My Hijackthis Log

Question

I've been having numerous spyware pop-up window problems. I've used Adaware's latest removal tool, Google toolbar's popup blocker and POW! from AnalogX but I'm still getting popups. I ran the Hijackthis as stated in this forum. Below is my log file. Thank you for any help you can give to to remove this annoying spyware!   Thanks! MH   --------------------------------   Logfile of HijackThis v1.99.0 Scan saved at 1:10:41 PM, on 1/18/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Netropa\Multimedia Keyboard
hksrv.exe C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe C:\PROGRA~1\Navnt\DefWatch.exe C:\DMI\WIN32\bin\DellDmi.exe C:\Program Files\Dell\OpenManage\Client\EventAgt.exe C:\Program Files\Dell\OpenManage\Client\DLT.exe C:\WINNT\SYSTEM32\DWRCS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\PROGRA~1\Navnt\Rtvscan.exe C:\WINNT\system32egsvc.exe C:\WINNT\system32\MSTask.exe C:\dmi\win32\bin\Win32sl.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe C:\WINNT\system32\CCM\CcmExec.exe C:\WINNT\Explorer.EXE C:\Program Files\Microsoft Hardware\Mouse\point32.exe C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe C:\WINNT\system32\SxgTkBar.exe C:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exe C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe C:\Program Files\Netropa\Onscreen Display\OSD.exe C:\WINNT\Downloaded Program Files\spvic.exe C:\Program Files\Winamp\Winampa.exe C:\Program Files\Navnt\vptray.exe C:\WINNT\system32	ogfjxbt.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE C:\Program Files\Common Files\System\MAPI\1033
t\MAPISP32.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://business.dellnet.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://atlas.medcity.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://atlas.medcity.net R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Provided by HCA Healthcare Co. R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy-pac/hca.ins O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINNT\ZServ.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: InstantChess - {40D61F04-59E4-4C8D-BF6E-697AB9C21F43} - C:\WINNT\Downloaded Program Files\ChessBar.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: AdwareFilter - {1028F737-81E7-452B-A860-E50CAD90A08C} - C:\Program Files\AdwareFilterToolBar\AdwareFilter.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe O4 - HKLM\..\Run: [IC_KEY_3] C:\WINNT\Downloaded Program Files\spvic.exe O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe' O4 - HKLM\..\Run: [vptray] C:\Program Files\Navnt\vptray.exe O4 - HKLM\..\Run: [wovcmkkuc] C:\WINNT\system32	ogfjxbt.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [farmmext] C:\WINNT\farmmext.exe O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://atlas.medcity.net O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/adobe/MTSInstallers/MetaStream3.cab?url=http://www.hamonrye.com/atmosphere/resources/popup.html?url=http://www.hamonrye.com/atmosphere/DARKcity.aer&title=D%20A%20R%20K%20%20C%20I%20T%20Y O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.refurbdepot.com/CFIDE/classes/CFJava.cab O16 - DPF: {0B72CCA4-5F11-11D0-9CB5-0000C0EC9FDB} (Street Technologies ActiveX Control Object) - http://www2.stlu.com/plugins/Plugin5.0.0219//streetnoagent7.cab O16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://nwmcapp01/tsweb/mstscax.cab O16 - DPF: {40D61F04-59E4-4C8D-BF6E-697AB9C21F43} (InstantChess) - http://www.instantchess.com/applet/chessbar.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {731918D2-517A-47E2-886A-3BC1380C591D} - http://webpdp.gator.com/v3/download/pdpplugin_4094_hd3ptdm.cab O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://216.65.38.226/Download_Plugin.exe O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://imany.webex.com/client/latest/webex/ieatgpc.cab O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} (Dhsigned Control) - http://ads.dealhelper.com/updates/DealHelperNew.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hca.corpad.net O17 - HKLM\System\CCS\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.net O17 - HKLM\System\CCS\Services\Tcpip\..\{DB5C1355-ABCC-4558-BDE7-51A4D96CE347}: Domain = orl.medcity.net O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hca.corpad.net O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = orl.medcity.net O17 - HKLM\System\CS1\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = hca.corpad.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = orl.medcity.net O17 - HKLM\System\CS2\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.net O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = orl.medcity.net O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\Navnt\DefWatch.exe O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE O23 - Service: FTP Software FTP Server - FTP Software, Inc. - C:\PROGRA~1\FTPSOF~1\OnNet32\ftpd\ftpd.exe O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard
hksrv.exe O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\Navnt\Rtvscan.exe O23 - Service: Telnet - Unknown - C:\WINNT\system32	lntsvr.exe (file missing) O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe

zbestwun2001 · Answer

Hi
I would like you to go to this site and do on online virus scan and let it remove all it finds.
http://www.trendmicro.com/en/home/us/enterprise.htm
and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched.
Steve

Midnight Star · Answer

MH,

Let's see what we can do...

Go to Add/Remove programs and move(uninstall) the following, if present:

anything with 'search' in the entry.
anything with 'toolbar' on the entry.

Be careful not to remove any personal or system software, or anything that you didn't intentionally install.

Run HiJackThis then:

1. Click " Config..."
2. Click " Misc Tools"
3. Click " Open Process manager"

-

Next, while holding down the CTRL key, locate ( if present) and click on ( highlight) each of the following:

C:\WINNT\system32\togfjxbt.exe

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Now, let's run HiJackThis, then:

1. click " Config..."
2. click " Misc Tools"
3. click " Delete a file on reboot"
4. browse to, then double-click on each of the file(s) below, one at a time, if present:

C:\WINNT\system32\togfjxbt.exe
C:\WINNT\ZServ.dll
C:\WINNT\farmmext.exe

5. when prompted to "Reboot Now", after selecting each file, select "No"

-

It's ok if some of these files aren't found, just continue with the next one on the list.

Now, let's open a command prompt and unregister the dll(s) we're going to remove, by entering the following:

regsvr32 /u ZServ.dll
regsvr32 /u AdwareFilter.dll

It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to a command prompt to save on the typing.

Run HiJackThis and click "Scan", then check(tick) the following, if present:

O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINNT\ZServ.dll

O3 - Toolbar: AdwareFilter - {1028F737-81E7-452B-A860-E50CAD90A08C} - C:\Program Files\AdwareFilterToolBar\AdwareFilter.dll

O4 - HKLM\..\Run: [wovcmkkuc] C:\WINNT\system32\togfjxbt.exe
O4 - HKLM\..\Run: [farmmext] C:\WINNT\farmmext.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
(Unless you've set these with a anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)

O16 - DPF: {731918D2-517A-47E2-886A-3BC1380C591D} - http://webpdp.gator.com/v3/download/pdpplugin_4094_hd3ptdm.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://216.65.38.226/Download_Plugin.exe
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} (Dhsigned Control) - http://ads.dealhelper.com/updates/DealHelperNew.cab

O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe (file missing)

Now, with all windows closed except HiJackThis, click "Fix checked".

Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\AdwareFilterToolBar

Don't reboot just yet and post back a new log.

Mike.

mahrpsgt11 · Answer

Thank you both for your responses.

Steve: I tried the online virus solution you suggested, but apparantly my company is blocking the site/tool because I kept getting the message of "could not connect to the server".

Mike: I will try the steps you've posted... got some work ahead of me! I will repost my log when I've completed it.

Thanks again for your help!

MH

mahrpsgt11 · Answer

Mike: Okay, I've completed all the steps you said, and here is post-fixing log. I'm hoping this resolved my problems. I'm eager to see what you think of it now. Thanks again for your help! MH ---------------------------------- Logfile of HijackThis v1.99.0Scan saved at 10:14:22 AM, on 1/19/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Netropa\Multimedia Keyboard
hksrv.exeC:\WINNT\System32\3Com_DMI\3CDMINIC.EXEC:\Program Files\Dell\OpenManage\Client\ActionAgent.exeC:\PROGRA~1\Navnt\DefWatch.exeC:\DMI\WIN32\bin\DellDmi.exeC:\Program Files\Dell\OpenManage\Client\EventAgt.exeC:\Program Files\Dell\OpenManage\Client\DLT.exeC:\WINNT\SYSTEM32\DWRCS.EXEC:\WINNT\System32\svchost.exeC:\Program Files\Dell\OpenManage\Client\Iap.exeC:\PROGRA~1\Navnt\Rtvscan.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\dmi\win32\bin\Win32sl.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\System32\mspmspsv.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exeC:\WINNT\system32\CCM\CcmExec.exeC:\WINNT\Explorer.EXEC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exeC:\WINNT\system32\SxgTkBar.exeC:\Program Files\Netropa\Multimedia Keyboard\mmusbkb2.exeC:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exeC:\Program Files\Netropa\Onscreen Display\OSD.exeC:\WINNT\Downloaded Program Files\spvic.exeC:\Program Files\Winamp\Winampa.exeC:\Program Files\Navnt\vptray.exeC:\WINNT\system32\ctfmon.exeC:\WINNT\system32\svchost.exeC:\Program Files\HijackThis\HijackThis.exeC:\Program Files\Internet Explorer\IEXPLORE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://business.dellnet.com/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://atlas.medcity.net/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://atlas.medcity.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Provided by HCA Healthcare Co.R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy-pac/hca.insO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: InstantChess - {40D61F04-59E4-4C8D-BF6E-697AB9C21F43} - C:\WINNT\Downloaded Program Files\ChessBar.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -offO4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exeO4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exeO4 - HKLM\..\Run: [IC_KEY_3] C:\WINNT\Downloaded Program Files\spvic.exeO4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\Winampa.exe'O4 - HKLM\..\Run: [vptray] C:\Program Files\Navnt\vptray.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /backgroundO4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htmO8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.htmlO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htmO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO14 - IERESET.INF: START_PAGE_URL=http://atlas.medcity.netO16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/adobe/MTSInstallers/MetaStream3.cab?url=http://www.hamonrye.com/atmosphere/resources/popup.html?url=http://www.hamonrye.com/atmosphere/DARKcity.aer&title=D%20A%20R%20K%20%20C%20I%20T%20YO16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.refurbdepot.com/CFIDE/classes/CFJava.cabO16 - DPF: {0B72CCA4-5F11-11D0-9CB5-0000C0EC9FDB} (Street Technologies ActiveX Control Object) - http://www2.stlu.com/plugins/Plugin5.0.0219//streetnoagent7.cabO16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://nwmcapp01/tsweb/mstscax.cabO16 - DPF: {40D61F04-59E4-4C8D-BF6E-697AB9C21F43} (InstantChess) - http://www.instantchess.com/applet/chessbar.cabO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exeO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://imany.webex.com/client/latest/webex/ieatgpc.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hca.corpad.netO17 - HKLM\System\CCS\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.netO17 - HKLM\System\CCS\Services\Tcpip\..\{DB5C1355-ABCC-4558-BDE7-51A4D96CE347}: Domain = orl.medcity.netO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hca.corpad.netO17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = orl.medcity.netO17 - HKLM\System\CS1\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.netO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = hca.corpad.netO17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = orl.medcity.netO17 - HKLM\System\CS2\Services\Tcpip\..\{2082B1CC-FF24-4C6F-B766-B87433A09619}: Domain = orl.medcity.netO17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = orl.medcity.netO23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXEO23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\Navnt\DefWatch.exeO23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exeO23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exeO23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exeO23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: DameWare Mini Remote Control - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXEO23 - Service: FTP Software FTP Server - FTP Software, Inc. - C:\PROGRA~1\FTPSOF~1\OnNet32\ftpd\ftpd.exeO23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exeO23 - Service: Netropa NHK Server - Unknown - C:\Program Files\Netropa\Multimedia Keyboard
hksrv.exeO23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\Navnt\Rtvscan.exeO23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe

Midnight Star · Answer

MH,

Good job - that log looks good to me! Now, let's see if we can do some cleanup work on that system. Since that's computer at work, i've added an extra step to create a restore point, just in case we have a problem with AdAware or Spybot. One important thing to note, is to use the most current program and all the available updates, since there are some conditions where using 'outdated' versions can cause trouble.

-

I did notice two seperate remote system control agents running, so i'll assume that's normal for your office system; also, I didn't include any reference(s) to "med.city" in the fix.

Now let's do some cleanup...

1. First, let's backup your entire registry; this is the extra step I mentioned.

2. Run "Disk Cleanup" and allow it to remove everything it finds.

3. Go to www.trendmicro.com and click "Free Online Scan", then "Scan now, it's free!". When it's downloaded, select all available drives, then check(tick) "Auto clean", then click "Scan".

4. Run AdAware SE Personal and "perform a full system scan", then Spybot S&D, and "Check for Problems". Let them both remove the residual 'problems' left that HiJackThis couldn't fix.

(Make sure everything is working ok, before we remove the restore points.)

5. Disable, then re-enable system restore; with a reboot in-between. Then immediately create a new system point manually.

-

Post back if you are having anymore problems, or questions.

Mike.

Virus & Spyware

My Hijackthis Log

Was this post helpful?