Adware problem

  1. #1

    Adware problem About:blank with HJT log

    Yesterday I found that I had some problems with adware - Homepage not setting to what I wish, internet cutting off - the usual.

    So What I've done I have downloaded Lavasoft ad-aware se with all the newest updates and Ive deleted all known trojans miners the lot. However I still cannot set my homepage. everytime I load a new page in the address bar I get- about:blank

    I've since downloaded the file from MSN - microsoft antiSpyware and have ran this several times. It identifies one file each time which I delete but it reapears

    This is a hijacked browser and it says its location is internet explorer search page 1 which has baffled me

    Can anyone help because I'm at the end of my teather.

    Cheers
    Last edited by Davidjosephjackson; 23-02-2005 at 10:19 AM.


  2. #2
    Hi here is my Hijackthis log file

    Logfile of HijackThis v1.99.1
    Scan saved at 2224, on 22/02/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\appwl32.exe
    C:\WINDOWS\system32\addwh.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\ZipCentral\ZCentral.exe
    C:\DOCUME~1\David\LOCALS~1\Temp\_ZCTmp.Dir\HijackT his.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ymftj.dll/sp.html#28129
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {5FED6D45-2D6E-9D60-4B64-A4543F387F99} - C:\WINDOWS\system32\javajy32.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [addwh.exe] C:\WINDOWS\system32\addwh.exe
    O4 - HKLM\..\Run: [18.tmp] C:\DOCUME~1\David\LOCALS~1\Temp\18.tmp.exe 1 28129
    O4 - HKLM\..\Run: [1A.tmp] C:\DOCUME~1\David\LOCALS~1\Temp\1A.tmp.exe 0 28129
    O4 - HKLM\..\Run: [18.tmp.exe] C:\DOCUME~1\David\LOCALS~1\Temp\18.tmp.exe 1 28129
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\RunOnce: [appwl32.exe] C:\WINDOWS\appwl32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: *.awmdabest.com
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2CFD9C34-B7C5-415C-A8A9-13CD945DF152}: NameServer = 213.1.119.100 213.1.119.99
    O23 - Service: Remote Procedure Call (RPC) Helper (%AF夶À¨) - Unknown owner - C:\WINDOWS\msqw.exe (file missing)

  3. #3
    Is anybody there???

  4. #4
    owen is offline D-A-L Team Member (UK)
    Save 20% on AVG Internet Security 2012 Suite!
    Sorry about the response time, if you still require help, could you post a fresh log. Cheers.

+ Reply to Thread