Oni's Hjck This Log

Oni

By Oni,
in Malware Removal

 Share Followers 0

Recommended Posts

Oni

Oni

Posted
Posted

Ok first of all, I'll just begin with the problems that I have with my computer. I've been experimented with ProRat (Rat BackDoor Trojan Hacker.. Well actaully something administrative tool..) So that thing in my log is fine. But I've been missing my service.exe? It sometimes comes up on an error screen saying that I'm missing that in one of my important folder.. (Systems32 maybe...)

I just newly noticed after I started my computer up have a IE Hijacker... Called Slotch I Googled it but I only found forums of people asking for help with no real answer... So my main problem is the missing service.exe AND Slotch...

Help me please <_<

Here you all techies go!

Look down.. I gotta new log.

Link to post
Share on other sites
njustice

njustice

Posted
Posted

Hello Oni,

Before downloading the latest version could you please make a permanent folder off the desktop and put HijackThis.exe in that folder.

How to make a permanent folder:

Click My Computer, then C:\

In the menu bar, File->New->Folder.

That will create a folder named New Folder, which while highlighted you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ folder.

Please put your HijackThis.exe there......post a new log.

Link to post
Share on other sites
njustice

njustice

Posted
Posted

Download Spybot from

http://www.safer-networking.org/index.php?page=download

after installing......hit.."Search for Updates".....get them all.......(Download Updates)........then "Check for Problems".......after the scan is complete..allow Spybot to remove everything listed in RED...reboot your computer.

NOTE: Spybot will flag 5 DSO Exploit's...this is a bug in the program and will be fixed in the next version, you can ignore these.

-------------------------------------------------------------------------

Then Download Ad-aware SE from: http://www.majorgeeks.com/download506.html

Install the program and launch it.

First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.

Next, we need to configure Ad-aware for a full scan.

Click on the Gear icon (second from the left) to access the preferences/settings window

1. In the General window make sure the following are selected:

* Automatically save log-file

* Automatically quarantine objects prior to removal

* Safe Mode (always request confirmation)

2. Click on the Scanning button on the left and select :

* Scan Within Archives

* Scan Active Processes

* Scan Registry

* Deep Scan Registry

* Scan my IE favorites for banned URL’s

* Scan my Hosts file

* Under Click here to select drives + folders, choose:

* All of your hard drives

Click on the Advanced button on the left and select:

* Include additional process information

* Include additional file information

* Include environment information

Click the Tweak button and select:

* Under the Scanning Engine:

o Unload recognized processes & modules during scan

o Include additional Ad-aware settings in logfile

* Under the Cleaning Engine:

o Let Windows remove files in use at next reboot

Click on Proceed to save the settings.

Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

* Use Custom Scanning Options

Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

Save the log file when it asks and then click Finish

When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

Reboot your computer.

-------------------------------------------------------------------------

Do an online virus scan HERE and HERE.....reboot after each scan, let us know what couldn't be cleaned(include file path).

-------------------------------------------------------------------------

Download latest version of 'Hijack This!'. HijackThis 1.98.2

Post a new log.... :ph34r:

Link to post
Share on other sites
njustice

njustice

Posted
Posted

Hello Oni, sorry for the delay.

Go to add/remove programs and uninstall if found: couponsandoffers, 180 Solutions(if present), WeatherBug, 2findm~1, 16HIDE~1 and SpeedHack(if not recognized).....reboot if prompted.

Close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items if present:

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll

O3 - Toolbar: GreyMore - {627DA590-A05C-ADAD-277A-A75F6CD7554C} - C:\PROGRA~1\16HIDE~1\acid sect.dll (file missing)

O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"

O4 - HKLM\..\Run: [synchronization Agent] C:\Documents and Settings\canf\Desktop\SpeedHack\Speed hack.exe<---what is this, if you don't know remove it.

O4 - HKLM\..\Run: [saap] c:\progra~1\2findm~1\partner\saap.exe

O4 - HKLM\..\Run: [OSS] c:\windows\system32\ossproxy.exe -boot

O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1

O4 - Startup: PowerReg SchedulerV2.exe

O8 - Extra context menu item: Coupons - file://C:\Program Files\couponsandoffers\System\Temp\couponsandoffers_script0.htm

O9 - Extra button: ÃøÖ·´óÈ« (HKLM)<---no info on this....removing won't hurt.

O9 - Extra 'Tools' menuitem: ÃøÖ·´óÈ« (HKLM)<---no info on this....removing won't hurt.

O9 - Extra button: WeatherBug (HKCU)

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tri...Transporter.cab?

Click "Fix Checked"...Reboot to SAFE mode (F8 on bootup)

How to start the computer in Safe mode

Show hidden files and folders-->

Show hidden files & folders

and delete the following folders/files in red if found.....

C:\PROGRAM FILES\16HIDE~1<---folder will start with 16HIDE

C:\Documents and Settings\canf\Desktop\SpeedHack<---see note above

O4 - HKLM\..\Run: [saap] c:\program files\2findm~1<---folder will start with 2findm

O4 - HKLM\..\Run: [OSS] c:\windows\system32\ossproxy.exe

C:\Program Files\couponsandoffers

reboot.....download the latest version of HijackThis HERE....post new log.

Link to post
Share on other sites
Oni

Oni

Posted
  • Author
Posted

Here ya go!

I think this is the newest version...

I wasn't able to find everything that you said that was in the programs folder though...

A BIG problem. Sometimes I can't close windows, for now it's gone I think its gone for good but Im not that sure.

Another thing, this started happening after I rebooted after safe mode. I see my desktop background after I click the user account I which to login as. I don't see anything else, everything else is gone after I try to login. I wait... So I get this Xp version who has windows and toolbars which look like OS 95. I hate 95, 98. Even how they look. I love Xp though...

Can you tell me how to make it look like REAL Xp? And That booting problem :( SOmetimes the 98 version never pops up. It just stays at my desktop backgorund :(

Help me out again :) So far your good at it! :P

Logfile of HijackThis v1.97.7

Scan saved at 6:11:43 PM, on 11/5/2004

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\netdde.exe

C:\Program Files\Apache Group\Apache\Apache.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\basfipm.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\system32\clipsrv.exe

C:\Program Files\Apache Group\Apache\Apache.exe

C:\WINDOWS\System32\dllhost.exe

C:\Program Files\ewido\security suite\ewidoguard.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\msiexec.exe

C:\Program Files\Symantec\Ghost\ngctw32.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\services.exe

C:\WINDOWS\System32\dllhost.exe

C:\WINDOWS\System32\tlntsvr.exe

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\dmadmin.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Apoint\Apntex.exe

C:\Documents and Settings\canf\Desktop\SpeedHack\Speed hack.exe

C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\RamBooster\Rambooster.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://education.dellnet.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://education.dellnet.com/

F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [bascstray] BascsTray.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NGClient] C:\Program Files\Symantec\Ghost\ngctw32.exe

O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

O4 - HKLM\..\Run: [synchronization Agent] C:\Documents and Settings\canf\Desktop\SpeedHack\Speed hack.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster\Rambooster.exe

O4 - HKCU\..\Run: [warez] "C:\Documents and Settings\canf\Desktop\Alper\Warez P2P Client\warez.exe" -h

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: =>&Español - http:\\wordreference.com\es\j\iees69.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)

O9 - Extra button: AIM (HKLM)

O9 - Extra button: ICQ 4.0 (HKLM)

O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)

O9 - Extra button: Messenger (HKLM)

O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...ector/swdir.cab

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/...7993.5388773148

O16 - DPF: {AD08A333-609E-11D3-950C-008098601567} - http://wordreference.com/Install/English%20to%20Spanish.cab

O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{86227E37-D968-4D38-A943-438570D30533}: NameServer = 134.53.253.1

Link to post
Share on other sites
Oni

Oni

Posted
  • Author
Posted

Sommore problems :(

Logfile of HijackThis v1.98.2

Scan saved at 10:04:45 PM, on 11/5/2004

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\netdde.exe

C:\Program Files\Apache Group\Apache\Apache.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\basfipm.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\Apache Group\Apache\Apache.exe

C:\WINDOWS\system32\clipsrv.exe

C:\WINDOWS\System32\dllhost.exe

C:\Program Files\ewido\security suite\ewidoguard.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\mcshield.exe

C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\dllhost.exe

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\System32\tlntsvr.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\WINDOWS\System32\vssvc.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Documents and Settings\canf\Desktop\SpeedHack\Speed hack.exe

C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

C:\WINDOWS\System32\dmadmin.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\RamBooster\Rambooster.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Documents and Settings\canf\My Documents\mIRC\mirc.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\notepad.exe

C:\Program Files\AIM\aim.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HJT2\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://education.dellnet.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://education.dellnet.com/

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [bascstray] BascsTray.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NGClient] C:\Program Files\Symantec\Ghost\ngctw32.exe

O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe

O4 - HKLM\..\Run: [synchronization Agent] C:\Documents and Settings\canf\Desktop\SpeedHack\Speed hack.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RamBooster] C:\Program Files\RamBooster\Rambooster.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: =>&Español - http:\\wordreference.com\es\j\iees69.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\Microsoft Games\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\Microsoft Games\ICQLite\ICQLite.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab

O16 - DPF: {AD08A333-609E-11D3-950C-008098601567} - http://wordreference.com/Install/English%20to%20Spanish.cab

O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{86227E37-D968-4D38-A943-438570D30533}: NameServer = 134.53.253.1

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Followers 0
Go to topic listing