Hello and welcome to the forum
You have been hijacked by folks in the Ukraine see this:
http://www.whois.sc/85.255.114.108
It will take a little work to get rid of them, and the instructions must be followed carefully to be successful.
1) Move HJT from the Desktop for safety. I prefer C:\HJT\HijackThis.exe, if you need additional instructions use these:
http://russelltexas.com/malware/createhjtfolder.htm
Thanks to LonnyRJones and any others who helped with this fix.
2) You may want to print out these instructions for reference, since you will have to restart your computer during the fix.
Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe
Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
At the end of the fix, you may need to restart your computer again.
Finally, please post a fresh HijackThis log, along with the contents of the logfile C:\fixwareout\report.txt (hold the logs until the end please)
Now lets check some settings on your system.
(2000/XP) Only
In the windows control panel. If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections. Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Click the Networking tab. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot if it asks.
That option might not be avaiable on some systems
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit hit enter
(that space between g and / is needed)
(Spyware Doctor may block the fix we must make, turn it off until you are done)
(some lines may be gone, do not be concerned, just do not miss any)
3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\zgych.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\zgych.dll
O4 - HKLM\..\Run: [SysCheck32] SysCheck32.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F54D557-AC48-4872-A177-C52F0AECD854}: NameServer = 85.255.114.108,85.255.112.143
O17 - HKLM\System\CCS\Services\Tcpip\..\{2810EB22-763D-4D0C-9450-64BBD1758685}: NameServer = 85.255.114.108,85.255.112.143
O17 - HKLM\System\CCS\Services\Tcpip\..\{83FF1B5A-6982-4DCB-AB12-FBE3104461B0}: NameServer = 85.255.114.108,85.255.112.143
O17 - HKLM\System\CCS\Services\Tcpip\..\{CCC1F58C-308F-4472-AAE5-1C50ADCCDF06}: NameServer = 85.255.114.108,85.255.112.143
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F54D557-AC48-4872-A177-C52F0AECD854}: NameServer = 85.255.114.108,85.255.112.143
O17 - HKLM\System\CS3\Services\Tcpip\..\{0F54D557-AC48-4872-A177-C52F0AECD854}: NameServer = 85.255.114.85,85.255.112.13
Close all programs but HJT and all browser windows, then click on "Fix Checked"
Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
You will need to search for the location of this item: SysCheck32.exe
RIGHT Click on Start then click on Explore. Locate and delete these items:
SysCheck32.exe >>> file
C:\Windows\Prefetch\ >>> delete the contents (NOT THE FOLDER)
Prefetch info:
http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html
Download CCleaner from this link:
http://www.ccleaner.com/ Review the instructions
http://www.ccleaner.com/help/tour1.asp
Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do.
Restart the computer and post the C:\fixwareout\report.txt, a new HJT log and any comments you think will help. We will have more to do.
Thanks...pskelley
Safer Networking Forums
