PCTech Forums

Hi guys longtime no see!
im having problems with explorer in the task manager its eating up all my memory.
ran spybot, adaware & cw swredder but to no avail?
ran a virus scan too had some trojans but got rid of them.
so heres my log file:

thanks for the help

you guys rock!

Logfile of HijackThis v1.99.1
Scan saved at 11:50:29 AM, on 8/24/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\netaa.exe
C:\WINDOWS\system32\d3zj.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe,msieysvr.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\System32\msieysvr.exe,C:\Documents and Settings\Owner\Application Data\Explorer\msieysvr.exe
O2 - BHO: Class - {6F78A3D1-E4D5-B092-FCE9-A46EF23174ED} - C:\WINDOWS\system32\addix.dll
O4 - HKLM\..\Run: [Update Player] C:\WINDOWS\System32\msieysvr.exe
O4 - HKLM\..\Run: [netaa.exe] C:\WINDOWS\netaa.exe
O4 - HKCU\..\Run: [Update Player] C:\WINDOWS\System32\msieysvr.exe
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O21 - SSODL: Update Themes - {5677940C-BE79-40D6-BCEF-6524641F4F8D} - C:\WINDOWS\System32\eulancui.dll
O23 - Service: Network Security Service ( 11Ffl‰#<sum>?ƒ÷`I) - Unknown owner - C:\WINDOWS\system32\d3zj.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.


Press Ctrl/Alt/Del and"End Task"or"End Process"on each of the following:
(They may or may not be there)
msieysvr
netaa
d3zj

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\bpldr.dll/sp.html#37049
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe,msieysvr.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,C:\WINDOWS\System32\msieysvr.exe,C:\Do cuments and Settings\Owner\Application Data\Explorer\msieysvr.exe
O2 - BHO: Class - {6F78A3D1-E4D5-B092-FCE9-A46EF23174ED} - C:\WINDOWS\system32\addix.dll
O4 - HKLM\..\Run: [Update Player] C:\WINDOWS\System32\msieysvr.exe
O4 - HKLM\..\Run: [netaa.exe] C:\WINDOWS\netaa.exe
O4 - HKCU\..\Run: [Update Player] C:\WINDOWS\System32\msieysvr.exe
O21 - SSODL: Update Themes - {5677940C-BE79-40D6-BCEF-6524641F4F8D} - C:\WINDOWS\System32\eulancui.dll
O23 - Service: Network Security Service ( 11Ffl‰#?ƒ÷`I) - Unknown owner - C:\WINDOWS\system32\d3zj.exe


Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WINDOWS\netaa.exe
C:\WINDOWS\system32\d3zj.exe

If you could not delete any of the above files add them to the list to have HijackThis delete on reboot

Start HijackThis and click the Open the misc tools section now click Delete a file on reboot
Select the following file to be deleted on reboot:
C:\WINDOWS\System32\eulancui.dll

Click open but click no to reboot now do the same for each of the following files:
C:\WINDOWS\System32\msieysvr.exe


Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.