Member Avatar for Fiendforeva

Hello, I just recently got Highjackthis and was wondering if someone could help me in what I should do in regards to this log. :o

Logfile of HijackThis v1.98.0
Scan saved at 11:41:18 AM, on 7/9/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\intel32.exe
C:\Program Files\Funcom\Anarchy Online\client.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {D479C3B3-273A-439F-A5D6-FDDCE2DC325E} - C:\WINDOWS\system32\amfl.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe"

/L ElbyCDFL
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll,DllInstall
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O18 - Filter: text/html - {BCAC5015-24C8-4B66-A602-D1A2D3327D4F} -

C:\WINDOWS\system32\amfl.dll
O18 - Filter: text/plain - {BCAC5015-24C8-4B66-A602-D1A2D3327D4F} -

C:\WINDOWS\system32\amfl.dll

  • 4 Contributors
  • 16 Replies
  • 293 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

This thread documents a typical browser‑hijack cleanup where community troubleshooting removed an intrusive temporary DLL that had changed Internet Explorer settings. The successful workflow was iterative: update the diagnostic tool, isolate the system, run a targeted removal utility, scan with an up‑to‑date anti‑malware product, and repeat until the diagnostic log was clean. Credit to for the stepwise guidance and to for scanner suggestions — the coordinated approach is what fixed the problem without a reinstall.

Practical checklist (compact, reproducible):

  • Isolate the PC from the network and create a backup or System Restore point before removing anything.
  • Keep diagnostic/removal tools in a permanent folder (not a Temp folder) and ensure they are the latest builds. Close all browsers and Explorer windows before running fixes; run scans in a normal boot (not Safe Mode) when the malware alters live IE settings.
  • Run a full scan with a reputable anti‑malware tool, then run the targeted removal utility for the transient DLL, reboot, and re‑run the diagnostic scanner until the log shows only expected entries.
  • After cleanup, clear temporary files and browser caches, reset browser settings to defaults, and update all system and security software.

Deeper checks and prevention:

  • Inspect startup entries, services and scheduled tasks (msconfig / services.msc) for unknown items. Research unfamiliar names before deleting; export registry keys or create a restore point first.
  • Verify no persistent helper objects or toolbars remain and check for leftover files in temporary folders and user profiles. Flush DNS and clear local caches if redirects persist.
  • Finally, rotate important passwords and monitor accounts for unusual activity. If reinfection recurs, consider an offline scan or a clean OS install as a last resort.

This summary supplements the thread history by distilling the effective, repeatable steps used here so future readers facing similar IE redirections have a clear, safe procedure to follow.

Recommended Answers

All 16 Replies

Member Avatar for DMR

Hi Fiendforeva, welcome to the site. :)

The log you posted definitely shows signs of infections, but there are a few things you need to take care of before we can begin to work onit:

1. Logfile of HijackThis v1.98.0

The log entry above indicates that you are using a very old version (1.98.0) of HijackThis. Please download the latest version (1.99.1) and post the log it generates.

Once downloaded, create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.


2. C:\Program Files\Internet Explorer\iexplore.exe

The log entry above indicates that you had at least 1 instance of Internet Explorer running when you ran HijackThis. Before actually fixing problems with HijackThis, you should close all other open programs, especially your web browser and Windows Explorer. HijackThis cannot fully perform its fixes while any instances of your web browser are open.


3. The log you did post has odd line breaks and the like in it, which makes it difficult to read. Make sure the new log you post doesn't come out "fractured" like that.

Member Avatar for Fiendforeva

Alright, I got the new version of HJT, closed all windows, I think I got it right this time. And thank you for the fast reply :mrgreen:

Logfile of HijackThis v1.99.1
Scan saved at 4:11:26 PM, on 7/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {AC041E98-2B0B-4F4B-B30A-9347102B4C14} - C:\WINDOWS\system32\amfl.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {9A8BBFF4-F181-4333-9D0D-BC403740D165} - C:\WINDOWS\system32\amfl.dll
O18 - Filter: text/plain - {9A8BBFF4-F181-4333-9D0D-BC403740D165} - C:\WINDOWS\system32\amfl.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Member Avatar for Fiendforeva

hmmm, Sorry about the strange line breaks again, it looked alright in the preview.. :(

Member Avatar for DMR

hmmm, Sorry about the strange line breaks again, it looked alright in the preview.. :(

I edited the post to clean up the formatting a bit. :)

That log looks very short on content for a normal XP computer, and it's missing a lot of entries that appeared in the first log you posted. Did your latest log come from a scan done while booted into Safe Mode? If so, you need to do a scan while booted normally and post that log.

Member Avatar for Fiendforeva

No, I wasn't in safe mode, But I have tinkered with my computer alot, removed this and that, disabled and whatnot...Havn't had problems so far. and from my first post I have ran spybot search and destroy, Adaware, and registry mechanic, so they might of found some of the problems. but i still have a nasty spyware making very hard navigate the web :sad:

Member Avatar for frenemy

Try using the following programs:



TrojanHunter
Ad-Aware

Make sure to get the latest definitions/updates for these and run these in Safe Mode.

Member Avatar for Fiendforeva

I just rebooted normally, not in safe mode, closed all explorer windows, and all programs, scanned again, and the logfile came out identical. =\ I hope i havn't removed something i shouldn't have :o Mainly i was just trying to clean useless stuff up, and get rid of annoying startup programs and the like.

Member Avatar for frenemy

For that, please use CCleaner

Member Avatar for DMR

Mainly i was just trying to clean useless stuff up, and get rid of annoying startup programs and the like.

OK- I just needed to check; that's the shortest log I've ever seen from an XP system.

That said, every single entry in the log except the last one indicates the "about:blank" infection. Please follow the removal instructions in my first , and give us a new log after that.

Member Avatar for Fiendforeva

Allllright, I beleive I did everything correctly, and here is the logfile I was left with.

Logfile of HijackThis v1.99.1
Scan saved at 5:00:35 PM, on 7/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O18 - Filter: text/html - {BB19CEC2-134E-499A-BBC6-ABC7A0315BDC} - (no file)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Member Avatar for DMR

Better, but not by much.

1. Please download . Run the utility and click on the "start disinfection" button to initiate the removal procedure.


2. Run HJT again and have it fix the following entries if they still exist:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O18 - Filter: text/html - {BB19CEC2-134E-499A-BBC6-ABC7A0315BDC} - (no file)


3. Reboot, run HJT again, and post a new log.

Member Avatar for Fiendforeva

Alright, I ran that program, it rebooted, then when i ran hjt i didn't see any of those entries. Heres the log.

Logfile of HijackThis v1.99.1
Scan saved at 9:00:39 PM, on 7/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Member Avatar for DMR

Good job- that's a totally clean log now. :)

If the fix really worked, you should now be able to set your IE Start Page to whatever you want (the "hsremove.com" entry is obviously just left over from running hte HSRemove utility).

Let us know if you're still experiencing any problems or if things seem to be working correctly now.

Member Avatar for Fiendforeva

Yessir, Everything is working perfect now. Thank you guys very much for all the assistance. You have been extremely helpful! :D

Member Avatar for DMR

You're welcome. glad we could help. :)

Member Avatar for crunchie

This thread is now closed. If you need it reopened, please send a PM to one of our Mods.

Include the link to the thread and detail why you need it reopened.

If this is not your thread please start a New Topic.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.