Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

MAYOR HELP NEEDED.. THIS IS MY LAST RESORT!


  • Please log in to reply

#1
SlowComp

SlowComp

    Member

  • Member
  • PipPip
  • 33 posts
O please, i finally got my internet to work. My computer is full of Spyware, Viruses, ... you name it i have it.
Some programs i delete and they keep coming back.!

I keep getting re-directed to other sites, and my homepage was hijacked.
I run Windows Me, btw.

Please help and thanks in advance to who ever helps me.! TNX!

Heres my HJT LOG:
Logfile of HijackThis v1.99.1
Scan saved at 8:34:14 PM, on 10/22/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SCARDSVR.EXE
C:\PROGRAM FILES\COMPAQ\COMPAQ MESSAGE SCREENER\BIN\COMPAQ-RBA.EXE
C:\PROGRAM FILES\WZCBDL SERVICE\WZCBDL9X.EXE
C:\PROGRAM FILES\ANI\ANIWZCS2 SERVICE\WZCSLDR2.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\MICROSOFT WORKS\WKSSB.EXE
C:\PROGRAM FILES\COMPAQ\DIGITAL DASHBOARD\CPQMLDET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\STARTEAK.EXE
C:\COMPAQ\EAKDRV\EAUSBKBD.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\D-LINK\AIR USB UTILITY\AIRCFG.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\D-LINK\AIRPLUS G\AIRGCFG.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\NZVKA.EXE
C:\PROGRAM FILES\BHAT\TBAR.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\AMERICA ONLINE 6.0\AOLTRAY.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACK\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {C82AF178-7A05-41C9-A0A7-A9BFC4F5ACC1} - C:\WINDOWS\SYSTEM\CPIL.DLL
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\QUESTMOD.DLL (file missing)
O2 - BHO: (no name) - {EC97FC23-3098-603B-EC58-3A76146A0490} - C:\WINDOWS\SYSTEM\JSQRVS.DLL (file missing)
O2 - BHO: (no name) - {32EA8839-17D9-4E79-FD59-1A943A9B89C3} - C:\WINDOWS\SYSTEM\TCAB.DLL
O2 - BHO: (no name) - {601AC7BE-560F-06F9-2BB4-0495CBF0DE9C} - C:\WINDOWS\SYSTEM\HLYMRCMA.DLL
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL
O2 - BHO: (no name) - {64BA8A69-178D-192E-FD59-1A943A9B89C3} - C:\WINDOWS\SYSTEM\TCAB.DLL
O2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\DREXINIT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [WCOLOREAL] C:\Program Files\COMPAQ\COLOREAL\COLOREAL.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\CPQMLDET.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CpqBootPerfDb] C:\Cpqs\Scom\CpqBootPerfDb.exe
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Program Files\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\PROGRAM FILES\D-LINK\AIRPLUS G\AIRGCFG.EXE
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [ScardSvr] C:\WINDOWS\SYSTEM\ScardSvr.exe
O4 - HKLM\..\RunServices: [Compaq_RBA] C:\PROGRAM FILES\COMPAQ\COMPAQ MESSAGE SCREENER\BIN\COMPAQ-RBA.EXE
O4 - HKLM\..\RunServices: [WZCBDLService] C:\Program Files\WZCBDL Service\WZCBDL9X.exe
O4 - HKLM\..\RunServices: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Wfmeieqm] C:\WINDOWS\SYSTEM\nzvka.exe
O4 - HKCU\..\Run: [Reoe] "C:\Program Files\bhat\tbar.exe" -vt mt
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: America Online 6.0 Tray Icon.lnk = C:\America Online 6.0\aoltray.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
O15 - Trusted IP range: 67.19.185.246 (HKLM)
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} (Dhsigned Control) - http://ads.dealhelpe...alHelperNew.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.co...etup1.0.0.8.cab
O16 - DPF: DigiChat Applet - http://host2.digicha...s/Client_IE.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:\nosuch.mht!http://2awm.com/pop/...m::/on-line.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-downlo....cab?refid=3548
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://67.19.185.246/i/1/loader2.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O18 - Filter: text/html - {32F71F3F-289D-4772-A998-D4D4677D8FFC} - C:\WINDOWS\SYSTEM\CPIL.DLL
O18 - Filter: text/plain - {32F71F3F-289D-4772-A998-D4D4677D8FFC} - C:\WINDOWS\SYSTEM\CPIL.DLL

Right now i have like 10 pop ups ... OMG!


