Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

015 Trusted site 69sexsearch will not go away


  • Please log in to reply

#1
jaime

jaime

    New Member

  • Member
  • Pip
  • 5 posts
hello
I was infected with a cws, after many removal attempts by different companies--
xoftspy did the trick for the most part -- it rmoved trojans-- realsearc.cc went away from home page -- also adult link from favorites-- and little annoying error message from the trojan that i was infected.

i have removed 015 trusted site from hijackthis, I also have removed it from internet options , security and even added it to restricted site. somethin changes it all back when CLOSING IE browser ONLY and 4or5 69sexsearch pop ups or pages come up.

Thanks Jaime

anyway, here is my latest hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 6:44:11 AM, on 12/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\AT&T\DSL\programs\dslpca.exe
C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\RTDLDANI.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Paltalk\pnetaware.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jaime A\Local Settings\Temp\Temporary Directory 4 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKLM\..\Run: [SpyBlocs3.0] C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
O4 - HKLM\..\Run: [DEAF89C6] C:\WINDOWS\system32\RTDLDANI.exe
O4 - HKLM\..\Run: [CDEEC95E] C:\WINDOWS\system32\LIBOMONFM.exe
O4 - HKLM\..\Run: [0C0F99CE] C:\WINDOWS\system32\VTAPELC.exe
O4 - HKLM\..\Run: [B6DB6266] C:\WINDOWS\system32\UPSLIOMU.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [D2041AF6] C:\WINDOWS\system32\tl7UTO.exe
O4 - HKLM\..\Run: [DAE8CC6E] C:\WINDOWS\system32\eamSOC.exe
O4 - HKLM\..\Run: [1370B976] C:\WINDOWS\system32\DSNWILT.exe
O4 - HKLM\..\Run: [DF6D9B73] C:\WINDOWS\system32\UDROW.exe
O4 - HKLM\..\Run: [B9641676] C:\WINDOWS\system32\AMWIAS.exe
O4 - HKLM\..\Run: [D0893DD3] C:\WINDOWS\system32\OPSDI.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [BAEB657E] C:\WINDOWS\system32\CTLIBPT3.exe
O4 - HKLM\..\Run: [44675DF6] C:\WINDOWS\system32\CTMGILT.exe
O4 - HKLM\..\Run: [E3C855C3] C:\WINDOWS\system32\CLUIDSUDIO.exe
O4 - HKLM\..\Run: [034CD186] C:\WINDOWS\system32\DSNol.exe
O4 - HKLM\..\Run: [AB21A606] C:\WINDOWS\system32\ENLUMDIA.exe
O4 - HKLM\..\Run: [A58AE2C6] C:\WINDOWS\system32\DVAXELIB.exe
O4 - HKLM\..\Run: [8C814EC6] C:\WINDOWS\system32\SFERTL30.exe
O4 - HKLM\..\Run: [808A6176] C:\WINDOWS\system32\WRTLBCAT.exe
O4 - HKLM\..\Run: [D56E0A56] C:\WINDOWS\system32\ATStUI.exe
O4 - HKLM\..\Run: [B3626556] C:\WINDOWS\system32\DSUDwgin.exe
O4 - HKLM\..\Run: [FE189846] C:\WINDOWS\system32\DSMSUPSPTDL.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [DEAF89C6] C:\WINDOWS\system32\RTDLDANI.exe
O4 - HKCU\..\Run: [CDEEC95E] C:\WINDOWS\system32\LIBOMONFM.exe
O4 - HKCU\..\Run: [0C0F99CE] C:\WINDOWS\system32\VTAPELC.exe
O4 - HKCU\..\Run: [B6DB6266] C:\WINDOWS\system32\UPSLIOMU.exe
O4 - HKCU\..\Run: [D2041AF6] C:\WINDOWS\system32\tl7UTO.exe
O4 - HKCU\..\Run: [DAE8CC6E] C:\WINDOWS\system32\eamSOC.exe
O4 - HKCU\..\Run: [1370B976] C:\WINDOWS\system32\DSNWILT.exe
O4 - HKCU\..\Run: [DF6D9B73] C:\WINDOWS\system32\UDROW.exe
O4 - HKCU\..\Run: [B9641676] C:\WINDOWS\system32\AMWIAS.exe
O4 - HKCU\..\Run: [D0893DD3] C:\WINDOWS\system32\OPSDI.exe
O4 - HKCU\..\Run: [BAEB657E] C:\WINDOWS\system32\CTLIBPT3.exe
O4 - HKCU\..\Run: [44675DF6] C:\WINDOWS\system32\CTMGILT.exe
O4 - HKCU\..\Run: [E3C855C3] C:\WINDOWS\system32\CLUIDSUDIO.exe
O4 - HKCU\..\Run: [034CD186] C:\WINDOWS\system32\DSNol.exe
O4 - HKCU\..\Run: [AB21A606] C:\WINDOWS\system32\ENLUMDIA.exe
O4 - HKCU\..\Run: [A58AE2C6] C:\WINDOWS\system32\DVAXELIB.exe
O4 - HKCU\..\Run: [8C814EC6] C:\WINDOWS\system32\SFERTL30.exe
O4 - HKCU\..\Run: [808A6176] C:\WINDOWS\system32\WRTLBCAT.exe
O4 - HKCU\..\Run: [D56E0A56] C:\WINDOWS\system32\ATStUI.exe
O4 - HKCU\..\Run: [B3626556] C:\WINDOWS\system32\DSUDwgin.exe
O4 - HKCU\..\Run: [FE189846] C:\WINDOWS\system32\DSMSUPSPTDL.exe
O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: PalNetaware.lnk = C:\Program Files\Paltalk\pnetaware.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O15 - Trusted Zone: http://*.69sexsearch.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsec...an/TDECntrl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1104235701171
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{693EF426-076C-4361-9A4F-429C64967C49}: NameServer = 64.105.124.154 64.105.159.250
O17 - HKLM\System\CS1\Services\Tcpip\..\{693EF426-076C-4361-9A4F-429C64967C49}: NameServer = 64.105.124.154 64.105.159.250
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: pcAnywhere Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • 0

Advertisements


#2
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
Welcome jaime. Download and save file -- Unzip. To execute this file: in Explorer - right-click (this file). Select Install from the Menu.

Download here: http://www.geekstogo...=download&id=40

Warning: Deletes all entries in the Restricted & Trusted Zone list

Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants. Afterwards, Please Post a fresh Hijack This log. :tazz:
  • 0

#3
jaime

jaime

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Welcome jaime. Download and save file -- Unzip. To execute this file: in Explorer - right-click (this file). Select Install from the Menu.

Download here: http://www.geekstogo...=download&id=40

Warning: Deletes all entries in the Restricted & Trusted Zone list

Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants. Afterwards, Please Post a fresh Hijack This log. :tazz:

View Post


  • 0

#4
jaime

jaime

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

View Post


Thanks, I will try when I get to the infected PC....LATER TONIGHT 12/30/04

I HAD TRIED TO INSTALL CWSHREDDER YESTERDAY, BUT IE WOULD CRASH AND 69SEXSEARCH WOULD REAPPEAR......



AGAIN THANKS

jAIME
  • 0

#5
jaime

jaime

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Thanks, I will try when I get to the infected PC....LATER TONIGHT 12/30/04

I HAD TRIED TO INSTALL CWSHREDDER YESTERDAY, BUT IE WOULD CRASH AND 69SEXSEARCH WOULD REAPPEAR......
AGAIN THANKS

jAIME

View Post



Hello again

cwshredder is finding none cws, and the unzip link is giving me a bad link message
Thanks

Jaime
  • 0

#6
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
Download: DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.

Post a new HijackThislog please.

Regards,

Pieter
  • 0

#7
jaime

jaime

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks all is well

Happy New Year
  • 0

#8
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
That's good to hear, but I'd rather have another look at your log jaime.

Regards,

Pieter
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP