also @ TechSpot: ATI Radeon HD 5570 Review: Low Profile + Gaming

Read on full site | Join TechSpot! (it's free) | Bookmark / Share this



Suspicious network activity - Help with HijackThis logfile needed

Ole99
08-07-2005, 07:10 PM
My computer has recently given me the warnings "WARNING: Windows Firewall detected suspicious network activity on yor computer" and "Your computer might be at risk." In addition Internet Explorer starts by itself when I start/reboot my pc.

I have the McAfee security package. I've installed and ran Spybot S&D, Bazooka and CWS Shredder but the problem is still there. I would be greatful for some help. HijackThis logfile attached

RealBlackStuff
08-08-2005, 09:10 AM
Download RapidBlaster Killer here: http://www.spywareinfo.com/downloads/rbkiller/rbkiller.exe
Don't run it till I tell you!

Boot in Safe Mode.
Switch System restore OFF, see how here (www.bleepingcomputer.com/forums/tutorial56.html).
In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here (www.bleepingcomputer.com/forums/tutorial62.html).

Next, run RapidBlaster Killer

Next, open Windows Task Manager.
On Windows 95/98/ME, press CTRL+ALT+DELETE.
On Windows NT/2000/XP, press CTRL+SHIFT+ESC.
Click the Processes tab, select the process (if there), click End Process for:
STDSB.exe
Icon.exe
d3tf32.exe
ClickMe.exe

Next, try to UNinstall anything to do with (not delete yet!):
C:\apps\ClickMe\ClickMe.exe

Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
........................................................................... ........................
C:\WINDOWS\system32\drivers\STDSB.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\d3tf32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [ClickMe] C:\apps\ClickMe\ClickMe.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe (this starts IE at boottime)
O4 - HKLM\..\Run: [d3tf32.exe] C:\WINDOWS\system32\d3tf32.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
........................................................................... ........................
Now click on the Fix Checked button in HJT.

When done, from between the above dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal. When all OK, switch System Restore back on.

Ad
08-08-2005, 09:10 AM
  

Post a reply, see related topics & more

 Top Technology News

ATI Radeon HD 5570 Review

TechSpot's PC Buying Guide: Always up to date!

ATI Radeon HD 5450 Review

Nvidia automates switchable mobile graphics with Optimus

Netflix to roll out 1080p streaming later this year

Google to launch Twitter-like service for Gmail

Intel unveils Itanium 9300 series enterprise processors

AMD's six-core Thuban to have feature like Turbo Boost?

More Tech News

  
 Software Downloads

GameGain 2.2.8.2010

Ashampoo Photo Commander 7.31

Ashampoo UnInstaller 4.04

VueScan 8.6.10 for Mac OS X

Speed Download 5.2.11 for Mac OS X

Vienna 2.4.0.2401 for Mac OS X

UltraISO 9.3.6.2750

More Downloads



Copyright © 1998-2009 TechSpot.com. TechSpot is a registered trademark. All Rights Reserved.