Tech Support Forum - View Single Post

sUBs · 10-15-2005, 04:13 PM

It appears that the tool managed to fix Vundo.

Let's fix the other entries in your log.

Uninstall the following programs, if present, using Control Panel->Add/Remove Programs:

MyWaySA

With HiJackThis & place a check next to these items and select "Fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O4 - HKLM\..\Run: [NI.UWAS5LP_0001_0811] "C:\Documents and Settings\Jennifer Markley\Local Settings\Temporary Internet Files\Content.IE5\SHI3C1YZ\WAS5Scan[1].exe"
O20 - Winlogon Notify: imgabr - C:\WINDOWS\msagent\chars\imgabr.dll (file missing)

Locate & delete this folder - C:\Program Files\MyWaySA\

Go to Start> Run - type cleanmgr (this starts Windows DiskCleanup)

Select Drive C: & click the 'OK' button
Select the following options:
- Temporary Internet Files
- Temporary Files
Click the 'OK' button

Perform an online scan with Internet Explorer with Panda ActiveScan

Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
Click Scan Now
Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls

Begin the scan by selecting My Computer

If it finds any malware, it will offer you a report.
Click on see report. Then click Save report

Post the contents of the report in your next reply along with a new HJT log

*You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
*Turn off the real time scanner of any existing antivirus program while performing the online scan

10-15-2005, 04:13 PM	#6 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,326 OS: N/A	It appears that the tool managed to fix Vundo. Let's fix the other entries in your log. Uninstall the following programs, if present, using Control Panel->Add/Remove Programs: MyWaySA With HiJackThis & place a check next to these items and select "Fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O4 - HKLM\..\Run: [NI.UWAS5LP_0001_0811] "C:\Documents and Settings\Jennifer Markley\Local Settings\Temporary Internet Files\Content.IE5\SHI3C1YZ\WAS5Scan[1].exe" O20 - Winlogon Notify: imgabr - C:\WINDOWS\msagent\chars\imgabr.dll (file missing) Locate & delete this folder - C:\Program Files\MyWaySA\ Go to Start> Run - type cleanmgr (this starts Windows DiskCleanup) Select Drive C: & click the 'OK' button Select the following options: Temporary Internet Files Recycle Bin Temporary Files Click the 'OK' button Perform an online scan with Internet Explorer with Panda ActiveScan Click Scan your PC & a 'pop up' window shall appear. ensure that your pop up blocker doesn't block it Click Scan Now* Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls Begin the scan by selecting My Computer If it finds any malware, it will offer you a report. Click on see report. Then click Save report Post the contents of the report in your next reply along with a new HJT log You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report. Turn off the real time scanner of any existing antivirus program while performing the online scan __________________ Question - what have you done for the community today?