Read on full site | Join TechSpot! (it's free) | Bookmark / Share this



Suspicious network activity - Help with HijackThis logfile needed

Ole99
08-07-2005, 07:10 PM
My computer has recently given me the warnings "WARNING: Windows Firewall detected suspicious network activity on yor computer" and "Your computer might be at risk." In addition Internet Explorer starts by itself when I start/reboot my pc.

I have the McAfee security package. I've installed and ran Spybot S&D, Bazooka and CWS Shredder but the problem is still there. I would be greatful for some help. HijackThis logfile attached

RealBlackStuff
08-08-2005, 09:10 AM
Download RapidBlaster Killer here: http://www.spywareinfo.com/downloads/rbkiller/rbkiller.exe
Don't run it till I tell you!

Boot in Safe Mode.
Switch System restore OFF, see how here (www.bleepingcomputer.com/forums/tutorial56.html).
In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here (www.bleepingcomputer.com/forums/tutorial62.html).

Next, run RapidBlaster Killer

Next, open Windows Task Manager.
On Windows 95/98/ME, press CTRL+ALT+DELETE.
On Windows NT/2000/XP, press CTRL+SHIFT+ESC.
Click the Processes tab, select the process (if there), click End Process for:
STDSB.exe
Icon.exe
d3tf32.exe
ClickMe.exe

Next, try to UNinstall anything to do with (not delete yet!):
C:\apps\ClickMe\ClickMe.exe

Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
........................................................................... ........................
C:\WINDOWS\system32\drivers\STDSB.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\d3tf32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [ClickMe] C:\apps\ClickMe\ClickMe.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe (this starts IE at boottime)
O4 - HKLM\..\Run: [d3tf32.exe] C:\WINDOWS\system32\d3tf32.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
........................................................................... ........................
Now click on the Fix Checked button in HJT.

When done, from between the above dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal. When all OK, switch System Restore back on.

Ad
08-08-2005, 09:10 AM
  

Post a reply, see related topics & more

Tip: Download Advanced SystemCare 3 Free - Clean, Repair, Protect & Optimize your PC.



 Top Technology News

Weekend Open Forum: Have you upgraded to Windows 7 yet? What is there to like/not?

Tech Tip of The Week: Turn Off your Display Using a Windows Shortcut and More

Nvidia's profits up 74% in third quarter

Intel finds X25-M firmware bug

Samsung announces new .6mm-thick NAND memory package

DFI intros MI P55-T36, the world's first P55-based mini-ITX board

Nvidia Tegra 2 to double performance, arrive next year?

Google touts privacy and transparency with Dashboard

More Tech News

  
 Software Downloads

GMABooster 2.1a

Power Plan Assistant for Windows 7 v1.2b

Picasa 3.5.0.79.81

Adobe Shockwave Player 11.5.2.602

FileZilla 3.3.0 RC1

DivX Player 7.2.1.1 for Windows

VSO Image Resizer 3.0.0.140

More Downloads



Copyright © 1998-2009 TechSpot.com. TechSpot is a registered trademark. All Rights Reserved.