HijackThis Hijacked?

Question

Whenever i scan for problems on hijack this and try to remove one of the bad files it says' Error could not remove selected item' and it said this for ervery bad file in the log. Anyone know whats wrong? Message Edited by Tallbballman21 on 07-16-2004 08:47 PM

jwatt · Answer

The best way to get help interpreting HijackThis logs and deciding what needs to be done is to post your log, along with a description of the problems you're experiencing and what steps you've taken to resolve them. If this is a continuation of a problem you've been helped with in one of your other threads, please post back to that thread.

If this is a new problem, post your log in this thread.

Jim

redwolfe_98 · Answer

everything that 'hijackthis' finds is not bad (in case you were not aware of that).. if your hijackthis program is not working properly for you, i would try redownloading the program.. maybe you need to be logged in as an administrator for hijackthis to work properly, and that is the problem.. http://www.majorgeeks.com/download.php?det=3155 here is a user-guide for hijackthis: http://aumha.org/a/hjttutor.htm

Tallbballman21 · Answer

Yes i know that. Im doing a log for my friend and im tryin to get rid of the obvious stuff. Example..He has Ebates thing on there and i know its spyware and I cant remove. Also theres virtual bouncer and i cant remove that.

cghost · Answer

One possibility is that the files you are wanting to remove are in use by the system. Two solutions you can try

1) Read a little about the "problem" you are trying to remove. If it loads an add/remove program entry that wont cause damage, try removing there first.

Then look in running processes for processes related to your "problem". Stop those and try hjt again.

2) Try booting in safe mode and then running hjt.

3) Also if other programs such as virus scan, spybot, adaware etc are appropriate, run them first and then come back to hjt.

4) There are some differences between 1.98 and 1.97.7 . If you are using 1.98 you could try 1.97 and see if that gets you a different result.

Remember backups are good. Amateur advisors (myself included) have a responsibility to remind the people we are trying to help about that and see they are able to restore system or save data in case our actions screw up their system.

Regards.

Tallbballman21 · Answer

Oh noo. Im infected with spoyware AGAIN. these virus killing and spyware killing icons appeared out of nowhere on my  desktop. Can someone help me fix HJT then analyze my new log??...... .Logfile of HijackThis v1.98.0Scan saved at 5:39:14 PM, on 7/19/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\LEXPPS.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\DATACA~1\FLashKsk.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXEC:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exeC:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exeC:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exeC:\Program Files\McAfee.com\Agent\mcagent.exeC:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exeC:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exeC:\Program Files\SBC Self Support Tool\bin\mad.exeC:\Program Files\SBC Self Support Tool\bin\mpbtn.exeC:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXEC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Yahoo!\browser\ybrowser.exeC:\PROGRA~1\Yahoo!\browser\ycommon.exeC:\Program Files\Yahoo!\browser\ybrwicon.exeC:\HJT\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dslR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dslO2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dllO2 - BHO: ohb - {4D568F0F-8AC9-40AB-88B7-415134C78777} - C:\WINDOWS\System32\winb2s32.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dllO3 - Toolbar: Begin2Search.com Bar - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - C:\WINDOWS\System32\winb2s32.dllO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exeO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [DataCaching] C:\PROGRA~1\DATACA~1\FLashKsk.exeO4 - HKLM\..\Run: [DeadAIM] rundll32.exe 'C:\Program Files\AIM95\DeadAIM.ocm',ExportedCheckODLsO4 - HKLM\..\Run: [sr1exe] 'C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe' O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.1\MOUSE32A.EXEO4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTARTO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exeO4 - HKLM\..\Run: [IPInSightLAN 02] 'C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe' -lO4 - HKLM\..\Run: [IPInSightMonitor 02] 'C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe'O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exeO4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exeO4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exeO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odlO4 - HKCU\..\Run: [Yahoo! Pager] 1O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exeO4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Basic\Components\QBAgent\qbdagent2002.exeO4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exeO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dllO9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dllO12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dllO12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dllO16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dllO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dllO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28177.cabO16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cabO16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cabO16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/kdx.cabO16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

Tallbballman21 · Answer

ok heres what the message says when i try to get rid of one of the baddies... 'An unexpectd error has occured ar procedure:cmdFix_click()   Error number 75_pathfile acces error (57 items in result list)'  What is it i need help! i tried downloading HJT again but it says the same thing! HELP PLEASE Message Edited by Tallbballman21 on 07-19-2004 07:37 PM

Tallbballman21 · Answer

help

Virus & Spyware

HijackThis Hijacked?

Was this post helpful?