[Mammal]

Whatever happened I struggled to get back to this site without allowing my firewall
to allow all traffic. but here is my log from STARTDRECK

tartDreck (build 2.1.5 public BETA) - 2004-06-30 @ 13:29:20
Platform: Windows 98 SE (Win 4.10.2222 A)

»Registry
»Run Keys
»Current User
»Run
*FreeMem Pro="C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
*Desktop Architect="C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
»RunOnce
»Default User
»Run
*FreeMem Pro="C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
*Desktop Architect="C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
»RunOnce
»Local Machine
»Run
*ScanRegistry=C:\WINDOWS\scanregw.exe /autorun
*SystemTray=SysTray.Exe
*SmcService=C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
*StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE
*REGSHAVE=C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
*AVG_CC=C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
*CriticalUpdate=C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
*TaskMonitor=C:\WINDOWS\taskmon.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*gnetmous=C:\Gmouse\gnetmous.exe
*CHotkey=mHotkey.exe
*WinDVRCtrl=C:\WINDOWS\WDVRCtrl.exe
*Lexmark X1100 Series="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
*LexStart=lexstart.exe
»RunOnce
»RunServices
*SmcService=C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
*Avgserv9.exe=C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
*LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
*SchedulingAgent=mstask.exe
»RunServicesOnce
»RunOnceEx
»RunServicesOnceEx
»Files
»System/Drivers
»Running Processes
*FFCFD325=C:\WINDOWS\SYSTEM\KERNEL32.DLL
*FFFF84C1=C:\WINDOWS\SYSTEM\MSGSRV32.EXE
*FFFF9271=C:\WINDOWS\SYSTEM\MPREXE.EXE
*FFFE0559=C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
*FFFE934D=C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
*FFFD69C1=C:\WINDOWS\SYSTEM\MSTASK.EXE
*FFFD4F6D=C:\WINDOWS\SYSTEM\PTUDFAPP.EXE
*FFFD352D=C:\WINDOWS\SYSTEM\mmtask.tsk
*FFFD0931=C:\WINDOWS\SYSTEM\DDHELP.EXE
*FFFDF449=C:\WINDOWS\EXPLORER.EXE
*FFFC7881=C:\WINDOWS\SYSTEM\SYSTRAY.EXE
*FFFC39FD=C:\WINDOWS\SYSTEM\STIMON.EXE
*FFFCC0CD=C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
*FFFC8B5D=C:\WINDOWS\TASKMON.EXE
*FFFB5BE1=C:\GMOUSE\GNETMOUS.EXE
*FFFB18AD=C:\WINDOWS\MHOTKEY.EXE
*FFFBD1A1=C:\WINDOWS\WDVRCTRL.EXE
*FFFBAD19=C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
*FFFB8B25=C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE
*FFFA6369=C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE
*FFFE00E1=C:\WINDOWS\SYSTEM\RNAAPP.EXE
*FFFBBA25=C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
*FFFC6B89=C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
*FFFA17C1=C:\WINDOWS\SYSTEM\LEXBCES.EXE
*FFFCC719=C:\WINDOWS\SYSTEM\TAPISRV.EXE
*FFFA0279=C:\WINDOWS\SYSTEM\WMIEXE.EXE
*FFFC1AD5=C:\WINDOWS\SYSTEM\RPCSS.EXE
*FFF949E9=C:\WINDOWS\SYSTEM\LEXPPS.EXE
*FFF8EDC1=C:\WINDOWS\NOTEPAD.EXE
*FFF87371=C:\UNZIPPED\STARTDRECK\STARTDRECK.EXE
»Application specific

If I were to install a diferent Browser eg, Mozilla Firefox would this help? I don't want to install and create more problems if my system is unstable. Please advise.

Thanking You

Edited by Mammal, 30 June 2004 - 03:45 AM.

[Advertisements]

Yes, using Mozilla would help prevent infection. Almost every spyware program is written to take advantage of Internet Explorer weaknesses. But first, we need to get these pests off your system. Stick with us, we're almost there! You seem to either have mutiple layers of infection, or you're getting infected as fast as we can remove them. If you don't have all Windows Critical Updates applied, please do so if you're able. Also, please don't visit any sites other than this one until we get your system clean! I'll be around all day and I'll continue checking this thread.

