win eto problem...

By jdlferreira
in Smart Home, Network & Security

 Share

Recommended Posts

Enthusiast

jdlferreira

Posted
Posted

well, I got spyware, I cant remove it, win-eto, here4search and kitasearch...

heres my hijack log:

Logfile of HijackThis v1.98.2

Scan saved at 15:15:46, on 15-01-2005

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programas\Ahead\InCD\InCDsrv.exe

C:\Programas\TGTSoft\StyleXP\StyleXPService.exe

C:\Programas\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\CTHELPER.EXE

C:\Programas\Ahead\InCD\InCD.exe

C:\Programas\Java\j2re1.4.2_05\bin\jusched.exe

C:\WINDOWS\System32\RUNDLL32.EXE

C:\WINDOWS\System32\RUNDLL32.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe

C:\WINDOWS\System32\rundll32.exe

C:\Programas\QuickTime\qttask.exe

C:\WINDOWS\System32\rundll32.exe

C:\Programas\PestPatrol\PPMemCheck.exe

C:\Programas\PestPatrol\CookiePatrol.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Programas\MSN Messenger\MsnMsgr.Exe

C:\Programas\Messenger\msmsgs.exe

C:\Programas\Ares\Ares.exe

C:\Programas\Spyware Doctor\spydoctor.exe

C:\Programas\TGTSoft\StyleXP\StyleXP.exe

C:\Programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\rundll32.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Programas\Internet Explorer\iexplore.exe

C:\Documents and Settings\Filho\Darkruler Stuff\HijackThis.exe

C:\WINDOWS\svchost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/sp.htm?id=31403

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=31403

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://soho.sygate.com/ref/spfref_sos.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperliga??es

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~3.DLL

O3 - Toolbar: &R?dio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [Jet Detection] C:\Programas\Creative\SBLive\PROGRAM\ADGJDet.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Programas\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programas\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sysMetrix] C:\Programas\SysMetrix\SysMetrix.exe

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programas\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [blah service] winsv32.exe

O4 - HKLM\..\Run: [PelSetupRun] E:\setup.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Makes Your Windows Creative and Fast Downloader] creative32b.exe

O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL

O4 - HKLM\..\Run: [winupdt] RUNDLL32.EXE c:\windows\mfsivba.dll,_mainRD

O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\ieloader.exe

O4 - HKLM\..\Run: [PPMemCheck] C:\Programas\PestPatrol\PPMemCheck.exe

O4 - HKLM\..\Run: [CookiePatrol] C:\Programas\PestPatrol\CookiePatrol.exe

O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe

O4 - HKLM\..\RunServices: [MSN Update] dllcon.exe

O4 - HKLM\..\RunServices: [blah service] winsv32.exe

O4 - HKLM\..\RunServices: [Makes Your Windows Creative and Fast Downloader] creative32b.exe

O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WhatPulse] C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE

O4 - HKCU\..\Run: [ares] "C:\Programas\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [spyware Doctor] "C:\Programas\Spyware Doctor\spydoctor.exe" /Q

O4 - HKCU\..\Run: [sTYLEXP] C:\Programas\TGTSoft\StyleXP\StyleXP.exe -Hide

O8 - Extra context menu item: &AIM Search - res://C:\Programas\AIM Toolbar\AIMBar.dll/aimsearch.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\MSMSGS.EXE

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Programas\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab

O16 - DPF: {10000000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://www.free32.com/POP.CHM::/sp.exe

O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://greg-tut.com/G7/chm10.chm::/ieloader.exe

O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://www.alarm-works.com/t.chm::/ttt.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {DDF44FD9-749F-4761-89BB-E8A59339E459} - http://akamai.downloadv3.com/binaries/Live...ice_9_EN_XP.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{10BE99CD-25A1-4238-8AD6-DBFB7D0192AB}: NameServer = 194.65.100.117

O17 - HKLM\System\CS1\Services\Tcpip\..\{10BE99CD-25A1-4238-8AD6-DBFB7D0192AB}: NameServer = 194.65.100.117

please help...

