• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Something evil is in this PC

GasX

GasX

Lifer
Last week when I visited my parents, I performed an exorcism and removed ungodly amounts of spyware, etc...

This week I am working on the one remaining problem. A whole bunch of websites either will NOT load or will get redirected to www.safe-site.com and then to some random website.

WTF is going on?
 
Logfile of HijackThis v1.97.6
Scan saved at 12:10:48 AM, on 11/28/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\Cyb2k.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\America Online 9.0b\aoltray.exe
C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla.org\Firebird\MozillaFirebird.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.comcast.net/comcast.html
R3 - URLSearchHook: (no name) - _{DD1BCA06-F674-424D-A08E-42DA97C4D5DD} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [HP SchedIndexer] C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppschedindexer.exe
O4 - HKLM\..\Run: [HP AutoIndexer] C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppautoindexer.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: HP LaserJet Director.lnk = C:\Program Files\Hewlett-Packard\LaserJet All-in-one\hppdirector.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Translate Page - res://c:\windows\downloaded program files\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{D79CD89A-D891-44BF-8D92-666BCA953F47}: NameServer = 64.12.107.134
 
check your HOSTS file, mebbe.

windows directory\system32\drivers\etc\

HOSTS (no file extention, right-click and "open with: select program". choose notepad or similiar)
 
Originally posted by: Amorphus
check your HOSTS file, mebbe.

windows directory\system32\drivers\etc\

HOSTS (no file extention, right-click and "open with: select program". choose notepad or similiar)
Click to expand...
hosts is fine... 🙁
 
Originally posted by: Tetsuo
kill it in your processes tab, delete the file (C:\WINDOWS\wanmpsvc.exe)
Click to expand...
According to one of the search results from your link, you just helped mwilding disable his AOL account... See response No. 2 here
 
Originally posted by: Mwilding
Last week when I visited my parents, I performed an exorcism and removed ungodly amounts of spyware, etc...

This week I am working on the one remaining problem. A whole bunch of websites either will NOT load or will get redirected to www.safe-site.com and then to some random website.

WTF is going on?
Click to expand...


Dude, I swear I went through the same thing a couple days ago with this kids' computer I was fixing. I've never seen a PC so riddled with spyware and junk. I would go through msconfig and uncheck any programs I thought were unnecessary, reboot, and when logging in the rogue program would either be back or 2 others would be installed in its' place. Finally after messing with it for over an hour I went ballistic and pulled virtually everything out that was starting up with the system. No lie I must have pulled at least 30 apps....and that's a conservative estimate.

After I went through msconfig I blew away kazaa desktop and replaced it with kazaa lite, nuked gain, threw down service pack 1 (for xp...which he didn't have yet), and installed google toolbar and his PC was finally manageable. I know that there's still a ton of junk on his PC but I had already been there for 3+ hours fixing 2 others machines and I eventually threw in the towel.

I say you check and see what's starting up with their computer 'cause it's still possible that there was something left behind. If all else fails you could probably give them mozilla to use until you can perform the exorcism right by nuking everything in the PC.
 
Originally posted by: Palek
Originally posted by: Tetsuo
kill it in your processes tab, delete the file (C:\WINDOWS\wanmpsvc.exe)
Click to expand...
According to one of the search results from your link, you just helped mwilding disable his AOL account... See response No. 2 here
Click to expand...


My reading skill at midnight are pretty bad eh. Oh well, I provided a link to the google results, he could have read them before deleting
 
Originally posted by: Tetsuo
Originally posted by: Palek
Originally posted by: Tetsuo
kill it in your processes tab, delete the file (C:\WINDOWS\wanmpsvc.exe)
Click to expand...
According to one of the search results from your link, you just helped mwilding disable his AOL account... See response No. 2 here
Click to expand...


My reading skill at midnight are pretty bad eh. Oh well, I provided a link to the google results, he could have read them before deleting
Click to expand...
Noone should be using AOL anyway, eh? 😉
 
Originally posted by: Palek
Originally posted by: Tetsuo
Originally posted by: Palek
Originally posted by: Tetsuo
kill it in your processes tab, delete the file (C:\WINDOWS\wanmpsvc.exe)
Click to expand...
According to one of the search results from your link, you just helped mwilding disable his AOL account... See response No. 2 here
Click to expand...


My reading skill at midnight are pretty bad eh. Oh well, I provided a link to the google results, he could have read them before deleting
Click to expand...
Noone should be using AOL anyway, eh? 😉
Click to expand...

EXACTLY :beer:
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top