TechSpot

Kindly request assistance with Hijack This log

By brandiecase
Feb 14, 2005
Topic Status:
Not open for further replies.
  1. I have read the topic how to remove search assist and did as directed. I am running spybot 1.4b and it removed an extra couple of things spybot 1.3 couldn't/didn't. I am working on win98 and I keep getting weird things happening. This is a friend computer, mine doesn't have any of this stuff and I honestly don't know how it gets there. I must have a firewall and my norton must be working well :) along with spybot.

    Thank you very much for your help. I appreicate you folks being here!
     
  2. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

    Move C:\WINDOWS\DESKTOP\HIJACKTHIS[1].EXE to its own permanent directory.

    Boot in Safe Mode.

    Get rid of this pest, C:\WINDOWS\SYSTEM\LOCATORS.DLL following these instructions:
    http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076978

    Run HJT on its own and let it 'fix':
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://ls0.net/srchasst.html (obfuscated)
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\SYSTEM\LOCATORS.DLL
    O9 - Extra 'Tools' menuitem: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\SYSTEM\LOCATORS.DLL
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O19 - User stylesheet: (file missing)

    When done, delete C:\WINDOWS\SYSTEM\LOCATORS.DLL
     
  3. bugman

    bugman TS Rookie

    My HijackThis log-file - please help!

    I've followed all the instructions from realblackstuff and cleaned out a lot of spyware, etc. The only thing I haven't done yet is switched from IE to Firefox.
    I attach my HijackThis log-file. What else is there that needs cleaning?
    Many thanks for your help.
     
  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

    bugman,
    you are clean, congrats.
     
  5. bugman

    bugman TS Rookie

    Thanks

    Many thanks for your help!
    :giddy:
     
  6. brandiecase

    brandiecase TS Rookie Topic Starter

    Check back

    I did as you suggested. The only thing is when I deleted the first one for earthlink, I lost my start page. so that one is still there because I want start.earthlink.net as start page.

    Let me know if ok, otherwise.
     
  7. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

    brandiecase
    Your log is clean. Hope you are using Firefox from now on!
     
  8. brandiecase

    brandiecase TS Rookie Topic Starter

    Here I go again

    A friend used this computer before I got a chance to switch to firefox or to get a firewall and it is all messed up again. :dead: I keep getting a toolbar called for intra. can't get it to go away, keeps coming back. puke:
     
  9. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 8,165

Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.