g.msn.com/1cl91enus/?... errors please help!

tristanwolf · Sep 16, 2004

after 10 minutes my computer stops responding. any new website i get either a search.msn.com/pass/dnserror.aspx...or more often, i get a g.msn/1cl91enus/... error. nop pictures show up, no websites accesssible. i turn on and off, and it works fine again for 10 minutes. i end up rebooting everything 10 times a day. i am going fricken crazy. msn.com tech support did nothing (4 different people). i have no idea, maybe corrupt dll files or hosts or hotkeys?

i am running win 98 se with ie explorer 6 but have same problem wethere in msn.com browser or ie.

i have run adaware, spybot, shredder, etc, all to no avail. i can post a hijack this log if it may help. or maybe i should be in the win 98 se forum?

any advice greatly appreciated!

chaslang · Sep 17, 2004

Please follow all the steps in this Sticky thread < READ ME FIRST: Basic Spyware, Trojan And Virus Removal >

If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

tristanwolf · Oct 14, 2004

chaslang, thanks for your help. was gone for a while, but came back, still have same problems. have run/ updated virtually all tools- adaware, spybot, blaster, ms critical updates, etc. still computer stops working after 10 minutes or so. when i restart and scan again, i am still finding some viruses, so some are being kept stored, i have win 98 se, so i am unsure if i can disable system restore?

anyways here is most recent hijack this log if it helps. thanks a lot ofr your help , really appreciated.

chaslang · Oct 14, 2004

Please do not post HJT logs unless we ask for them. Read the HJT tutorial. And when requested please post them as .txt file attachments not inline text. Get the correct version of HijackThis (1.98.2) and post your log properly.

When you post, tell me your expected home page too.

tristanwolf · Oct 14, 2004

sorry. is it okay now to post a new one as a txt file now? or what do i have to do to be asked to post one? my homepage is usually livejournal.com because i have msn, for the family, they use comcast on the same computer, so in IE browser they have comcast.com or .net as theirs i think. but the problems we have are with either browser.
thanks

chaslang · Oct 14, 2004

I asked you to post in my last message. But use the correct version of HJT and post it as a .txt file attachment.

tristanwolf · Oct 14, 2004

hope i am doing this right-

chaslang · Oct 14, 2004

You need to get HijackThis into its own directory which is not a temp directory. You have it here:
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

Put it in a folder like one of these:
c:\HJT\HIJACKTHIS.EXE
c:\Program Files\HJT\HIJACKTHIS.EXE

You will loose HJT backups if you leave it in a temp folder.

chaslang · Oct 14, 2004

Make sure you have system restore disabled and viewing of hidden files enabled.

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below processes and End them:
TEHE
NNSB
FASH

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: {29D75040-CFB0-11D8-AF85-444553540000} - {29D75040-CFB0-11D8-AF85-444553540000} - C:\WINDOWS\1089179654.dll
O2 - BHO: (no name) - {6EAB3F5E-EE1C-5A97-8753-60550DA82C1F} - C:\WINDOWS\SYSTEM\JHAX.DLL (file missing)
O2 - BHO: (no name) - {38AB365C-BD19-0B92-8754-675508F52A38} - C:\WINDOWS\SYSTEM\MAAS.DLL
O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file)
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKCU\..\Run: [Heta] C:\WINDOWS\Application Data\tehe.exe
O4 - HKCU\..\Run: [Aafzlnix] C:\WINDOWS\SYSTEM\nnsb.exe
O21 - SSODL: OLE Automation Module - {3F143C3A-1457-6CCA-03A7-7AA23B61E40F} - C:\WINDOWS\SYSTEM\child.dll

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\APPLICATION DATA\TEHE.EXE
C:\WINDOWS\SYSTEM\NNSB.EXE
C:\WINDOWS\fash.exe
C:\WINDOWS\SYSTEM\MAAS.DLL
C:\WINDOWS\SYSTEM\child.dll

No reboot in normal mode and post a new HJT log. And tell us how things are working.

Did you install something that causes these below lines?
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp

Log in or Sign up

g.msn.com/1cl91enus/?... errors please help!

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

Attached Files:

hijackthis.log7.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Log in or Sign up

g.msn.com/1cl91enus/?... errors please help!

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tristanwolf Private E-2

Attached Files:

hijackthis.log7.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches