Web nexus

[fh]

How about jusched.exe

This ones running right now with the firewall possibly down!
eventhou alg.exe is still uppand running the firewall has been turned off.
Please Pick somthing useless or usefull I can down load and remove easily so I can get hjt to log a somthing it won't log unless I down load somthing new.

Thanx

[fh]

StartupList report, 12/30/2005, 5:48:12 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Fred\Desktop\HJT\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Fred\Desktop\HJT\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Spyware Cleaner = "C:\Program Files\Spyware Cleaner\SpywareCleaner.Exe" /boot

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

--------------------------------------------------

Enumerating Download Program Files:

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/MsnMe ... loader.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://download.macromedia.com/pub/shoc ... wflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\pnrpnsp.dll
NameSpace #5: C:\WINDOWS\system32\pnrpnsp.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

1 = C:\WINDOWS\system32\service\explorer.exe

--------------------------------------------------

End of report, 4,418 bytes
Report generated in 0.051 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[fh]

http://xoftspy.com/

[Gecko]

Start HijackThis do a scan and look for the entry with the following file reference:
C:\windows\system32\service\explorer.exe
Put a check next to it and have HijackThis fix it.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled.
Also make sure that Display the contents of System Folders is checked.

Now run KillBox and navigate to this file:
C:\windows\system32\service\explorer.exe

Now put a check next to 'Standard file kill' and next to ‘End Explorer shell while killing file’ click on the red X,
Your desktop should go blank and then reload this is normal.

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin and reboot the system.

[fh]

[fh]

I finally found the temp folder Even doing a seach for files and folder I could not find this dam thing!Anyway all the hjt logs were there all the virus logos are there there are other things there for media player , Axtive x control , jusched. log

Should I be dumping everything in this folder?????????????

Thanx

[Gecko]

[fh]

Rebooted now everyting seem s normal!.
The only thing left to do is find out why HJT is not leaving a log file on the desk top or at least some place I can look at it!

What can I do about that????

Fred

[Gecko]

Start HijackThis and ‘Do a System scan only’
Once its finished click the save log button, choose to save it in the HijackThis folder.
You should now be able to open the saved log with notepad.

[fh]

Ive been doing that as you have asked many times, that button has only apeared the once when I down loaded the killbox file.That got deleted when we did this last temp thing I think.

Whats this
hsperfdata_Fred

Sorry I'm suspisious of everything now!Guess thats the joy these guys get from making these virus things.Kinda like a terrorist. creaating terror on the internet comunity



IT is in the temp file.

[Gecko]

Download a new HijackThis from and save it to your desktop but do not run it yet!.

Now right click on your desktop and point to “New” and select “Folder” name it HJT.

Put the HijackThis.exe file you downloaded into the HJT folder, open the HJT folder and run HijackThis.exe from there.

See if it will work right now for you.

[JK]

I was getting hit with that adware too! I found a free way to get rid of it though, and out of revenge to those bozos WNN that screwed up my PC for months, I'm telling everyone how to delete it from their machines. In my blog, I wrote a post many months ago because I was absolutely elated to finally get rid of those pop ups! In fact, so many others have found it, I put a link to the WNN post on the front page right side bar titled "Web Nexus Network No More". There is a link in the post for a free 14 day trial. THE FREE TRIAL GETS RID OF WNN! ..... a free solution for people (like me) that have PC skills that are "yet to be discovered".

http://www.achancetosoundoff.blogspot.com