[bodeekwa]

My internet explorer has been take over by onemoresearch.net and I get a pop up error that i have sspMydoom.cih. I need to remove this but it is difficult. I am a novice so please walk me through this. I also received a pop up that someone was attempting to access my computer maliciously. Can some one help me with this? Below is the hijack log, thanks


Logfile of HijackThis v1.98.2
Scan saved at 10:06:14 AM, on 2/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BELKIN USB Wireless Monitor\WLService.exe
C:\Program Files\BELKIN USB Wireless Monitor\WLanCfgG.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\javakr.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Sonic\RecordNow!\RecordNow.exe
C:\My Documents\software\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\vjzqm.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {D26AE4F7-8228-80E6-B5BD-8F1418D6EC44} - C:\WINDOWS\msst.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\RunOnce: [javakr.exe] C:\WINDOWS\system32\javakr.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

[Advertisements]

you might want to start by reading my thread under the screen name "drgwspup." I had the same message and i started posting about a week ago. Took me a while to get it all off but now running clean. I downloaded another browser, instead of IE so i could download all the diagnostic tools that I was told to use. This is a great site to get help. Good luck.

[drgwspup]

you might want to start by reading my thread under the screen name "drgwspup." I had the same message and i started posting about a week ago. Took me a while to get it all off but now running clean. I downloaded another browser, instead of IE so i could download all the diagnostic tools that I was told to use. This is a great site to get help. Good luck.

[bodeekwa]

I tried all that step by step, and I still have the same problem. My internet explorer still has "about:blank" in the address bar and some one has taken control of Internet Explorer.

[drgwspup]

Hi,

I'm a newbie like you, so really not qualified to assist you, sorry. But It took me several days running and re-running the diagnostic tools. For example, the About Buster scan which is in some of the later posts in my thread took 5 hours to run each, you have to do it twice for a total of ten hours each cycle. I tried a short cut and then I had to run it again! For a total of 15 hours running About Buster. A key is knowing which lines of code that you need to delete through HiJack This. It's going to vary from machine to machine and that's where you need a more knowledgable person than me. Good Luck.

The folks here are volunteers so hopefully someone can get to you soon.

[JeePee]

Hi,
This is a big problem to get rid off. I downloaded the Beta version of Microsoft Antispyware (one get's desparate) and surprisingly enough it has managed to kill it. Or put it into a suspended state, I'm not sure if it's really removed or just blocked. Through the Beta you are ale to monitor and block/allow changes in the IE settings and that has succesfully blocked this for now.

[bodeekwa]

Is this the only way to get rid of this? And can you give me the link to the Microsoft Spy ware page?

Also something else that this bug does, it creates links in my person web page that are not real links. When you click on the link, it takes you to onemoresearch.net.

This ONEMORESEARCH.NET is what has taken control of my Internet Explorer. Any other tips on how to get rid of this invader????????

[JeePee]

This is the link to the Microsoft anti-spyware.
http://www.microsoft...ware/about.mspx

It works fine for me still. Today I had another attack of this bloody thing and it noticed and blocked it perfectly. Good luck with it.

[bodeekwa]

I tried this microsoft spyware cure, and it did delete alot of crap, but there are files on the computer that none of the above programs have been able to completely remove, because some bizarre file attempts to take over Internet Explore.

The Microsoft anti-spyware attempts to block this from occurring, but eventually it takes over again. Unfortunately nothing is able to get rid of this bug.