Apparently, I have had some adware attach itself to my hard drive. Ad-Aware does nothing, even with the latest updates. I thought I killed most of it with HijackThis! But apparently not.
Here is the log file:
Logfile of HijackThis v1.96.1Real.com (HKLM)http://www.aol.com/netmail/aolnetmail.cab http://www.aol.com/netmail/aolapi-n.cab http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://www.msnbc.com/download/nm0713.cab http://activex.microsoft.com/controls/mcsi/mcsimenu.cab http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://www.apple.com/qtactivex/qtplugin.cab http://www.ipix.com/viewers/ipixx.cab http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
Any ideas on what I should fix? Actually, I know one file in particular should be gone but I can’t keep it dead:
O4 - HKCU…\Run: [5-2-46-59[1]] c:\windows\5-2-46-59[1].exe -m
Everytime I remove this, it just pops right back in to my next scan. Not sure what to do.
I can’t say if its a virus, but get yourself to www.grisoft.com , get AVG, and run it.
Its free and its cleared up numerous problems for myself and every person that I’ve refererred to them.
Hey, couldn’t hurt…
Toddly
April 24, 2004, 12:13am
3
Neurotik:
Apparently, I have had some adware attach itself to my hard drive. Ad-Aware does nothing, even with the latest updates. I thought I killed most of it with HijackThis! But apparently not.
Any ideas on what I should fix? Actually, I know one file in particular should be gone but I can’t keep it dead:
O4 - HKCU…\Run: [5-2-46-59[1]] c:\windows\5-2-46-59[1].exe -m
Yes that one does look suspcious. Have you tried MSCONFIG? If not GoTo Run>type “msconfig” (no quotes) and select the Startup Tab. Scan through the menu and see if it is there and if so uncheck it. You may be able to remove it if it does not load so after restart delete the rascal if possible. You might also post your HiJack file in the Spyware Forums these folks are experienced and surely could help.
There are several problems. The first one you have to deal with is the peper trojan:
O4 - HKLM…\Run: [2RDRGFM4R325YA] C:\WINDOWS\SYSTEM\Mdm7N.exe
Cleaning via hijackthis doesn’t help. You need to download the cleaner from here. (scroll down to the very bottom of the page for the link). You will need to be connected to the Internet while cleaning.
This is a partial log, so I can’t analyze all the problems (notibly, any browser hijackers). However, some things need immediate attention, so
Click on Fix checked and delete the items.
Restart the computer and delete these files, if present:
wupdater.exe
The “svchost” should also be deleted, but there are legitimate programs with that name, so it’s best to go to http://housecall.trendmicro.com/housecall and let their online virus scanner clean it up.
When you’re done, post you entire log here so it can be checked.
Thank you, thank you, thank you all.
James , that’s a great program!
Toddly , good suggestion. I unchecked a few things and that helped.
RealityChuck ! Fantastic. Thanks for looking at the stuff. I tried to run the first program - the trojan remover, but it just had a little box popup saying it won’t run in DOS mode. I’m not sure why, but that’s what happened.
I killed the files you told me to in HijackThis and restarted the computer and don’t see any sing of them when I ran it again. Here is the entire log file I just ran:
Logfile of HijackThis v1.96.1
Running processes:
O4 - HKLM…\Run: [ScanRegistry] c:\windows\scanregw.exe /autorunReal.com (HKLM)http://www.aol.com/netmail/aolnetmail.cab http://www.aol.com/netmail/aolapi-n.cab http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://www.msnbc.com/download/nm0713.cab http://activex.microsoft.com/controls/mcsi/mcsimenu.cab http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://www.apple.com/qtactivex/qtplugin.cab http://www.ipix.com/viewers/ipixx.cab http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
Thanks so much, everyone. I don’t know if it’s dead, but it’s certainly been beaten badly.
Toddly
April 24, 2004, 7:04am
6
I’m glad you have the advantage. I would recommend that you download and install Spyware Blaster . This is a nice little program that prevents spyware from installing. I think it works pretty well. My kids machines are in good shape and I actually attribute some of that to this program. You install it and update it as needed.