Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Please view my log for nasties and please let me k [CLOSED]


  • This topic is locked This topic is locked

#16
Mammal

Mammal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
Whatever happened I struggled to get back to this site without allowing my firewall
to allow all traffic. but here is my log from STARTDRECK

tartDreck (build 2.1.5 public BETA) - 2004-06-30 @ 13:29:20
Platform: Windows 98 SE (Win 4.10.2222 A)

舞egistry
舞un Keys
翟urrent User
舞un
*FreeMem Pro="C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
*Desktop Architect="C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
舞unOnce
聞efault User
舞un
*FreeMem Pro="C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
*Desktop Architect="C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
舞unOnce
腿ocal Machine
舞un
*ScanRegistry=C:\WINDOWS\scanregw.exe /autorun
*SystemTray=SysTray.Exe
*SmcService=C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
*StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE
*REGSHAVE=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
*AVG_CC=C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
*CriticalUpdate=C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
*TaskMonitor=C:\WINDOWS\taskmon.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*gnetmous=C:\Gmouse\gnetmous.exe
*CHotkey=mHotkey.exe
*WinDVRCtrl=C:\WINDOWS\WDVRCtrl.exe
*Lexmark X1100 Series="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
*LexStart=lexstart.exe
舞unOnce
舞unServices
*SmcService=C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
*Avgserv9.exe=C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
舞unServicesOnce
舞unOnceEx
舞unServicesOnceEx
肇iles
艋ystem/Drivers
舞unning Processes
*FFCFD325=C:\WINDOWS\SYSTEM\KERNEL32.DLL
*FFFF84C1=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
*FFFF9271=C:\WINDOWS\SYSTEM\MPREXE.EXE
*FFFE0559=C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
*FFFE934D=C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
*FFFD69C1=C:\WINDOWS\SYSTEM\MSTASK.EXE
*FFFD4F6D=C:\WINDOWS\SYSTEM\PTUDFAPP.EXE
*FFFD352D=C:\WINDOWS\SYSTEM\mmtask.tsk
*FFFD0931=C:\WINDOWS\SYSTEM\DDHELP.EXE
*FFFDF449=C:\WINDOWS\EXPLORER.EXE
*FFFC7881=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
*FFFC39FD=C:\WINDOWS\SYSTEM\STIMON.EXE
*FFFCC0CD=C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
*FFFC8B5D=C:\WINDOWS\TASKMON.EXE
*FFFB5BE1=C:\GMOUSE\GNETMOUS.EXE
*FFFB18AD=C:\WINDOWS\MHOTKEY.EXE
*FFFBD1A1=C:\WINDOWS\WDVRCTRL.EXE
*FFFBAD19=C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
*FFFB8B25=C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE
*FFFA6369=C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE
*FFFE00E1=C:\WINDOWS\SYSTEM\RNAAPP.EXE
*FFFBBA25=C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
*FFFC6B89=C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
*FFFA17C1=C:\WINDOWS\SYSTEM\LEXBCES.EXE
*FFFCC719=C:\WINDOWS\SYSTEM\TAPISRV.EXE
*FFFA0279=C:\WINDOWS\SYSTEM\WMIEXE.EXE
*FFFC1AD5=C:\WINDOWS\SYSTEM\RPCSS.EXE
*FFF949E9=C:\WINDOWS\SYSTEM\LEXPPS.EXE
*FFF8EDC1=C:\WINDOWS\NOTEPAD.EXE
*FFF87371=C:\UNZIPPED\STARTDRECK\STARTDRECK.EXE
翠pplication specific

If I were to install a diferent Browser eg, Mozilla Firefox would this help? I don't want to install and create more problems if my system is unstable. Please advise.

Thanking You

Edited by Mammal, 30 June 2004 - 03:45 AM.

  • 0

Advertisements


#17
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
Yes, using Mozilla would help prevent infection. Almost every spyware program is written to take advantage of Internet Explorer weaknesses. But first, we need to get these pests off your system. Stick with us, we're almost there! You seem to either have mutiple layers of infection, or you're getting infected as fast as we can remove them. If you don't have all Windows Critical Updates applied, please do so if you're able. Also, please don't visit any sites other than this one until we get your system clean! I'll be around all day and I'll continue checking this thread.

Download and run this file: http://www.geekstogo...=download&id=21

Reboot your PC (this should fix the DLL error, and your Internet connection problems).

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: (no name) - {2D877C0B-3F44-42CD-A283-57AAA9186CB9} - C:\PROGRA~1\GOGODATA.COM\GOGODA~1\GOGODA~1.DLL (file missing)
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O8 - Extra context menu item: Grokster Support - file://C:\Program Files\GroksterSupport\System\Temp\grokstershop_script0.htm

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\PROGRAM FILES\GOGODATA.COM <- this entire folder

You don't seem to have much success removing this folder -> C:\PROGRAM FILES\GOGODATA.COM. Are you able to boot into safe mode, and are your viewing hidden files? Click here -> http://www.xtra.co.n...1916458,00.html

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log <_<
  • 0

#18
Mammal

Mammal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 29 posts
G'Day here we go again, well first when I tried to run that program to fix my connection problems, my computer would just reboot and then I had to reload dialup connections from my CD, this has enabled me to access the net, but not through the normal desktop shortcut, I just get a message "cannot find server", but I can connect through My Computer >Dialup Connections,
Any way here is my Log

Logfile of HijackThis v1.97.7
Scan saved at 1:38:39 PM, on 7/1/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\PTUDFAPP.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\TASKMON.EXE
C:\GMOUSE\GNETMOUS.EXE
C:\WINDOWS\MHOTKEY.EXE
C:\WINDOWS\WDVRCTRL.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bigpond.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [WinDVRCtrl] C:\WINDOWS\WDVRCtrl.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [FreeMem Pro] "C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
O4 - HKCU\..\Run: [Desktop Architect] "C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra 'Tools' menuitem: GoGoData ToolBar (HKLM)
O9 - Extra button: Popup Slapdown Options (HKLM)
O9 - Extra button: Bug Swatter Options (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7976.0135069444
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.micro...rchsettings.cab
  • 0

#19
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
Try running this file again http://www.geekstogo...=download&id=21, and then reinstall your dial-up software. Your connection was damaged by the spyware, but it's all gone now. :D

Congratulations! Your system is CLEAN <_<

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use).

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.
Link to SpywareBlaster: http://www.geekstogo...tion=show&id=12

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

It's okay to delete the Hijack This folder if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats. :D
  • 0

#20
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP