Hi there....

Thanks so much for your help! I've followed all your instructions. Well i downloaded 
my previous spyware remover, Ad-aware 6.0, from www.lavasoft.com. 

This is the log from the hijack this scan:

Logfile of HijackThis v1.97.7

Scan saved at 1:23:30 PM, on 5/6/04

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Unable to get Internet Explorer version!


Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\INTRENAT.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\RNAAPP.EXE

C:\WINDOWS\SYSTEM\TAPISRV.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE

C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE

C:\WINDOWS\LOADQM.EXE

C:\WINDOWS\RUNDLL32.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE

C:\WINDOWS\SYSTEM\INTERNAT.EXE

C:\PROGRAM FILES\WINAMP3\WINAMPA.EXE

C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE

C:\PROGRAM FILES\ALTNET\POINTS MANAGER\POINTS MANAGER.EXE

C:\ATI\ATIDESK\ATISCHED.EXE

C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE

C:\PROGRAM FILES\IMESH\CLIENT\IMESHCLIENT.EXE

C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\TLA.EXE

C:\PROGRAM FILES\ALTNET\DOWNLOAD MANAGER\ASM.EXE

C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soucn.net

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soucn.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soucn.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soucn.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.soucn.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.soucn.net

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.soucn.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R3 - URLSearchHook: (no name) - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - (no file)

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 
5.0\READER\ACTIVEX\ACROIEHELPER.OCX

O2 - BHO: (no name) - {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe

O4 - HKLM\..\Run: [AtiKey] atiptkad.exe

O4 - HKLM\..\Run: [ATIGART] c:\ATI\GART\ATIGART.exe

O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe

O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe

O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE

O4 - HKLM\..\Run: [LoadQM] loadqm.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe

O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 
-osboot

O4 - HKLM\..\Run: [internat.exe] internat.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"

O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE 
/AUTOSTART

O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points 
Manager.exe -s 

O4 - HKLM\..\Run: [WlN32] regedit -s C:\$NtUninstallQ887508$\WINSYS.cer

O4 - HKLM\..\Run: [Intrenat] C:\WINDOWS\intrenat.exe

O4 - HKLM\..\Run: [IEXPLORE.EXE] IEXPLORE.EXE http://www.soucn.net

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [tlA] C:\WINDOWS\SYSTEM\tlA.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [Intrenat] C:\WINDOWS\intrenat.exe

O4 - HKCU\..\Run: [] regedit -s C:\$NtUninstallQ887508$\WINSYS.cer

O4 - HKLM\..\RunOnce: [WlN32] C:\$NtUninstallQ887508$\WINSYS.vbs

O4 - Startup: ATISched.lnk = C:\ATI\ATIDESK\atisched.exe

O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Allow Popups - C:\Program Files\Meaya\Popup Ad Filter\WhiteGetUrl.js

O9 - Extra button: °Ù¶ÈËÑË÷°é (HKLM)

O11 - Options group: [!IESearch] !IESearch

O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin2.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe

O16 - DPF: {652524F4-F52B-4951-9C1E-30DB62B2B34D} (Yahoo! Photos Easy Upload Tool 
Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_3sg.cab

O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab


The http://www.soucn.net is the website that keeps appearing in my homepage and i 
want to remove it. I have not fixed anything yet from this scan... Do advise me on 
it! Thanks so much....

Jerlyn

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum