|
Member Login:
|
|
 |
January 23rd, 2004
|
Top | #1 |
OSNN One Post Wonder
Joined: January 2004
Posts: 1
Reputation: 0
Power: 0 |
sp.tmp?
|
|
|
|
January 23rd, 2004
|
Top | #2 |
Good grief Charlie Brown
Joined: May 2002
Location: Melbourne Australia
Posts: 5,920
Reputation: 560
Power: 187 |
Welcome Washi.
 Try doing a google search for gdi.exe error. Came up with 2,000 hits. Sift through & find your problem. |
|
|
|
|
January 23rd, 2004
|
Top | #3 |
|
OSNN Veteran Addict
Joined: February 2003
Posts: 1,338
Reputation: 330
Power: 130 |
Remove just those 04 items. Then find and remove sp.tmp, KERNEL32.VBS, install.js and delete everything in C:\Program Files\NewDotNet
SpyBot or AAW should be able to remove most of NewDotNet for you. You can also go into control panel add/remove and try the "uninstaller" that comes with newdotnet. It may work. http://www.geocities.com/poiuyt_1940/KLnewnetfull.html http://www.kephyr.com/spywarescanner...et/index.phtml |
|
|
|
|
January 4th, 2005
|
Top | #4 |
|
1337 633|<
Joined: January 2005
Location: Topeka, IN
Posts: 2
Reputation: 0
Power: 0 |
Same Problem
I have almost the exact same HijackThis result as you did. I deleted all the 04Run files, but I also have a few 04Startup items that show those four infected things. Should I delete those too? And how do I locate/destroy the sp.tmp, KERNEL32.VBS, install.js, and NewDotNet stuff? I couldn't even find the NewDotNet in my Program Files. Here's a copy of my HijackThis log:
Logfile of HijackThis v1.99.0 Scan saved at 2:15:44 PM, on 1/4/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\SMTRAY.EXE C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE C:\WINDOWS\WT\UPDATER\WCMDMGR.EXE C:\UTIL\PRINTNOW.EXE |
|
|
|
|
January 4th, 2005
|
Top | #5 |
|
1337 633|<
Joined: January 2005
Location: Topeka, IN
Posts: 2
Reputation: 0
Power: 0 |
Oops
Sorry, I'm an idiot, here's the rest of the log ^^;
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\PROGRAM FILES\INTERNET\ICC\ICC32.EXE C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.usefulware.com R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - Startup: PrintNow.lnk = C:\util\PRINTNOW.EXE O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM\E_SRCV02.EXE O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\AIM.EXE O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/...ditControl.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho.../yinst0401.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab |
|
|
|
|
| Bookmarks |
«
Previous Thread
|
Next Thread
»
| Thread Tools | |
|
|
