PDA

View Full Version : Browser lag and redirection to porn sites


Octavian
2004-06-09, 05:10 PM
Whilst I was searching for male related things, a pop-up said that I was infected with such and such. I thought it would just lead to worse things so I clicked Cancel. Once I had finished that, the My Search Bar installed itself. I uninstalled it twice. It finally seems to be gone now though. Then a case of severe mouse lag set in, terrible, just terrible. Windows lag came along later, so as when I tried clicking on a window, it would take 2-3 mins just to open up. I've tried ScanDisk, Defrag, Ad-aware and SpyBot numerous times, but to no avail. This is really getting quite difficult for me. Although the main problem is that it continues to redirect me to weird porn sites. Norton Antivirus 2004 says there is no virus or trojan though.

Below is the HijackThis log.

Logfile of HijackThis v1.97.7
Scan saved at 1:42:37 PM, on 7/06/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\sb.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Elliot.HELLEN\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.legiontotalwar.com/forums/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com.
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll
O2 - BHO: sr - {FC2593E3-3E5A-410F-AF3D-82613CCE58E5} - c:\winnt\sr.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mswspl] C:\WINNT\sb.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: Shortcut to TRAYICON.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downl...922/wmv9VCM.CAB
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} - http://download.microsoft.com/downl...N-US/msorun.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/...ash/swflash.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuit.../ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF45BC3A-FB75-44C6-B594-6E474F3FB39E}: NameServer = 192.168.0.1

I really doubt any of you can figure this out, Robert and 2 others can't.

JetRaiden
2004-06-09, 06:13 PM
NEVER hit cancel in a popup. always hit the "X" in the upper right corner. most of the time it installs whatever software it was either way.

Octavian
2004-06-09, 11:46 PM
Is there any cure for it though?

EDIT - Ah a relief, I downloaded jv16PowerTools. Its worked absolute miracles for me.

TekDragon
2004-06-10, 07:14 AM
NEVER hit cancel in a popup. always hit the "X" in the upper right corner. most of the time it installs whatever software it was either way.

I dunno if that's even safe. I alt f4 out of all popups.

KiKiNCHiKiNcool
2004-06-19, 07:23 PM
i dont think you guys should use internet explorer...

i use mozilla firefox (www.mozilla.org) and it blocks all pop-ups by disabling popups period, disables by browser :D

however you can enable it for some sites