I'm Bod and here to help you with your Hijack This log.
Please only use this topic for your replies on this problem. Do not start another thread.
The fixes we will use are specific to your problems and should only be used for this problem on this computer.
These things need to be properly researched and a complete fix for many malware problems can take some time and be spread over a number of posts, so please be patient and try to see it through to the end.
I am currently looking over your log and as I am an undergraduate at Malware Removal University, everything that I post to you must be checked by an expert. There may therefore be a slight delay between posts. I will post back as soon as I can.
I've had a look through your log and there a number of problems to be sorted out.
Before you start, please read through these instructions and make sure that you understand them.
If you are not sure about anything, post a reply in this thread with your questions.
You will be booting into Safe Mode for one step in these instructions, so you should print out these instructions for reference. You will not have internet access in Safe Mode.
Step 1
Hijack This needs to be installed in its' own folder to make sure proper backups are made, not run from within the temp folder, we will have to clear this out later. Create a folder,
c:\Program Files\HijackThis for example, and install the program into this new folder, see
http://russelltexas.com/malware/createhjtfolder.htm for more help.
Step 2 Click
Start > Control Panel > Add/Remove Programs.
Allow the list to populate, then click on "
Remove" for all of the following programs that appear in the list (not all may be there).
QuickLinks LinkMaker Related Websites SafeSurfing PassiveCow Superlogy BMG3.LongTooth Elite Media
Do not reboot until you have attempted to remove all of these entries entries that you find.
Step 3 Run
Hijack This, don't have any other programs open, and click
Scan.
In the scan results, click on the check box for all of the following lines that are present.
R3 - URLSearchHook: (no name) - {2B67C851-5D9E-6D26-A48F-632B0BA05383} - (no file) O2 - BHO: (no name) - SOFTWARE - (no file) O2 - BHO: (no name) - {2335EA94-74D6-46B4-BA93-8567DAC6CC9B} - (no file) O2 - BHO: (no name) - {4487598C-2EC7-43A2-870E-6D8D720FDD9F} - (no file) O2 - BHO: (no name) - {4AFB6072-E860-2EC8-8603-64550DF32B1C} - (no file) O2 - BHO: (no name) - {70230839-555C-4862-8D42-BB1E2352502C} - (no file) O2 - BHO: (no name) - {71D1708F-973D-4600-AF01-AD86688403AE} - (no file) O2 - BHO: (no name) - {7CA220B8-EBDE-0EEF-9522-E64C1BC62837} - (no file) O2 - BHO: BMG3.LongTooth - {8110581C-FEA4-47AC-ADBC-DE958DD0F354} C:\WINDOWS\system32\{8110581C-FEA4-47AC-ADBC-DE958DD0F354}.dll O2 - BHO: (no name) - {B6551EB9-2908-F59C-8C1E-76909066BDB4} - (no file) O2 - BHO: (no name) - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: 233h3nR> inigkl.exe O4 - HKLM\..\Run: 7B847F8680878481> EEF7F2F9F3FAF7.exe O4 - HKCU\..\Run: dxtpcsvc.exe O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab O16 - DPF: {C0B6491F-C914-4344-A90E-DA847D7829A1} (XBTDataEncrypt Control) - http://reg.bugs.co.kr/cab/XBTDataEncrypt.CAB O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
Click on "
Fix checked".
Step 4 Re-boot in Safe Mode by pressing
F8 during Boot-up and chooing
Safe Mode from the boot options list.
Click
My Computer > Tools > View, then put a tick in the "
Display the contects of system folders" and "
Show hidden files and folders" check boxes.
Click "
OK".
Navigate to the following file and delete it.
C:\WINDOWS\system32\{8110581C-FEA4-47AC-ADBC-DE958DD0F354}.dll
You also need to search for some files.
Click
Start > Search > All Files and Folders > More advanced options
Make sure that there is a tick in the check box for "
Search System Folders", "
Search hidden files and folders", and "
Search subfolders"
One at a time, enter each of the following file names in "
All or part of file name" and click on "
Search".
inigkl.exe EEF7F2F9F3FAF7.exe dxtpcsvc.exe
If the file is found, delete it
Reboot as normal.
Step 5 Download
ATF Cleaner from
http://www.atribune.org/ccount/click.php?id=1 Run
ATF Cleaner. Click on the check box to select the following options:
Windows Temp All Users Temp Temporary Internet Files
Click "
Empty Selected". Exit when finished.
Step 6 Run
Hijack This with no other windows open, "
Scan", and post the log as a reply to this thread. I'll check it through, and get back to you.
I went through all the steps, and I'm already seeing some improvement. Websites load a little more slowly, but so far, it isn't freezing up every other minute like it was.
I didn't find any of the files you mentioned in steps 2 and 4. Hopefully that's a good sign.
I pasted the 'new and improved' HijackThis log file below. :)
Thanks so much for your help. I'll check back to see if you have any more suggestions.
Karen
Logfile of HijackThis v1.99.1 Scan saved at 6:26:46 PM, on 5/30/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Download, install, and update the free version of
Ewido Anti Malware from
http://www.ewido.net/en/download/.
When installing, under "
Additional Options" uncheck "
Install background guard" and "
Install scan via context menu".
When you run Ewido for the first time, you will get a warning "
Database could not be found!". Click "
OK". From the main Ewido screen, click on "
update" in the left menu, then click "
Start update". After the update finishes, the status bar at the bottom will display "
Update successful"
Click
Scanner > Complete System Scan, and choose "
Remove" then click "
OK" for everything found. Beware of false positives, so check each item found before choosing to remove.
At the end of the scan, click "
Save Report". Please send a copy of this log as your next post.
Please also follow these instructions to keep your computer clean.
Step 1 - Microsoft Windows Update Keep Windows up to date Click Start > All Programs > Windows Update. This will take you to the Windows Update site. Follow the instructions to download and install all of the latest critical updates. Repeat this as many times as necessary, until there are no more updates available. Reboot whenever instructed. Click Start > Control Panel > Security Centre and make sure that Automatic Updates are On.
Step 2 - Hide System Files Click Start > My Computer > Tools > Folder Options > View Tab. Un-check "Show hidden files and folders" in the Hidden files and folders section, and Select "Hide protected operating system files (recommended)" option. Click Yes > OK.
Step 3 Create a clean system restore point Click Start > Control Panel > System > System Restore Tab and click to put a tick in the "Turn off System Restore" check box, then click "Apply". Reboot, then click Start > Control Panel > System > System Restore Tab and click to remove the tick in the "Turn off System Restore" check box, and then click Apply > OK to create a new restore point and then close Control Panel.
Step 4 - Make your Internet Explorer more secure Open Internet Explorer click Tools > Options > Security tab >Internet icon to highlight >Custom Level, then select the following options:- Change "Download signed ActiveX controls" to "Prompt" Change "Download unsigned ActiveX controls" to "Disable" Change "Initialise and script ActiveX controls not marked as safe" to "Disable" Change "Installation of desktop items" to "Prompt" Change "Launching programs and files in an IFRAME" to "Prompt" Change "Navigate sub-frames across different domains" to "Prompt" Click "OK", then Apply > OK to exit the Internet Properties page.
Step 5 - Anti Virus Software It is very important that your computer has an anti-virus software running on your machine and that it is kept up to date.
You have Norton so make sure it is updated at least weekly, preferably daily. If your anti-virus is a trial copy or your subscription has expired, you can use one of these, both of which have a free version for home, non-networked, single user use. Grisoft AVG http://free.grisoft.com/doc/1 Avast http://www.avast.com/
Step 6 - Firewall XP SP2 includes the Windows Firewall which is enabled by default. You need to use this as a minimum, it is a very basic firewall, so you would be better off using one of these, both of which have a free version for home, non-networked, single user use. ZoneAlarm http://www.zonelabs.com/store/content/home.jsp Kerio http://www.sunbelt-software.com/Kerio.cfm
Step 8 - Spybot Search & Destroy You have Spybot Search & Destroy from http://www.safer-networking.org/en/download/index.html Enable the TeaTimer and SD Helper options. Update this and scan your PC on a weekly basis.
Step 10 - SpywareBlaster Download and install Javacools SpywareBlaster from http://www.javacoolsoftware.com/spywareblaster.html. When installed, run SpywareBlaster, click "Enable All Protection", then "Download Latest Protection Updates" and follow the instructions to download and enable the latest update. SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.
Hopefully these will help keep your computer clean, glad I could be of assistance,
I too am having issues simular to this. although I have also noticed that some of the setting will change and not be the same as I have. Also that its like that the computer isnt detecting any battery for my laptop. I can pull the AC plug out and it wont even change the icon to the battery.
Now I did install and run the "HijackThis" and here is the log that it produced. I would greatly appreciate any advice.
Logfile of HijackThis v1.99.1 Scan saved at 11:04:48 PM, on 3/31/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Bod99
561 Posts
0
May 29th, 2006 18:00
I'm Bod and here to help you with your Hijack This log.
Please only use this topic for your replies on this problem. Do not start another thread.
The fixes we will use are specific to your problems and should only be used for this problem on this computer.
These things need to be properly researched and a complete fix for many malware problems can take some time and be spread over a number of posts, so please be patient and try to see it through to the end.
I am currently looking over your log and as I am an undergraduate at Malware Removal University, everything that I post to you must be checked by an expert. There may therefore be a slight delay between posts. I will post back as soon as I can.
Thanks,
Bod
evenstar7794
4 Posts
0
May 29th, 2006 21:00
Bod99
561 Posts
0
May 30th, 2006 14:00
I've had a look through your log and there a number of problems to be sorted out.
Before you start, please read through these instructions and make sure that you understand them.
If you are not sure about anything, post a reply in this thread with your questions.
You will be booting into Safe Mode for one step in these instructions, so you should print out these instructions for reference. You will not have internet access in Safe Mode.
Step 1
Hijack This needs to be installed in its' own folder to make sure proper backups are made, not run from within the temp folder, we will have to clear this out later. Create a folder, c:\Program Files\HijackThis for example, and install the program into this new folder, see http://russelltexas.com/malware/createhjtfolder.htm for more help.
Step 2
Click Start > Control Panel > Add/Remove Programs.
Allow the list to populate, then click on " Remove" for all of the following programs that appear in the list (not all may be there).
QuickLinks
LinkMaker
Related Websites
SafeSurfing
PassiveCow
Superlogy
BMG3.LongTooth
Elite Media
Do not reboot until you have attempted to remove all of these entries entries that you find.
Step 3
Run Hijack This, don't have any other programs open, and click Scan.
In the scan results, click on the check box for all of the following lines that are present.
R3 - URLSearchHook: (no name) - {2B67C851-5D9E-6D26-A48F-632B0BA05383} - (no file)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {2335EA94-74D6-46B4-BA93-8567DAC6CC9B} - (no file)
O2 - BHO: (no name) - {4487598C-2EC7-43A2-870E-6D8D720FDD9F} - (no file)
O2 - BHO: (no name) - {4AFB6072-E860-2EC8-8603-64550DF32B1C} - (no file)
O2 - BHO: (no name) - {70230839-555C-4862-8D42-BB1E2352502C} - (no file)
O2 - BHO: (no name) - {71D1708F-973D-4600-AF01-AD86688403AE} - (no file)
O2 - BHO: (no name) - {7CA220B8-EBDE-0EEF-9522-E64C1BC62837} - (no file)
O2 - BHO: BMG3.LongTooth - {8110581C-FEA4-47AC-ADBC-DE958DD0F354} C:\WINDOWS\system32\{8110581C-FEA4-47AC-ADBC-DE958DD0F354}.dll
O2 - BHO: (no name) - {B6551EB9-2908-F59C-8C1E-76909066BDB4} - (no file)
O2 - BHO: (no name) - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: 233h3nR> inigkl.exe
O4 - HKLM\..\Run: 7B847F8680878481> EEF7F2F9F3FAF7.exe
O4 - HKCU\..\Run: dxtpcsvc.exe
O16 - DPF: {9AC54695-69A4-46F1-BE10-10C74F9520D5} - http://cabs.elitemediagroup.net/cabs/mediaview.cab
O16 - DPF: {C0B6491F-C914-4344-A90E-DA847D7829A1} (XBTDataEncrypt Control) - http://reg.bugs.co.kr/cab/XBTDataEncrypt.CAB
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
Click on " Fix checked".
Step 4
Re-boot in Safe Mode by pressing F8 during Boot-up and chooing Safe Mode from the boot options list.
Click My Computer > Tools > View, then put a tick in the " Display the contects of system folders" and " Show hidden files and folders" check boxes.
Click " OK".
Navigate to the following file and delete it.
C:\WINDOWS\system32\{8110581C-FEA4-47AC-ADBC-DE958DD0F354}.dll
You also need to search for some files.
Click Start > Search > All Files and Folders > More advanced options
Make sure that there is a tick in the check box for " Search System Folders", " Search hidden files and folders", and " Search subfolders"
One at a time, enter each of the following file names in " All or part of file name" and click on " Search".
inigkl.exe
EEF7F2F9F3FAF7.exe
dxtpcsvc.exe
If the file is found, delete it
Reboot as normal.
Step 5
Download ATF Cleaner from http://www.atribune.org/ccount/click.php?id=1
Run ATF Cleaner. Click on the check box to select the following options:
Windows Temp
All Users Temp
Temporary Internet Files
Click " Empty Selected". Exit when finished.
Step 6
Run Hijack This with no other windows open, " Scan", and post the log as a reply to this thread. I'll check it through, and get back to you.
Thanks,
Bod
evenstar7794
4 Posts
0
May 30th, 2006 21:00
Hi Bod,
I went through all the steps, and I'm already seeing some improvement. Websites load a little more slowly, but so far, it isn't freezing up every other minute like it was.
I didn't find any of the files you mentioned in steps 2 and 4. Hopefully that's a good sign.
I pasted the 'new and improved' HijackThis log file below. :)
Thanks so much for your help. I'll check back to see if you have any more suggestions.
Karen
Logfile of HijackThis v1.99.1
Scan saved at 6:26:46 PM, on 5/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_2.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148518531984
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.shockwave.com/content/luxor/mjolauncher.cab
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/24/install/gtdownls.cab
O16 - DPF: {CA797B15-445F-4AA9-9828-8A88502F560F} (Uninstall Control) - http://www.worldwinner.com/games/shared/uninstall.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4713/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Bod99
561 Posts
0
May 31st, 2006 07:00
Your new Hijack This log is clean.
Download, install, and update the free version of Ewido Anti Malware from http://www.ewido.net/en/download/.
When installing, under " Additional Options" uncheck " Install background guard" and " Install scan via context menu".
When you run Ewido for the first time, you will get a warning " Database could not be found!". Click " OK". From the main Ewido screen, click on " update" in the left menu, then click " Start update". After the update finishes, the status bar at the bottom will display " Update successful"
Click Scanner > Complete System Scan, and choose " Remove" then click " OK" for everything found. Beware of false positives, so check each item found before choosing to remove.
At the end of the scan, click " Save Report". Please send a copy of this log as your next post.
Thanks,
Bod
evenstar7794
4 Posts
0
May 31st, 2006 20:00
ewido anti-malware - Scan report
---------------------------------------------------------
+ Report-Checksum: 2A1027EF
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4487598C-2EC7-43A2-870E-6D8D720FDD9F} -> Adware.SafeSurfing : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5345A7A1-805A-4923-B505-86B2FEBA3FE0} -> Adware.Generic : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5345A7A9-805A-4923-B505-86B2FEBA3FE0} -> Adware.Generic : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{70230839-555C-4862-8D42-BB1E2352502C} -> Adware.SafeSurfing : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{71D1708F-973D-4600-AF01-AD86688403AE} -> Adware.SafeSurfing : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\msbb -> Adware.180Solutions : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\SurfSideKick3 -> Adware.SurfSide : Cleaned with backup
HKU\S-1-5-21-2744671939-2385888220-4247592070-1008\Software\SurfSideKick3\Internet Explorer -> Adware.SurfSide : Cleaned with backup
::Report End
Bod99
561 Posts
0
June 1st, 2006 08:00
Hi Karen,
Please also follow these instructions to keep your computer clean.
Step 1 - Microsoft Windows Update
Keep Windows up to date
Click Start > All Programs > Windows Update. This will take you to the Windows Update site. Follow the instructions to download and install all of the latest critical updates. Repeat this as many times as necessary, until there are no more updates available. Reboot whenever instructed.
Click Start > Control Panel > Security Centre and make sure that Automatic Updates are On.
Step 2 - Hide System Files
Click Start > My Computer > Tools > Folder Options > View Tab. Un-check "Show hidden files and folders" in the Hidden files and folders section, and Select "Hide protected operating system files (recommended)" option. Click Yes > OK.
Step 3 Create a clean system restore point
Click Start > Control Panel > System > System Restore Tab and click to put a tick in the "Turn off System Restore" check box, then click "Apply". Reboot, then click Start > Control Panel > System > System Restore Tab and click to remove the tick in the "Turn off System Restore" check box, and then click Apply > OK to create a new restore point and then close Control Panel.
Step 4 - Make your Internet Explorer more secure
Open Internet Explorer click Tools > Options > Security tab >Internet icon to highlight >Custom Level, then select the following options:-
Change "Download signed ActiveX controls" to "Prompt"
Change "Download unsigned ActiveX controls" to "Disable"
Change "Initialise and script ActiveX controls not marked as safe" to "Disable"
Change "Installation of desktop items" to "Prompt"
Change "Launching programs and files in an IFRAME" to "Prompt"
Change "Navigate sub-frames across different domains" to "Prompt"
Click "OK", then Apply > OK to exit the Internet Properties page.
Step 5 - Anti Virus Software
It is very important that your computer has an anti-virus software running on your machine and that it is kept up to date.
You have Norton so make sure it is updated at least weekly, preferably daily. If your anti-virus is a trial copy or your subscription has expired, you can use one of these, both of which have a free version for home, non-networked, single user use.
Grisoft AVG http://free.grisoft.com/doc/1
Avast http://www.avast.com/
For more information on anti-virus programs see http://forum.malwareremoval.com/viewtopic.php?p=53#53
Step 6 - Firewall
XP SP2 includes the Windows Firewall which is enabled by default. You need to use this as a minimum, it is a very basic firewall, so you would be better off using one of these, both of which have a free version for home, non-networked, single user use.
ZoneAlarm http://www.zonelabs.com/store/content/home.jsp
Kerio http://www.sunbelt-software.com/Kerio.cfm
For more information on firewalls see http://forum.malwareremoval.com/viewtopic.php?p=56#56
Step 7 - Windows Defender
Download and install Windows Defender from http://www.microsoft.com/athome/security/spyware/software/default.mspx
Step 8 - Spybot Search & Destroy
You have Spybot Search & Destroy from http://www.safer-networking.org/en/download/index.html
Enable the TeaTimer and SD Helper options. Update this and scan your PC on a weekly basis.
Step 9 - AdAware
You have Lavasoft Adaware SE Personal from http://www.lavasoftusa.com/software/adaware/
Update this and scan your PC on a weekly basis.
Step 10 - SpywareBlaster
Download and install Javacools SpywareBlaster from http://www.javacoolsoftware.com/spywareblaster.html. When installed, run SpywareBlaster, click "Enable All Protection", then "Download Latest Protection Updates" and follow the instructions to download and enable the latest update.
SpywareBlaster adds a list of ActiveX controls, tracking cookies and sites which will be blocked in either Internet Explorer or Firefox browsers. You need to manually check for updates regularly.
Hopefully these will help keep your computer clean, glad I could be of assistance,
Bod
Phoenix201
1 Message
0
April 1st, 2008 03:00
I too am having issues simular to this. although I have also noticed that some of the setting will change and not be the same as I have. Also that its like that the computer isnt detecting any battery for my laptop. I can pull the AC plug out and it wont even change the icon to the battery.
Now I did install and run the "HijackThis" and here is the log that it produced. I would greatly appreciate any advice.
Logfile of HijackThis v1.99.1
Scan saved at 11:04:48 PM, on 3/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: GoToAssist - Unknown owner - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe" Start=service (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE