View Single Post
Old 10-11-2003, 09:33 AM   #8 (permalink)
jgvernonco
Old Timer
 
jgvernonco's Avatar
 
Join Date: Sep 2003
Location: Northern Arizona
Posts: 7,958
OS: Vista Home Premium, SP 27


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\System32.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\System32.exe
O2 - BHO: (no name) - {15f0ce81-49ac-4150-9581-74d2af216d15} - C:\DOCUME~1\Owner\APPLIC~1\eiegchstlz.dll
O2 - BHO: (no name) - {A78FAAEB-F125-FED7-9F30-1C280BFCB6EB} - C:\WINDOWS\system32\xyowdltf.dll
O2 - BHO: (no name) - {A7E7C9DA-5AAD-025C-7962-876A8F8D901B} - C:\WINDOWS\system32\oqjfkhzo.dll
O3 - Toolbar: rckstfchble - {90cd1ac2-1a6a-4c5b-bcbb-15d073b35a0a} - C:\DOCUME~1\Owner\APPLIC~1\eiegchstlz.dll
O4 - HKLM\..\Run: [Generic host proccess for windows] SVCHOSTS.EXE
O4 - HKLM\..\RunOnce: [NetFxUpdate_v1.0.3705] "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\netfxupdate.exe" 0 v1.0.3705 GAC + NI
O4 - HKCU\..\RunOnce: [Generic host proccess for windows] SVCHOSTS.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O16 - DPF: {0D4312E2-5E4D-4A27-A9D8-043E43904277} - http://www.warezoracle.com/xdownloader.exe


Two different Trojans, an bad boy browser hijacker, and assorted shrapnel from same.

Run HJT, check all of the items above, make sure that all browser windows are closed, then tell HJT to fix these. Reboot

Now, there are going to be programs associated with this stuff, and I am hoping that, rather than hunting them down one by one, we can now use Spybot to find them. Run a Spybot Scan and fix everything in red.

If Spybot works, post another HJT log. If it doesn't, uninstall it, download it again, and try running it.

Let us know what happens.
jgvernonco is offline