re: Evil "lexplore" virus hijacked me
Tuesday, June 8, 2004 at 2:14 pm
Windows 98 Annoyances Discussion Forum
Posted by Ms. Eagle
(33507 messages posted)
This may work out, but try running Spybot again after fixing these and following
the rest of the instructions. I don't know where it's hanging at, just by those numbers
you posted.
First move HIJACKTHIS into a folder, any folder but a temp folder. It creates backups
and places them in the same location as Hijackthis is in.
Next, uninstall Wild Tangent in Add/Remove programs. Reboot. Run HijackThis. Select
Fix checked. Reboot. Delete the items I mentioned below.
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\BROADJUMP\CLIENT FOUNDATION\CFD.EXE
C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c99&s=search&i=enu
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c99&s=search&i=enu
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c99&s=search&i=enu
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4CE} - :\WINDOWS\DOWNLOADED
PROGRAM FILES\SBCIE026.DLL
O2 - BHO: (no name) - {bcfad060-b146-11d7-8ce3-0008c713a59e} - (no file)
O2 - BHO: (no name) - {08227B4B-54FE-4C4D-809F-BCA46292FC5B} - C:\WINDOWS\SYSTEM\ZEDD4.DLL
O2 - BHO: (no name) - {EFF80427-F837-4B74-8834-BAF18E0553FD} - C:\PROGRA~1\SYSTEM\MISC\MBH19.DLL
(file missing)
O3 - Toolbar: (no name) - {5E92F538-B50B-46c5-9C5F-C6EECED3F6C6} - (no file)
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [OEMCLEANUP] c:\windows\OPTIONS\oemreset.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
-osboot
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKLM\..\RunServices: [HC Reminder] hc.exe
O4 - HKLM\..\RunServices: [Installer] C:\WINDOWS\SYSTEM\WINST.EXE
O4 - HKCU\..\Run: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} (SideStep IE Inst) - http://download.sidestep.com/get/k00719/sb026.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
MiniBug is spyware app installed with Weatherbug spyware app. Not needed-->>
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
Delete the entire TV Media folder:
C:\TV MEDIA\TVM.EXE
Delete these files->>
C:\WINDOWS\SYSTEM\ZEDD4.DLL
C:\WINDOWS\SYSTEM\WINST.EXE
Wild Tangent folder/files. Look for a WT folder containing these files, delete if
there->>
C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
Download this IEFIX.reg file to your Desktop. Double-click on it and answer Yes,
to merge into your registry. It will restore all the default Search settings for
IE.
SpywareInfo.com-IEFIX.reg
|
All messages in this thread [show all]
 | | | | | | | | | | |  | re: Evil "lexplore" virus hijacked me (Ms. Eagle: Tue, Jun 8, 2004, 2:14 pm) |
| |
| |
Return to the Windows 98 Discussion Forum
|
|
