB5E] C:\WINDOWS\system32\exakupc.exe
O4 - HKLM\..\Run: [A4CDB273] C:\WINDOWS\system32\wadessrv.exe
O4 - HKLM\..\Run: [CCABFDDE] C:\WINDOWS\system32\utattwse.exe
O4 - HKLM\..\Run: [DB0A518B] C:\WINDOWS\system32\ciodisenh.exe
O4 - HKLM\..\Run: [XPSP2 Firewall] C:\WINDOWS\system32\xpsp2fw.exe
O4 - HKLM\..\Run: [84C45763] C:\WINDOWS\system32\ididicr.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKLM\..\Run: [B439ADFB] C:\WINDOWS\system32\metesrv.exe
O4 - HKLM\..\Run: [ED2601F6] C:\WINDOWS\system32\dvaptmapi.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [D72D05D6] C:\WINDOWS\system32\tracatt.exe
O4 - HKLM\..\Run: [52294F8E] C:\WINDOWS\system32\ctrisplcnbj.exe
O4 - HKLM\..\Run: [DE6B916B] C:\WINDOWS\system32\fitUnsopy.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FD23470B] C:\WINDOWS\system32\TLotenand.exe
O4 - HKCU\..\Run: [D442EB6E] C:\WINDOWS\system32\adslrocl.exe
O4 - HKCU\..\Run: [8F147B06] C:\WINDOWS\system32\o4ctrs7q.exe
O4 - HKCU\..\Run: [C5CD268E] C:\WINDOWS\system32\xoisp.exe
O4 - HKCU\..\Run: [8B051463] C:\WINDOWS\system32\i32vifi.exe
O4 - HKCU\..\Run: [ED9CC60E] C:\WINDOWS\system32\cnoiewcdf.exe
O4 - HKCU\..\Run: [BDA552EE] C:\WINDOWS\system32\phell32.exe
O4 - HKCU\..\Run: [B838ABEE] C:\WINDOWS\system32\esrnfomp.exe
O4 - HKCU\..\Run: [905E6B5B] C:\WINDOWS\system32\akuwashle.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Windows Update Client ] C:\WINDOWS\system32\wuclient.exe
O4 - HKCU\..\Run: [F0750266] C:\WINDOWS\system32\caaddi.exe
O4 - HKCU\..\Run: [B678326E] C:\WINDOWS\system32\ioview.exe
O4 - HKCU\..\Run: [1A5E6F7E] C:\WINDOWS\system32\dsldadvp.exe
O4 - HKCU\..\Run: [F9EFAEF3] C:\WINDOWS\system32\momssfs.exe
O4 - HKCU\..\Run: [1B4FCB5E] C:\WINDOWS\system32\exakupc.exe
O4 - HKCU\..\Run: [A4CDB273] C:\WINDOWS\system32\wadessrv.exe
O4 - HKCU\..\Run: [CCABFDDE] C:\WINDOWS\system32\utattwse.exe
O4 - HKCU\..\Run: [DB0A518B] C:\WINDOWS\system32\ciodisenh.exe
O4 - HKCU\..\Run: [84C45763] C:\WINDOWS\system32\ididicr.exe
O4 - HKCU\..\Run: [B439ADFB] C:\WINDOWS\system32\metesrv.exe
O4 - HKCU\..\Run: [ED2601F6] C:\WINDOWS\system32\dvaptmapi.exe
O4 - HKCU\..\Run: [D72D05D6] C:\WINDOWS\system32\tracatt.exe
O4 - HKCU\..\Run: [52294F8E] C:\WINDOWS\system32\ctrisplcnbj.exe
O4 - HKCU\..\Run: [DE6B916B] C:\WINDOWS\system32\fitUnsopy.exe
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Robert\Application Data\DownloadPlus.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O15 - Trusted Zone: http://*.69s*xsearch.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: clickspring.net
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: mt-download.com
O15 - Trusted IP range: ysbweb.com
O15 - Trusted IP range: slotchbar.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: searchmiracle.com
O15 - Trusted IP range: windupdates.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: my-internet.info
O15 - Trusted IP range: skoobidoo.com
O15 - Trusted IP range: searchmiracle.com (HKLM)
O15 - Trusted IP range: windupdates.com (HKLM)
O15 - Trusted IP range: my-internet.info (HKLM)
O15 - Trusted IP range: ysbweb.com (HKLM)
O15 - Trusted IP range: clickspring.net (HKLM)
O15 - Trusted IP range: 67.19.185.246 (HKLM)
O15 - Trusted IP range: mt-download.com (HKLM)
O15 - Trusted IP range: slotchbar.com (HKLM)
O15 - Trusted IP range: skoobidoo.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:C:\s*xtxsp.chm::/on-line.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3} (webhelper Class) - http://register.btinternet.com/templates/btwebcontrol023.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8E56B59A-BF0B-400C-8871-8D47913FF258}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB06BDDC-E956-4840-B1B6-2EB2ACA353ED}: NameServer = 192.168.0.1
O18 - Filter: text/html - {72403F39-C10C-40BA-AFDE-30A3ACAF10B8} - C:\WINDOWS\System32\bil.dll
O18 - Filter: text/plain - {72403F39-C10C-40BA-AFDE-30A3ACAF10B8} - C:\WINDOWS\System32\bil.dll
O21 - SSODL: RuHvBuEwqe - {903D8E1F-3A97-24B5-EAC4-D36E91B4C9E1} - C:\WINDOWS\System32\dgdb.dll
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Logged

 
henriut
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 2


Bookmark and Share

View Profile
« Reply #1 on: January 07, 2005, 03:10:40 PM »

Can anyone help, please?
Logged

 
greyknight17
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 28


Bookmark and Share

View Profile
« Reply #2 on: January 07, 2005, 04:03:38 PM »

You have one of the newer infections here which will take a couple of steps to fix (at least).

Please print out or copy this page to Notepad.  Make sure to work through the fixes in the exact order it is mentioned below.  If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.  You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.  Also make sure that Display the contents of System Folders' is checked.  Windows XP's search feature is a little different.  When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom.  Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean.  If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore.  Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it back on and create a new restore point.

Download Winsock2Fix (http://www.greyknight17.com/spy/Winsock2Fix.zip) and unzip it.  Then double-click on it to run it.

Right click on this link (http://www.greyknight17.com/spy/DelO15Domains.inf) and choose Save As.  Save it to your desktop.  Right click on that file and choose Install.  You may delete it afterwards.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro (http://uk.trendmicro-europe.com/enterprise/products/housecall_launch.php). Just follow the instructions on the site to run the online scan.  Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Reboot into Safe Mode (hit F8 key until menu shows up).  Make sure to close any open browsers.  Go into HijackThis->Config->Misc. Tools->Open process manager.  Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\WINDOWS\system32\adslrocl.exe
C:\WINDOWS\system32\xpsp2fw.exe
C:\WINDOWS\System32\tibs3.exe

Run a scan in HijackThis.  Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://realsearch.cc/?a=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
R3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - 3 - URLSearchHook: (no name) - _{CA0E28FA-1AFD-4C21-A8DC-70EB5BE2F076} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [D442EB6E] C:\WINDOWS\system32\adslrocl.exe
O4 - HKLM\..\Run: [905E6B5B] C:\WINDOWS\system32\akuwashle.exe
O4 - HKLM\..\Run: [FD23470B] C:\WINDOWS\system32\TLotenand.exe
O4 - HKLM\..\Run: [B838ABEE] C:\WINDOWS\system32\esrnfomp.exe
O4 - HKLM\..\Run: [C5CD268E] C:\WINDOWS\system32\xoisp.exe
O4 - HKLM\..\Run: [ED9CC60E] C:\WINDOWS\system32\cnoiewcdf.exe
O4 - HKLM\..\Run: [8F147B06] C:\WINDOWS\system32\o4ctrs7q.exe
O4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exe
O4 - HKLM\..\Run: [F0750266] C:\WINDOWS\system32\caaddi.exe
O4 - HKLM\..\Run: [BDA552EE] C:\WINDOWS\system32\phell32.exe
O4 - HKLM\..\Run: [SESync] "C:\Program Files\SED\SED.exe"
O4 - HKLM\..\Run: [8B051463] C:\WINDOWS\system32\i32vifi.exe
O4 - HKLM\..\Run: [B678326E] C:\WINDOWS\system32\ioview.exe
O4 - HKLM\..\Run: [1A5E6F7E] C:\WINDOWS\system32\dsldadvp.exe
O4 - HKLM\..\Run: [F9EFAEF3] C:\WINDOWS\system32\momssfs.exe
O4 - HKLM\..\Run: [1B4FCB5E] C:\WINDOWS\system32\exakupc.exe
O4 - HKLM\..\Run: [A4CDB273] C:\WINDOWS\system32\wadessrv.exe
O4 - HKLM\..\Run: [CCABFDDE] C:\WINDOWS\system32\utattwse.exe
O4 - HKLM\..\Run: [DB0A518B] C:\WINDOWS\system32\ciodisenh.exe
O4 - HKLM\..\Run: [XPSP2 Firewall] C:\WINDOWS\system32\xpsp2fw.exe
O4 - HKLM\..\Run: [84C45763] C:\WINDOWS\system32\ididicr.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKLM\..\Run: [B439ADFB] C:\WINDOWS\system32\metesrv.exe
O4 - HKLM\..\Run: [ED2601F6] C:\WINDOWS\system32\dvaptmapi.exe
O4 - HKLM\..\Run: [D72D05D6] C:\WINDOWS\system32\tracatt.exe
O4 - HKLM\..\Run: [52294F8E] C:\WINDOWS\system32\ctrisplcnbj.exe
O4 - HKLM\..\Run: [DE6B916B] C:\WINDOWS\system32\fitUnsopy.exe
O4 - HKCU\..\Run: [FD23470B] C:\WINDOWS\system32\TLotenand.exe
O4 - HKCU\..\Run: [D442EB6E] C:\WINDOWS\system32\adslrocl.exe
O4 - HKCU\..\Run: [8F147B06] C:\WINDOWS\system32\o4ctrs7q.exe
O4 - HKCU\..\Run: [C5CD268E] C:\WINDOWS\system32\xoisp.exe
O4 - HKCU\..\Run: [8B051463] C:\WINDOWS\system32\i32vifi.exe
O4 - HKCU\..\Run: [ED9CC60E] C:\WINDOWS\system32\cnoiewcdf.exe
O4 - HKCU\..\Run: [BDA552EE] C:\WINDOWS\system32\phell32.exe
O4 - HKCU\..\Run: [B838ABEE] C:\WINDOWS\system32\esrnfomp.exe
O4 - HKCU\..\Run: [905E6B5B] C:\WINDOWS\system32\akuwashle.exe
O4 - HKCU\..\Run: [Windows Update Client ] C:\WINDOWS\system32\wuclient.exe
O4 - HKCU\..\Run: [F0750266] C:\WINDOWS\system32\caaddi.exe
O4 - HKCU\..\Run: [B678326E] C:\WINDOWS\system32\ioview.exe
O4 - HKCU\..\Run: [1A5E6F7E] C:\WINDOWS\system32\dsldadvp.exe
O4 - HKCU\..\Run: [F9EFAEF3] C:\WINDOWS\system32\momssfs.exe
O4 - HKCU\..\Run: [1B4FCB5E] C:\WINDOWS\system32\exakupc.exe
O4 - HKCU\..\Run: [A4CDB273] C:\WINDOWS\system32\wadessrv.exe
O4 - HKCU\..\Run: [CCABFDDE] C:\WINDOWS\system32\utattwse.exe
O4 - HKCU\..\Run: [DB0A518B] C:\WINDOWS\system32\ciodisenh.exe
O4 - HKCU\..\Run: [84C45763] C:\WINDOWS\system32\ididicr.exe
O4 - HKCU\..\Run: [B439ADFB] C:\WINDOWS\system32\metesrv.exe
O4 - HKCU\..\Run: [ED2601F6] C:\WINDOWS\system32\dvaptmapi.exe
O4 - HKCU\..\Run: [D72D05D6] C:\WINDOWS\system32\tracatt.exe
O4 - HKCU\..\Run: [52294F8E] C:\WINDOWS\system32\ctrisplcnbj.exe
O4 - HKCU\..\Run: [DE6B916B] C:\WINDOWS\system32\fitUnsopy.exe
O4 - Startup: Download Plus.lnk = C:\Documents and Settings\Robert\Application Data\DownloadPlus.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll

O15 - Trusted Zone: http://*.69s*xsearch.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: clickspring.net
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: mt-download.com
O15 - Trusted IP range: ysbweb.com
O15 - Trusted IP range: slotchbar.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: searchmiracle.com
O15 - Trusted IP range: windupdates.com
O15 - Trusted IP range: http://69s*xsearch.com
O15 - Trusted IP range: my-internet.info
O15 - Trusted IP range: skoobidoo.com
O15 - Trusted IP range: searchmiracle.com (HKLM)
O15 - Trusted IP range: windupdates.com (HKLM)
O15 - Trusted IP range: my-internet.info (HKLM)
O15 - Trusted IP range: ysbweb.com (HKLM)
O15 - Trusted IP range: clickspring.net (HKLM)
O15 - Trusted IP range: 67.19.185.246 (HKLM)
O15 - Trusted IP range: mt-download.com (HKLM)
O15 - Trusted IP range: slotchbar.com (HKLM)
O15 - Trusted IP range: skoobidoo.com (HKLM)
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:C:\s*xtxsp.chm::/on-line.exe
O18 - Filter: text/html - {72403F39-C10C-40BA-AFDE-30A3ACAF10B8} - C:\WINDOWS\System32\bil.dll
O18 - Filter: text/plain - {72403F39-C10C-40BA-AFDE-30A3ACAF10B8} - C:\WINDOWS\System32\bil.dll
O21 - SSODL: RuHvBuEwqe - {903D8E1F-3A97-24B5-EAC4-D36E91B4C9E1} - C:\WINDOWS\System32\dgdb.dll

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\system32\adslrocl.exe
C:\WINDOWS\system32\xpsp2fw.exe
C:\WINDOWS\System32\tibs3.exe
C:\WINDOWS\System32\bil.dll
C:\WINDOWS\System32\dgdb.dll
C:\Program Files\SED\

Also delete all those files listed above in RED.

Reboot into Normal Mode and run new HijackThis scan.  Save the log file and run HijackThis Analyzer (http://www.greyknight17.com/spy/HijackThis%20Analyzer.zip) in the same folder to get the result.txt log.  Just post the contents of the result.txt file in the forum.
Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page July 14, 2017, 09:41:58 PM