lurker
 

I have been a lurker here for a long time.The only reason why im posting is because this is the only website I can get to.I have talked to my isp and my computer support people and they arent really much help.I have run virus checks and spyware programs to no avail.Obviosly I can get online but this is the only website in my fav lists that will load the rest of the wwebsites will just hang forever and not load.It will say opening page but it will not load.I also cant get any emails and for work related reasons I need to get my emails.So any of you really smart people have any ideas what I can do.Also I have a few grand in numerous poker sites that I dont what exploited.Any help will be much appreciated

I thought someone was going to try to steal Pass' woman...

welcome?

I see that SkyDog has you firmly in his grasp.

There is no escape for you.

You don't by chance have a Hacked Adult Membership Site?

You can get those anywhere...hold out for a copy of Net Detective.

I'm thinking you have an IE issue.

Check tools --> internet options --> connections --> lan settings (make sure it's set to automatically detect settings)

You could also load Firefox, just to see if it is indeed IE that is the issue.


Todd

although I have been to adult websites I dont have any hacks to get into them............this is unreal.I have no way of getting firefox

Isn't there an option in IE that says "work offline"?

why would I want to work offline I need to get to webpages and my email

I had a similar problem a while ago with my windows 98 system. I removed some software from my system, and it deleted a dll that I needed.

Can you access your e-mail? If so, I could try to e-mail you the Firefox download...

Edit- Nevermind, I see that you can't...

What I meant is that maybe the offline option was checked, I didn't mean to switch it to Offline. Just tossing out ideas.

I had this happen to me before, and I had to ping my ISP, but if you have already contacted them and they didn't say anything, then that is probably not gonna help either.

I am utterly useless.

You say that you can't reach anything on your favorites list. Have you tried just typing in the URLs? Maybe your favorites folder got compromised somehow...

ya I tried all the cnn.com and all the regulars and it just hangs

What operating system are you running?

You can try to repair Internet Explorer go to Control Panel / Add Remove Programs and find the listing for Internet Explorer if you double click on it there should be an option to repair. But you probably won't find that if you are running Windows XP.

I would suggest in IE to go to Tools / Internet Options click on Delete Files, hopefully deleting your cache will fix the issue. If not then go to the connections tab and the button down at the buttom of the window that says Lan Settings click on it and then make sure all the boxes are UNCHECKED (someone told you to check automatically configure, I personally am against that setting because it can cause problems.).

Other then that... What type of internet service do you have? Is it dial up/broadband?

Are you connected to a router?

Do you have firewall software?

If either of that last two are true disable/remove them and see if that fixes the issue.

Let me know.

If Dangarions advice doesn't work or lead you in the right direction, ping or PM this member of FOFC .

xp dsl and I got that linksys wireless router.......I have talked to my isp they say my online is fine they think it might be somekind of spyware.I have disabled my firewall(doesnt help}I already deleted all the cookies and files.I think it might be time to backup my files and reformat

Well if your browser is indeed the problem then ftp should still work. But since you are having problems with email as well there may be other issues.

1. Open a command prompt
2. type: ftp ftp.mozilla.org
3. login as anonymous with your email as your password
4. type: cd /pub/mozilla.org/firefox/releases/1.0rc2/win32/en-US
5. type: bin
6. type: hash
7. type: get "Firefox Setup 1.0rc2.exe"
8. when it is done downloading type: bye
9. run the Firefox Setup file that you just downloaded.

I can't remember how to do this, but maybe someone else here has done it more recently and will.

There is a way to change your settings back to the way they were at different dates (I guess when they were backed up). So, you can go back to the way your computer was set up last Weds. or 6 months ago. This worked for a similar problem for me awhile back when reformatting seemed like my last option.

Anyone know how to do this?

Lightning Bolt?

ya i already did a system restore.....but didnt help.Im running spybot again and the same thing that i got las time running spybot came up again

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1499652673-3805779733-2337131557-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3


--- Spybot - Search && Destroy version: 1.3 ---
2004-05-12 Includes\Cookies.sbi
2004-05-12 Includes\Dialer.sbi
2004-05-12 Includes\Hijackers.sbi
2004-05-12 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-05-12 Includes\Malware.sbi
2004-05-12 Includes\Revision.sbi
2004-05-12 Includes\Security.sbi
2004-05-12 Includes\Spybots.sbi
2004-05-12 Includes\Tracks.uti
2004-05-12 Includes\Trojans.sbi

Did you try ad-aware by lavasoft too?

I work with this kind of stuff every day.

You need to have Spyware S & D (up to current version).
and HiJackthis.exe (up to current version).

Only after having current versions of those two programs. Shut down.
Go into Safe Mode and run Spyware S & D first. Remove the items after
it is done searching. Reboot. Run HiJackThis.exe. If you're not familiar
what to remove, post your results at their (HiJackThis.exe site). The
experts will tell you what to remove.
The culprit will be listed in the HiJackThis.exe report.

I work on these things EVERY day.

how can I get hijack this if I cant get online

You need to get access to another computer that is online.
And be able to save the file to a floppy. Spyware will not
fit on a floppy. It is larger than 1000k.

for some reason I was able to get to hijack this here are the results

Logfile of HijackThis v1.99.0
Scan saved at 11:48:00 AM, on 2/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kevin Barrows\Desktop\New Folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forumserver.twoplustwo.com/ubbthreads.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/redirects/...p?affid=105-36
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [SFP] C:\Program Files\Common Files\Verizon Online\SFP\vzSFPWin.EXE /s
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .WAV: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/check/nets...l/gtdownls.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

I'd suggest to bypass your router and connect your computer directly to your DSL modem.

I don't like the evidence of Myway Search and PartyPoker.com on there.

You've got a blank reference to a registry entry on there too (DBA230D1-8467-4e69-987E-5FAE815A3B45). But we're not removing that yet. See if the other removals help.

In order for this to be perfectly clean though, you must first remove the spware itself with Spyware S & D. This is free. Don't use the wrong one. There are now hundreds with the word Spyware in the name. Only then after removing the spyware re-install threat can you remove those files with HiJackThis.exe.

REMOVE:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll

http://www.microsoft.com/athome/secu...e/default.mspx

Like it or not microsoft's works great. Although it does you no good if you can't get to the internet.


Todd

Agreed I've really grown to like it.

trilogy, I ran SPYBOT SEEK@DESTROY 1.3 again and the same dso exploits are still there I am guessing I must get rid of these before I start deleting the stuff on hijack this............Again thks for the help.I f it wont remove the dso exploits what do I do?

Use Spybot S&D to remove everything it possibly can.
If it can't remove it, Spybot will suggest that it runs itself at
the next boot. And it will do this only if you do a normal boot the
next time. It won't do it for a re-boot back into safe mode.

Use hijackthis to remove the really nasty spyware. The stuff
that Spybot S&D can't remove.

Thanks for having my back, Jeebs.

DSO exploit was a problem a few years ago, but IE fixes have cured that. It's something that spybot still looks for, but it is harmless today.

Do a reboot after unchecking everything on the startup tab after running msconfig from the run prompt. Then run Spybot. Or run spybot in safe mode, you probably have a serious adware and/or virus.