Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Please Help with Spyware.Iwantsearch

Started by Feux , Oct 01 2004 01:26 PM

  • Please log in to reply

#1
Feux
Posted 01 October 2004 - 01:26 PM

Feux

    New Member

  • Member
  • Pip
  • 5 posts
Hi
Norton Antivirus detects Spyware.Iwantsearch in
C:\WINDOWS\Downloaded Program Files\rundlg32.dll
Help Please
Thanks

This is my logfile:

Logfile of HijackThis v1.98.2
Scan saved at 21:21:24, on 01/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\TBPanel.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Feux\Desktop\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pt.lu/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102
O17 - HKLM\System\CS2\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102
  • 0

Advertisements

#2
-=jonnyrotten=-
Posted 01 October 2004 - 02:08 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Before you follow throught with these procedures maybe you'll want to read this.

http://www.pestpatro.../f/flashget.asp

And when you decide to get rid of this program then follow through with this.

You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102
O17 - HKLM\System\CS1\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102
O17 - HKLM\System\CS2\Services\Tcpip\..\{89391563-16E9-4459-834D-E457A8E6582E}: NameServer = 194.154.192.101,194.154.192.102

If you decide to keep FlashGet then ignore all the entries referring to FlashGet and definitely remove the rest.

Next step.

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):

C:\Program Files\FlashGet assuming you are removing FlashGet. Before deleting this directory you should try to uninstall it in Add/Remove programs first, then delete the directory.

Next.

Reset your host file. Click Here to download HostsFileReader. To reset the host file to default, simply open the program, click the "reset default" button, and confirm the changes.

Reboot, and rescan with Hijack This and post fresh log. Let us know if the problem is fixed. You will then receive further instructions.

-=jonnyrotten=- <_<
  • 0

#3
Feux
Posted 01 October 2004 - 02:51 PM

Feux

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
After following your instructions I got the following :

Logfile of HijackThis v1.98.2
Scan saved at 22:46:46, on 01/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HJT\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ASUS\Probe\ASUSPROB.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
  • 0

#4
-=jonnyrotten=-
Posted 01 October 2004 - 02:55 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Is that the whole log? I think you missed the very bottom.

-=jonnyrotten=- <_<
  • 0

#5
Smokey
Posted 01 October 2004 - 02:55 PM

Smokey

    Member 1K

  • Retired Staff
  • 1,423 posts
Congratulations! Your system is CLEAN <_<

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use).

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.
Link to SpywareBlaster: http://www.geekstogo...tion=show&id=12

It's also CRITICAL to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

Running an anti-virus and keeping it up-to-date is REQUIRED to keep a clean system. If you don't have one or are sick of paying for what you have, AVG offers a great, free anti-virus:
http://free.grisoft....us/doc/2/tpl/v5

A firewall is also another MUST. If you do not have one or Windows XP Service Pack 2, both Zone Labs and Sygate offer great, free firewalls. I suggest using Zone Alarm for an advanced user or Sygate Personal Firewall for beginner users.

These next two steps are optional, but will provide the greatest protection.
1. Use ANY browser at all times besides Internet Explorer, almost every exploit is crafted to take advantage of an IE weakness. We usually recommend Firefox (You'll need to use IE only to visit Windows Update).
2. Install Sun's Java. It's much more secure than Microsoft's Java Virtual Machine.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats. :D
  • 0

#6
Feux
Posted 01 October 2004 - 02:58 PM

Feux

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Yes it is the whole log !

Did I something wrong ???
  • 0

#7
Feux
Posted 01 October 2004 - 03:09 PM

Feux

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Now I have make a Norton Antivirus scan
and Norton always find

rundlg.dll Spyware.Iwantsearch Spyware found Delete failed

?????????????
  • 0

#8
-=jonnyrotten=-
Posted 01 October 2004 - 04:09 PM

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Reboot in safe mode, click start, and click search. Search for files and folders
Type rundlg.dll make sure it is exactly the same file name and delete it.

-=jonnyrotten=- <_<
  • 0

#9
Feux
Posted 03 October 2004 - 06:27 AM

Feux

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
OK got it

now it's clean

Thanks to all
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP