123 Mania

  1. 14-08-2004  #1
    RobWood
    RobWood is offline Newbie

    Re: 123 Mania

    Moved to a new thread. Read the announcements marked **Read before Posting**!

    Hello evryone. I too have been hit by 123 mania which is INTENSELY irritating. Having also been hit by a dial back scam that cost me a lot of money I am a bit disillusioned with the internet. A friend suggested I run Hijack this and post the results here - to see if anyone can help. So the log is below and any help is appreciated.

    Thanks

    Logfile of HijackThis v1.98.0
    Scan saved at 20:32:48, on 22/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Web_Rebates\WebRebates0.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
    C:\Program Files\Nikon\NkView5\NkvMon.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Web_Rebates\WebRebates1.exe
    E:\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freeserve.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.123mania.com/0809/ie.asp
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Freeserve
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: SrchHook Class - {15651C7C-E812-44a2-A9AC-B467A2233E7D} - C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: BHOsrc Class - {622CC208-B014-4FE0-801B-874A5E5E403A} - C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
    O2 - BHO: HTML Class - {9C5B2F29-1F46-4639-A6B4-828942301D3E} - C:\WINDOWS\System32\SIPSPI32.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [LoadSIPS] rundll32.exe C:\WINDOWS\System32\SIPSPI32.dll,SIPSPI32
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [GetMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:GetMP3:t
    O4 - HKCU\..\Run: [NewMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:NewMP3:t
    O4 - HKCU\..\Run: [DownloadMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTMLownloadMP3:t
    O4 - HKCU\..\Run: [YourMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:YourMP3:t
    O4 - HKCU\..\Run: [CoolMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:CoolMP3:t
    O4 - HKCU\..\Run: [MP3download] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t
    O4 - HKCU\..\Run: [MP3Collection] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3Collection:t
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office 2000\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
    O8 - Extra context menu item: Search with Freeserve - res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
    O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: CoolMP3 - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} - C:\WINDOWS\System32\CoolMP3 (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {15651C7C-E812-44A2-A9AC-B467A2233E7D} (SrchHook Class) - http://www.123mania.com/GIDCAI32.cab
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://www.napster.co.uk/client/setup.exe
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {9C5B2F29-1F46-4639-A6B4-828942301D3E} (HTML Class) - http://www.123mania.com/SIPSPI32.cab
    Last edited by owen; 14-08-2004 at 03:32 PM.

  3. 15-08-2004  #2
    owen
    owen is offline D-A-L Team Member (UK)
    Before we do anything could you please update your version of Hijack This then post a new log. http://hjt.isecureit.co.uk.
  4. 17-08-2004  #3
    RobWood
    RobWood is offline Newbie
    OK will do
  5. 17-08-2004  #4
    RobWood
    RobWood is offline Newbie
    Logfile of HijackThis v1.98.2
    Scan saved at 20:42:55, on 17/08/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\mHotkey.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Web_Rebates\WebRebates0.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\FotoStation Easy\FotoStation Easy AutoLaunch.exe
    C:\Program Files\Nikon\NkView5\NkvMon.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Web_Rebates\WebRebates1.exe
    E:\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    http://www.freeserve.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    http://www.freeserve.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    http://www.freeserve.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    http://www.123mania.com/0809/ie.asp
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
    Internet Explorer provided by Freeserve
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: SrchHook Class - {15651C7C-E812-44a2-A9AC-B467A2233E7D}
    - C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
    Files\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
    C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program
    Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: BHOsrc Class - {622CC208-B014-4FE0-801B-874A5E5E403A} -
    C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} -
    C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
    O2 - BHO: HTML Class - {9C5B2F29-1F46-4639-A6B4-828942301D3E} -
    C:\WINDOWS\System32\SIPSPI32.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} -
    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
    C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
    C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Freeserve - {8B68564D-53FD-4293-B80C-993A9F3988EE} -
    C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
    Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
    Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
    Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [LoadSIPS] rundll32.exe
    C:\WINDOWS\System32\SIPSPI32.dll,SIPSPI32
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
    Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe
    SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [WebRebates0] "C:\Program
    Files\Web_Rebates\WebRebates0.exe"
    O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series]
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE /P30 "EPSON Stylus
    Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
    O4 - HKLM\..\Run: [EPSON Product Registration Reminder]
    C:\WINDOWS\Temp\RegModule.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
    /background
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program
    Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [GetMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:GetMP3:t
    O4 - HKCU\..\Run: [NewMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:NewMP3:t
    O4 - HKCU\..\Run: [DownloadMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTMLownloadMP3:t
    O4 - HKCU\..\Run: [YourMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:YourMP3:t
    O4 - HKCU\..\Run: [CoolMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:CoolMP3:t
    O4 - HKCU\..\Run: [MP3download] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t
    O4 - HKCU\..\Run: [MP3Collection] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3Collection:t
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy
    Sweeper\SpySweeper.exe" /0
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common
    Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: FotoStation Easy AutoLaunch.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office 2000\Office\OSA9.EXE
    O4 - Global Startup: NkvMon.exe.lnk = C:\Program
    Files\Nikon\NkView5\NkvMon.exe
    O8 - Extra context menu item: Search with Freeserve -
    res://C:\PROGRA~1\FREESE~1\FSBar\FSBar.dll/VSearch.htm
    O8 - Extra context menu item: Web Rebates - file://C:\Program
    Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: MP3Collection - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} -
    C:\WINDOWS\System32\MP3Collection (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
    C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} -
    C:\Program Files\Microsoft Money\System\mnyside.dll
    O12 - Plugin for .spop: C:\Program Files\Internet
    Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) -
    http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {15651C7C-E812-44A2-A9AC-B467A2233E7D} (SrchHook Class) -
    http://www.123mania.com/GIDCAI32.cab
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) -
    http://www.cult3d.com/download/cult.cab
    O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup
    Player 2K2) - http://www.napster.co.uk/client/setup.exe
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) -
    http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {9C5B2F29-1F46-4639-A6B4-828942301D3E} (HTML Class) -
    http://www.123mania.com/SIPSPI32.cab
  6. 18-08-2004  #5
    owen
    owen is offline D-A-L Team Member (UK)
    Save 20% on AVG Internet Security 2012 Suite!
    Hello,
    Close all browser windows, restart Hijack This and put a checkmark next to the following entries:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    http://www.123mania.com/0809/ie.asp
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft
    Internet Explorer provided by Freeserve
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: SrchHook Class - {15651C7C-E812-44a2-A9AC-B467A2233E7D}
    - C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program
    Files\MyWay\myBar\1.bin\MYBAR.DLL
    O2 - BHO: BHOsrc Class - {622CC208-B014-4FE0-801B-874A5E5E403A} -
    C:\WINDOWS\System32\GIDCAI32.dll
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} -
    C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll (file missing)
    O2 - BHO: HTML Class - {9C5B2F29-1F46-4639-A6B4-828942301D3E} -
    C:\WINDOWS\System32\SIPSPI32.dll
    O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} -
    C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P
    Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [LoadSIPS] rundll32.exe
    C:\WINDOWS\System32\SIPSPI32.dll,SIPSPI32
    O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program
    Files\webHancer\Programs\whSurvey.exe"
    O4 - HKLM\..\Run: [WebRebates0] "C:\Program
    Files\Web_Rebates\WebRebates0.exe"
    O4 - HKCU\..\Run: [GetMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:GetMP3:t
    O4 - HKCU\..\Run: [NewMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:NewMP3:t
    O4 - HKCU\..\Run: [DownloadMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTMLownloadMP3:t
    O4 - HKCU\..\Run: [YourMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:YourMP3:t
    O4 - HKCU\..\Run: [CoolMP3] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:CoolMP3:t
    O4 - HKCU\..\Run: [MP3download] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3download:t
    O4 - HKCU\..\Run: [MP3Collection] rundll32.exe
    C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3Collection:t
    O8 - Extra context menu item: Web Rebates - file://C:\Program
    Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: MP3Collection - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} -
    C:\WINDOWS\System32\MP3Collection (file missing)
    O16 - DPF: {15651C7C-E812-44A2-A9AC-B467A2233E7D} (SrchHook Class) -
    http://www.123mania.com/GIDCAI32.cab
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) -
    http://acceso.masminutos.com/laaplicacion.cab
    O16 - DPF: {9C5B2F29-1F46-4639-A6B4-828942301D3E} (HTML Class) -
    http://www.123mania.com/SIPSPI32.cab

    The following are optional fixes:
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe
    SYSTEMBOOTHIDEPLAYER
    System Tray access for Real Player. Not Needed.

    O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program
    Files\Microsoft Works\WkDetect.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office 2000\Office\OSA9.EXE
    Resource Hogs that seriously slow down startup and system speed related to Microsoft Office.

    Click Fix Checked

    Then boot into Safe Mode and ensure that you are showing Hidden Files and Folders.

    Go to Start> Control Panel, double click Add/Remove programs. Uninstall the following programs. If one of them doesn't exist, skip it and move onto the next:
    P2P Networking
    webHancer     (and items related to webHancer)
    Web_Rebates (and items related to Web Rebates)
    MyWay (and anything related to MyWay or MyWebSearch)

    Then delete the following folders:
    C:\Program Files\My Way
    C:\Program Files\Web_Rebates
    C:\Program Files\webHancer
    C:\Program Files\Common Files\WinTools

    Delete the following files:
    C:\WINDOWS\System32\MSA64CHK.dll

    Then reboot and post a fresh log
+ Reply to Thread
« about:blank | Hijack looking-for.cc (Resolved) »