Please help with my log

Discussion in 'Malware Help (A Specialist Will Reply)' started by bani, Mar 30, 2005.

  1. bani

    bani Private E-2

    I'm having about:blank prob. I have tried several antispywares, like spybot, ms antispy, spybouncer..None of them seems to work. Now I'm using spyware doctor. There are also a lot other probs other than this about:blank. Different software has different scan result. I am following the steps and here attached is my Hijackthis log. Please help! Thanks so much.
     

    Attached Files:

  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please print out these instructions so that you can operate with All Browser Windows CLOSED.

    Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



    Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

    atllt.exe

    ntwc.exe

    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {3C0A8EE5-B656-B26C-3E8C-52FBC8832036} - C:\Windows\system32\d3df.dll

    O4 - HKLM\..\Run: [apun] C:\Windows\msagent\chars\apun.exe
    O4 - HKLM\..\Run: [ntwc.exe] C:\Windows\ntwc.exe
    O4 - HKCU\..\Run: [dfrgsnap] C:\Windows\System32\dfrgsnap.exe
    O4 - HKCU\..\Run: [wowfax] C:\Windows\System32\wowfax.exe

    O9 - Extra button: 3721??? - {5D73EE86-05F1-49ed-B850-E423120EC329} - http://cmail.3721.com?fb=client (file missing)
    O9 - Extra button: ?? - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\Kingsoft\IEPlugin.dll
    O9 - Extra button: ?? - {9A687CA6-D585-4947-9ED9-BE96071F5CD9} - C:\Kingsoft\XDictExB.dll
    O9 - Extra button: ???? - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\Kingsoft\IEPlugin.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Microsoft AntiSpyware helper - {7FEBE352-6EED-4C1B-B26E-8216837DAF2A} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7FEBE352-6EED-4C1B-B26E-8216837DAF2A} - (no file) (HKCU)

    O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\Kingsoft\XDictExB.dll

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

    C:\Kingsoft ←–– Delete this whole folder if it exist!

    C:\WINDOWS\atllt.exe

    C:\WINDOWS\ntwc.exe

    C:\WINDOWS\system32\d3df.dll

    C:\WINDOWS\msagent\chars\apun.exe

    C:\WINDOWS\System32\dfrgsnap.exe

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.
    Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    Reboot to Normal Windows , Scan with HijackThis and attach the new log.
    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

    Good Luck!:)


    C:\WINDOWS\System32\wowfax.exe
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds