system
August 11, 2004, 10:29pm
1
Logfile of HijackThis v1.97.7
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://martfinder.com/crindex.html http://server224.smartbotpro.net/7search/?001 http://server224.smartbotpro.net/7search/?002 http://www.yahoo.com http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=3c00&s=consumer&LC=0409 http://martfinder.com/crindex.html http://server224.smartbotpro.net/7search/?003 http://martfinder.com/crindex.html http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=3c00&s=searchbar&LC=0409 http://martfinder.com/crindex.html http://martfinder.com/crindex.html http://martfinder.com/crindex.html http://files.cc.cometsystems.com/assist/cc/1.0/assist_st.html http://www.search-2003.com/ http://martfinder.com/crindex.html auto.search.msn.com www.google.akadns.net www.google.com google.com www.altavista.com altavista.com search.yahoo.com uk.search.yahoo.com ca.search.yahoo.com jp.search.yahoo.com au.search.yahoo.com de.search.yahoo.com www.lycos.de alltheweb.com web.ask.com ask.com www.ask.com www.teoma.com search.aol.com www.looksmart.com auto.search.msn.com search.msn.com ca.search.msn.com fr.ca.search.msn.com search.latam.yupimsn.com search.msn.de search.msn.fi search.msn.fr search.yupimsn.com uk.search.msn.com search.lycos.com www.lycos.com www.google.uk www.google.co.uk www.google.de www.google.fi www.google.fr www.google.com.ru go.google.com google.de google.fi google.fr
system
August 11, 2004, 10:29pm
2
O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL@msdxmLC.dll ,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXhttp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://download.games.yahoo.com/games/clients/y/ct0_x.cab http://download.games.yahoo.com/games/clients/y/potb_x.cab http://install.wildtangent.com/bgn/partners/shockwave/virtualwarfare/install.cab http://download.games.yahoo.com/games/clients/y/cct0_x.cab http://www.apple.com/qtactivex/qtplugin.cab http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx http://download.games.yahoo.com/games/clients/y/dtt1_x.cab http://install.spywarelabs.com/1210030908/BundleOuter1210030908.EXE http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37884.5686342593 http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://download.yahoo.com/dl/installs/yinstc.cab http://dm.cometsystems.com/dm/dm_286.cab mydomain.com
system
August 11, 2004, 10:30pm
3
which of these should i delete? (logfile in 2 previous posts)
DavidR
August 11, 2004, 11:00pm
4
Hi Steve, welcome to the forums.
I’m no expert, there will probably be one along soon, but in the meantime!
I would however start with the all 01 Hosts with the IP address 207.44.220.30, as you can see the whois query for 207.44.220.30 returns the following results, so this would appear to be a hijack of your search locations/tools. Unless this is intentional ???
Search results for: 207.44.220.30
OrgName: Everyones Internet, Inc.
OrgID: EVRY
Address: 2600 Southwest Freeway
Address: Suite 500
City: Houston
StateProv: TX
PostalCode: 77098
Country: US
NetRange: 207.44.128.0 - 207.44.255.255NS1.EV1.NET NS2.EV1.NET
You don’t have the latest version of hijack this so I would suggest that you download it.
Then visit Eddy’s HiJackThis pages, HijackThis log file analyzer and follow the directions there and get back to us if you need more help…
HTH David
system
August 11, 2004, 11:06pm
5
Hello
http://www.pestpatrol.com/pestinfo/c/comet_dmserver.asp
I think I saw something about wildtangent also, you might try a Google search for that as it rings a bell with me.
I’m busy with updates at the moment so I can’t offer any more help right now, but I know that others here (much more knowledgeable than me) will be able to help you.
In the meantime an online automated analyser for your log can be found herehttp://hijackthis.de/index.php?langselect=english
system
August 11, 2004, 11:13pm
6
DavidR, you beat me to it was just going to post Eddy’s link athttp://members.home.nl/edeijl/acred/cleaning.htm
What a terrific forum for support.
Eddy
August 12, 2004, 6:01am
7
Fix all of the following:
\program files\downloadware\dw.exehttp://martfinder.com/crindex.html http://server224.smartbotpro.net/7search/?001 http://server224.smartbotpro.net/7search/?002 http://martfinder.com/crindex.html http://server224.smartbotpro.net/7search/?003 http://martfinder.com/crindex.html http://martfinder.com/crindex.html http://martfinder.com/crindex.html http://martfinder.com/crindex.html http://files.cc.cometsystems.com/assist/cc/1.0/assist_st.html http://www.search-2003.com/ http://martfinder.com/crindex.html auto.search.msn.com www.google.akadns.net www.google.com google.com www.altavista.com altavista.com search.yahoo.com uk.search.yahoo.com ca.search.yahoo.com jp.search.yahoo.com au.search.yahoo.com de.search.yahoo.com www.lycos.de alltheweb.com web.ask.com ask.com www.ask.com www.teoma.com search.aol.com www.looksmart.com auto.search.msn.com search.msn.com ca.search.msn.com fr.ca.search.msn.com search.latam.yupimsn.com search.msn.de search.msn.fi search.msn.fr search.yupimsn.com uk.search.msn.com search.lycos.com www.lycos.com www.google.uk www.google.co.uk www.google.de www.google.fi www.google.fr www.google.com.ru go.google.com google.de google.fi google.fr http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://download.games.yahoo.com/games/clients/y/ct0_x.cab http://download.games.yahoo.com/games/clients/y/potb_x.cab http://install.wildtangent.com/bgn/partners/shockwave/virtualwarfare/install.cab http://download.games.yahoo.com/games/clients/y/cct0_x.cab http://www.apple.com/qtactivex/qtplugin.cab http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/quicktimeinstaller.exe http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx http://download.games.yahoo.com/games/clients/y/dtt1_x.cab http://install.spywarelabs.com/1210030908/bundleouter1210030908.exe http://v4.windowsupdate.microsoft.com/cab/x86/ansi/iuctl.cab?37884.5686342593 http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://download.yahoo.com/dl/installs/yinstc.cab http://dm.cometsystems .
system
August 12, 2004, 10:42am
8
didnt notice AV or firewall or anything resembling security / protection . ???
Eddy
August 12, 2004, 11:10am
9
Good observing galooma, I noticed it too. Besides this there is also another thing that will track your attention if you look at the log. He installed allmost all those spy/-adware himself with those p2p applications.
Definatly someone who should look at the link in my signature. ;D
DavidR
August 12, 2004, 11:46am
10
Eddy:
Good observing galooma, I noticed it too. Besides this there is also another thing that will track your attention if you look at the log. He installed allmost all those spy/-adware himself with those p2p applications.
Definatly someone who should look at the link in my signature. ;D
You can only lead the horse to the water he has to want to drink.
As galooma observed he should also install avast! (or enable it to run at start up) it’s the least he could do for the assistance he has received from the Alwil Software Forum - avast! Support Forums ;D
