Freezing Browser !

Discussion in 'Malware Help (A Specialist Will Reply)' started by geneman, Jan 27, 2005.

Page 2 of 2
  1. geneman

    geneman Private First Class

    Hi Chaslang

    I have installed a firewall ,yes i have 2 AV, i installed AVG yesterday only after i got some pop ups. i usually uninstal it after everything gets ok. Regarding PC Doctor, i have uninstalled it way back.. and its not there in my Add/Remove program list.
    I have attached the new HJT log.

    Thanks
    Gene
     

    Attached Files:

    geneman, Apr 13, 2005
    #51
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you do not like or trust Norton then why don't you uninstall it instead of having to install AVG. First you must only use one AV. They can cause conflicts with each other and make it difficult or impossible to remove problems. Also they each require loads of valuable system resources.

    Until you uninstall one of them now, we are going nowhere.
     
    chaslang, Apr 13, 2005
    #52
  3. geneman

    geneman Private First Class

    i have removed AVG now...

    Thanks
    Gene
     
    geneman, Apr 13, 2005
    #53
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
    C:\WINDOWS\System32\prfsic.exe
    C:\WINDOWS\System32\plurinit.exe
    C:\Program Files\CxtPls\CxtPls.exe

    After killing all the above processes, click "Back".

    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {0124A648-E06F-FC8C-4E3B-1B14764D71E9} - (no file)
    O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
    O2 - BHO: (no name) - {9FE13CF7-8771-9253-28A5-B4B05238AA13} - (no file)
    O4 - HKLM\..\Run: [sFsV35P] prfsic.exe
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [do39RRjpj] plurinit.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\prfsic.exe
    C:\WINDOWS\System32\plurinit.exe
    C:\Program Files\CxtPls <--- the whole folder
    C:\Program Files\Spyware Doctor <--- the whole folder

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file. Tell me if you do not find any of these or cannot delete them.

    Now run Ccleaner (installed while running the READ ME FIRST).

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
     
    chaslang, Apr 13, 2005
    #54
  5. geneman

    geneman Private First Class

    Hi Chaslang

    I did as u told, but donno how it will work in internet explorere bcoz IE is not opening any site , the firewall is blocking IE. moreover the firewall keeps giving a frequent message of something called "NDIS user mode I/O drive (ndisuio.sys) is trying to access the network" or something like that...

    i havent put the firewall off yet, donno much about its use. wrtiting this by using mozilla.

    Have attached the new log.

    Waiting for further advice from you..

    Thanks a lot !
    Gene
     

    Attached Files:

    geneman, Apr 14, 2005
    #55
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I just realize you never updated your HJT version to the one I gave you. Please do that and post a new HJT log.

    Why are you having your firewall block IE? Also ndisuio.sys is okay too.
     
    chaslang, Apr 14, 2005
    #56
  7. geneman

    geneman Private First Class

    ok i will update hjt.
    regarding firewall i donno how the IE got blocked, but now its blocking anything that i open in IE without asking my permission.. donno how to make it not to block :confused:
     
    geneman, Apr 14, 2005
    #57
  8. geneman

    geneman Private First Class

    ok now i have been able to unblock IE. have not seen the frequent messages i used to get from firewall about this n that trying to access the network.. n system is running much faster now...i think probs r solved now.. will see few more hours n then let u know again.....

    i have attached the log after after getting the new HJT.

    Many thanx for the great help.. once again must say u r a genius !

    Best Regards my frend..
    Gene
     

    Attached Files:

    geneman, Apr 14, 2005
    #58
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome Gene! Happy to hear it all worked out.

    Other than the two O2 BHO lines:

    O2 - BHO: (no name) - {0124A648-E06F-FC8C-4E3B-1B14764D71E9} - (no file)
    O2 - BHO: (no name) - {9FE13CF7-8771-9253-28A5-B4B05238AA13} - (no file)

    Your log is clean. Don't worry about those lines! The file is gone and they can do no harm. There are a bunch of problems like this around where we cannot get HJT of even manual registry editing to remove those registry keys.

    You should now make sure you have complete the equivalent of all the steps in the below link (many you have already done):

    How to Protect yourself from malware!
     
    chaslang, Apr 14, 2005
    #59
  10. geneman

    geneman Private First Class

    Dear Chaslang,

    Here is one more distress call. Today when i opened a site suddenly a msg came from norton that it has just blocked bloodhound. then some pop ups showed up. i immediately cut off the internet connection, and did all the scans as suggested here and got few spywares, deleted them and reconnected internet, now there is no popup but two things i m noticing..

    1. an unwanted toolbar (other than the google toolbar)
    2. when i open internet explorer browser, a search page automatically loads in each browser (it loads if the net connection is off also).

    otherwise the system is running in excellent speed.

    i have attached the HJT log for your kind consideration.

    i know i am an idiot.. i am very careful these days, still these craps somehow tries to get in.

    Regards
    Gene
     

    Attached Files:

    geneman, Apr 23, 2005
    #60
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O2 - BHO: (no name) - {0124A648-E06F-FC8C-4E3B-1B14764D71E9} - (no file)
    O2 - BHO: IE SP2 AddOn - {16857A1C-5574-4CC2-AE1B-6B1CFBF0CEB7} - C:\WINDOWS\System32\sphla.dll
    O2 - BHO: (no name) - {9FE13CF7-8771-9253-28A5-B4B05238AA13} - (no file)
    O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\ie2cltr.dll
    O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://195.95.218.82/users/zoom/web/axe/x.chm::/update.exe

    After clicking Fix, exit HJT.

    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\sphla.dll
    C:\WINDOWS\System32\ie2cltr.dll

    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.

    The below items were not in your HJT log last time. I'm wondering why they now appear?
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEB616F-B856-4E52-A26A-CABBEF05DF0B}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A8EF95B9-0564-46B0-879E-1CC30B2E48D5}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9D1BAF-E855-466F-9A1B-6D79AEE34BC8}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EDF84D10-08AD-40AD-B7A1-909923425F86}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F1CDC6EB-2D30-401F-997E-B45A6F54070B}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0CEB616F-B856-4E52-A26A-CABBEF05DF0B}: NameServer = 69.50.176.156,195.225.176.31
     
    chaslang, Apr 23, 2005
    #61
  12. geneman

    geneman Private First Class

    Dear Chaslang,

    Thank you very much for your quick reply. I did everything as you did and removed all those. now that toolbar and that home page is not there. but once i saw a pop up (of some poker site). i have attached the new HJT log for your review.

    you asked yesterday : "The below items were not in your HJT log last time. I'm wondering why they now appear?"
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEB616F-B856-4E52-A26A-CABBEF05DF0B}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A8EF95B9-0564-46B0-879E-1CC30B2E48D5}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EB9D1BAF-E855-466F-9A1B-6D79AEE34BC8}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EDF84D10-08AD-40AD-B7A1-909923425F86}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F1CDC6EB-2D30-401F-997E-B45A6F54070B}: NameServer = 69.50.176.156,195.225.176.31
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0CEB616F-B856-4E52-A26A-CABBEF05DF0B}: NameServer = 69.50.176.156,195.225.176.31

    i also dont have any idea may b in between these days something happened and they got entry. do i need to remove these BHO also? plis inform.

    Best Regards
    Gene
     

    Attached Files:

    geneman, Apr 24, 2005
    #62
  13. geneman

    geneman Private First Class

    Hi Chaslang

    It is in reference to my message below posted 2 hours back i want to inform you that i am getting pop ups at a gap of around 15-20 min.

    Thanks
    Gene
     
    geneman, Apr 24, 2005
    #63
  14. geneman

    geneman Private First Class

    Dear Chaslang,

    Plis check the two messages below this one that i posted in the morning. Pop ups are coming intermitantly (of some sex poker sites, real annoying!), also i have noticed a new desktop icon, though i traced its folder in c:/ and uninstalled. getting annoyed i ran adaware and deleted some stuffs, thats y i have again posted the newest HJT log with this message, so you plis check this log rather than the one i posted in the morning.

    Waiting for your kind response.

    Regards
    Gene
     

    Attached Files:

    geneman, Apr 24, 2005
    #64
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is this your ISP:
    If so, the IP address are OK.

    Where did this WareOut.exe program come from all of a sudden? Do yourself a favor and do not download anything unless you get it from Majorgeeks. This is malware!

    First look in Add/Remove programs for an uninstall to WareOut and uninstall it if found.
    If that does not work, follow the steps below.

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
    WareOut.exe

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\Program Files\WareOut <--- the whole folder

    Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now reboot in normal mode and post a new HJT log. And tell us how things are working.

    Personally I would fix the below two items but they are up to you. They are for auto updates for HP and Logitech products. I do not want anyone given permission to automatically install or change anything on my PCs.
    O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
     
    chaslang, Apr 24, 2005
    #65
  16. geneman

    geneman Private First Class

    dear Chaslang,

    i did as u told and no pop ups seen now... that wareout.exe thing came itself i didnt download..
    regarding the ISP that u have mentioned i havent got anything.. thats totally strange for me.. i am not in CA, i am in KS. i get my net from university connection, dont have much idea about ISP. so wat shud i do regarding this? kindly inform.

    Regards
    Gene
     
    geneman, Apr 25, 2005
    #66
  17. geneman

    geneman Private First Class

    Hi Chaslang

    I am waiting for a reply from you.

    Thanks
    Gene
     
    geneman, Apr 25, 2005
    #67
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I would still double check with the University network admins to see if that is where they get their service from. They should be able to tell you if that is a valid address.

    So is everything from my last message fixed now?
    How are things working?
     
    chaslang, Apr 26, 2005
    #68
  19. geneman

    geneman Private First Class

    Dear Chaslang

    Things are working very nice. speed is excellent. Thanks a lot for the great help man !

    Regarding the ISP, i will go and talk with university people once i get time. If by chance that is not my ISP, then what kind of prob may b there cud u plis explain. is that a hacker?

    Gene
     
    geneman, Apr 26, 2005
    #69
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome! Typically what is found in the O17 lines is the address of your Domain Name Server (DNS) or the name of a domain (if you are part of a domain - which you are not).
    If there is a address in there that is not part of your network, you could be suffer from a DNS hijack, or you could also have an old address in there from another network. The latter happens quite often when people move PCs (like laptops) around from office to home or to different networks (like your house then to a friends house).
     
    chaslang, Apr 26, 2005
    #70
  21. geneman

    geneman Private First Class

    but if the ISP is related with my internet connection or with some place where this PC had been, then how come these things didnt appear in the HJT log that i posted only a week ago, as u were also wondering..
     
    geneman, Apr 27, 2005
    #71
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I don't know! That is why I questioned when they all of a sudden appeared. You can have HijackThis fix those entries and see what happens. They can always be restored in necessary from the Backups HJT makes.
     
    chaslang, Apr 27, 2005
    #72
  23. geneman

    geneman Private First Class

    Dear Chaslang,
    i talked with our university internet people, they say that ISP is not related with our university net connection, so what do u suggest now.. Plis inform.

    Gene
     
    geneman, Apr 27, 2005
    #73
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Have HJT fix those O17 lines. Then reboot and see if they stay fixed. Also see how things work afterwards. If you run into a problem like the O17 lines were needed, you can also restore them from the Backups that HJT creates.
     
    chaslang, Apr 27, 2005
    #74
Page 2 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds