# Homepage changing



## psaila

Please help me.  Everytime I open explorer the page http://www.updatestate.com/ is coming as homepage even if I change it.  This page says that I have to install some antivirus software but I already have NAV2007.  What is this and how to remove it.  I already ran spybot and adaware but it did not solve the problem.


----------



## ghost

gonna need more than spybot m8y, do you know what a Hijack log is ?
If so post it here... 
If not ask for how to do this and either I or some1 here will help you


----------



## psaila

ghostfacesuk said:


> gonna need more than spybot m8y, do you know what a Hijack log is ?
> If so post it here...
> If not ask for how to do this and either I or some1 here will help you




No tell me how to do it pls


----------



## ghost

Ok np, go to http://www.spywareinfo.com/~merijn/programs.php#hijackthis 
and download Hijackthis, it comes in a zip file. Just upzip it to the desktop and run the software. It will give you a option to do a system scan and save a logfile.
Do that and then post the log file here. I`ll have a look and see if there is anything i can do to help if not some reaper dude will come and help


----------



## psaila

Logfile of HijackThis v1.99.1
Scan saved at 19:42:21, on 29/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ETIENN~1\LOCALS~1\Temp\Rar$EX00.125\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {363E0F3A-63FA-F43A-A2F8-094B6522170D} - C:\WINDOWS\system32\hwiluzd.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} - C:\WINDOWS\system32\ixt1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\SYSTEM32\winpsa32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


----------



## psaila

It seems that I solved the problems using a prog called Browser Hijacking Recovery.  How can I be sure that my computer is clean?


----------



## ghost

cool ive never used that tool before. Just restart your PC and then have a look at the Internet Explorer.

EDIT: your Hijack log looks clean too, a few missin files but im sure it nothing to worry about.


----------



## Trizoy

put in a new HJT log...
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T 1.EXE
Is that your problem? Or epson?


----------



## ghost

Trizoy said:


> put in a new HJT log...
> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T 1.EXE
> Is that your problem? Or epson?


 Thats for a EPSON Stylus printer


----------



## psaila

The problems seems to be solved now.  I restarted my computer and the homepage is not changing anymore.  Thanks for you help.

Could you tell me of good anti spyware and adaware programs to run to be sure that my computer is clean?  Usually I run spybot and Lavasoft adaware but maybe these are not enough.  I just got a new fast computer and I do not want these stupid things to slow it.


----------



## ghost

CA Antivirus You can download and use it for free for 1 year. Just install the Antivirus software and do a system scan. Its really good


----------



## SirKenin

The best antivirus is Avast! and it's free.  The best malware program is Prevx1, followed by Ewido.  Adaware, HJT and Spybot are practically useless now.  There are a couple other good ones, but I can't remember the names at the moment, but they will both simply smoke all three of those.  If I can remember I will post back.


----------



## ghost

SirKenin said:


> The best antivirus is Avast! and it's free.  The best malware program is Prevx1, followed by Ewido.  Adaware, HJT and Spybot are practically useless now.  There are a couple other good ones, but I can't remember the names at the moment, but they will both simply smoke all three of those.  If I can remember I will post back.




Cool ya got links ?


----------



## Buzz1927

ghostfacesuk said:


> EDIT: your Hijack log looks clean too, a few missin files but im sure it nothing to worry about.



Perhaps you need to look again, it's not clean.


> Adaware, HJT and Spybot are practically useless now



That may be partially true of Adaware and Spybot, but not Hijackthis.

psaila, please post a new Hijackthis log.


----------



## ghost

Ahh so Buzz is ya name  Yeah im not to hot on hijack logs thats why i said some reaper dude will come and help


----------



## Buzz1927

ghostfacesuk said:


> Ahh so Buzz is ya name  Yeah im not to hot on hijack logs thats why i said some reaper dude will come and help


This isn't in my section, so I might well have missed it if it wasn't for the thread title. And if you're "not too hot" on Hijackthis, why did you say the log was clean? The thread starter has left thinking they're clean, when they have at least 2 infections. Do me a favour, if you (or anyone else) asks for a log outside my section, pm me the link so I can check it out, cheers.


----------



## ghost

yeah course dude, i`ll take that in mind next time  and yer i said it LOOKS clean, i couldnt see anything obviously wrong with it. Could you point them out maybe ?


----------



## SirKenin

Buzz1927 said:


> Perhaps you need to look again, it's not clean.
> 
> 
> That may be partially true of Adaware and Spybot, but not Hijackthis.
> 
> psaila, please post a new Hijackthis log.



Hijackthis is pretty much useless.  I make a living out of cleaning computers and HJT misses many of today's threats.  There is another one out there that does the job of HJT plus much more, but I can't remember the name of it. I posted it in this forum quite a while back.  HJT was bought out and that's why you don't see any updates for it.  It was incorporated into a commercial software package.


----------



## Buzz1927

SirKenin said:


> Hijackthis is pretty much useless.  I make a living out of cleaning computers and HJT misses many of today's threats.  There is another one out there that does the job of HJT plus much more, but I can't remember the name of it. I posted it in this forum quite a while back.  HJT was bought out and that's why you don't see any updates for it.  It was incorporated into a commercial software package.


You make a living out of cleaning computers? What's your first course of action? What is this wonder program you talk of, if it's so good, and you make your living cleaning this stuff off people's machines, you must use it all the time.  And Hijackthis hasn't been bought out (why would someone buy a tool designed purely for diagnostic purposes?), you must be thinking of CWShredder, which has the same author as Hijackthis.


----------



## psaila

Logfile of HijackThis v1.99.1
Scan saved at 15:33:25, on 30/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunServer.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\CounterSpy.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
D:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ETIENN~1\LOCALS~1\Temp\Rar$EX00.641\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com.mt
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com.mt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com.mt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com.mt
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {363E0F3A-63FA-F43A-A2F8-094B6522170D} - C:\WINDOWS\system32\hwiluzd.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} - C:\WINDOWS\system32\ixt1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvjug.dll,startup
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\SYSTEM32\winpsa32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


This is my new log.  Can you please tell me what I have wrong?  Now the homepage is not changing anymore however I have an exclamation mark coming on the toolbar (near the clock) saying that my computer is at risk.  If I click on it a window opens suggesting some security software.


----------



## ghost

Dunno if Buzz is here at the min but you do have 2 problems that need taking care of !

O2 - BHO: (no name) - {755bbd1a-aa59-456c-afeb-b4c42c4dcb6f} - C:\WINDOWS\system32\ixt1.dll

&

O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\SYSTEM32\winpsa32.dll

I dont think it is as easy as checking the two boxes and fixing them!?
You can try that but if i was you i would just wait till he gets back to you.


----------



## psaila

Is it true that Prevx1 is a very good spyware and malware remover?  I installed it and it seems to have done a very good job.


----------



## jp198780

never heard of it, i use Spybot S&D, Ewido/AVG Anti-Spyware, Spyblaster 3.5, and AdAware SE Personal.


----------



## SirKenin

psaila said:


> Is it true that Prevx1 is a very good spyware and malware remover?  I installed it and it seems to have done a very good job.



Prevx1 kicks the competition's ass, hands down..   Absolutely.  It spanks Spybot, Adaware, HJT and even Ewido.  It's too bad you have to pay for it after the first month, but it would be worth it.  I just install it on a client's computer long enough to clean it up and then delete it.


----------



## SirKenin

Buzz1927 said:


> You make a living out of cleaning computers? What's your first course of action? What is this wonder program you talk of, if it's so good, and you make your living cleaning this stuff off people's machines, you must use it all the time.  And Hijackthis hasn't been bought out (why would someone buy a tool designed purely for diagnostic purposes?), you must be thinking of CWShredder, which has the same author as Hijackthis.



Right right right.  Yes, CWShredder was bought out.  He just doesn't do any updates for HJT.

I'm trying to remember what that program is.  See, I don't use it all the time because I have no need to post logs anywhere and then turn around and use it to remove the threats.  I know exactly what I'm looking at and I just remove them with a particular strategy.  I just can't be bothered helping people in here because it's a frustrating task as it is, never mind doing it over the internet..  Besides, I try and offer strategies in here and you get people that think they own the threads start getting lippy and sending you nasty PMs.  You want to pay me $50/hour?  Sure..  But other than that I'll pass.  lol 

Truthfully, I think the methods I see used in here to be completely unnecessary and sometimes even bass ackwards.  They might get the job done eventually, but they could be done far more efficiently with the proper tools and strategies.

Ok, I'll go look for the thread.

Edit.  Damnit!  I can't find that thread.   That search kinda sucks.  I have the tool here somewhere, I'm sure of it, but that means searching a dozen HDDs for it and 100 CDs.  However, if it is important to you, and you'll actually USE it, I will look it up for you, along with that tool from Technet.  But tell me now, because if you're going to stay on this course and stick to the 5 page threads in order to fix a one page problem then I'm not going to waste my time.  Fair enough?


----------



## samsgz

ghostfacesuk said:


> Ok np, go to http://www.spywareinfo.com/~merijn/programs.php#hijackthis
> and download Hijackthis, it comes in a zip file. Just upzip it to the desktop and run the software. It will give you a option to do a system scan and save a logfile.




Thanks   , for u aid! 

saludos!


----------



## Buzz1927

> Right right right. Yes, CWShredder was bought out. He just doesn't do any updates for HJT.


No, there'll be no more updates, he's working on Hijackthis 2.0



> I know exactly what I'm looking at and I just remove them with a particular strategy.


I've got a badly infected machine here, if you're up for it, i'd like to see your method for cleaning it up. I can post a log if you like.



> Truthfully, I think the methods I see used in here to be completely unnecessary and sometimes even bass ackwards. They might get the job done eventually, but they could be done far more efficiently with the proper tools and strategies.


See above, show us what you got.



> I have the tool here somewhere, I'm sure of it, but that means searching a dozen HDDs for it and 100 CDs. However, if it is important to you, and you'll actually USE it, I will look it up for you, along with that tool from Technet.


I'd love to see this tool, and if I think it'd help me, of course I'd use it.



> But tell me now, because if you're going to stay on this course and stick to the 5 page threads in order to fix a one page problem then I'm not going to waste my time. Fair enough?


I don't believe I've ever had a 5 page thread, got a link?


----------



## SirKenin

Ok, I'll look up that program for you.  You'll really like it.  As for the computer that's infected, hook me up on a remote desktop connection and let's see what we have.  But you'll owe me a box of beer..  lol

As for the one from Technet, I'll try my best to look it up.  It does more or less what HJT does, but is far more thorough.  I found a couple of threats it couldn't get rid of, but I manually removed those myself.

As for the five page threads, I don't believe it was you yourself involved in them.  They're in the security forum and there are quite a few of them.

Edit:  Incidentally, the record I have seen for threats on a machine was 12,000 threats.  It took me four hours, but I got every single one of them.


----------



## Buzz1927

> As for the computer that's infected, hook me up on a remote desktop connection and let's see what we have. But you'll owe me a box of beer.. lol


Not really what I had in mind, how about you tell me what to do, I do it and report back, like I've come here with a problem. We can start with the Hijackthis log if you like, or whatever else you'd like to see. Don't really want you poking around on this machine.



> Incidentally, the record I have seen for threats on a machine was 12,000 threats.


Only a few on this one, so it shouldn't take you long.


----------



## SirKenin

Heh.  Like there's nothing I haven't seen before and anything I'd want.  lol.  If I want it, I already have it. 

You should always start with a scan by Prevx1 followed by an online scan at Panda.  If you are unable to access Panda by getting a page cannot be displayed error then we need to get rid of the little bugger that is controlling your hosts file.

After that, reboot the machine and tell me what symptoms you have.  Then I can go from there.

edit:  btw, I don't do the Panda scan right off the bat when I'm working on them, but seeing as how I don't have yours in front of me, the easiest thing to do is to tell you to do it now to get it out of the way.


----------



## Buzz1927

This is fun! Ok, I'll do what you say and post back in a while.

FYI, this is the Hijackthis log now (from safemode).

Logfile of HijackThis v1.99.1
Scan saved at 09:36:43 ??????, on 12/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\$NtUninstallKB9826380$\kavss.exe
C:\Documents and Settings\Gus\Desktop\hijackthis\gus.exe

O2 - BHO: C:\WINDOWS\System32\xsRecovery.dll - {8A5849B5-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\System32\xsRecovery.dll
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [sysvx] C:\WINDOWS\sysvx_.exe
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\cmd32.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - HKLM\..\Run: [oqhveyb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\oqhveyb.dll,sxvhtmb
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\Gus\LOCALS~1\Temp\svchost.exe
O4 - HKCU\..\Run: [WinMedia] "C:\DOCUME~1\Gus\LOCALS~1\Temp\2DF2623781.exe" 
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Gus\LOCALS~1\Temp\A.tmp
O4 - HKCU\..\Run: [WinUpdate] "C:\DOCUME~1\Gus\LOCALS~1\Temp\2DF2634828.exe " 
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\System32\taskdir.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\ugqyum.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\System32\aspi3062511.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (file missing)
O23 - Service: VMware Tools Service (VMTools) - Unknown owner - C:\Program Files\VMware\VMware Tools\VMwareService.exe (file missing)


----------



## SirKenin

By the way, the name of the utility you want from Technet is Autoruns.

http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx

Oh, and btw you have quite a few little nasties in there.  That's ok, we'll get 'em.

And glad you find it fun.  I think it's a pain in the keister.


----------



## apj101

moved to computer security section.


----------



## Buzz1927

That prevx1 wouldn't install, kept rebooting, so I'm running that Pandascan, I'd never heard of it, looks pretty good.  I'll try to install prevx1 after that.


----------



## Buzz1927

Got it all to run, this is my log now, still looks like crap, what"s next?

Logfile of HijackThis v1.99.1
Scan saved at 11:13:55 ??????, on 12/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\aspi110912.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Gus\Desktop\hijackthis\gus.exe

O2 - BHO: C:\WINDOWS\System32\xsRecovery.dll - {8A5849B5-93F3-429D-FF34-660A2068897C} - C:\WINDOWS\System32\xsRecovery.dll
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [oqhveyb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\oqhveyb.dll,sxvhtmb
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\Gus\LOCALS~1\Temp\svchost.exe
O4 - HKCU\..\Run: [Key] C:\DOCUME~1\Gus\LOCALS~1\Temp\A.tmp
O4 - HKCU\..\Run: [WinUpdate] "C:\DOCUME~1\Gus\LOCALS~1\Temp\2DF2634828.exe " 
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\System32\taskdir.exe
O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2D25BEDE-BDEE-6527-7FEF-6D942F0D658F} - http://85.255.114.166/1/rdgFR2648.exe
O16 - DPF: {5B0BA061-6036-3FB5-7368-0C9D1B6FA56D} - http://85.255.114.166/1/rdgFR2648.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: DCOM Server 2236 - {2C1CD3D7-86AC-4068-93BC-A02304BB2236} - C:\WINDOWS\System32\ctppuj.dll
O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINDOWS\System32\aspi110912.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (file missing)
O23 - Service: VMware Tools Service (VMTools) - Unknown owner - C:\Program Files\VMware\VMware Tools\VMwareService.exe (file missing)


----------



## Buzz1927

SirKenin said:


> By the way, the name of the utility you want from Technet is Autoruns.


Yeah, I got that ages ago, it's crap.


----------



## liaodarren

yo brothers! help me too plz...
i am having the same problem too!!
and i have tried "Browser Hijacking Recovery" but the problem still comes out
plz help me
thank you guys so much
here is my log....  


Logfile of HijackThis v1.99.1
Scan saved at 下午 07:44:55, on 2006/12/1
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Inventec\Dreye\DreyeMT\msnplugin.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Foxy\Foxy.exe
C:\WINDOWS\system32\STEM~1\taskmgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\桌面\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67270207-b9ee-4d26-9270-860fdb060ca1} - C:\WINDOWS\system32\ixt4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [MSNDreyePlugin] C:\Program Files\Inventec\Dreye\DreyeMT\msnplugin.exe /h
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvvag.dll,startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [foxy] "C:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Earu] "C:\WINDOWS\system32\STEM~1\taskmgr.exe" -vt yazb
O8 - Extra context menu item: Foxy 下載 - res://C:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 搜尋 - res://C:\Program Files\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 轉換成簡體中文(&S) - res://C:\WINDOWS\system32\tcscconv.dll/tosimp
O8 - Extra context menu item: 轉換成繁體中文(&T) - res://C:\WINDOWS\system32\tcscconv.dll/totrad
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O14 - IERESET.INF: START_PAGE_URL=http://tw.yahoo.com
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C5544812-7CDF-4CEB-8D94-8C0F81C24507}: NameServer = 168.95.192.1 168.95.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winbjt32 - C:\WINDOWS\SYSTEM32\winbjt32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: HotKey Poller - Unknown owner - C:\WINDOWS\G_Server2006
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


----------



## Buzz1927

liaodarren  	

Start a new thread, looks like you got that chinese crap, someone will help you in your new thread.


----------



## keren20

*I Have The Same Problem!!*

PLZ HELP ME!

Logfile of HijackThis v1.99.1
Scan saved at 14:35:37, on 01/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\isnotify.exe
C:\PROGRA~1\KEMailKb\KEMailKb.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ismini.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\UpsPilot\Winpower.exe
C:\Program Files\UpsPilot\jre\bin\javaw.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\UpsPilot\monitor.exe
C:\Program Files\UpsPilot\jre\bin\javaw.exe
C:\PROGRA~1\UpsPilot\wpRMI.exe
C:\Program Files\UpsPilot\jre\bin\javaw.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MOMAND~1\LOCALS~1\Temp\Rar$EX00.078\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.il/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {67270207-b9ee-4d26-9270-860fdb060ca1} - C:\WINDOWS\system32\ixt2.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\System32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\System32\sw24.exe
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMailKb\KEMailKb.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\ers_startupmon.exe"
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\dc6_startupmon.exe"
O4 - HKLM\..\RunServices: [Winpower] C:\Program Files\UpsPilot\Winpower.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [Bin Extender] C:\Program Files\ISWare\Bin Extender\Bin Extender.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winhab32 - C:\WINDOWS\SYSTEM32\winhab32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Winpower - ZeroG Software - C:\PROGRA~1\UpsPilot\Winpower.exe
O23 - Service: Winpowermanager - ZeroG Software - C:\PROGRA~1\UpsPilot\manager.exe
O23 - Service: Winpowermonitor - ZeroG Software - C:\PROGRA~1\UpsPilot\monitor.exe
O23 - Service: WinpowerRMI - ZeroG Software - C:\PROGRA~1\UpsPilot\wpRMI.exe

Every two minutes it gives me an add to go to a site and download there spyware 

PLZ HELPPPPP


----------



## SirKenin

Can someone please delete these other damn posts?  I'm getting confused and it's irritating me.  lol 

Well, Buzz, I don't know how you can say it's crap when it does exactly what HJT does, yet much more?  You don't make any sense.

You didn't use Prevx1 correctly or you would have gotten rid of the following trojan:

O4 - HKCU\..\Run: [Nord] C:\WINDOWS\System32\nordsys.exe (Trojan UpdateX)

I suggest running Prevx1 again to get rid of it, because it installs other programs and will continue to give you headaches until you get rid of it.

Anyways, the next thing you have to do is download SmitFraud and run it in Safe Mode.

With My Computer go to C:\DOCUMENTS AND SETTINGS\Gus\Local Settings\Temp\, show hidden files and folders and system files and delete the entire contents of the folder except the other folders.  You may have to change some file attributes to do it.

Then, if you're going to do things my way, while your in Safe Mode run Autoruns and delete the following.  Before you do, go into Options and check off the following:

Include empty locations
Verify Code Signatures
Hide Signed Microsoft Entries

O4 - HKLM\..\Run: [oqhveyb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\oqhveyb.dll,sxvhtmb
O16 - DPF: {2D25BEDE-BDEE-6527-7FEF-6D942F0D658F} - http://85.255.114.166/1/rdgFR2648.exe
O16 - DPF: {5B0BA061-6036-3FB5-7368-0C9D1B6FA56D} - http://85.255.114.166/1/rdgFR2648.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Unknown owner - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (file missing)
O23 - Service: VMware Tools Service (VMTools) - Unknown owner - C:\Program Files\VMware\VMware Tools\VMwareService.exe (file missing)

The reason you use Autoruns is to check all the other tabs to make sure the files aren't trying to load anywhere else.  The last three are just to clean up empty entries.

That gives you a place to start.


