This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

as request hijack-this - browser redirect - ero-advertising

2 min read

This thread's last reply is from March 1, 2009, 10:43 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:49 PM, on 2/16/09
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe -expressboot
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [ioloDelayModule] C:\PROGRAM FILES\IOLO\SYSTEM MECHANIC PROFESSIONAL 6\delay.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

--
End of file - 1914 bytes
I'm very sorry that you have waited so long and have not received a reply from a helper. Most likely this is because there is nothing in your HijackThis log, nor in the logs you posted in your previous topics, that would provide clues to the source of the problems you're experiencing. It is unfortunate, but most of the scanning tools available to helpers these days will not run on operating systems older than Windows 2000. As your operating system is Windows 98, and no malware is evident in your logs, we have no way of tracking down the malware, and so our hands are tied.

My only suggestion is for you to see if there is an entry in Add/Remove Programs for anything related to ero-advertising, Zango, Hotbar, and any/all toolbars, coupon/shopping site helpers, etc., and then uninstall them. Also, download and install the latest version of Spybot Search and Destroy and perform a scan, and remove everything it finds:

http://www.safer-networking.org/index2.html

Download CCleaner and use it to clean out all your cookies and temp files:

http://www.ccleaner.com/

I would also suggest, if it still works on Windows 98, that you install the Google toolbar as it has a very good pop-up blocker.

You've been very patient and I do apologize that we are not able to offer you better support for your system.

As this issue does not involve an operating system for which we have scanners/tools available, and the malware does not make itself visible in the provided logs, the support of this system falls outside the scope of this forum.

As we are unable to provide assistance, this topic is now closed.


You can help support this site from this link :
Donations For Malware Removal