BTw: i use wireless internet... PLEASE HELP :tazz: :)

This is my sister's computer, i have already been here, and was helped with my other computer!
I am doing an online virus scan and will post results when its done.

I know you guys are busy, and tnx in advance!
And i Also , when i reboot , i get an error...Explorer has casused and error in <unknown> and will now close... then it just freezes my computer and i have to manually turn off my comp . This happens ALOT!, and aslo ... RealPlay has caused an error in <unknown> and will now close....

I also did an AVG scan.. and i think it found 140 trojan horses, and viruses!!! i told it to delete them but i dont think it worked! So much stuff wrong w/ my computer!.

Edited by SlowComp, 22 October 2005 - 10:17 PM.

  • 0

Advertisements


#2
Danny

Danny

    Visiting Staff

  • Member
  • PipPipPip
  • 684 posts
Hi,
  • Download DLLCompare.
  • Double-click on DllCompare.exe to run the program.
  • Click "Run Locate.com" and it will scan your system for files.
  • Once the scan has finished click "Compare" to compare your files to valid Windows files.
  • Once it has finished comparing click "Make a Log of what was found".
  • Click "Yes" at the View Log file? prompt to view the log.
  • Copy and paste the entire log into this topic.
  • If you accidentally close out of the log it is also saved as log.txt to where you saved DllCompare.exe.
  • Click "Exit" to exit DLLCompare.
Post a new HijackThis log and a new DLLCompare log.

Danny :tazz:
  • 0

#3
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
oh, hi for the fast reply
im going to turn on my sisters computer.
please stay here and lets see if we can do this in one day!

tnx ill be right back
  • 0

#4
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
hi, i just need to try to connect to the internet on my sis computer to do what u asked me
please standby. tnx! for your reply
  • 0

#5
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
you know what?.. let s just forget about fixing the spyware and viruses....

one thing that i did wanted to ask you was... do u know y can no longer system restore it?
i have the cd, and when i press the option to restore to the original, it says that there is no factory copy of my system.

is there any way that i can restore the computer, and get rid of everything?

please if u know , let me know tnx!
  • 0

#6
Danny

Danny

    Visiting Staff

  • Member
  • PipPipPip
  • 684 posts
Hi,

If you are sure, read this tutorial. http://www.dknoppix....73.new.html#new

Post back if you have any questions.

Danny :tazz:
  • 0

#7
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Hello, and tnx for your reply.,

I dont have The CD to reinstall Windows.. i Just have a System Recovery disk... but the ting is that it doesnt want to do a recovery, nor will it restore to a previous restore point.

do you know what is the problem?... or how can just Start my computer All over again... and delete EVERything. I just want to have a clean computer, and i dont mind if i lose all my data on the computer!

Tnx, for your time! :tazz:
  • 0

#8
Danny

Danny

    Visiting Staff

  • Member
  • PipPipPip
  • 684 posts
It'll be the same thing. Make sure while your computer is starting up, that when it says "Press any Key to boot from CD"...press a key!

Feel free to print out those directions :)

Danny :tazz:
  • 0

#9
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
But.. Danny,

its windows ME, not Xp...
and also.. what CD???.... and what is the WIndows Product KEY?....iono if i have that..

The only thing that i have is THe RECOVERY DISK... which doesnt let me recover... cuz it says that there is no copy of it in the Drive ... or something like that.

tnx for your time ^_^

Edited by SlowComp, 26 October 2005 - 06:58 PM.

  • 0

#10
Danny

Danny

    Visiting Staff

  • Member
  • PipPipPip
  • 684 posts
Hmm... It should still be the same..'

Download this, and run it. It should tell you your product key. http://www.magicalje...keyfinder.shtml

Then keep your recovery CD in the CD drive while you reboot, and it should say "Press any button to boot from CD".

Press a button. Then follow the tutorial.

Danny
  • 0

#11
SlowComp

SlowComp

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
hi, and tnx for teh reply.

when i put in the recovery disk, it gives me 4 options only, and the 3rd option is to do full system recovery, but it says that there is no copy.

The other ones dont do anything either.

tnx... btw .... i still dont know what the tutorial is talking about
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP