victim of find-online.net

[Bramin3000]

Brad, I have updated all critical updates and ran spybot s&d but have not run adaware. Unfortutanetly CWshredder was run on my computer already due to something I read in another forum before I found PCTech. CWshredder did report that it found a trojan but I cannot remember the name and it did say that it had infected my media player and i would have to reinstall media player before the problem will be fixed. I thought that was strange, needless to say the problem still exists. IE start page has been hijacked but that seems to be the only problem I can see right now. It did not add anything to favorites, i can still navigate the web o.k. but this annoying thing wont go away no matter what I do. Please advise, here is my latest hijackthis log.

Logfile of HijackThis v1.97.7
Scan saved at 8:15:45 AM, on 6/27/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Program Files\Aardvark\aardvark.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
D:\programs\Speed Disk\nopdb.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\progra~1\vision~1\paperp~1\pptd40nt.exe
C:\WINNT\system32\shellexp.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weathsr.com/main.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\spybot\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PaperPort PTD] c:\progra~1\vision~1\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [xaqfnv] C:\WINNT\system32\eaqtsj.exe
O4 - HKCU\..\Run: [Explorer] C:\WINNT\system32\shellexp.exe en
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/04f6b6e8e9618a9cc4 ... xIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 906.298125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab

[liljim]

Your log doesnt look bad,give this a shot and let us know if it helps.

Press Ctrl/Alt/Del and "End Task" or "End Process" on the following: (it may or may not be there)

eaqtsj.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.) Close all other open Windows and have HiJackThis Fix:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weathsr.com/main.html

O4 - HKLM\..\Run: [xaqfnv] C:\WINNT\system32\eaqtsj.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

Now you need to open regedit and find the following keys,if any of them exist,delete them.

HKEY_CLASSES_ROOT\clsid\{1d6711c8-7154-40bb-8380-3dea45b69cbf}
HKEY_CLASSES_ROOT\webp2pinstaller.installer
HKEY_CLASSES_ROOT\webp2pinstaller.installer.1
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1d6711c8-7154-40bb-8380-3dea45b69cbf}

Browse to C:\WINNT\system32 and delete
eaqtsj.exe
(You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

Now, empty all your TEMP Folders/ Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

[Bramin3000]

liljim,
How do you disable system restore in win2k? Does it exist?

[brad]

Win2000 doesn't have "System Restore".
Just skip that step.
In addition to liljim's suggestions:

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

shellexp.exe

Close all other open Windows and have HiJackThis Fix:

O4 - HKCU\..\Run: [Explorer] C:\WINNT\system32\shellexp.exe en
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/04f6b6e8e9618a9cc4 ... xIE601.cab

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINNT\system32\shellexp.exe

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad

[liljim]

[Bramin3000]

:rox: Thanks to liljim and brad this problem seems to be fixed. You guys are the greatest. I had been to all the forums I could find and this one is the best! I couldn't find anyone that really could fix this problem, I saw a lot of attempts and suggestions but no one had it resolved. You guys ROCK!

A million thanks!
Best Regards,
Bramin3000

[liljim]

Glad we could help,tell the friends and family!