Download and run this file: http://www.geekstogo...=download&id=21

Reboot your PC (this should fix the DLL error, and your Internet connection problems).

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: (no name) - {2D877C0B-3F44-42CD-A283-57AAA9186CB9} - C:\PROGRA~1\GOGODATA.COM\GOGODA~1\GOGODA~1.DLL (file missing)
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O8 - Extra context menu item: Grokster Support - file://C:\Program Files\GroksterSupport\System\Temp\grokstershop_script0.htm

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\PROGRAM FILES\GOGODATA.COM <- this entire folder

You don't seem to have much success removing this folder -> C:\PROGRAM FILES\GOGODATA.COM. Are you able to boot into safe mode, and are your viewing hidden files? Click here -> http://www.xtra.co.n...1916458,00.html

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log

[admin]

Yes, using Mozilla would help prevent infection. Almost every spyware program is written to take advantage of Internet Explorer weaknesses. But first, we need to get these pests off your system. Stick with us, we're almost there! You seem to either have mutiple layers of infection, or you're getting infected as fast as we can remove them. If you don't have all Windows Critical Updates applied, please do so if you're able. Also, please don't visit any sites other than this one until we get your system clean! I'll be around all day and I'll continue checking this thread.

Download and run this file: http://www.geekstogo...=download&id=21

Reboot your PC (this should fix the DLL error, and your Internet connection problems).

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: (no name) - {2D877C0B-3F44-42CD-A283-57AAA9186CB9} - C:\PROGRA~1\GOGODATA.COM\GOGODA~1\GOGODA~1.DLL (file missing)
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O8 - Extra context menu item: Grokster Support - file://C:\Program Files\GroksterSupport\System\Temp\grokstershop_script0.htm

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\PROGRAM FILES\GOGODATA.COM <- this entire folder

You don't seem to have much success removing this folder -> C:\PROGRAM FILES\GOGODATA.COM. Are you able to boot into safe mode, and are your viewing hidden files? Click here -> http://www.xtra.co.n...1916458,00.html

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log

[Mammal]

G'Day here we go again, well first when I tried to run that program to fix my connection problems, my computer would just reboot and then I had to reload dialup connections from my CD, this has enabled me to access the net, but not through the normal desktop shortcut, I just get a message "cannot find server", but I can connect through My Computer >Dialup Connections,
Any way here is my Log

Logfile of HijackThis v1.97.7
Scan saved at 1:38:39 PM, on 7/1/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\PTUDFAPP.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\TASKMON.EXE
C:\GMOUSE\GNETMOUS.EXE
C:\WINDOWS\MHOTKEY.EXE
C:\WINDOWS\WDVRCTRL.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE
C:\PROGRAM FILES\LEXMARK X1100 SERIES\LXBKBMON.EXE
C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bigpond.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\SYGATE\SPF\SMC.EXE -startgui
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [gnetmous] C:\Gmouse\gnetmous.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [WinDVRCtrl] C:\WINDOWS\WDVRCtrl.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\RunServices: [SmcService] C:\PROGRAM FILES\SYGATE\SPF\SMC.EXE
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [FreeMem Pro] "C:\PROGRAM FILES\FREEMEM STANDARD\FREEMEM.EXE" Startup
O4 - HKCU\..\Run: [Desktop Architect] "C:\PROGRAM FILES\DESKTOP ARCHITECT\DATRAY.EXE" -S
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra 'Tools' menuitem: GoGoData ToolBar (HKLM)
O9 - Extra button: Popup Slapdown Options (HKLM)
O9 - Extra button: Bug Swatter Options (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...7976.0135069444
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.micro...rchsettings.cab

[admin]

Try running this file again http://www.geekstogo...=download&id=21, and then reinstall your dial-up software. Your connection was damaged by the spyware, but it's all gone now.

Congratulations! Your system is CLEAN

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use).

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.
Link to SpywareBlaster: http://www.geekstogo...tion=show&id=12

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

It's okay to delete the Hijack This folder if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.