Member Panel

Remember me ?

Forgot password?   

Sponsors and Ads

Live Tag Cloud
PC Forum PC Help Forum » Security & Safety » Spyware / AdWare » Hjt Log

Spyware / AdWare - Hjt Log posted in the Security & Safety forums; Hi people, i cant work out whats wrong with McAfee at the moment every time i click fix it says " one or more problems require your response"??? then it ...

JOIN US NOW to remove these Ads

PC Help Forum, the number one FREE computer support website in the search engines
Post New Thread  Reply
Page 1 of 2 1 2 >
  #1  
Old 07-11-2007
norris7850's Avatar
Silver Member
My PC
 
Join Date: May 2007
Location: Wilts,England
Posts: 140
PC Experience: Some Experience
norris7850 - See this Members User comments on their Profile page
Default Hjt Log
Hi people,

i cant work out whats wrong with McAfee at the moment every time i click fix it says " one or more problems require your response"??? then it just goes back this home page telling me action required,can anyone help because it is really annoying

Many thanks

Matty

Attached Files
File Type: txt hijackthis log.txt (8.7 KB, 4 views)


__________________
  #2  
Old 07-11-2007
MadGamer's Avatar
Moderator
My PC
 
Join Date: May 2004
Location: UK
Posts: 2,334
PC Experience: Experienced
MadGamer - See this Members User comments on their Profile page MadGamer - See this Members User comments on their Profile page MadGamer - See this Members User comments on their Profile page MadGamer - See this Members User comments on their Profile page MadGamer - See this Members User comments on their Profile page MadGamer - See this Members User comments on their Profile page
Default
You need to update your virus defination files.
  #3  
Old 07-11-2007
valis's Avatar
Senior Security Analyst
My PC
 
Join Date: Jan 2007
Location: texas, USA
Posts: 2,576
PC Experience: PC Illiterate
valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page
Default
hey norris....you got all sorts of goodies in there.

go to start > run > appwiz.cpl and remove new.net and wildtangent. Then right click start > explore > navigate to program files and delete both of those from that directory.

May want to print this out, as I need you to close all windows, start hjt, click 'perform system scan only', place a tick next to the following, then click 'fix checked':

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll (file missing)
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe (file missing)
O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://securegameloader.com/cont/sc.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00721/sb028.cab
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} - http://www.wildtangent.com/install/w...lockbuster/wti nst.cab
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Do you know this IP address?
O17 - HKLM\System\CCS\Services\Tcpip\..\{B127406F-7FA1-4302-A271-9C5254F9FF46}: NameServer = 62.6.40.178 194.72.0.98 <-- those two

Reboot, and post a new log.

Thanks,

v


__________________

M.C.S.A.
M.C.P. - MS Server 2k3, Network Architecture

"Ask Bill why the string in function 9 is terminated by a dollar sign. Ask him, because he can't answer. Only I know that."
- Gary Kildall
  #4  
Old 07-11-2007
norris7850's Avatar
Silver Member
My PC
 
Join Date: May 2007
Location: Wilts,England
Posts: 140
PC Experience: Some Experience
norris7850 - See this Members User comments on their Profile page
Default
hi thanks V,

I have managed to delete new.net but wild tangent isnt on the list??

I have attached the latest HJT log

i dont know that ip address however i wouldnt know even if it was mine to tell the truth ? why do you ask??

Still having probs with mcafee. i clicked update and it says there are no updates ? maybe i need to reinstall it?

Many thanks

Matt
Attached Files
File Type: txt hijackthisnew1.txt (7.5 KB, 1 views)


__________________
  #5  
Old 07-11-2007
valis's Avatar
Senior Security Analyst
My PC
 
Join Date: Jan 2007
Location: texas, USA
Posts: 2,576
PC Experience: PC Illiterate
valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page valis - See this Members User comments on their Profile page
Default
okay, I want to see if you have something called aurora at work on your machine. Right click start > explore > windows > find 'nail.exe' and delete it. Reboot, go back and see if it's there again. If it is, you've got aurora and we have to radically alter our plans.....

thanks,

v


__________________

M.C.S.A.
M.C.P. - MS Server 2k3, Network Architecture

"Ask Bill why the string in function 9 is terminated by a dollar sign. Ask him, because he can't answer. Only I know that."
- Gary Kildall
  #6  
Old 07-12-2007
norris7850's Avatar
Silver Member
My PC
 
Join Date: May 2007
Location: Wilts,England
Posts: 140
PC Experience: Some Experience
norris7850 - See this Members User comments on their Profile page
Default
ok done that and nail.exe is not there anymore.

Im getting another error message now though when rebooting is it something to do with removing new.net??

ive left a screenshot



__________________

Reply
New! Norton Internet Security 2008 – Download Now Click Here
Page 1 of 2 1 2 >

Bookmarks

« [Closed] trojan adware | [Answered] java versions »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On

Contact Us - PC Help Forum - Site Map - Privacy Statement - Top

All times are GMT +1. The time now is 02:45 PM.
Powered by vBulletin
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0 RC7
All Graphics & Content Copyright © 2004-2008 - PC Help Forum.com


Back to Top