got it and can't get rid of it

crusader · Cadet Joined: Mar 18, 2004 Posts: 2 Location: USA

I did a dumb thing . A really dumb thing . I downloaded a FREE emotes( yea right) and I got a boat load of junk and crap I can't get rid of. I hate the popnav that comes up now instead of my Yahoo home page. and the IE search the internet and party poker, 3 new Icons on my desk top. HOw do I get rid of these. Somehow my ad aware and spy nuker fell asleep. I am not very computer literate and will need a lot of help. HELP

_lueychun · Posted: Fri Mar 19, 2004 6:35 am Post subject:

Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Unzip to a convenient permanent folder, double click HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

PhilL_2oo4 · Cadet Joined: Apr 04, 2004 Posts: 3 Location: Australia

Hey i got the exactly the same problem and its fuckin annoying, i dont what you said and got the log file from hijack this, here it is

C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\svchost.exe
C:\Program Files\CursorXP\CursorXP.exe
c:\program files\warcraft iii\war3.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://about-blank.ws/page/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://about-blank.ws/page/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://about-blank.ws/page/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://about-blank.ws
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://about-blank.ws
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://about-blank.ws/page/
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://about-blank.ws/page/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://about-blank.ws
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://about-blank.ws/page/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://about-blank.ws/page/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://about-blank.ws
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://about-blank.ws/page/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://213.159.118.226/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Network Service] C:\WINDOWS\svchost.exe -sr -1
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Network Service] C:\WINDOWS\svchost.exe -sr -1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O13 - DefaultPrefix: http://about-blank.ws/page/
O13 - WWW Prefix: http://about-blank.ws/page/
O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\en.exe
O16 - DPF: {11111111-1111-1111-1111-111111111111} - mhtml:file://C:NXSFT.MHT!http://66.117.38.54:80/iex/ofile.exe?url=http://66.117.38.54:80/dexAU630.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200...taller.exe
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me...Client.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc...wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{52115F95-C991-4ED3-98F6-D19CFB6D3674}: NameServer = 203.194.56.150 203.194.27.57
O19 - User stylesheet: C:\WINDOWS\system32\ea441.t9n

These were the results any chance you can help me out and tell me whats happening

_lueychun · Posted: Mon Apr 05, 2004 8:41 am Post subject:

No vulgar language, please. And could you please start a new thread on your own, post your HijackThis log there and message me. i will attend to you as soon as possible.

norsky · Cadet Joined: Apr 07, 2004 Posts: 1 Location: USA

I, too, am having the same problem. I have deleted the trojan files which seem to be responsible for this problem from my computer. The creation of icons on my desktop and spontaneous opening of internet explorer has been prevented. However, I am not able to remove the message about Party Poker at the top of every webpage that I visit after typing in the web address. If I only click on old pages in my history, I avoid this problem, but obviously I would like to be able to remove the party poker advertisement from the pages that I manually try to visit. Please help!!
Thank you so much for any input that you may have to share!


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 622 pages served in previous 5 minutes. Page Generation: 0.728 seconds.