EDIT:   I forgot two entries you can delete:

O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\Gus\LOCALS~1\Temp\svchost.exe
O4 - HKCU\..\Run: [WinUpdate] "C:\DOCUME~1\Gus\LOCALS~1\Temp\2DF2634828.exe "


----------



## alotest

*someone help with mine please*

someone go to my thread and help with mine please

http://www.computerforum.com/66287-help-me.html


----------



## SirKenin

By the way Buzz, I'm sure you know this, but for the record after you have deleted those entries, delete the associated files.  Show Hidden Files and Folders if you haven't done so already.


----------



## Buzz1927

Well, this game has ended, the machine has died.  Can't open anything, can't get online, nothing. Probably nothing to do with you, but who knows? I followed your instructions, that stupid prevx was telling me all was well, got rid of it, ran smitfraud in safemode, booted back to normal mode and ran option 1, guess what? It showed all the files still there, and a rootkit! Had you have done what I would have done, and run that before anything else, you would have seen the rootkit and dealt with that first. Pissing about with your daft programs didn't get me anywhere, and, to use your phrase, doing things "arse-backwards" hasn't helped either. If you really get paid $50 an hour for this, you're 1. ripping people off, and 2. there must be a lot of mugs where you live.

Oh, and how do you generate a log in that autoruns thing?


----------



## SirKenin

Heh..  To say I have my doubts is an understatement.  Did I not tell you to get rid of that trojan?  Had you run a full system scan it would have found it, I promise you.  If you didn't remove it, it would have just reinstalled your problems that you just manually deleted.  That's what that trojan does.  You don't go on to the next step until you have successfully completed the previous one.  I was very specific about that.  Your trojan was your chief concern.

But you thought you knew everything...  And I guess you just demonstrated that you didn't.

And this, folks, is the chief reason why I refuse to help anyone in this forum.  If you're not going to follow my instructions to the "T" then don't ask me for help.  Simple.


----------



## ghost

Well that was abit of a F***up  
Not having a dig m8y but reaps has been helping people on this forum for a long time and has even successfully helped me out before too 
I guess people just do things differently!


----------



## SirKenin

Actually, I anticipated the end results before we even started.  The reason being is the very first problem, the Trojan.Updatex.  Not to mention the shoddy excuse for the remote desktop connection.  See, if I had fixed it on there, he would not be able to make this silly display in the forums.

You see, the reason he is feeding you a line of shit is because that exact problem is addressed at the Prevx homepage:

http://virusinfo.prevx.com/pxparall.asp?PXC=9fb057653668

He didn't do as I told him to, and he never intended to.  That wasn't his point.  He was out to discredit my methods right from the beginning.  I realized that as soon as he hadn't rid himself of that trojan, which installs other programs as you can read from it's description, and he badmouthed Autoruns, which actually performs a deeper scan than HJT.

So, it was damned from the beginning.  And thus I use his example to make it a point why I will not waste my time.

Should I mention that none of the infections that he has listed will kill his computer or prevent him from accessing the internet?  Not one.  You can look it up for yourself, but I'm finished wasting my time.  Think what you want.


----------



## ghost

I understand dude, i guess you will stick to your methods and reaps will stick to his.


----------



## Buzz1927

> Heh.. To say I have my doubts is an understatement. Did I not tell you to get rid of that trojan? Had you run a full system scan it would have found it, I promise you.


Doubts about what? Your scans didn't get that trojan, accept it. 



> But you thought you knew everything... And I guess you just demonstrated that you didn't.


No, that'd be you.



> And this, folks, is the chief reason why I refuse to help anyone in this forum


Thank god for that.



> If you're not going to follow my instructions to the "T" then don't ask me for help.


I did everything just as you said, it just didn't work because you hadn't dealt with the rootkit.



> Actually, I anticipated the end results before we even started.


So did I. 



> Not to mention the shoddy excuse for the remote desktop connection. See, if I had fixed it on there, he would not be able to make this silly display in the forums.


I was interested to see your method, that's why I wanted to do it like this. You seem to be taking it all personally, with your silly display.



> You see, the reason he is feeding you a line of shit


Not sure where i did that, can you explain?



> He didn't do as I told him to


Yes I did.



> and he never intended to.


Ditto.



> He was out to discredit my methods right from the beginning.


No I wasn't, but you made a pretty good job of it yourself.


> I realized that as soon as he hadn't rid himself of that trojan


Nothing to do with me, just followed your directions.



> Should I mention that none of the infections that he has listed will kill his computer or prevent him from accessing the internet? Not one.


Apart from possibly the rootkit that you didn't find.



> but I'm finished wasting my time.


Sorry you think like that, I found it very entertaining.



> i guess you will stick to your methods and reaps will stick to his.


Amen.


----------



## SirKenin

This guy followed directions:

http://www.computerforum.com/66201-how-eradicate.html

And notice the end result.


----------



## Buzz1927

SirKenin said:


> This guy followed directions:
> 
> http://www.computerforum.com/66201-how-eradicate.html
> 
> And notice the end result.


What's that got to do with my computer? As I said, I followed your directions, there was a rootkit on there you didn't check for.
And having looked at the thread you linked to, you missed a couple.


----------



## SirKenin

Buzz1927 said:


> What's that got to do with my computer? As I said, I followed your directions, there was a rootkit on there you didn't check for.
> And having looked at the thread you linked to, you missed a couple.




No, those other entries had to do with his homepage.   I looked them up.

And what that has to do with your computer is the fact that if you had followed directions, you would have caught the primary threat.  The other rootkit that you mention wasn't in your HJT log.  I assumed, wrongly, that seeing as how you know what you are doing that you would have done a full system scan with Prevx1, but you didn't.  You can't tell me you did.  That threat is very clearly part of the Prevx1 database.  You then eradicated the other threats, if you followed my directions properly, but they resurfaced again and more because you didn't eradicate the main one.  Did you even check all the tabs?  Did you even delete the files afterwards?  Probably not.

Step by step.  You didn't follow the steps.  It ended up in failure.  That's your fault, not mine, and to have the nerve to accuse me of scamming my clients is beyond ill repute and poor behaviour for a moderator.  There has never been one computer I haven't fixed, and the referrals speak for themselves.


----------



## Buzz1927

SirKenin said:


> No, those other entries had to do with his homepage.   I looked them up.
> 
> And what that has to do with your computer is the fact that if you had followed directions, you would have caught the primary threat.  The other rootkit that you mention wasn't in your HJT log.  I assumed, wrongly, that seeing as how you know what you are doing that you would have done a full system scan with Prevx1, but you didn't.  You can't tell me you did.  That threat is very clearly part of the Prevx1 database.  You then eradicated the other threats, if you followed my directions properly, but they resurfaced again and more because you didn't eradicate the main one.  Did you even check all the tabs?  Did you even delete the files afterwards?  Probably not.
> 
> Step by step.  You didn't follow the steps.  It ended up in failure.  That's your fault, not mine, and to have the nerve to accuse me of scamming my clients is beyond ill repute and poor behaviour for a moderator.  There has never been one computer I haven't fixed, and the referrals speak for themselves.


How many times do I have to tell you, I followed your directions exactly. Sometimes things don't go as you expect, you then deal with what you're left with. I did the full scan with Prevx1, perhaps you don't fully understand what Hijackthis shows (obviously not as you had me fix those 023 entries). I didn't accuse you of scamming your clients, just that they must be gullible, they'd get better advice here for free, if you came to my house with this comedy, you'd be leaving on the end of my boot.



> No, those other entries had to do with his homepage. I looked them up.


That wasn't what I was referring to.

And you haven't answered my questions.

Oh yeah, if you really do what you claim, how do you explain this?



> As I mentioned in response to a PM, I don't clean up other people's "messes". Not online, not in real life. It's a policy of mine.


----------



## SirKenin

Buzz1927 said:


> How many times do I have to tell you, I followed your directions exactly. Sometimes things don't go as you expect, you then deal with what you're left with. I did the full scan with Prevx1, perhaps you don't fully understand what Hijackthis shows (obviously not as you had me fix those 023 entries). I didn't accuse you of scamming your clients, just that they must be gullible, they'd get better advice here for free, if you came to my house with this comedy, you'd be leaving on the end of my boot.
> 
> 
> That wasn't what I was referring to.
> 
> And you haven't answered my questions.
> 
> Oh yeah, if you really do what you claim, how do you explain this?



Maybe you might want to write to Prevx and tell them that one of the threats they claim to remove doesn't.  I mean, what can I say?  You are somehow an exception to the rule..

Those 023 entries, if you look closely, were files missing.  That's why I had you delete them.  Not for malware's sake, but just to clean up useless entries.  Standard policy.

As for the quote, I know you're trying really hard to discredit me, that much is obvious, but you should have done your fans a service and quoted it in context.  What it means is that if someone else starts the job on a thread and quits after they make a mess of it I refuse to come in and clean up the mess.

The same goes in real life.  One client hired a manager who also knew something about computers.  He wanted to give him access to the network that I was administering.  I made him make a choice, him or me.  I wasn't going to go in afterwards and try and figure out what kind of mess he had made.  It's not worth the frustration.


----------



## SirKenin

Buzz1927 said:


> How many times do I have to tell you, I followed your directions exactly. Sometimes things don't go as you expect, you then deal with what you're left with. I did the full scan with Prevx1, perhaps you don't fully understand what Hijackthis shows (obviously not as you had me fix those 023 entries). I didn't accuse you of scamming your clients, just that they must be gullible, they'd get better advice here for free, if you came to my house with this comedy, you'd be leaving on the end of my boot.
> 
> 
> That wasn't what I was referring to.
> 
> And you haven't answered my questions.
> 
> Oh yeah, if you really do what you claim, how do you explain this?



Maybe you might want to write to Prevx and tell them that one of the threats they claim to remove doesn't.  I mean, what can I say?  You are somehow an exception to the rule..

Those 023 entries, if you look closely, were files missing.  That's why I had you delete them.  Not for malware's sake, but just to clean up useless entries.  Standard policy.

As for the quote, I know you're trying really hard to discredit me, that much is obvious, but you should have done your fans a service and quoted it in context.  What it means is that if someone else starts the job on a thread and quits after they make a mess of it I refuse to come in and clean up the mess.

The same goes in real life.  One client hired a manager who also knew something about computers.  He wanted to give him access to the network that I was administering.  I made him make a choice, him or me.  I wasn't going to go in afterwards and try and figure out what kind of mess he had made.  It's not worth the frustration.

Anyways, I'm done with your nonsense.  You can either have your last word, lock the thread or let it die.


----------



## Buzz1927

You're up early! Still talking nonsense though. 


> Those 023 entries, if you look closely, were files missing.


Maybe you need to look closely, or learn more about Hijackthis, one of those entries was prevx1  It's a bug, made a fool of you  

Come clean and answer my questions,   I'm waiting.


----------



## SirKenin

No kidding eh? Is that what this means???

O23 - Service: *Prevx Agent* (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)

Thanks Captain Obvious.


----------



## Buzz1927

SirKenin, is this you?
http://i27.photobucket.com/albums/c189/GusJones1965/ckyM80s.jpg


----------



## SirKenin

lol.   No...  This is:






And yeah I'm up early.  Let's just say that it's been a hell of a last 24 hours


----------



## ghost

LMFAO carry on boys  you 2 have me in stitches


----------



## Buzz1927

Is that Dorian Gray?


----------



## Buzz1927

ghostfacesuk said:


> LMFAO carry on boys  you 2 have me in stitches


He's pretty funny, just don't wanna play with me anymore.


----------



## SirKenin

Buzz1927 said:


> Is that Dorian Gray?



No, that's me.  A buddy of mine photoshopped my face onto Kramer.  I love that picture.


----------



## Buzz1927

SirKenin said:


> No, that's me.  A buddy of mine photoshopped my face onto Kramer.  I love that picture.


You're obviously gay as they come, not that I have a problem with that.


----------



## SirKenin

Buzz1927 said:


> You're obviously gay as they come, not that I have a problem with that.



You don't know me very well then...   (not sure we should get into details on a computer forum though...  Whaddya think? )


----------



## Buzz1927

SirKenin said:


> You don't know me very well then...   (not sure we should get into details on a computer forum though...  Whaddya think? )


Just going by that gay photo.


----------



## TFT

Oh wow   

I don't need no other forum. This has all the entertainment I need.

Homepage to gays, and I never saw the join


----------

