Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

"about:blank" hijacker

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

"about:blank" hijacker

Unread postby NormanB » May 24th, 2005, 9:11 pm

I am not that computer savy and need specific instructions. I am running Windows 98 on a 5 year old Dell. I have Norton AntiVirus 2005 on my computer (I have been having trouble getting Live UpDate, but that's another problem). The hijack problem started about a month ago, when I started having problems with Live UpDate. My browser has been hijacked and my home page set to "about:blank". I have run CWShredder, spybot, and Ad-aware. Ad-aware finds and corrects 4 Reg keys. My home page is then back to MSN. In less that five minutes it goes back to "about:blank". Also, the hijacker puts four items on my Favorite's List. I delete them but they keep returning. I also keep getting a pop up ad saying "Only The Best" in the blue bar at top of ad. I have also run Hijack This, but am unable to run a log. I save the log to the desk top but when I try to open it the gray dialog box just come back up.
Thanks for any help
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm
Advertisement
Register to Remove

Unread postby Bertha » May 25th, 2005, 5:44 am

Hey Norman,

This part of your problem is confusing,

am unable to run a log. I save the log to the desk top


You say you cant run Hijackthis, yet you save a Log file?

Could you explain this in more detail, it may be that we need to try another version of HJT first

What version of Hijackthis are you using?

Bertha
User avatar
Bertha
Admin/Teacher Emeritus
 
Posts: 2053
Joined: February 6th, 2005, 1:17 pm
Location: Midlands

Unread postby ChrisRLG » May 25th, 2005, 6:28 am

NormanB

http://www.russelltexas.com/malware/faqhijackthis.htm

That FAQ page may help you set up HJT to be able to run it, in particular as you are running win98 you need a tool to unzip the zipped version if that was the download you got, if so go back to the downloads page at the top of this forum and download the exe or selfinstalling versions which are on that page.
ChrisRLG
Administrator Emeritus
 
Posts: 17759
Joined: December 16th, 2004, 10:04 am
Location: Southend, Essex, UK

Unread postby NormanB » May 25th, 2005, 8:27 am

Thanks for the replies. I had downloaded Hijack This from ZIP. I can run it by clicking on HijacjThis.exe. The program runs and I then select fix the items R1 R0 but it doesn't delete them. I tried going to the uninstall Hijack this and then redownloading. What I still can't do is open the Hijack This Log. When I click on the log icon the dialog box comes up. Even when I click on Open the same dialog box pops up. I am at work right now. When I go home for lunch I will try the link I was sent in the second post to my problem.
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby Perculator » May 25th, 2005, 8:46 am

Please listen..

open this topic you want to post in

Run the Hijack This.exe choose Do a system scan and save a logfile

When the program did its work, a notepadfile will open itself, in that notepadfile your cursor is blinking and all you have to do is press control + A to slect the text and then control + C to copy the text and then click with the mousecursor in the screen where you want to post and click control + v
Now your log is posted here.....

so there's no need to re-open your file just follow this instruction, and we will see your log soon :-)

Please don't fix things withhout sufficient knowledge about Hijack This logs, you might ruin your computer .....and second the infection you have will re-appear and reappear, till you fix it in the right way.
User avatar
Perculator
Regular Member
 
Posts: 470
Joined: March 30th, 2005, 4:55 pm
Location: netherlands

Unread postby NormanB » May 25th, 2005, 12:14 pm

I still can't get the log to open. I run Hijackthis.exe and it shows all the possible problems. I have two versions of Hijakthis on my computer 1.97.7 and 1.99.1. I have tried to uninstall them but nothing happens when select uninstall in the Hijackthis utility.

When i try to open the log file the File Download Dialog Box just keeps popping back up.
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby Bertha » May 25th, 2005, 2:55 pm

Hey Norman,

When you open Hijackthis (version 1.99.1) and you click on "do a system scan and save logfile" make sure you let it run, takes about 30 seconds

Then once it has run Notpead should open automatically with the results from the scan in it, then you post what is in the notepad onto the forum

Is notepad opening when you perform a scan?

I may need to talk you through it in the Chat Room here at Malware Removal if we seem to be getting no where

Bertha
User avatar
Bertha
Admin/Teacher Emeritus
 
Posts: 2053
Joined: February 6th, 2005, 1:17 pm
Location: Midlands

Unread postby NormanB » May 25th, 2005, 7:42 pm

Bertha,

Thanks for trying to help. I run Hijackthis version 1.99.1. When its done I get a list of possible things to fix. The list starts with R1 then R0 then 02, etc. I can't copy that list. At the bottom of screen, in the box labeled scan&fix stuff there is a button save log. I save log to a folder on my desktop but when I try to open the file it won't open. If I need to go to chat room how do I do that? Hard tobelieve but I have never used a chat room.
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

LOG of Sweep

Unread postby NormanB » May 25th, 2005, 8:49 pm

I was able to download SpySweep which had been recomended. Here is the log of their sweep:
07:56 PM: |··· Start of Session, Wednesday, May 25, 2005 ···|
07:56 PM: Spy Sweeper 3.5.0 (Build 199) started
07:56 PM: Updating spyware definitions
07:57 PM: Your spyware definitions have been updated.
08:01 PM: Sweep initiated using definitions version 491
08:01 PM: Sweeping memory for threats.
08:01 PM: Found: Memory-resident threat CWS_TINY0, version 1
08:01 PM: Found: Memory-resident threat CWS_TINY0, version 1
08:01 PM: Memory sweep has completed. Elapsed time 00:00:31
08:01 PM: Registry sweep initiated.
08:01 PM: Found: 14 @WinSpy registry traces.
08:02 PM: Found: 10 CWS MasterSearch Hijacker registry traces.
08:02 PM: Found: 35 CWS_NS3 registry traces.
08:02 PM: Found: 7 CWS_NS3 Hijacker registry traces.
08:02 PM: Found: 8 CWS_TINY0 registry traces.
08:02 PM: Found: 13 Heretofind registry traces.
08:02 PM: Found: 1 Locators Toolbar registry traces.
08:02 PM: Found: 57 PurityScan registry traces.
08:02 PM: Found: 7 Spad registry traces.
08:02 PM: Found: 4 ABetterInternet registry traces.
08:02 PM: Found: 27 WildMedia registry traces.
08:02 PM: Registry sweep completed. Elapsed time 00:01:40
08:02 PM: Full sweep on all local drives initiated.
08:02 PM: Now sweeping drive C:
08:02 PM: Found: @WinSpy, version 2.0
08:05 PM: Found System Monitor: @WinSpy, version 2.0, c:\windows\system\winspy.tlb
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\sdkqi.exe
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\sdkzz.exe
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\addva32.exe
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\addxc.exe
08:05 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\system\tyhbr.dll
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\sdkut32.exe
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\ntsx.exe
08:05 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\system\jufiu.dll
08:05 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\system\epjtw.dll
08:05 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\system\mmuvm.dll
08:05 PM: Found Adware: CWS_TINY0, version 1, c:\windows\system\netht.exe
08:05 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\system\xnmve.dll
08:08 PM: Found Cookie: 6425137 Cookie, version 1, c:\windows\cookies\default@6425137[2].txt
08:08 PM: Found Cookie: Server.iad.Liveperson Cookie, version 1, c:\windows\cookies\default@server.iad.liveperson[2].txt
08:08 PM: Found Cookie: go.com Cookie, version 1, c:\windows\cookies\default@go[1].txt
08:08 PM: Found Adware: PurityScan, version 1, c:\windows\downloaded program files\mediaticketsinstaller.ocx
08:08 PM: Found Adware: CoolWebSearch (CWS), version 1, c:\windows\favorites\seven days of free porn.url
08:08 PM: Found Adware: CoolWebSearch (CWS), version 1, c:\windows\favorites\only sex website.url
08:08 PM: Found Adware: CoolWebSearch (CWS), version 1, c:\windows\favorites\search the web.url
08:09 PM: Found System Monitor: @WinSpy, version 2.0, c:\windows\desktop\downloads\wssetup.exe
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\ifclrb.dat
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\sdksr.exe
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\jfmcoo.log
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\pfodj.dll
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\xdsmfi.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\ajotsu.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\erqya.dll
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\ntav.exe
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\bpeukc.dat
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\crgy.exe
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\d3zl.exe
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\iplm32.exe
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\iqcugr.dat
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\wincn.exe
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\hyxrd.dll
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\vxmjhi.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\eilpix.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\rgwed.dll
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\gjgro.dll
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\btfqo.dll
08:10 PM: Found Adware: CWS_TINY0, version 1, c:\windows\craq.exe
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\ucrfjc.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\rpidw.dll
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\jhwcuz.dat
08:10 PM: Found Adware: CWS-AboutBlank, version 1, c:\windows\tfmhxd.txt
08:15 PM: Found: DiallerProgram, version 1
08:15 PM: Found: @WinSpy, version 2.0
08:15 PM: Found: Spad, version 1
08:17 PM: Found System Monitor: @WinSpy, version 2.0, c:\program files\winspy\winspy.chm
08:17 PM: Found: 57 file traces.
08:17 PM: Full Sweep has completed. Elapsed time 00:18:20
25,649 fil08:38 PM: |··· Start of Session, Wednesday, May 25, 2005 ···|
08:38 PM: Spy Sweeper 3.5.0 (Build 199) started

Thanks for any help
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby ChrisRLG » May 26th, 2005, 4:14 am

NormanB

That log does show you infected, but we do need that HJT log to be able to give advice.

The chat room - at the top of this page is a link to the IRC Chat Room Click that it will take you to a page with a big 'clickhere' to enter link.

That will open a window which will be a chat room window for you to talk.

A few points on that window:-

1. do not click the rooms button, it could take ages to show you the thousands of rooms avaialable.

2. Do not close the window as it will break the connection while you are talking.

3. On the right hand side it will show a link of people in that room. Two of which are not real people, ChanBot and Angel-Logger are room roBOTS who look after and log the words 'spoken'. So they cannot answer back or help you.

So if those two are the only people in the room you will need to come back at another time when the room has proper 'people' to help you. I will be on normally from approx 8pm UK time (1 pm US Central) but other people are available at different times.

Please speak (type) a message when you come in and if you can provide a link to this topic. Ask the person who is helping you to assist you to getting a HJT log posted so we (or they) can help you.

If you type (exactly) the name of someone in the room, it will normally make thier computer beep, warning them someone is trying to talk to them. Be aware that it is sometimes a few minutes before you might get a reply, I when I am on Chat have some 10 of those rooms open at the same time, so can be busy.
ChrisRLG
Administrator Emeritus
 
Posts: 17759
Joined: December 16th, 2004, 10:04 am
Location: Southend, Essex, UK

Unread postby NormanB » May 26th, 2005, 7:51 am

Bertha,

Thanks. I am in eastern US. I will try the chat room today around noon. I can't figure out why I was able to run Spy Sweep and get a log and not HJT.
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby NormanB » May 26th, 2005, 6:55 pm

I will try the chat room to see if I can get the log to copy. In the mean time I copied down all of the "R"s and am posting them here.

