Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Please help me... DSO, etc.


  • Please log in to reply

#1
umsilver

umsilver

    New Member

  • Member
  • Pip
  • 3 posts
Can someone please help me with my Hijack This log file below. I am having problems with Spybot removing DSO and cleveriehooker.jeired. I also have a rediculous search bar at the bottom of my IE that I can't get rid of.

Thank you in advance.
Chad

Logfile of HijackThis v1.99.0
Scan saved at 9:27:33 AM, on 12/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPTBC.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPVSTOP.EXE
C:\PROGRAM FILES\PROTECTOR PLUS\PPINUPDT.EXE
C:\PROGRAM FILES\MAIL.COM\MCALERT.EXE
C:\PROGRAM FILES\THEWEATHERNETWORK\WEATHEREYE\WEATHEREYE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\COMMON FILES\INTUIT\QUICKBOOKS\QBUPDATE\QBUPDATE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACK THIS\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\TV MEDIA\TvmBho.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [PP2000 Taskbar Control] C:\PROGRA~1\PROTEC~1\PPTbc.EXE
O4 - HKLM\..\Run: [PP2000 Real-time Scan] C:\PROGRA~1\PROTEC~1\PPVstop.exe
O4 - HKLM\..\Run: [PP2000 InstaUpdate] C:\PROGRA~1\PROTEC~1\PPInupdt.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [VERBATIM STORE 'N' G] c:\program files\verbatim store n go\verbatim store 'n' go.exe sys_auto_run C:\PROGRAM FILES\VERBATIM STORE N GO
O4 - HKLM\..\Run: [Free Log Readme Noun] C:\WINDOWS\Application Data\Iso Axis Free Log\Driveuser.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\Run: [Mail.com] C:\Program Files\mail.com\mcalert.exe -auto
O4 - HKCU\..\Run: [WeatherEye] C:\program files\TheWeatherNetwork\WeatherEye\WeatherEye
O4 - HKCU\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServicesOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
  • 0

Advertisements


#2
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,672 posts
First follow instructions here:
http://support.micro...om/?kbid=886590

Then look here:
http://www.majorgeek...wnload4392.html

Then post a new HijackThis log along with any complaints that are left to take care off.

Regards,

Pieter
  • 0

#3
umsilver

umsilver

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Hello,

Tried running the 1st program you mentioned and got these 2 errors:

"The TVMCLN.EXE file is linked to missing export SHELL32.DLL:SHGetFolderPathA"

and

"Error creating process <C:\windows\temp\IXP000.TMP\TVMCln.exe> Reason: A device attached to the system is not functioning"

And I already have Spybot loaded on my computer. It still finds my 2 previously mentioned problems.

This doesn't seem good. Do you have any suggestions?

Chad
  • 0

#4
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,672 posts
Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\TV MEDIA\TvmBho.dll

O4 - HKLM\..\Run: [Free Log Readme Noun] C:\WINDOWS\Application Data\Iso Axis Free Log\Driveuser.exe

O4 - HKLM\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE

O4 - HKCU\..\RunOnce: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServicesOnce: [TV Media] C:\TV MEDIA\TVM.EXE

Reboot after doing so, preferably into safe mode and delete:
C:\TV MEDIA <= entire folder

Please reread the article at majorgeeks.
I know you have Spybot S&D since the DSO Exploit is a false positive by that program.

Regards,

Pieter
  • 0

#5
umsilver

umsilver

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Thank you! Everything is clean now.
  • 0

#6
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,672 posts
Glad we could help. :tazz:

Safe surfing,

Pieter
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP