TechSpot

Need help with hijack this log

By comwiz
Jun 12, 2005
  1. My friends been having problems with their computer i have got rid of some of the files causing problems but there are still things that hijack picked up that i cant seem to get rid off.

    any help would be great thanks
     
  2. Spike

    Spike TS Evangelist Posts: 2,168

    I'm afraid the machine in question is still infested.

    just at a quick glance, I can see an instance of Trickler, which is mal/adware, and sistray.exe, which is either the system tray icon for SiS graphics installed in the system, or a file created by the prova trojan.

    have you followed the instructions here precisely? If not, please could you do so and post back in this thread with a new HJT log and we'll take another look.
     
  3. comwiz

    comwiz TS Rookie Topic Starter Posts: 21

  4. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Boot in Safe Mode.
    Switch System restore OFF.
    Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:

    MsgPlus.exe
    OpenClock.exe

    Next, UNinstall anything to do with:
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\DOCUME~1\Home\APPLIC~1\THESIZ~1\OpenClock.exe

    Next, run a HJT scan and place a tick-mark in the little square before (if still there):
    ...................................................................................................
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fvhnlpvttwolwucs.com/IHa...rqCgdBA7wPvE58fuBK4eo640btAhbef0JDoOr8EM.html
    O2 - BHO: (no name) - {4C11C419-291A-5B5A-4CC7-E5796A6A8141} - (no file)
    O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
    O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [Heck 4] C:\DOCUME~1\Home\APPLIC~1\THESIZ~1\OpenClock.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    FIX ALL your O16 - DPF: entries
    ...................................................................................................
    Now click on the Fix Checked button in HJT.

    When done, from between the dotted lines, delete the highlighted bold files.
    When a \directory-name\ is bold, delete everything in it, including that directory itself.
    Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
    Repeat this for ALL [usernames].
    Boot normal. When all OK, switch System Restore back on.
     
  5. comwiz

    comwiz TS Rookie Topic Starter Posts: 21

    clean computer

    Thanks Spike & realblackstuff the computer is now clean.

    Regards
    comwiz
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...