R1 HKCU\software\microsoft\InternetExplorer\main,searchbar=res://c:\windows\system\xnmve.dll/sp.html#37049

R1 HKCU\software\microsoft\InternetExplorer/main,searchpage=res://c:\windows\system\xnmve.dll/sp.html#37049

R0 HKCU\software\microsoft\InternetExplorer/main,startpage=about:blank

R1 HKLM\software\microsoft\InternetExplorer/main,default_page_url=about blank

R1 HKLM\software\microsoft\InternetExplorer/main,default_search_url=res://c:\windows\system\xnmve.dll/sp.html#37049

R1 HKLM\software\microsoft\InternetExplorer/main,search bar=res://c:\windows\system\xnmve.dll/sp.html#37049

R1 HKLM\software\microsoft\InternetExplorer/main,search page=res://c:\windows\system\xnmve.dll/sp.html#37049

R0 HKLM\software\microsoft\InternetExplorer/main,startpage=about blank

R1 HKCU\software\microsoft\InternetExplorer/searchassistant=res://c:\windows\system\xnmve.dll/sp.html#37049

R0 HKLM\software\microsoft\InternetExplorer/searchassistant=res://c:\windows\system\xnmve.dll/sp.html#37049

R3 Default url searchassistant is missing

There were othe items also listed but they didn't begin with "R"
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby Bertha » May 27th, 2005, 3:14 am

Hey Norman,

Sorry I wasnt around yesterday,

Anyway from those R Lines we can say that you have About Blank 2/4, now all we need to do is get the rest of the Hijackthis Log

Ill keep haniging aroudn in the chat room, just incase you turn up in there, but as you said you are in the US and Im across the pond

Bertha
User avatar
Bertha
Admin/Teacher Emeritus
 
Posts: 2053
Joined: February 6th, 2005, 1:17 pm
Location: Midlands

Unread postby NormanB » May 27th, 2005, 2:03 pm

Bertha,
Thanks for trying to help me. I went in chat room yesterday but I never hit enter after I typed a question so I guess it didn't post. Anyway I am there now, Friday 2pm eastern US (daylight Savings Time). If you let me know around a good time to try today or over the weekend I'll give it another shot.
I run HJT by hitting run scan and save log. There is a large box that is open even before I hit scan. After the scan all the items appear in that box with a small square in front of each line. It says to check each square it delete or fix that line. Also, a dialog box pops up for the log and asks to open, save, or cancel. Nothing happens if I hit open. If I hit save it asks me where to save. I pick a folder and save it. Then when I hit open nothing happens. Is there a virus or something that has stopped me getting a log?
I have typed HJT in the find folders menue and it brings up a couple of versions of HJT on my computer. I had used HJT last year. I have tried to uninstall them but they don't uninstall.

Norman
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm

Unread postby NormanB » May 27th, 2005, 2:22 pm

Here it is.

Logfile of HijackThis v1.97.7
Scan saved at 2:22:04 PM, on 5/27/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\HPOOPM07.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP OFFICEJET K SERIES\BIN\HPODEV07.EXE
C:\PROGRAM FILES\CHECKIT\86\CHECKIT86.EXE
C:\WINDOWS\SYSTEM\D3VK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\D3TJ32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\DOWNLOADS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\xnmve.dll/sp.html#37049
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E6A72EF0-3235-8BD6-C66C-9125C3686A14} - C:\WINDOWS\WINFW32.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\stimon.exe
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [D3TJ32.EXE] C:\WINDOWS\D3TJ32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [D3VK.EXE] C:\WINDOWS\SYSTEM\D3VK.EXE /s
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet K Series\bin\hpodev07.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: CheckIt 86.lnk = C:\Program Files\CheckIt\86\CheckIt86.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Add To CheckIt &86 Trust List - C:\PROGRA~1\CHECKIT\86\AddToTrustList.js
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra 'Tools' menuitem: CheckIt &86 (HKLM)
O9 - Extra button: Microsoft® JavaScript® Console (HKLM)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKLM)
O9 - Extra button: Dell Home (HKCU)
O9 - Extra button: Microsoft® JavaScript® Console (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console (HKCU)
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7669444444
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsup ... veData.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} (GDIChk Object) - http://www.microsoft.com/security/contr ... GDIChk.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsup ... mAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsup ... SupCtl.cab
NormanB
Regular Member
 
Posts: 20
Joined: May 24th, 2005, 8:58 pm
Advertisement
Register to Remove

Next

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 497 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware