re: IE6 won't let me make msn default search engine
Friday, November 7, 2003 at 8:37 pm
Windows 98 Annoyances Discussion Forum
Posted by Tony
(1 messages posted)
This is my logfile, and thank you so much for your help (If you read it!!!:))
Logfile of HijackThis v1.97.3
Scan saved at 10:33:54 PM, on 11/7/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
E:\WINNT\System32\svchost.exe
C:\PROGRA~1\norton\NORTON~2\GHOSTS~2.EXE
E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\norton\Norton AntiVirus\navapsvc.exe
C:\Program Files\norton\Norton Utilities\NPROTECT.EXE
E:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
E:\WINNT\system32\regsvc.exe
E:\WINNT\system32\MSTask.exe
C:\PROGRA~1\norton\SPEEDD~1\nopdb.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\system32\MsPMSPSv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\Explorer.exe
E:\Program Files\Common Files\Symantec Shared\SymTray.exe
E:\WINNT\system32\cmd32.exe
E:\WINNT\system32\S3tray2.exe
E:\Documents and Settings\Mysteri\Desktop\HijackThis.exe
E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb07.exe
E:\Program Files\Yahoo!\browser\ybrwicon.exe
E:\Program Files\Symantec\LiveUpdate\AUpdate.exe
E:\Program Files\BroadJump\Client Foundation\CFD.exe
E:\WINNT\System32\P2P Networking\P2P Networking.exe
E:\PROGRA~1\YAHOO!\browser\ycommon.exe
E:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\norton\Norton Ghost\GhostStartTrayApp.exe
C:\program files\altnet\points manager\points manager.exe
E:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
E:\WINNT\SM1BG.EXE
E:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
E:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
E:\Program Files\AIM\aim.exe
E:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe
E:\WINNT\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
E:\Program Files\Microsoft Office\Office10\OSA.EXE
E:\Program Files\WinZip\WZQKPICK.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F0 - system.ini: Shell=Explorer.exe E:\WINNT\system32\cmd32.exe
F2 - REG:system.ini: Shell=Explorer.exe E:\WINNT\system32\cmd32.exe
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - E:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - E:\Program Files\Panicware\Pop-Up
Stopper Pro\CCHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - E:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - E:\WINNT\wsem216.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\norton\Norton
AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - E:\WINNT\nem214.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - E:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program
Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program
Files\norton\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat
6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Pa&nicware Pop-Up Stopper Pro - {B1E741E7-1E77-40D4-9FD8-51949B9CCBD0}
- E:\Program Files\Panicware\Pop-Up Stopper Pro\popuppro.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINNT\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [YBrowser] E:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [BJCFD] E:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [tgcmdprovidersbc] "c:\program files\support.com\bin\tgcmd.exe"
/server /startmonitor /deaf /nosystray
O4 - HKLM\..\Run: [P2P Networking] E:\WINNT\System32\P2P Networking\P2P Networking.exe
/AUTOSTART
O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "E:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\norton\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points
manager.exe -s
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] E:\Program Files\Common Files\Symantec
Shared\Symtray.exe SetReg
O4 - HKLM\..\Run: [RDLL] RunDll16.exe
O4 - HKLM\..\Run: [WCOLOREAL] "E:\Program Files\WayTech\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [PS2] E:\WINNT\system32\ps2.exe
O4 - HKLM\..\Run: [NeroCheck] E:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Internet Optimizer] "c:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe"
-osboot
O4 - HKLM\..\Run: [SM1BG] E:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "E:\Program Files\SBC Yahoo!\Connection Manager\IP
InSight\IPMon32.exe"
O4 - HKLM\..\Run: [82302492.exe] E:\WINNT\System32\82302492.exe
O4 - HKLM\..\RunServices: [RDLL] RunDll16.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [AIM] E:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] E:\PROGRA~1\YAHOO!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = E:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///E:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///E:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Flash Saver (HKLM)
O9 - Extra 'Tools' menuitem: Flash Saver (HKLM)
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download2.abetterinternet.com/download/cabs/FON19106/payload2.cab
O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/ddm_control.CAB
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/FON19106/flash.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/299b8406865c08d57103/netzip/RdxIE601.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup
Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37922.7930671296
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/installs/yab_af.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cab
On Monday, September 1, 2003 at 8:56 pm, Carol wrote:
>
>Kelly, that's the symptoms of a browser hijacker. There's a lot of that going on
>these days. First, run Spybot S&D to clean out as much spyware junk as possible.
>Download Spybot S&D
>
>After installing it, restart your computer. Then load it and go online and download
>"all" updates that aren't optional. Close all browser windows, then start it in
Easy
>mode and run the scan. Then click 'Check All', and fix everything SpybotSD labels
>in red. Restart your computer.
>
>Then download this small application, "Hijack This" and follow instructions and
post
>the logfile.
>
>'Hijack This'
>
>Unzip 'HT' into a new folder. Then double click the .Exe file to run it. Choose
Scan.
>It will display a list. Most of the things you see listed are necessary or required
>entries, so don't fix anything yet. The Scan button will turn into Save Log.Choose
>Save log, then click Edit - Select all and copy/paste the contents of the log file
>in a post, either here, on the Spywareinfo forums or on Spybot's support forums
(last
>link).
>
>If you post here, PLEASE choose this Option below before posting the log, so it
will
>be legible: Check this box to preserve your spacing....
>href="http://www.spywareinfo.com/articles/hijacked/">
>Spywareinfo Hijacking Article
>color="FF69B4">
>So how did I get infected in the first place?
>
>
|
All messages in this thread [show all]
 |  |  | re: IE6 won't let me make msn default search engine (Tony: Fri, Nov 7, 2003, 8:37 pm) |
| |
| |
Return to the Windows 98 Discussion Forum
|
|
