Tech Support Forum - View Single Post - got some weird program that won't go away

sUBs · 03-01-2006, 10:23 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

* * * * * * UN-INSTALLING PROGRAMS * * * * * * * * * * * * * *

Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs:

webHancer

Please note any other programs that you dont recognize in that list in your next response

* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * *

Do a HijackThis scan & place a check next to these items and select "Fix checked":

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - Default URLSearchHook is missing
O2 - BHO: Yvakt Class - {0DEADE31-9A37-48B2-921A-7825EA93D32A} - C:\WINDOWS\system32\wdc1n.dll
O2 - BHO: (no name) - {CE535C3C-C8A2-D205-F0F8-973B800074B2} - C:\WINDOWS\system32\eab.dll
O4 - HKLM\..\Run: [strtas] l074.exe
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
O4 - HKLM\..\Run: [NJv7jy] "C:\WINDOWS\system32\dgfgql.exe"
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
O4 - HKLM\..\Run: [win3207322129673] C:\WINDOWS\win3207322129673.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [2<|9] C:\windows\eee2.exe
O4 - HKLM\..\Run: [loadadv64] C:\WINDOWS\system32\loadadv64
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [LWS*] C:\windows\eee2.exe
O4 - HKLM\..\RunServices: [strtas] l074.exe
O4 - HKCU\..\Run: [strtas] l074.exe
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O18 - Filter: text/html - {BA576CDE-9949-4473-A8F7-6C17C2A7E600} - C:\WINDOWS\system32\wdc1n.dll
O20 - AppInit_DLLs: repairs303169536.dll

* * * * * *

Download & SAVE ON DESKTOP, the file attached - fix.zip

** It's important that the file must be saved to Desktop

From within it, double-click on fix.exe & allow it to run
It shall reboot your computer automatically & present you with a log which you should post back here. Also post a fresh HJT log

03-01-2006, 10:23 PM	#12 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,331 OS: N/A	Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. * * * * * * UN-INSTALLING PROGRAMS * * * * * * * * * * * * * * Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs: webHancer Please note any other programs that you dont recognize in that list in your next response * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R3 - Default URLSearchHook is missing O2 - BHO: Yvakt Class - {0DEADE31-9A37-48B2-921A-7825EA93D32A} - C:\WINDOWS\system32\wdc1n.dll O2 - BHO: (no name) - {CE535C3C-C8A2-D205-F0F8-973B800074B2} - C:\WINDOWS\system32\eab.dll O4 - HKLM\..\Run: [strtas] l074.exe O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe O4 - HKLM\..\Run: [NJv7jy] "C:\WINDOWS\system32\dgfgql.exe" O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe O4 - HKLM\..\Run: [win3207322129673] C:\WINDOWS\win3207322129673.exe O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe" O4 - HKLM\..\Run: [2<\|9] C:\windows\eee2.exe O4 - HKLM\..\Run: [loadadv64] C:\WINDOWS\system32\loadadv64 O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe O4 - HKLM\..\Run: [LWS] C:\windows\eee2.exe O4 - HKLM\..\RunServices: [strtas] l074.exe O4 - HKCU\..\Run: [strtas] l074.exe O15 - Trusted Zone: .media-motor.net O15 - Trusted Zone: .popuppers.com O18 - Filter: text/html - {BA576CDE-9949-4473-A8F7-6C17C2A7E600} - C:\WINDOWS\system32\wdc1n.dll O20 - AppInit_DLLs: repairs303169536.dll * * * * * Download & SAVE ON DESKTOP, the file attached - fix.zip It's important that the file must be saved to Desktop From within it, double-click on fix.exe** & allow it to run It shall reboot your computer automatically & present you with a log which you should post back here. Also post a fresh HJT log __________________ Question - what have you done for the community today? Last edited by sUBs; 03-28-2006 at 08:50 AM.