MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: Help me get rid of 69s*xsearch
July 20, 2019, 06:04:00 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
July 20, 2019, 06:04:00 AM

Login with username, password and session length
 
News
12th Anniversary Celebrating 12 Years! (1997 - 2009) 12th Anniversary
Thanks to ALL that make this site what it is!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: Help me get rid of 69s*xsearch  (Read 1006 times)
ophidian_flux
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 3


Bookmark and Share

View Profile
« on: January 07, 2005, 05:00:00 PM »

Hi Guys & Gals

Help me get rid of 69s*xsearch!

I'v read & tried the stuff in this forum, but had little luck.

Can anyone help me?

Logfile of HijackThis v1.99.0
Scan saved at 11:46:07 AM, on 1/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\adsluag.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Steven Dean\Application Data\othb.exe
C:\WINDOWS\System32\t?skmgr.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\Steven Dean\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msaps.dll/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/customize/rogers/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = res://msaps.dll/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1089D8C1-470C-3B89-513A-3F36599BFF91} - C:\WINDOWS\System32\xyqebs.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {3AAB155E-C442-7AC4-855C-15550AF57B3E} - C:\WINDOWS\System32\wrtzphq.dll (file missing)
O2 - BHO: (no name) - {3CFC4100-C867-7EB2-D50A-665504852849} - C:\WINDOWS\System32\qddwalwy.dll (file missing)
O2 - BHO: (no name) - {3DFE455A-9012-2EC3-855C-15550AF07F6A} - C:\WINDOWS\System32\eopj.dll (file missing)
O2 - BHO: (no name) - {6AFC1A58-9B6F-79B9-D60E-665504DF2510} - C:\WINDOWS\System32\tbtqi.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {00000000-0000-0000-0000-000000000001} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [dluca] c:\windows\system32\msinstall\dlu32\dluca\dluca.exe /noconnect
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [WindowsRegKey update] svchostc.exe
O4 - HKLM\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [9D1853E6] C:\WINDOWS\system32\adsti3id.exe
O4 - HKLM\..\Run: [CEE77CD3] C:\WINDOWS\system32\adsluag.exe
O4 - HKLM\..\Run: [1AC79576] C:\WINDOWS\system32\aseclbc.exe
O4 - HKLM\..\Run: [AF391DD6] C:\WINDOWS\system32\tksrcmpr.exe
O4 - HKLM\..\Run: [8128554B] C:\WINDOWS\system32\aaaidrli.exe
O4 - HKLM\..\Run: [5A4E6256] C:\WINDOWS\system32\aaamtvo3.exe
O4 - HKLM\..\Run: [889A8ACB] C:\WINDOWS\system32\dslvta.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [163CAB5E] C:\WINDOWS\system32\cftida.exe
O4 - HKLM\..\Run: [A4C8B3E6] C:\WINDOWS\system32\lrsvtmfrows.exe
O4 - HKLM\..\Run: [E9A83AD6] C:\WINDOWS\system32\lrsvlack.exe
O4 - HKLM\..\Run: [9CB49D06] C:\WINDOWS\system32\disyewcim.exe
O4 - HKLM\..\Run: [CA537BF3] C:\WINDOWS\system32\rdsomhc.exe
O4 - HKLM\..\Run: [EC6ECAEE] C:\WINDOWS\system32\ti2dcmomc.exe
O4 - HKLM\..\Run: [1A43C0CE] C:\WINDOWS\system32\cluidem.exe
O4 - HKLM\..\Run: [D9009946] C:\WINDOWS\system32\wavendep.exe
O4 - HKLM\..\Run: [BEFC31CB] C:\WINDOWS\system32\pdlljmpol.exe
O4 - HKLM\..\Run: [EF2349DE] C:\WINDOWS\system32\mon3dsrv.exe
O4 - HKLM\..\RunServices: [WindowsRegKey update] svchostc.exe
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WindowsRegKey update] svchostc.exe
O4 - HKCU\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Steven Dean\Application Data\othb.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [9D1853E6] C:\WINDOWS\system32\adsti3id.exe
O4 - HKCU\..\Run: [CEE77CD3] C:\WINDOWS\system32\adsluag.exe
O4 - HKCU\..\Run: [1AC79576] C:\WINDOWS\system32\aseclbc.exe
O4 - HKCU\..\Run: [AF391DD6] C:\WINDOWS\system32\tksrcmpr.exe
O4 - HKCU\..\Run: [8128554B] C:\WINDOWS\system32\aaaidrli.exe
O4 - HKCU\..\Run: [5A4E6256] C:\WINDOWS\system32\aaamtvo3.exe
O4 - HKCU\..\Run: [889A8ACB] C:\WINDOWS\system32\dslvta.exe
O4 - HKCU\..\Run: [Vrorh] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [163CAB5E] C:\WINDOWS\system32\cftida.exe
O4 - HKCU\..\Run: [A4C8B3E6] C:\WINDOWS\system32\lrsvtmfrows.exe
O4 - HKCU\..\Run: [E9A83AD6] C:\WINDOWS\system32\lrsvlack.exe
O4 - HKCU\..\Run: [9CB49D06] C:\WINDOWS\system32\disyewcim.exe
O4 - HKCU\..\Run: [CA537BF3] C:\WINDOWS\system32\rdsomhc.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [EC6ECAEE] C:\WINDOWS\system32\ti2dcmomc.exe
O4 - HKCU\..\Run: [1A43C0CE] C:\WINDOWS\system32\cluidem.exe
O4 - HKCU\..\Run: [D9009946] C:\WINDOWS\system32\wavendep.exe
O4 - HKCU\..\Run: [BEFC31CB] C:\WINDOWS\system32\pdlljmpol.exe
O4 - HKCU\..\Run: [EF2349DE] C:\WINDOWS\system32\mon3dsrv.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Advisor - {B826BB43-A824-4435-AC49-6B43039AA21B} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=1c02&lc=0409
O15 - Trusted Zone: http://*.69s*xsearch.com
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096564576184
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4299/mcfscan.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP Configuration Interface Service - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


------------------------

Thanks O'Flux Cool
Logged

 
greyknight17
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 28


Bookmark and Share

View Profile
« Reply #1 on: January 07, 2005, 07:31:47 PM »

Welcome to MyTechSupport.

Did you run Ad-aware, Spybot and CWShredder yet?  If not, do the following now:

Please print out or copy this page to Notepad.  Make sure to work through the fixes in the exact order it is mentioned below.  If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.  You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.  Also make sure that Display the contents of System Folders' is checked.  Windows XP's search feature is a little different.  When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom.  Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean.  If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Please download Ad-aware SE (http://www.greyknight17.com/spyware.htm#adaware) and install it if you don't have it already.  Make sure it's the newest version and check for any updates before running it.  Go to http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml to get the plug-in for fixing VX2 variants.  To run this tool, go into Ad-aware->Add-ons and select VX2 Cleaner.  Then click Run Tool and OK to start it.  If it's clean, it will say Status System Clean.  Otherwise, you will have to click on the Clean button to remove the VX2 infection.  Also make sure to customize (http://www.greyknight17.com/spyware.htm#adaware) the settings in Ad-aware for better scan results.  Run the scan and fix everything that it finds.

Download and install Spybot S&D (http://security.kolla.de/).  Run Spybot and click on the 'Search for Updates' button.  Install any updates that are available.  Next click on the 'Check for Problems' button.  Let it run the scan.  If it finds something, check all those in RED and hit the 'Fix Selected Problems' button.  Exit Spybot.  If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix (http://majorgeeks.com/download4392.html) and install it over the current Spybot installation.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro (http://uk.trendmicro-europe.com/enterprise/products/housecall_launch.php). Just follow the instructions on the site to run the online scan.  Otherwise, make sure your antivirus program has the latest definitions and run a full system scan.

Reboot into Safe Mode (hit F8 key until menu shows up).  Make sure to close any open browsers.  Go into HijackThis->Config->Misc. Tools->Open process manager.  Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\WINDOWS\system32\adsluag.exe
C:\Documents and Settings\Steven Dean\Application Data\othb.exe
C:\WINDOWS\System32\t?skmgr.exe - make sure it's spelled exactly as listed here

