Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Hijack this log


  • Please log in to reply

#1
meikko

meikko

    New Member

  • Member
  • Pip
  • 2 posts
I've been getting Messenger Alert Popups directing me to go to any number of websites. When I'm not online, I get dial up requests from light.merked.us and error.merked.us...

I've run adaware, spybot and Norton virus scan, but I'm still getting the popups... I've turned off messenger alerts, but I don't wish to just mask the problem, I'd like to clear it up altogether...

Here's my Hijack this log:

Logfile of HijackThis v1.98.2
Scan saved at 8:08:39 PM, on 9/4/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\inetsrv\inetinfo.exe
C:\Windows\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Windows\System32\smsc.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Windows\System32\wserv32.exe
C:\Windows\System32\scrgrd.exe
C:\Windows\System32\svxhost.exe
C:\Program Files\BrowseBlast Web Accelerator\browseblast.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.cybrquest.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com...PT/0409/bF8.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.cybrquest.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.cybrquest.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\BrowseBlast Web Accelerator\PBHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [System Update] C:\Windows\System32\gknwtq.exe
O4 - HKLM\..\Run: [Microsoft Update] wserv32.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\Windows\System32\skshuv.exe
O4 - HKLM\..\Run: [Microsoft-Updates] svxhost.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wserv32.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunServices: [Microsoft-Updates] svxhost.exe
O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [Microsoft Update] wserv32.exe
O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] smsc.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: BrowseBlast Web Accelerator.lnk = C:\Program Files\BrowseBlast Web Accelerator\browseblast.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = co.lewis.id.us
O17 - HKLM\Software\..\Telephony: DomainName = co.lewis.id.us
O17 - HKLM\System\CCS\Services\Tcpip\..\{29B4E22A-AC30-4CBB-BDFD-4A7F8012E062}: NameServer = 10.249.0.1,12.127.16.68
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = co.lewis.id.us
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = co.lewis.id.us,lewis.id.us,id.us
O17 - HKLM\System\CS1\Services\Tcpip\..\{29B4E22A-AC30-4CBB-BDFD-4A7F8012E062}: NameServer = 10.249.0.1,12.127.16.68
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = co.lewis.id.us
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = co.lewis.id.us,lewis.id.us,id.us
O17 - HKLM\System\CS2\Services\Tcpip\..\{29B4E22A-AC30-4CBB-BDFD-4A7F8012E062}: NameServer = 10.249.0.1,12.127.16.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = co.lewis.id.us,lewis.id.us,id.us


Thanks for any assistance you can offer...
-Meikko
  • 0

Advertisements


#2
Smokey

Smokey

    Member 1K

  • Retired Staff
  • 1,423 posts
Welcome to GTG meikko <_<

You have malware we need to fix, but first you need to apply Windows Critical updates. Without critical updates, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://windowsupdate.microsoft.com/
-or-
Order if you're on dial-up, order a free CD here:
http://www.microsoft...us/default.mspx

Also, see the fourth tweak on this page:
http://www.geekstogo...?showtopic=2780
  • 0

#3
meikko

meikko

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Since I am unable to download anything sucessfully on the affected computer, I've ordered the CD, but its a 4-6 week waiting period... I was planning on completeing necessary updates once the malware was cleaned off...

Any assistance toward this end would be greatly appreciated!!!

-Meikko
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP