Help with Hijackthis

[time_limit0]

Ok I cant get the bad guys from the good guys any help?

 

 

 

 

 

 

 

Logfile of HijackThis v1.97.7

 

 

 

Scan saved at 12:54:42 PM, on 12/17/2005

 

 

 

Platform: Windows XP SP2 (WinNT 5.01.2600)

 

 

 

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

 

 

 

 

 

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.runescape.com/

 

 

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

 

 

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html

 

 

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.gamefiesta.com/search.html

 

 

 

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com

 

 

 

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972}_ - (no file)

 

 

 

R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}_ - (no file)

 

 

 

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

 

 

 

O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)

 

 

 

O2 - BHO: PosHelp - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - (no file)

 

 

 

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

 

 

 

O3 - Toolbar: (no name) - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - (no file)

 

 

 

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32[Caution: ExecutableFile] C:\WINDOWS\System32\NvCpl.dll,NvStartup

 

 

 

O4 - HKLM\..\Run: [nwiz] nwiz[Caution: ExecutableFile] /install

 

 

 

O4 - HKLM\..\Run: [Ad-Aware] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware[Caution: ExecutableFile]" +c

 

 

 

O4 - HKLM\..\Run: [kblog] C:\WINDOWS\Config\kblog[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [spoolsvc] C:\WINDOWS\system32\spoolsvc[Caution: ExecutableFile]

 

 

 

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

 

 

 

O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msgked[Caution: ExecutableFile]

 

 

 

O4 - HKCU\..\Run: [Aida] C:\Documents and Settings\Jordan\Application Data\ttuh[Caution: ExecutableFile]

 

 

 

O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv[Caution: ExecutableFile]

 

 

 

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile]" /background

 

 

 

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager[Caution: ExecutableFile] -quiet

 

 

 

O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather[Caution: ExecutableFile]"

 

 

 

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl[Caution: ExecutableFile]

 

 

 

O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF[Caution: ExecutableFile]

 

 

 

O4 - Global Startup: Storm Team 4.lnk = C:\Program Files\Common Files\Storm Team 4\TrueWeather[Caution: ExecutableFile]

 

 

 

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm

 

 

 

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL[Caution: ExecutableFile]/3000

 

 

 

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm

 

 

 

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm

 

 

 

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm

 

 

 

O9 - Extra button: Advanced Searchbar (HKLM)

 

 

 

O9 - Extra 'Tools' menuitem: Advanced Searchbar (HKLM)

 

 

 

O9 - Extra button: Research (HKLM)

 

 

 

O9 - Extra button: Messenger (HKLM)

 

 

 

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

 

 

 

O10 - Hijacked Internet access by New.Net

 

 

 

O10 - Hijacked Internet access by New.Net

 

 

 

O10 - Hijacked Internet access by New.Net

 

 

 

O10 - Hijacked Internet access by New.Net

 

 

 

O10 - Hijacked Internet access by New.Net

 

 

 

O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/ ... 1/chat.cab

 

 

 

O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/c ... /ct2_x.cab

 

 

 

O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/c ... /nt1_x.cab

 

 

 

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b30149.cab

 

 

 

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://support2.charter.com/sdccommon/d ... gctlcm.cab

 

 

 

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab

 

 

 

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab

 

 

 

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b28578.cab

 

 

 

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

 

 

 

O16 - DPF: {3253534D-9980-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... ms9dmo.cab

 

 

 

O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... p43dmo.CAB

 

 

 

O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9dmo.cab

 

 

 

O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://mirror.worldwinner.com/games/v45/pool/pool.cab

 

 

 

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 3509754579

 

 

 

O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/A ... ngctrl.cab

 

 

 

O16 - DPF: {8A8F3D75-6564-4599-A7DC-313B43A89E1D} (AdInstaller Control) - http://www.movies.net.cn/digital/AdInstaller.ocx

 

 

 

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://mirror.worldwinner.com/games/shared/wwlaunch.cab

 

 

 

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b28578.cab

 

 

 

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - http://fpdownload.macromedia.com/get/sh ... rashim.cab

 

 

 

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab

 

 

 

O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/a ... _en_dl.cab

 

 

 

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZI ... b34246.cab

 

 

 

O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} - http://games-dl.real.com/gameconsole/Bu ... eRdxIE.cab

 

 

 

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Ba ... b30149.cab

 

 

 

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh ... wflash.cab

 

 

 

O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab28578.cab

 

 

 

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab

 

 

 

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.compani ... 3_16_0.cab

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Thanks really help.

[Kcaz1]

http://hijackthis.de/ just go here and past a copy of the hijackthis log and click analyze

 

 

 

 

 

 

 

edit: you should deffinitly delete anything it says is unneccessary or nasty

[blade995]

http://hijackthis.de/ just go here and past a copy of the hijackthis log and click analyze

 

 

 

 

 

 

 

edit: you should deffinitly delete anything it says is unneccessary or nasty

 

 

 

 

 

 

 

That doesn't tell you everything to remove. Sometimes it gives false items to remove also.

 

 

 

 

 

 

 

Your hijackthis is out of date. Download from here http://www.spywareinfo.com/~merijn/

 

 

 

 

 

 

 

Then post a new log.

[Phil]

http://hijackthis.de/ just go here and past a copy of the hijackthis log and click analyze

 

 

 

 

 

 

 

edit: you should deffinitly delete anything it says is unneccessary or nasty

 

 

 

No don't listen to this.

 

 

 

 

 

 

 

hijackthis.de should only be used by people who know what they are doing with logs.

[coltm4carbine]

Don't use it hijackthis.de. It gives out False possitives- and i think it also tells you to fix an o10 (bad idea).

 

 

 

 

 

 

 

I need the running processes part of the log and i give you the fix for new.net when i find it.

 

 

 

 

 

 

 

Edited with canned.

 

 

 

 

 

 

 

I am not going to tell you to fix the entries in HJT cos i need the running processes.

 

 

 

 

 

 

 

new.net fix <- do this first because it messes with your lsp.

 

 

 

 

 

 

 

First, Download LSPFix[Caution: ExecutableFile] to a convenient location. Do NOT run this program. This is only to be used if you lose Internet Access after removing NewDotNet.

 

 

 

 

 

 

 

To Get rid of NewDotNet, go to:

 

 

 

 

 

 

 

Start > Control Panel > Add or Remove Programs and remove the following:

 

 

 

 

 

 

 

New.Net Applications or New.Net Domains (anything that says New.Net)

 

 

 

 

 

 

 

If it is not there, go here and follow Procedure 4: NewDotNet Removal Procedure 4.

 

 

 

 

 

 

 

In the event that you lose Internet access after removing New.Net, please double-click LSPFix[Caution: ExecutableFile] that you downloaded earlier. You will see 2 panels. If there is any file listed in the "Remove" panel on the right-side, leave it as is and just click "Finish>>" then reboot your computer and you should now have access to the Internet. If nothing is listed under the "Remove Panel", do NOT do anything - just close the program. You will need to use another computer to come back here for further instructions on what to do.