I was infected with a cws, after many removal attempts by different companies--
xoftspy did the trick for the most part -- it rmoved trojans-- realsearc.cc went away from home page -- also adult link from favorites-- and little annoying error message from the trojan that i was infected.
i have removed 015 trusted site from hijackthis, I also have removed it from internet options , security and even added it to restricted site. somethin changes it all back when CLOSING IE browser ONLY and 4or5 69sexsearch pop ups or pages come up.
Thanks Jaime
anyway, here is my latest hijackthis log:
Logfile of HijackThis v1.99.0
Scan saved at 6:44:11 AM, on 12/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\AT&T\DSL\programs\dslpca.exe
C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\RTDLDANI.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Paltalk\pnetaware.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jaime A\Local Settings\Temp\Temporary Directory 4 for hijackthis[1].zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AT&T DSL Service PCA Program] C:\Program Files\AT&T\DSL\programs\dslpca.exe /ws
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [tibs3] C:\WINDOWS\System32\tibs3.exe
O4 - HKLM\..\Run: [SpyBlocs3.0] C:\Program Files\SpyBlocsv3.0\SpyBlocs3.0.exe
O4 - HKLM\..\Run: [DEAF89C6] C:\WINDOWS\system32\RTDLDANI.exe
O4 - HKLM\..\Run: [CDEEC95E] C:\WINDOWS\system32\LIBOMONFM.exe
O4 - HKLM\..\Run: [0C0F99CE] C:\WINDOWS\system32\VTAPELC.exe
O4 - HKLM\..\Run: [B6DB6266] C:\WINDOWS\system32\UPSLIOMU.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [D2041AF6] C:\WINDOWS\system32\tl7UTO.exe
O4 - HKLM\..\Run: [DAE8CC6E] C:\WINDOWS\system32\eamSOC.exe
O4 - HKLM\..\Run: [1370B976] C:\WINDOWS\system32\DSNWILT.exe
O4 - HKLM\..\Run: [DF6D9B73] C:\WINDOWS\system32\UDROW.exe
O4 - HKLM\..\Run: [B9641676] C:\WINDOWS\system32\AMWIAS.exe
O4 - HKLM\..\Run: [D0893DD3] C:\WINDOWS\system32\OPSDI.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [BAEB657E] C:\WINDOWS\system32\CTLIBPT3.exe
O4 - HKLM\..\Run: [44675DF6] C:\WINDOWS\system32\CTMGILT.exe
O4 - HKLM\..\Run: [E3C855C3] C:\WINDOWS\system32\CLUIDSUDIO.exe
O4 - HKLM\..\Run: [034CD186] C:\WINDOWS\system32\DSNol.exe
O4 - HKLM\..\Run: [AB21A606] C:\WINDOWS\system32\ENLUMDIA.exe
O4 - HKLM\..\Run: [A58AE2C6] C:\WINDOWS\system32\DVAXELIB.exe
O4 - HKLM\..\Run: [8C814EC6] C:\WINDOWS\system32\SFERTL30.exe
O4 - HKLM\..\Run: [808A6176] C:\WINDOWS\system32\WRTLBCAT.exe
O4 - HKLM\..\Run: [D56E0A56] C:\WINDOWS\system32\ATStUI.exe
O4 - HKLM\..\Run: [B3626556] C:\WINDOWS\system32\DSUDwgin.exe
O4 - HKLM\..\Run: [FE189846] C:\WINDOWS\system32\DSMSUPSPTDL.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [DEAF89C6] C:\WINDOWS\system32\RTDLDANI.exe
O4 - HKCU\..\Run: [CDEEC95E] C:\WINDOWS\system32\LIBOMONFM.exe
O4 - HKCU\..\Run: [0C0F99CE] C:\WINDOWS\system32\VTAPELC.exe
O4 - HKCU\..\Run: [B6DB6266] C:\WINDOWS\system32\UPSLIOMU.exe
O4 - HKCU\..\Run: [D2041AF6] C:\WINDOWS\system32\tl7UTO.exe
O4 - HKCU\..\Run: [DAE8CC6E] C:\WINDOWS\system32\eamSOC.exe
O4 - HKCU\..\Run: [1370B976] C:\WINDOWS\system32\DSNWILT.exe
O4 - HKCU\..\Run: [DF6D9B73] C:\WINDOWS\system32\UDROW.exe
O4 - HKCU\..\Run: [B9641676] C:\WINDOWS\system32\AMWIAS.exe
O4 - HKCU\..\Run: [D0893DD3] C:\WINDOWS\system32\OPSDI.exe
O4 - HKCU\..\Run: [BAEB657E] C:\WINDOWS\system32\CTLIBPT3.exe
O4 - HKCU\..\Run: [44675DF6] C:\WINDOWS\system32\CTMGILT.exe
O4 - HKCU\..\Run: [E3C855C3] C:\WINDOWS\system32\CLUIDSUDIO.exe
O4 - HKCU\..\Run: [034CD186] C:\WINDOWS\system32\DSNol.exe
O4 - HKCU\..\Run: [AB21A606] C:\WINDOWS\system32\ENLUMDIA.exe
O4 - HKCU\..\Run: [A58AE2C6] C:\WINDOWS\system32\DVAXELIB.exe
O4 - HKCU\..\Run: [8C814EC6] C:\WINDOWS\system32\SFERTL30.exe
O4 - HKCU\..\Run: [808A6176] C:\WINDOWS\system32\WRTLBCAT.exe
O4 - HKCU\..\Run: [D56E0A56] C:\WINDOWS\system32\ATStUI.exe
O4 - HKCU\..\Run: [B3626556] C:\WINDOWS\system32\DSUDwgin.exe
O4 - HKCU\..\Run: [FE189846] C:\WINDOWS\system32\DSMSUPSPTDL.exe
O4 - Startup: HotSync Manager.LNK = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: PalNetaware.lnk = C:\Program Files\Paltalk\pnetaware.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O15 - Trusted Zone: http://*.69sexsearch.com
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.s...sa/LSSupCtl.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsec...an/TDECntrl.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1104235701171
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...sa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{693EF426-076C-4361-9A4F-429C64967C49}: NameServer = 64.105.124.154 64.105.159.250
O17 - HKLM\System\CS1\Services\Tcpip\..\{693EF426-076C-4361-9A4F-429C64967C49}: NameServer = 64.105.124.154 64.105.159.250
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: pcAnywhere Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Sign In
Create Account