Link to comment
https://www.neowin.net/forum/topic/271829-win-eto-problem/
Share on other sites
Mentor

JaredFrost

Posted
Posted

If this were my system I would remove the follow stuff, You should go through

the list; I might have selected things you put on there on perpose

PS- Don't blame me if stuff you use stops working :whistle:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/sp.htm?id=31403

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=31403

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=31403

O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~3.DLL

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Programas\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

O4 - HKLM\..\Run: [blah service] winsv32.exe

O4 - HKLM\..\Run: [PelSetupRun] E:\setup.exe

O4 - HKLM\..\Run: [Makes Your Windows Creative and Fast Downloader] creative32b.exe

O4 - HKLM\..\Run: [winupdt] RUNDLL32.EXE c:\windows\mfsivba.dll,_mainRD

O4 - HKLM\..\Run: [FX] C:\WINDOWS\Downloaded Program Files\ieloader.exe

O4 - HKLM\..\RunServices: [MSN Update] dllcon.exe

O4 - HKLM\..\RunServices: [blah service] winsv32.exe

O4 - HKLM\..\RunServices: [Makes Your Windows Creative and Fast Downloader] creative32b.exe

O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe ** This is a virus

O4 - HKCU\..\Run: [WhatPulse] C:\PROGRA~1\WHATPU~1\WHATPU~1.EXE

O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Programas\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab

O16 - DPF: {10000000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://www.free32.com/POP.CHM::/sp.exe

O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://greg-tut.com/G7/chm10.chm::/ieloader.exe

O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://www.alarm-works.com/t.chm::/ttt.exe

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Can't access the forum on mobile

      By Mindovermaster · Posted

      I'm not aware of this issue, but to help the other guys.  What version of Android are you using? Did you try a different browser? To see if Edge is the issue here.
    • Windows 11's big performance boost is finally available for all

      By +Good Bot, Bad Bot · Posted

      I agree when are you going to read this (really poor BTW) article? Here is a better article so you actually know what is going on and answers questions you had in other comments --> https://arstechnica.com/gadgets/2026/05/speed-boosting-low-latency-profile-is-one-of-the-improvements-coming-to-windows-11/ It is unclear if one will be able to disable the new profile at this point but I am not seeing any reason why one would.
    • Euro-Office must default to ODF to be considered "genuinely European", LibreOffice argues

      By Snake Doc · Posted

      I disagree; they come off very "bitchy" and "whiny". Make a great product and combine that with a great price (free) and people will come over to your side. Or build it and they will come as they say. Constantly trying to get attention by complaining all the time, will turn people off to your product.
    • Euro-Office must default to ODF to be considered "genuinely European", LibreOffice argues

      By +Eternal Tempest · Posted

      It use to be a nightmare, with LibreOffice supporting a newer draft ODF standard by default, and Microsoft Office supporting the older non-draft standard. Now that they both support the same version of ODF, they should be interoperable.
    • Brave Browser 1.91.171

      By Copernic · Posted

      Brave Browser 1.91.171 by Razvan Serea Brave Browser is a lightning-fast, secure web browser that stands out from the competition with its focus on privacy, security, and speed. With features like HTTPS Everywhere and built-in tracker blocking, Brave keeps your online activities safe from prying eyes. Brave is one of the safest browsers on the market today. It blocks third-party data storage. It protects from browser fingerprinting. And it does all this by default. Speed - Brave is built on Chromium, the same technology that powers Google Chrome, and is optimized for speed, providing a fast and responsive browsing experience. Brave Browser also features Brave Rewards, a system that rewards users with Basic Attention Tokens (BAT) for viewing opt-in ads. This innovative system provides an alternative revenue model for content creators and a way to support the Brave community. SlimBrave Neo takes all the good things about Brave and makes them even better by keeping everything clean, light, and privacy-focused. It removes the extra clutter, turns off features you might not need, and cuts down on anything that could slow you down or collect unnecessary data. Because it relies on simple settings and policies instead of modifying the browser itself, you still get full Brave compatibility—just in a smoother, lighter, and more privacy-friendly package. Brave Browser 1.91.171 changelog: General Fixed Cardano not being disabled on upgrade to Brave Origin. Upgraded Chromium to 149.0.7827.103. Origin Removed “Survey Panelist” setting from brave://settings/privacy. Fixed P3A and usage ping under brave://settings/privacy being displayed on first launch on Linux. Upgraded Chromium to 149.0.7827.103. Download: Brave Browser 64-bit | 1.2 MB (Freeware) Download: Brave Browser 32-bit View: Brave Homepage | Offline Installers | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • One Month Later
      Jamswaz earned a badge
      One Month Later
    • Week One Done
      Jamswaz earned a badge
      Week One Done
    • Rookie
      Marzoid went up a rank
      Rookie
    • Community Regular
      coch went up a rank
      Community Regular
    • One Year In
      slackerzz earned a badge
      One Year In

  • Popular Contributors

    1. 1
      +primortal
      517
    2. 2
      PsYcHoKiLLa
      189
    3. 3
      +Edouard
      156
    4. 4
      Steven P.
      84
    5. 5
      ATLien_0
      75
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!