PCTech Forums

Hi all...

Don't you just love spyware?... Hopefully someone can be kind enough to help me out.

My default browser is Mozilla Firefox. When I opened Internet Explorer 6 today (first time in 3 days) I discovered I had a new toolbar (spyware for sure) that runs searches through mysearchnow.com.

I managed to get rid of it after more than 2 hours trying, with the aid of Spybot and HijackThis... but my firewall, ZoneAlarm, is telling me that IE is requesting access to the internet when I load IE up, even though my start page is "about:blank". IE should have no reason to access the internet when I start it up, so I was wondering if anyone has any suggestions as to why it is?... Or how I can find out what website it's trying to access?...

Maybe there is something left over from this mysearchnow.com toolbar which hasn't been completely removed?

Any thoughts/suggestions etc would be very, very much appreciated.

I'm running IE 6.0 SP1 on WinXP SP1. I have a HijackThis log if it's any help...

Thanks in advance, John Billion.

Yes, please post your HiJack This Log.
brad

For one thing you've got a Worm:
D:\Program Files\GlobalSCAPE\CuteFTP\cutftp32.exe


Then close all other open Windows and have HiJack This Fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = IE
O2 - BHO: (no name) - {0C98CE87-AD25-C70A-0710-0C84C3408C0D} - D:\PROGRA~1\SECOND~1\Metaless.dll
O3 - Toolbar: PLAY LONG DRAW - {55BE734D-591B-AE61-86F2-453C74A20AAA} - D:\PROGRA~1\SECOND~1\Metaless.dll
O4 - HKCU\..\Run: [Windows Update] D:\WINDOWS\winupdate.exe



What are these?
O4 - HKLM\..\Run: [MBM 5] "D:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [htm atom] D:\PROGRA~1\Chic Joy\MEDIAAMOKPILE.exe

brad

Hey brad...i dont mean to speak on anyone's behalf but

O4 - HKLM\..\Run: [MBM 5] "D:\Program Files\Motherboard Monitor 5\MBM5.EXE"

is a monitoring program for cpu hdd and motherboard chipset temps.Keeps the temps in your taskbar,very nice little program

Have to concur with liljim, Mother Board Monitor is a nice little program
for monitoring your temps, fan speeds, and the processor volts and Mhz. It’s real nice for overclocking.
You can even set alarms and ranges for any of the monitored hardware.
You can download it for free from .

As for this:
O4 - HKLM\..\Run: [htm atom] D:\PROGRA~1\Chic Joy\MEDIAAMOKPILE.exe
I have no idea, I search and found nothing

Thanks for your response Brad.

liljim you're correct about MBM5 , but I have no idea what
O4 - HKLM\..\Run: [htm atom] D:\PROGRA~1\Chic Joy\MEDIAAMOKPILE.exe
is... I don't like the look of it either :S

How is CuteFTP a worm? I had CuteFTP running while I ran this check... maybe I should have closed it down?...

If I may suggest there is a very good free program out there called SpywareGuard. With the increase of browser hijacks I found it to be a very usefull program. When it detects a browser hijack it pops up a box saying it has detected the hijack and would you like to restore to your old value or keep the new one. Naturally if you changed the browser setting you will want the new value but if it is something you never heard of abviously you will want to stick with your old value. Daniel

Hi, I've the same problem too with mysearchnow.com coming up as my start up page.
Is anyone willing to help me check my Hijack This log?

Thanks!

Yes, but post it in a New Topic, please.
Also, Download / Install / Update / and Run .
Then:
Download and run: before posting it.

brad