Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Would appreciate help with this TNS spyware.


  • This topic is locked This topic is locked

#1
Nickio

Nickio

    New Member

  • Member
  • Pip
  • 2 posts
I'm not quite sure where it came from, but it seems that it's on the family computer and has proven to be quite a nuisance. I've tried everything to my ability with no success, it just keeps manifesting itself. It is a spyware of some type, puts many pop-ups on the screen every so often with an annoying buzzer and a message-box, usually dirty pop-ups, and will throw at least three columns of bad (sex, drugs, etc) icons on the desktop.

Logfile of HijackThis v1.99.1
Scan saved at 6:27:14 PM, on 9/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\svchost.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Nick\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.t...all/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1125619056562
O21 - SSODL: AOL Instant Messenger - {CDE85FEA-EC12-13D1-A093-961F6CDF4542} - c:\program files\aim\vref6.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe

The 'ztoolbar' DLL that usually shows up with TNS's stuff isn't shown in this log becuase I deleted it recently and hasn't came back yet, but when it does I'll post, in the mean time any thoughts on how to get rid of it for good come to mind?
  • 0

Advertisements


#2
Nickio

Nickio

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Nevermind, I got rid of it following steps from another thread in this forum, thanks mr malware surgeon =)
  • 0

#3
g2i2r4

g2i2r4

    retired HiJack Helper

  • Retired Staff
  • 5,080 posts
Thank you for the feedback.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP