UNSOLVED

wgkoch

updated

19 years ago

W

wgkoch

8 Posts

0

1978

September 30th, 2007 19:00

Help Review HiJack This Log

I have been chasing this around and around...please help me get this popup pain!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:54:55 PM, on 9/30/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\drivers\CDAC11BA.EXE
D:\WINNT\system32\CTsvcCDA.EXE
D:\WINNT\System32\svchost.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
D:\WINNT\system32\mgabg.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\system32\tardisnt.exe
D:\Program Files\Viewpoint\Common\ViewpointService.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
D:\WINNT\System32\ZipToA.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINNT\System32\svchost.exe
D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\WINNT\Explorer.EXE
D:\program files\iomega\DriveIcons\ImgIcon.exe
D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
D:\WINNT\system32\PDesk\PDesk.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
N:\Program files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Linksys\logviewer2\LogViewer.exe
F:\Program Files\Tardis\T2Kv1.6\Tardis 2000\Tardis.exe
D:\Program Files\WINZIP\WZQKPICK.EXE
D:\Program Files\Trend Micro\HijackThis\HJT.exe
F:\Netscape\Netscape 8\Netscape Browser\netscape.exe
E:\EUDORA\Eudora.exe
D:\WINNT\system32\taskmgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://204.145.206.77/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=10.10.1.10:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = kochcons.com; 204.145.206.2;
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {51999E1D-8BED-4D86-9A50-C0D93CC06C9E} - D:\WINNT\system32\rqrpq.dll
O2 - BHO: BndDrive2 BHO Class - {8B27CC68-110C-46a9-80D3-F3107DE6EB98} - D:\Program Files\ISM\BndDrive4.dll (file missing)
O2 - BHO: (no name) - {9E65EA92-5E6A-44E2-942D-8D6A745E0FCB} - D:\Program Files\Intuit\hopebemuz4444.dll
O2 - BHO: (no name) - {C3AD77B9-162D-4B3D-8CD8-53888D52280B} - D:\Program Files\Intuit\hopebemuz83122.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [MP_STATUS_MONITOR] f:\canon\multipass\monitr32.exe I
O4 - HKLM\..\Run: [MPTBox] f:\canon\multipass\MPTBox.exe
O4 - HKLM\..\Run: [Iomega Startup Options] d:\program files\iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] d:\program files\iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [ADUserMon] D:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Deskup] d:\program files\iomega\DriveIcons\deskup.exe
O4 - HKLM\..\Run: [Matrox Powerdesk] D:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Picasa Media Detector] N:\Program files\Picasa\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\AcrobatReader\AdobeReader 8.x\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{A1-1E-EF-F7-ZN}] N:\Temp\thinksnet.exe CHD003
O4 - HKCU\..\Run: [DW4] "D:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [Creative Detector] "N:\Program files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [updateMgr] "f:\Program Files\AcrobatReader\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [ISMModule4] "D:\Program Files\ISM\ISMModule4.exe"
O4 - HKCU\..\Run: [WinAble] D:\Program Files\WinAble\winable.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: TA_Start.lnk = N:\Temp\thinksnet.exe
O4 - Global Startup: LogViewer.lnk = F:\Program Files\Linksys\logviewer2\LogViewer.exe
O4 - Global Startup: Microsoft Office.lnk = N:\Program files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Tardis.exe v 1.6.lnk = F:\Program Files\Tardis\T2Kv1.6\Tardis 2000\Tardis.exe
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WINZIP\WZQKPICK.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm020YYUS
O12 - Plugin for .htm: F:\Netscape\Netscape 8\PLUGINS\npTrident.dll
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/compaq.v2/vet_install_popup.pl?1&4&04.00.08.43-hp&http://h71016.www7.hp.com/html/interactive/xw8200/model.html?jumpid=in_r2910_3d/WKS/xw8200|3DCENTRAL|viewpoint
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/219c020c799b4e9cdf17/netzip/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175341505902
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15029/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5289C2F-5C34-4B3F-B767-36083C5C0287}: NameServer = 24.160.227.25,24.160.227.32,24.160.227.33
O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINNT\d2drb2No\command.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINNT\system32\CTsvcCDA.EXE
O23 - Service: CWShredder Service - Trend Micro Incorporated - D:\Program Files\CoolWebShredder\cwshredder.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: hpdj - Unknown owner - F:\Temp\hpdj.exe (file missing)
O23 - Service: Iomega App Services - Iomega Corporation - D:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: IomegaAccess - Iomega Corporation - D:\WINNT\System32\IomegaAccess.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - D:\WINNT\system32\mgabg.exe
O23 - Service: MPService - Unknown owner - f:\canon\multipass\mpservic.exe (file missing)
O23 - Service: Tardis time service (Tardis) - Unknown owner - D:\WINNT\system32\tardisnt.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - D:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - D:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
O23 - Service: ZipToA - Iomega Corporation - D:\WINNT\System32\ZipToA.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - D:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 8826 bytes