i have performed all the README tasks - help still needed please

jpmad4it · Aug 17, 2005

hello there

i recently posted a thread here:

http://forum.majorgeeks.com/showthread.php?t=70232

it was concerning slow windows XP boot performance. All the symptoms i have been getting can be read in that post.

I was told to carry out all the scans in the README, and post a topic here, in the spyware specific forum. The scans did not bring up anything major.

So where do i go from here?? I have HijackThis ready if you want me to post this.

regards Jonathan

jpmad4it · Aug 17, 2005

PS i forgot to add - the online scans - i had to carry these out under a normal boot - as my modem is a USB modem - and it did not load the drivers for it in safe mode. Just thought i should add.

jpmad4it · Aug 17, 2005

here is my attached log

jpmad4it · Aug 17, 2005

D3m3nt3d said:

FIRST:
Please Download this tool:
LSP - Fix

Please run LSP-Fix.

Check the Box labeled "I know what I'm doing" and then click on the idmmbc.dll file (in the “Keep” section) to select it.

Then, Select the >> button to move idmmbc.dll into the Remove section.

Now, click the Finish Button. When the Repair Summary box appears, click OK.

Have HJT FIX the following if they still exists!

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www,google.com/ie
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll

- Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
Click to expand...

hey there

i did all that - now what should i do??

jpmad4it · Aug 17, 2005

CCleaner run.....new hijackthis log file.

Startup is still slooooooow :-(

PS can i ask what that *.dll file i deleted was for?

jpmad4it · Aug 17, 2005

D3m3nt3d said:

That particular .dll was not malware, simply unknown.
It belongs to Internet Download Manager...did you use to run that?

Download this trial version of Ewido Security Suite

Install ewido security suite

Launch ewido, there should be an icon on your desktop double-click it.

The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.

After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

Click on Scanner

Then click Settings

Under What to Scan? Select Scan every file

Then click OK

Click on Complete System Scan and the scan will start.

Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

Click Save report

Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report. And tell me if you are still having any problems.
Click to expand...

hey there - yeah i DO use internet download manager - will it still work??

I will do what you have and get back to you ASAP - thanks

jpmad4it · Aug 17, 2005

PS - PS what does number "O17" in the hijack logfile code mean?

jpmad4it · Aug 17, 2005

hello again.

here are the 2 logs

only cookies were removed with the eiwdo scan

jpmad4it · Aug 17, 2005

D3m3nt3d said:

Your log is clean, along with the few cookies that Ewido found.

If your still moving slow, I dont think it is malware related.
Click to expand...

is there anyone on the forum as HELPFUL as you've been who can help me with the hardware side of things - you've been smashing ???

jpmad4it · Aug 18, 2005

AVG antivirus and ZoneAlarm are working fine for me - problem solved - dont install symantec!!!!!

If you have NAV/NIS/NSW installed get rid of it!!!!

Log in or Sign up

i have performed all the README tasks - help still needed please

jpmad4it Private E-2

jpmad4it Private E-2

jpmad4it Private E-2

Attached Files:

hijackthis.log

jpmad4it Private E-2

jpmad4it Private E-2

Attached Files:

hijackthis.log

jpmad4it Private E-2

jpmad4it Private E-2

jpmad4it Private E-2

Attached Files:

Scan report_20050817.txt.txt

hijackthis.log

jpmad4it Private E-2

jpmad4it Private E-2