Member Panel

ajspurs

hi there, i have a BT broadband connection that constantly goes on and off,it is really annoying especially when using msn messenger. It was alright for about 5 months, but now it has started again, i also have a microfilter which i find doesnt work very well. I have tried a phew things but none of those things have worked, i have a BT voyager 205 Router, could anyone suggest anything? cheers

Zimbo

Hey there ajspurs,

It may be tied up with spyware, would you be able to follow prework in my signature and run the ATF Cleaner, Ewido and Hijackthis.
Post the appropriate logs when you have finished.

Have you installed any antivirus of firewall software recently?

joe5

Also are you using p2p apps like bittorrent , edonkey ect.?

ajspurs

hi guys, thanks for ur replies,i am not using anything like bittorent or bitlord, though i am using limewire, but i have had limewire even when it was working fine, zimbo, i will try 2 remove all the spyware and post bak.

ajspurs

ok, i got report frm hijack this:

joe5

:o Wow , that doesn't look good at all.. I see plenty of things that could cause the problem you are having..

First run the Hoster:

Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original Hosts file.

Then go to add/remove programs and uninstall NewdotNet. If you don't have that option or if you have difficulties then please follow the instructions on this site

I would uninstall CachemanXP , apps like that are not needed with an O.S. as XP anymore and can only cause system instability.

Next i see entrys of Symantec , Sygate and Mcafee in youre log. And only the last seems to be running ok but im not sure about that even.
I would completly uninstall all three , and then reinstall only Mcafee.

Then boot youre pc in safemode (hit f8 when booting up).

Click Start>Run and type in: services.msc
Click OK
In the Services window find: Workstation NetLogon Service
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK
Open HJT and click config > misc tools > ?delete an NT service?
Copy and past: 11F??#????`I
Click OK.

Then fix these with hjt if still present:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...cid={SUB_CLCID}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.pandasoftware.com/redirec...ister&lang=eng
O1 - Hosts: 195.158.172.121 googl.de
O1 - Hosts: 195.158.172.121 www.googl.de
O1 - Hosts: 195.158.172.121 www.googl.at
O1 - Hosts: 195.158.172.121 googl.at
O1 - Hosts: 195.158.172.121 www.googl.ch
O1 - Hosts: 195.158.172.121 googl.ch
O1 - Hosts: 195.158.172.121 www.googl.nl
O1 - Hosts: 195.158.172.121 googl.nl
O1 - Hosts: 195.158.172.121 www.googl.se
O1 - Hosts: 195.158.172.121 googl.se
O2 - BHO: (no name) - {1895564A-E7B0-8B1E-2F35-16CB6EB249F0} - (no file)
O2 - BHO: (no name) - {1F77B61D-BE6B-566C-C734-47786D31C70C} - (no file)
O2 - BHO: (no name) - {27CF61EF-9339-4F47-D27B-D56CF2005AF4} - (no file)
O2 - BHO: (no name) - {29E7FFD8-E6A5-9FCB-ED6E-4AAE63F4CAE9} - (no file)
O2 - BHO: (no name) - {2CC1F27E-9D52-7F02-7CDE-B6567A968820} - (no file)
O2 - BHO: (no name) - {33F7AF52-59AE-18A1-199E-661008AFF6BF} - (no file)
O2 - BHO: (no name) - {364A9AC1-833E-64D6-405B-D34483F166CF} - (no file)
O2 - BHO: (no name) - {405C427D-7AE4-A1A7-D322-793595EC6979} - (no file)
O2 - BHO: (no name) - {41E85D98-6F3B-5C26-6D90-5875C3B7B83A} - (no file)
O2 - BHO: (no name) - {41EADA53-9855-F5E4-A237-FA8F16993990} - (no file)
O2 - BHO: (no name) - {46F3B906-9341-261A-174E-A449FCEEC741} - (no file)
O2 - BHO: (no name) - {483866A3-D9FA-8B06-B35A-0E72D8EA229F} - (no file)
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll
O2 - BHO: (no name) - {4ABB5929-6D33-1BD3-5889-307B70AC94D2} - (no file)
O2 - BHO: (no name) - {4B05C084-12D2-0FF6-D490-A0CF45280E50} - (no file)
O2 - BHO: (no name) - {4D8E7FD0-7790-B916-09D7-0575F565150C} - (no file)
O2 - BHO: (no name) - {514AD317-D072-49A6-8F45-BCC1983F2289} - (no file)
O2 - BHO: (no name) - {51800969-48F2-7F01-9784-D8DD201261BE} - (no file)
O2 - BHO: (no name) - {52148DC7-DCB5-A4A8-BCEB-3744B4F9F1FB} - (no file)
O2 - BHO: (no name) - {5DD80C18-51A3-6008-94F8-910369F02E0D} - (no file)
O2 - BHO: (no name) - {611BC1A6-C732-89BE-88E7-13D4CBB3E737} - (no file)
O2 - BHO: (no name) - {6A9852CC-FCBB-61A5-41A1-2EDA8230AEC5} - (no file)
O2 - BHO: (no name) - {73932121-4D3D-77E8-3DE2-0B1D233D3120} - (no file)
O2 - BHO: (no name) - {797CF3F6-DFA4-7C09-D2A7-116A21249ABF} - (no file)
O2 - BHO: (no name) - {7D80F0E3-D853-E15E-FD62-366068538F6E} - (no file)
O2 - BHO: (no name) - {81C4026E-2E5E-88DC-7B26-44B223181EC2} - (no file)
O2 - BHO: (no name) - {88AE5BAB-3DC7-9717-34AB-BAC95A1C967A} - (no file)
O2 - BHO: (no name) - {8A8EABA7-19AA-BB2B-F288-8E8741D4A2E0} - (no file)
O2 - BHO: (no name) - {8D581B79-7AD1-2537-0E66-F037063DC7BF} - (no file)
O2 - BHO: (no name) - {95BB3438-0B60-B4FB-A68F-174D498229E8} - (no file)
O2 - BHO: (no name) - {9709B368-B64F-22D7-F55C-19C0CF259122} - (no file)
O2 - BHO: (no name) - {9ABA5138-8227-CC21-68F5-2ABC964FBA9C} - (no file)
O2 - BHO: (no name) - {9E15F239-C4F7-8EB8-6033-C3BB100C2276} - (no file)
O2 - BHO: (no name) - {A82A02CC-65E3-A41A-62AD-6DC403543011} - (no file)
O2 - BHO: (no name) - {A9AA764C-4DF4-9D6E-2FEE-AF3AB6C73396} - (no file)
O2 - BHO: (no name) - {AC70C2E1-35DB-1982-F196-044C929035FF} - (no file)
O2 - BHO: (no name) - {B56233F4-AAE8-569E-8370-CAB92BF74D19} - (no file)
O2 - BHO: (no name) - {BA766B06-F528-DA73-2252-17372A2B1F55} - (no file)
O2 - BHO: (no name) - {BDA8AF27-D057-4727-6CE7-CFF4CE61A0FD} - (no file)
O2 - BHO: (no name) - {C145A150-7CF0-18AE-ABB4-8E6229CE6498} - (no file)
O2 - BHO: (no name) - {C35E61AF-D4CC-C616-D8F0-C6D3B83A1702} - (no file)
O2 - BHO: (no name) - {C513679F-3941-6193-9035-2B4BFA521474} - (no file)
O2 - BHO: (no name) - {C682057F-E371-B29A-848C-7D9B32E2DD9C} - (no file)
O2 - BHO: (no name) - {C903452D-F242-5368-3A53-B53766C88F7C} - (no file)
O2 - BHO: (no name) - {D0368D06-683D-696E-0632-27D74D49E207} - (no file)
O2 - BHO: (no name) - {D46BCBAD-B2DB-4BFA-6795-B84A766FCDDF} - (no file)
O2 - BHO: (no name) - {E3B14A8F-CDB3-F460-55F1-ACA21FB4131B} - (no file)
O2 - BHO: (no name) - {EE13EB7D-EBCF-F6FC-0596-289AC46D563C} - (no file)
O2 - BHO: (no name) - {EF3DA427-88BA-69AC-D4EE-CE669ADD36B2} - (no file)
O2 - BHO: (no name) - {F0433EDA-457B-BCD1-E20A-BAA824CBC00A} - (no file)
O2 - BHO: (no name) - {FF3C44AD-FD55-5AC7-EB1B-96541E72E0B6} - (no file)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\newdotnet7_22.dll,ClientStart up -s
O23 - Service: Workstation NetLogon Service ( 11F??#????`I) - Unknown owner - C:\WINDOWS\system32\mfcdw.exe (file missing)

And delete the folder in bold. Reboot and post a new hjt log , plus the Ewido log you made earlier.

Member Panel

Sponsors and Ads

Live Tag Cloud