It Just Will Not Die!

Printable View

07-09-2004, 05:29 PM
{%shellshock%}

Image Resized
Image Resized
[img]http://img49.exs.cx/img49/8787/spy.jpg' width='200' height='120' border='0' alt='click for full size view'>
Iv try'd every spyware removel i can think of.The only thing that seem's to get rid of it is Hijackthis but a few day's later i just come's back.Eny help please.
07-09-2004, 05:35 PM
[B][O][T]

Use the search....there's lots of topics about this.
And don't use IE :rolleyes: :rolleyes:

BOT
07-09-2004, 05:40 PM
{%shellshock%}

Thanks for your help. :)
07-09-2004, 05:59 PM
sparsely

Quote:

Originally posted by [B
[O][T],9 July 2004 - 12:43]Use the search....there's lots of topics about this.
And don't use IE  :rolleyes:  :rolleyes:

BOT

FIREFOOOOOOXXXXXXXXXX!!!!!!!

:D
07-09-2004, 06:22 PM
Ariel_001

Quote:

Originally posted by {%shellshock%}@9 July 2004 - 13:37
Image Resized
Image Resized
<a href='http://img49.exs.cx/img49/8787/spy.jpg' target='image'>Image Resized
Image Resized
[img]http://img49.exs.cx/img49/8787/spy.jpg' width='200' height='120' border='0' alt='click for full size view'></a>
Iv try'd every spyware removel i can think of.The only thing that seem's to get rid of it is Hijackthis but a few day's later i just come's back.Eny help please.

ok..

I beleve Hijackthis has the option to show a log of your computer`s state of something like that. Can you post it?
07-09-2004, 07:55 PM
{%shellshock%}

Logfile of HijackThis v1.97.7
Scan saved at 12:06:12 PM, on 7/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\robert\Desktop\Files\Hold\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {9964B2EF-BEA6-4B88-940D-A27310F9BF3B} - C:\WINDOWS\System32\pcl.dll
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shock...ash/swflash.cab
07-10-2004, 10:45 AM
Ariel_001

Ok there are some thing that would worry me for sure.....

Code:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\robert\LOCALS~1\Temp\sp.html

All that points to your %temp% folder and is all the same file. Delete it

Also this would worry me...

Code:

BHO: (no name) - {9964B2EF-BEA6-4B88-940D-A27310F9BF3B} - C:\WINDOWS\System32\pcl.dll
07-10-2004, 12:18 PM
Rastapopoulos

Yes what Ariel said, delete them all.
07-10-2004, 12:57 PM
muchspl2

http://members.cox.net/ot_space/spyware.jpg
07-10-2004, 01:29 PM
[B][O][T]

:rolleyes: lol yeah, it's getting more and more common now....

Use Firefox and You'll be safe :)

BOT
07-10-2004, 03:47 PM
{%shellshock%}

Alright im going to use firefox from now no.this browser just get's hijacked too much.Thanks for your help :)
07-10-2004, 04:04 PM
[B][O][T]

:beerchug: congrats :)

BOT
07-10-2004, 04:23 PM
Ariel_001

Quote:

Originally posted by muchspl2@10 July 2004 - 09:05
http://members.cox.net/ot_space/spyware.jpg

OMG. This is what happends when you click yes to every Activex install question.

If you did that I am afraid no browser can help you. (spyware attacks firefox too).
07-10-2004, 04:40 PM
{%shellshock%}

Quote:

Originally posted by muchspl2@10 July 2004 - 13:05
http://members.cox.net/ot_space/spyware.jpg

:lol: :lol: :lol:
07-10-2004, 09:02 PM
muchspl2

try to do a search, all the tool bars have a fight for the re-direct