Read on full site | Join TechSpot! (it's free) | Bookmark / Share this



Suspicious network activity - Help with HijackThis logfile needed

Ole99
08-07-2005, 07:10 PM
My computer has recently given me the warnings "WARNING: Windows Firewall detected suspicious network activity on yor computer" and "Your computer might be at risk." In addition Internet Explorer starts by itself when I start/reboot my pc.

I have the McAfee security package. I've installed and ran Spybot S&D, Bazooka and CWS Shredder but the problem is still there. I would be greatful for some help. HijackThis logfile attached

RealBlackStuff
08-08-2005, 09:10 AM
Download RapidBlaster Killer here: http://www.spywareinfo.com/downloads/rbkiller/rbkiller.exe
Don't run it till I tell you!

Boot in Safe Mode.
Switch System restore OFF, see how here (www.bleepingcomputer.com/forums/tutorial56.html).
In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here (www.bleepingcomputer.com/forums/tutorial62.html).

Next, run RapidBlaster Killer

Next, open Windows Task Manager.
On Windows 95/98/ME, press CTRL+ALT+DELETE.
On Windows NT/2000/XP, press CTRL+SHIFT+ESC.
Click the Processes tab, select the process (if there), click End Process for:
STDSB.exe
Icon.exe
d3tf32.exe
ClickMe.exe

Next, try to UNinstall anything to do with (not delete yet!):
C:\apps\ClickMe\ClickMe.exe

Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
........................................................................... ........................
C:\WINDOWS\system32\drivers\STDSB.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\d3tf32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [ClickMe] C:\apps\ClickMe\ClickMe.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe (this starts IE at boottime)
O4 - HKLM\..\Run: [d3tf32.exe] C:\WINDOWS\system32\d3tf32.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
........................................................................... ........................
Now click on the Fix Checked button in HJT.

When done, from between the above dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal. When all OK, switch System Restore back on.

Ad
08-08-2005, 09:10 AM
  

Post a reply, see related topics & more

Tip: Download Advanced SystemCare 3 Free - Clean, Repair, Protect & Optimize your PC.



 Top Technology News

Weekend Open Forum: Google Chrome OS and the future of cloud computing

Tech Tip of the Week: Unearth Region-Specific Windows 7 Themes

Sony: PlayStation 3 to be 3D-capable via firmware update

iSuppli: DDR3 to account for over half of DRAM shipments by Q2 2010

Facebook named third most popular video website behind YouTube and Hulu

Patriot introduces new PS-100 SSD series

Sony working on digital store for music, movies, books

Details of Intel's 32nm Atom emerge, on track for 2011

More Tech News

  
 Software Downloads

Norton Virus Definitions 2003-07 November 20, 2009

AVG Anti-Virus Updates November 20, 2009

Norton Virus Definitions 2008-09 November 20, 2009

avast! Virus Definitions November 20, 2009

McAfee SuperDAT Update 5808

Kaspersky Anti-Virus Update November 20, 2009

Google SketchUp 7.1.6087

More Downloads



Copyright © 1998-2009 TechSpot.com. TechSpot is a registered trademark. All Rights Reserved.