Hijack This Log

Question

Logfile of HijackThis v1.99.1 Scan saved at 1:13:50 AM, on 08/04/2005 Platform: Windows 2000  (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNTunservice.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\unzipped\hijackthis[1]\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/ R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {86CB6925-E2D3-4A34-A7AA-71DB473D649A} - C:\WINNT\System32\pemb.dll (file missing) O2 - BHO: (no name) - {F7DBFC25-9DCE-438C-99A9-66FC48417E46} - C:\WINNT\System32\pemb.dll (file missing) O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file) O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKLM\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKLM\..\Run: [Disk Keeper] C:\DOCUME~1\ALANYI~1\LOCALS~1\Temp\keep.exe O4 - HKLM\..\Run: [Service Host] C:\WINNT\System32\Services\{CE016278-FD3A-40CA-A2E1-4B4C0C20E800}\SVCHOST.EXE O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\System32\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O4 - HKCU\..\Run: [xset] C:\WINNT\System32\xset\wubohoem.exe O4 - HKCU\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKCU\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKCU\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKCU\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted IP range: 67.19.185.246 O15 - Trusted IP range: 67.19.185.246 (HKLM) O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c7.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/303515cf4eb05498d601/netzip/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O20 - Winlogon Notify: drct16 - C:\WINNT\SYSTEM32\drct16.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNTunservice.exe

Bertha2 · Answer

hey Bill, From what I see it looks like you ran this scan in safe mode if so please run one in normal mode!! Bertha2

Bill_Moocho · Answer

I've got a problem when I startup, it says some image file isn't valid and it tells me to check it with my installation disks.  My computer also runs really slowly, especially when I'm shutting down.  Thanks for any help.   Logfile of HijackThis v1.99.1 Scan saved at 5:57:07 PM, on 08/04/2005 Platform: Windows 2000  (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNTunservice.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINNT\isrvs\desktop.exe C:\unzipped\hijackthis[1]\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/ R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {86CB6925-E2D3-4A34-A7AA-71DB473D649A} - C:\WINNT\System32\pemb.dll (file missing) O2 - BHO: (no name) - {F7DBFC25-9DCE-438C-99A9-66FC48417E46} - C:\WINNT\System32\pemb.dll (file missing) O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file) O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKLM\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKLM\..\Run: [Disk Keeper] C:\DOCUME~1\ALANYI~1\LOCALS~1\Temp\keep.exe O4 - HKLM\..\Run: [Service Host] C:\WINNT\System32\Services\{CE016278-FD3A-40CA-A2E1-4B4C0C20E800}\SVCHOST.EXE O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\System32\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe O4 - HKLM\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O4 - HKCU\..\Run: [xset] C:\WINNT\System32\xset\wubohoem.exe O4 - HKCU\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKCU\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKCU\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKCU\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted IP range: 67.19.185.246 O15 - Trusted IP range: 67.19.185.246 (HKLM) O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c7.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/303515cf4eb05498d601/netzip/RdxIE601.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O20 - Winlogon Notify: drct16 - C:\WINNT\SYSTEM32\drct16.dll O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNTunservice.exe

Bertha2 · Answer

Hey Bill,   You have an infection which requires a specila fix however before we do that lets try this way first: Go to Add/Remove programs and remove(uninstall) the following, if present:       Desktop Search     WindUpdates   The above could appear anywhere within the entry. Be careful not to remove any personal or system software.   Run HiJackThis then: 1.  Click ' Config...' 2.  Click ' Misc Tools' 3.  Click ' Open Process manager' - Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:       C:\WINNT\isrvs\desktop.exe   Now double-check and make sure that only those item(s) above are highlighted, then click ' Kill process'. Now, click ' Refresh', check again, and repeat this step if any remain. Run HiJackThis and click ' Scan', then check(tick) the following, if present: R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {86CB6925-E2D3-4A34-A7AA-71DB473D649A} - C:\WINNT\System32\pemb.dll (file missing) O2 - BHO: (no name) - {F7DBFC25-9DCE-438C-99A9-66FC48417E46} - C:\WINNT\System32\pemb.dll (file missing) O3 - Toolbar: (no name) - {44BE0690-5429-47f0-85BB-3FFD8020233E} - (no file) O4 - HKLM\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKLM\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKLM\..\Run: [Disk Keeper] C:\DOCUME~1\ALANYI~1\LOCALS~1\Temp\keep.exe O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\System32\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINNT\isrvs\ffisearch.exe O4 - HKLM\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O4 - HKCU\..\Run: [xset] C:\WINNT\System32\xset\wubohoem.exe O4 - HKCU\..\Run: [PayTime] C:\WINNT\System32\paytime.exe O4 - HKCU\..\Run: [Cjb] C:\WINNT\Lug.exe O4 - HKCU\..\Run: [Kds] C:\WINNT\System32\Ruc.exe O4 - HKCU\..\Run: [Ova] C:\WINNT\System32\Cgm.exe O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted IP range: 67.19.185.246 O15 - Trusted IP range: 67.19.185.246 (HKLM) O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/303515cf4eb05498d601/netzip/RdxIE601.cab O20 - Winlogon Notify: drct16 - C:\WINNT\SYSTEM32\drct16.dll Now, with all windows closed except HiJackThis, click ' Fix checked'.   Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders: (see here - http://www.xtra.co.nz/help/0,,4155-1916458,00.html ) folders...       C:\WINNT\isrvs     C:\WINNT\System32\xset   files...       C:\WINNT\System32\paytime.exe     C:\WINNT\Lug.exe     C:\DOCUME~1\ALANYI~1\LOCALS~1\Temp\keep.exe     C:\WINNT\System32\cmd32.exe internat.dll     C:\WINNT\System32\Ruc.exe     C:\WINNT\System32\Cgm.exe     C:\WINNT\SYSTEM32\drct16.dll - Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from Safe Mode' http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam>Safe Post back a new log, and let me know how everything goes. - Bertha2

Bill_Moocho · Answer

Thanks for the help.  Unfortunately my right-click is still disabled.  Here's a new log.   Logfile of HijackThis v1.99.1 Scan saved at 11:04:01 AM, on 10/04/2005 Platform: Windows 2000  (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\WINNTunservice.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.exe C:\WINNT\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\unzipped\hijackthis[1]\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNTunservice.exe

Bertha2 · Answer

Hey Bill, Your Log looks clean Post something about your mouse in the Windows (relevant OS) fourm Bertha2

Virus & Spyware

Hijack This Log

Was this post helpful?