Please review hijackthis log file...

Question

MSN got me this time.  Thanks for your time....   Logfile of HijackThis v1.98.2 Scan saved at 9:16:41 AM, on 9/16/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)   Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG6\avgserv.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe C:\PROGRA~1\Grisoft\AVG6\AVGCC32.EXE C:\Program Files\Avant Browser\avant.exe   R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: Microsoft Office.lnk = D:\Programs\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exe O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\QUICKENW\bagent.exe O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Programs\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v3/vet_install_popup.pl?1&4&04.00.07.02&unknown&unknown&http://www.toyota.com/vehicles/2004/tundra/key_features/fullsize_bed.html O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemplates/ActiveSecurity.cab O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdq/downloads/msxml4.cab O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shop.intuit.com/commerce/account/downloads/executables/ie/IDA.cab O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

jamez kann · Answer

Scan your computer on http://security.symantec.com http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://housecall.trendmicro.com/

scan your computer for spyware here http://www.pestscan.com/
Run http://www.safer-networking.org/en/mirrors/index.html spybot

run a browser which spyware cannot hijack that easily http://www.mozilla.org/products/firefox/

http://www.fixyourwindows.com/windowsxpsolutions.htm

If the above fixes fail you would need to run hijackthis

All hijackthis posts need to be posted on the sites listed below not here

http://forums.subratam.org/index.php?showforum=7
Forum Led by: Forum Moderators,subratam,baskar1234(DELL REGULAR),efwis,Metallica,psyne, SpyDie, normmork, Admin

Pinned: How to use HijackThis
http://forums.subratam.org/index.php?showtopic=56

http://www.bleepingcomputer.com/forums/forum22.html
Forum Led by: Moderators, Global Moderator, groovicus,Grinler(DELL REGULAR),harrywaldron,Papakid,

http://forums.net-integration.net/
Forum Led by: Global Moderator, Administrators, Technical Experts, Technical Assistant, Team
Spybot S&D, Technical Guide TonyKlein,Eagle1,Galadriel,tashi,Archon_Wing,

http://www.zerosrealm.com/forums/index.php?showforum=4
Zero,Lopus,

Pinned: Sp.HTML Tools
http://www.zerosrealm.com/forums/index.php?showtopic=563
Pinned: About:Blank
http://www.zerosrealm.com/forums/index.php?showtopic=107

http://forum.gladiator-antivirus.com/
Forum Led by: CalamityJane, LoPhatPhuud, FatsGordon,Hunter,TheSentinel,

http://forums.techguy.org/
$teve ,flrman1,Rollin' Rog ,whz ,Davey7549

http://forums.thatcomputerguy.us/
Forum Led by: Searcher, Matrix420, Forum Moderator

Firewall Software:

http://www.tinysoftware.com/home/tiny2?la=EN â€“ Tiny Software Personal Firewall

http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp -- Zone Alarm Firewall.

http://us.mcafee.com/root/faqs.asp?search=dell_specific â€“ McAfee Security Center Dell-Specific Pages

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ics/ics/about_internet_connection_sharing_and_internet_connection_firewall.asp -- Microsoftâ€™s web page about the Internet Connection Firewall. It gives some nice background information on how it works and how to configure it.

General Security Info:

http://www.microsoft.com/technet/mpsa/start.asp -- Windows Security Checker. This page checks some aspects of your Windows installation to see if you are vulnerable.

http://www.pacs-portal.co.uk/startup_content.php -- Instructions on how to examine and modify all the programs that start when the system is booted. Contains a lengthy list of startup items and what programs they are a part of.

http://www.yourtechonline.com/virus.shtml -- How Not to get an email virus

bwurfel · Answer

Attn: jamez kann - I browsed this forum before posting my log and saw that you put the above reply to just about everyone who has posted a log.  Frankly, I am a bit upset at your post.  I think it is rude, especially the part about 'you need to post logs to these web sites, not this one.'  I feel your time could be better spent helping people rather than telling them, 'you canâ€™t post here.'  Please do not reply any further to my post and let the genuinely nice people out there help a fellow computer user with a problem.  Besides, your not an administrator, your a member.  Who are you to tell me not to post my problem on this web site.  It's people like you that scare people away from web sites when they are in need of help.  Either help people, or leave them alone.  And I know you are going to reply with 'I did try to help you with the first half of my message.'  Well, that is nonsense.  The first half of your message doen't help people that have my problem.  Your post was no help, so don't try to say that what you posted helps me, or anybody else with the same problem as me.

Midnight Star · Answer

'MSN got me...' What happened? Can you tell me just a little bit more about the problem your having? Symptoms? Any error messages being displayed? Mike.

DELL-Chris M · Answer

bwurfel,

I think you overreacted to jamez reply. Granted, he could change this statement, "All hijackthis posts need to be posted on the sites listed below not here" to "You can get additional help by posting on the sites listed below". I don't think an attack on him was justified.

Virus & Spyware

Please review hijackthis log file...

Was this post helpful?