Member Avatar for dlsoecht

I've tried my other spyware adware scanners/sweepers, but they all read my system clean. I'm pretty sure something is wrong, so I thought I'd try a hijackthis log check. Thanks in advance.

Logfile of HijackThis v1.99.1
Scan saved at 7:21:50 PM, on 4/29/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\qsacc\x1exec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.aeneas.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Aeneas Internet and Telephone
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7900
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;;;
;127.0.0.1;localhost;*windowsupdate.microsoft.
com;*;*wustat.windows.
com;*.pogo.com;*test-speed.com;liveupdate.symantecliveupdate.
com;*symantec.com;*.;*.;<local>
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\cdlsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://my.aeneas.net
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{5612677A-7327-4344-8D2A-60EAC7031F70}: NameServer =
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: hpdj - HP - C:\DOCUME~1\BETHMO~1\LOCALS~1\Temp\hpdj.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

  • 2 Contributors
  • 1 Reply
  • 130 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Brief expert summary for : is heading the right way — the symptoms point to Winsock/provider-layer hooks and a service registered from a nonstandard location. Follow a cautious, ordered cleanup so networking isn't broken and important files aren't removed by mistake.

Make a backup first (system restore or disk image) and export any registry keys you’ll change. Use Autoruns to inspect and disable suspicious autostart entries and service registrations, and use Process Explorer to inspect running processes and verify digital signatures before deleting binaries. (Autoruns and Process Explorer are compact, trusted tools from Microsoft Sysinternals: Autoruns, Process Explorer.)

For Winsock/LSP issues: if the OS supports it, use the supported Winsock reset procedure to restore the provider catalog (Microsoft documents the reset steps). If that’s not available or the problem persists, an LSP-repair utility is an appropriate next step (as suggested) — remove only entries you can confirm are malicious or unwanted, then reboot. Before deleting any file, upload it to an online multi-engine scanner to check reputation, and run a full system scan with a current anti‑malware scanner (examples: VirusTotal, Malwarebytes, Microsoft Safety Scanner).

If a service is registered to run from a temporary folder, treat it as highly suspicious: stop the service, remove its registry/service entry via Autoruns, then delete the file from Safe Mode. If anything resists removal, use an offline/rescue scanner or restore from backup. After cleanup, update Windows and your security tools, reboot, then post a fresh HijackThis log and note any remaining proxy/network settings so the next review can confirm everything is resolved.

Member Avatar for crunchie

OK. Please do the following...

===============

Download LSPFix and unzip to your desktop, then run it. Now, we need to:

1. check(tick) "I know what i'm doing".
2. click on (highlight) each occurance of the following, one at a time:

cdlsp.dll

3. then click ">>", moving each one, individually, to the 'Remove' pane.
4. (double-check, and make sure that only the above files are in the 'Remove'pane.)
5. click "Finish >>"


===============

Locate and delete the following item(s), if present. Make sure your able to "view system and hidden files/ folders:"

files...

c:\windows\system32\cdlsp.dll

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "".

-

Reboot.

===============

After rebooting your PC, post back a new log and let me know how everything goes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.