your Win98 box...
http://support.microsoft.com/?kbid=318378
(Method 2)
or Removing IE6 and Reinstalling Windows 98...
http://support.microsoft.com/?kbid=312451.
If you wouldn't feel comfortable doing either of the above, I suppose a
*trustworthy* (independent, IMHO) shop could handle it. I'd provide them
with the KB articles above, if so. Given current "firesale" pricings of
processors these days (even including WinXP), it may prove only slightly
more expensive to bet a new box.
While a firewall is certainly a very good idea (RTFM), it may not help you
avoid "drive-by" installs of malware. Consider getting/running
SpywareBlaster
http://www.javacoolsoftware.com/spywareblaster.html as well
as AdAware and Spybot. Always seek updates before each use of any of them.
--
HTH...Please post back to this thread
~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE)
http://mvp.support.microsoft.com
Anne wrote:
Hi PA Bear,
Thank you so much for all your help. I did post the logs
on that website. You were right about the ones to fix.
The 3 starting in R1, The one that said 02-BHO (no name)
and the one that said 03-toolbar (no name) After I clean
those, they said to reboot, then download SpyBot and fix
any problems found.
I did purchase a firewall to connect to my Comcast cable
modem to hopefully prevent further hijacking.
I am still not sure if that will fix my IE error re:
urlmon.dll. If not, do you think I should take my
computer in and have everything removed and then have
Window 98 reinstalled?
My computer is too small to have 2000 or XP. At least
that is what i have been told. I need to purchase a new
one but money is tight right now. I do appreciate all
your help. Thanks again. Anne
-----Original Message-----
Siljaline and Henri both confirm my suspicions (thread, this NG: "PING -
siljaline").
Hijackthis should be able to remove them...or post to spywareinfo.com
forum. --
~PA Bear
PA Bear wrote:
These look most suspicious to me, Anne. Both eWebSearch and JetSeeker
appear to be very new or new variants:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://www.ewebsearch.net/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL =
http://www.jetseeker.com/ie/
[see
http://snurl.com/1uum]
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.ewebsearch.net/sp.htm
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7- AC7CC6B5FFA7} -
C:\WINDOWS\TEMP\WINNDKJ.DLL
One of the malware experts here (siljaline) regularly posts these
instructions:
<paste>
Go to:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Unzip, double-click "HijackThis.exe" and Press "Scan".
When the scan is finished, the "Scan" button will change into a "Save
Log" button. Click: "Save Log" (generates "hijackthis.log")
Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button]
(generates "startuplist.txt")
Next, go to the below location: Spyware and Hijackware Removal Support.
http://www.spywareinfo.com/forums/index.php?
s=8a236cdf61469fbad3bddbe810be0374&act=SF&f=11
Sign in, then copy and paste both files in your message.
</paste>
I've asked siljaline to drop in on this thread. (I'd tell you to run
'hikackthis' again and have it 'fix' (remove) the 3 above but please
wait for more experienced guidance and/or post your results to the
forum above.) --
~PA Bear
Logfile of HijackThis v1.95.1
Scan saved at 8:11:43 PM, on 07/21/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVSYNMGR.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\VIRUSSCAN\WEBSCANX.EXE
D:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://www.ewebsearch.net/sp.htm
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,SearchURL =
http://www.jetseeker.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page =
http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =
http://www.ewebsearch.net/sp.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = *.r1.attbi.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local
Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 5.0
\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {1F48AA48-C53A-4E21-85E7-
AC7CC6B5FFA7} - C:\WINDOWS\TEMP\WINNDKJ.DLL
O3 - Toolbar: (no name) - {82599E0A-8C81-11d7-9F97-
0050FC5441CB} - C:\WINDOWS\SYSTEM\shdocvw.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888- 423F-
11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService]
C:\Program Files\Network Associates\VirusScan\AVSYNMGR.EXE
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Any idea what all of this means?
I was able to copy the msvbvm60.dll from a OS 98 machine
from work onto my machine. I tried the same process with
the urlmon.dll file but it says that Windows is using it
so that didn't work.
-----Original Message-----
I am hoping the text below is what you were asking for. ....
URLMON DLL 483,840 04-14-03 9:25a URLMON.DLL
Perfect. That proves that you probably have installed the right
patch for your OS.
There are still a few things we could try along this diagnostic tack
(e.g. IE Repair, check faultlog.txt) but I suggest we defer those
pending the outcome of your Hijack This! test.