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

freescan

Run a scan in HijackThis.  Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msaps.dll/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = res://msaps.dll/index.html
O2 - BHO: (no name) - {1089D8C1-470C-3B89-513A-3F36599BFF91} - C:\WINDOWS\System32\xyqebs.dll
O2 - BHO: (no name) - {3AAB155E-C442-7AC4-855C-15550AF57B3E} - C:\WINDOWS\System32\wrtzphq.dll (file missing)
O2 - BHO: (no name) - {3CFC4100-C867-7EB2-D50A-665504852849} - C:\WINDOWS\System32\qddwalwy.dll (file missing)
O2 - BHO: (no name) - {3DFE455A-9012-2EC3-855C-15550AF07F6A} - C:\WINDOWS\System32\eopj.dll (file missing)
O2 - BHO: (no name) - {6AFC1A58-9B6F-79B9-D60E-665504DF2510} - C:\WINDOWS\System32\tbtqi.dll (file missing)
O3 - Toolbar: (no name) - {00000000-0000-0000-0000-000000000001} - (no file)
O4 - HKLM\..\Run: [dluca] c:\windows\system32\msinstall\dlu32\dluca\dluca.exe /noconnect
O4 - HKLM\..\Run: [WindowsRegKey update] svchostc.exe
O4 - HKLM\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O4 - HKLM\..\Run: [9D1853E6] C:\WINDOWS\system32\adsti3id.exe
O4 - HKLM\..\Run: [CEE77CD3] C:\WINDOWS\system32\adsluag.exe
O4 - HKLM\..\Run: [1AC79576] C:\WINDOWS\system32\aseclbc.exe
O4 - HKLM\..\Run: [AF391DD6] C:\WINDOWS\system32\tksrcmpr.exe
O4 - HKLM\..\Run: [8128554B] C:\WINDOWS\system32\aaaidrli.exe
O4 - HKLM\..\Run: [5A4E6256] C:\WINDOWS\system32\aaamtvo3.exe
O4 - HKLM\..\Run: [889A8ACB] C:\WINDOWS\system32\dslvta.exe
O4 - HKLM\..\Run: [163CAB5E] C:\WINDOWS\system32\cftida.exe
O4 - HKLM\..\Run: [A4C8B3E6] C:\WINDOWS\system32\lrsvtmfrows.exe
O4 - HKLM\..\Run: [E9A83AD6] C:\WINDOWS\system32\lrsvlack.exe
O4 - HKLM\..\Run: [9CB49D06] C:\WINDOWS\system32\disyewcim.exe
O4 - HKLM\..\Run: [CA537BF3] C:\WINDOWS\system32\rdsomhc.exe
O4 - HKLM\..\Run: [EC6ECAEE] C:\WINDOWS\system32\ti2dcmomc.exe
O4 - HKLM\..\Run: [1A43C0CE] C:\WINDOWS\system32\cluidem.exe
O4 - HKLM\..\Run: [D9009946] C:\WINDOWS\system32\wavendep.exe
O4 - HKLM\..\Run: [BEFC31CB] C:\WINDOWS\system32\pdlljmpol.exe
O4 - HKLM\..\Run: [EF2349DE] C:\WINDOWS\system32\mon3dsrv.exe
O4 - HKLM\..\RunServices: [WindowsRegKey update] svchostc.exe
O4 - HKCU\..\Run: [WindowsRegKey update] svchostc.exe
O4 - HKCU\..\Run: [tapisys] C:\WINDOWS\System32\tss.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Steven Dean\Application Data\othb.exe
O4 - HKCU\..\Run: [9D1853E6] C:\WINDOWS\system32\adsti3id.exe
O4 - HKCU\..\Run: [CEE77CD3] C:\WINDOWS\system32\adsluag.exe
O4 - HKCU\..\Run: [1AC79576] C:\WINDOWS\system32\aseclbc.exe
O4 - HKCU\..\Run: [AF391DD6] C:\WINDOWS\system32\tksrcmpr.exe
O4 - HKCU\..\Run: [8128554B] C:\WINDOWS\system32\aaaidrli.exe
O4 - HKCU\..\Run: [5A4E6256] C:\WINDOWS\system32\aaamtvo3.exe
O4 - HKCU\..\Run: [889A8ACB] C:\WINDOWS\system32\dslvta.exe
O4 - HKCU\..\Run: [Vrorh] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [163CAB5E] C:\WINDOWS\system32\cftida.exe
O4 - HKCU\..\Run: [A4C8B3E6] C:\WINDOWS\system32\lrsvtmfrows.exe
O4 - HKCU\..\Run: [E9A83AD6] C:\WINDOWS\system32\lrsvlack.exe
O4 - HKCU\..\Run: [9CB49D06] C:\WINDOWS\system32\disyewcim.exe
O4 - HKCU\..\Run: [CA537BF3] C:\WINDOWS\system32\rdsomhc.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [EC6ECAEE] C:\WINDOWS\system32\ti2dcmomc.exe
O4 - HKCU\..\Run: [1A43C0CE] C:\WINDOWS\system32\cluidem.exe
O4 - HKCU\..\Run: [D9009946] C:\WINDOWS\system32\wavendep.exe
O4 - HKCU\..\Run: [BEFC31CB] C:\WINDOWS\system32\pdlljmpol.exe
O4 - HKCU\..\Run: [EF2349DE] C:\WINDOWS\system32\mon3dsrv.exe

O4 - Startup: PowerReg SchedulerV2.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Advisor - {B826BB43-A824-4435-AC49-6B43039AA21B} - C:\Program Files\COMPAQ\Compaq Advisor\bin\rbaLauncher.exe (file missing) (HKCU)
O15 - Trusted Zone: http://*.69s*xsearch.com

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\system32\adsluag.exe
C:\Documents and Settings\Steven Dean\Application Data\othb.exe
C:\WINDOWS\System32\t?skmgr.exe - make sure it's spelled exactly as listed here
msaps.dll
c:\freescan\
c:\windows\system32\msinstall\dlu32\

Also delete those those files listed above in RED

Reboot into Normal Mode and run new HijackThis scan.  Save the log file and run HijackThis Analyzer (http://www.greyknight17.com/spy/HijackThis%20Analyzer.zip) in the same folder to get the result.txt log.  Just post the contents of the result.txt file in the forum.
Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page July 17, 2019, 05:43:10 AM